crewly 1.3.31 → 1.4.1

package/dist/backend/backend/src/controllers/workspace/workspace.controller.d.ts

@@ -0,0 +1,39 @@
+/**
+ * Google Workspace Token Controller
+ *
+ * Provides a token-serving endpoint for agents to obtain short-lived
+ * Google access tokens for Workspace operations (Gmail, Drive, Calendar, Docs).
+ *
+ * Tokens are stored encrypted via UserIdentityService. This controller
+ * exchanges stored refresh tokens for fresh access tokens via Google's
+ * token endpoint, never exposing refresh tokens to callers.
+ *
+ * @module controllers/workspace/workspace.controller
+ */
+import { Request, Response, NextFunction } from 'express';
+/**
+ * GET /api/workspace/token — Provide a fresh Google access token.
+ *
+ * Looks up the authenticated user's stored Google refresh token,
+ * exchanges it for a short-lived access token, and returns it.
+ * The refresh token is never exposed to the caller.
+ *
+ * Query params:
+ * - userId (required): The user ID whose Google token to fetch
+ *
+ * @param req - Express request with query.userId
+ * @param res - Express response
+ * @param next - Express next function
+ */
+export declare function getWorkspaceToken(req: Request, res: Response, next: NextFunction): Promise<void>;
+/**
+ * GET /api/workspace/scopes — List available Workspace scopes.
+ *
+ * Returns the configured WORKSPACE_SCOPES from constants.
+ * Agents can use this to know which Google APIs are available.
+ *
+ * @param _req - Express request (unused)
+ * @param res - Express response
+ */
+export declare function listWorkspaceScopes(_req: Request, res: Response): void;
+//# sourceMappingURL=workspace.controller.d.ts.map

package/dist/backend/backend/src/controllers/workspace/workspace.controller.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"workspace.controller.d.ts","sourceRoot":"","sources":["../../../../../../backend/src/controllers/workspace/workspace.controller.ts"],"names":[],"mappings":"AAAA;;;;;;;;;;;GAWG;AAEH,OAAO,EAAE,OAAO,EAAE,QAAQ,EAAE,YAAY,EAAE,MAAM,SAAS,CAAC;AAmB1D;;;;;;;;;;;;;GAaG;AACH,wBAAsB,iBAAiB,CAAC,GAAG,EAAE,OAAO,EAAE,GAAG,EAAE,QAAQ,EAAE,IAAI,EAAE,YAAY,GAAG,OAAO,CAAC,IAAI,CAAC,CA+EtG;AAED;;;;;;;;GAQG;AACH,wBAAgB,mBAAmB,CAAC,IAAI,EAAE,OAAO,EAAE,GAAG,EAAE,QAAQ,GAAG,IAAI,CAOtE"}

package/dist/backend/backend/src/controllers/workspace/workspace.controller.js

@@ -0,0 +1,120 @@
+/**
+ * Google Workspace Token Controller
+ *
+ * Provides a token-serving endpoint for agents to obtain short-lived
+ * Google access tokens for Workspace operations (Gmail, Drive, Calendar, Docs).
+ *
+ * Tokens are stored encrypted via UserIdentityService. This controller
+ * exchanges stored refresh tokens for fresh access tokens via Google's
+ * token endpoint, never exposing refresh tokens to callers.
+ *
+ * @module controllers/workspace/workspace.controller
+ */
+import { GOOGLE_OAUTH_CONSTANTS } from '../../constants.js';
+import { UserIdentityService } from '../../services/user/user-identity.service.js';
+import { LoggerService } from '../../services/core/logger.service.js';
+const logger = LoggerService.getInstance().createComponentLogger('WorkspaceController');
+/**
+ * GET /api/workspace/token — Provide a fresh Google access token.
+ *
+ * Looks up the authenticated user's stored Google refresh token,
+ * exchanges it for a short-lived access token, and returns it.
+ * The refresh token is never exposed to the caller.
+ *
+ * Query params:
+ * - userId (required): The user ID whose Google token to fetch
+ *
+ * @param req - Express request with query.userId
+ * @param res - Express response
+ * @param next - Express next function
+ */
+export async function getWorkspaceToken(req, res, next) {
+    try {
+        const userId = req.query.userId ? String(req.query.userId) : '';
+        if (!userId) {
+            res.status(400).json({ success: false, error: 'Missing required query parameter: userId' });
+            return;
+        }
+        const clientId = process.env.GOOGLE_OAUTH_CLIENT_ID || '';
+        const clientSecret = process.env.GOOGLE_OAUTH_CLIENT_SECRET || '';
+        if (!clientId || !clientSecret) {
+            res.status(500).json({ success: false, error: 'Google OAuth credentials are not configured' });
+            return;
+        }
+        const users = UserIdentityService.getInstance();
+        const user = await users.getUserById(userId);
+        if (!user) {
+            res.status(404).json({ success: false, error: `User not found: ${userId}` });
+            return;
+        }
+        const googleService = user.connectedServices.find((s) => s.provider === 'google');
+        if (!googleService) {
+            res.status(404).json({ success: false, error: 'No Google account connected for this user' });
+            return;
+        }
+        // Decrypt the stored refresh token
+        const refreshToken = users.decryptToken(googleService.encryptedRefreshToken);
+        // Exchange refresh token for a fresh access token
+        const tokenResp = await fetch(GOOGLE_OAUTH_CONSTANTS.TOKEN_ENDPOINT, {
+            method: 'POST',
+            headers: { 'Content-Type': 'application/x-www-form-urlencoded' },
+            body: new URLSearchParams({
+                client_id: clientId,
+                client_secret: clientSecret,
+                refresh_token: refreshToken,
+                grant_type: 'refresh_token',
+            }),
+        });
+        const tokenData = await tokenResp.json();
+        if (!tokenResp.ok || tokenData.error) {
+            logger.error('Failed to refresh Google access token', {
+                userId,
+                error: tokenData.error || 'unknown',
+                description: tokenData.error_description,
+            });
+            res.status(502).json({
+                success: false,
+                error: `Token refresh failed: ${tokenData.error_description || tokenData.error || 'unknown error'}`,
+            });
+            return;
+        }
+        logger.info('Issued fresh Google Workspace access token', {
+            userId,
+            expiresIn: tokenData.expires_in,
+            scopes: tokenData.scope,
+        });
+        res.json({
+            success: true,
+            data: {
+                accessToken: tokenData.access_token,
+                expiresIn: tokenData.expires_in,
+                tokenType: tokenData.token_type,
+                scopes: tokenData.scope ? tokenData.scope.split(' ') : googleService.scopes,
+            },
+        });
+    }
+    catch (error) {
+        logger.error('Workspace token endpoint error', {
+            error: error instanceof Error ? error.message : String(error),
+        });
+        next(error);
+    }
+}
+/**
+ * GET /api/workspace/scopes — List available Workspace scopes.
+ *
+ * Returns the configured WORKSPACE_SCOPES from constants.
+ * Agents can use this to know which Google APIs are available.
+ *
+ * @param _req - Express request (unused)
+ * @param res - Express response
+ */
+export function listWorkspaceScopes(_req, res) {
+    res.json({
+        success: true,
+        data: {
+            scopes: [...GOOGLE_OAUTH_CONSTANTS.WORKSPACE_SCOPES],
+        },
+    });
+}
+//# sourceMappingURL=workspace.controller.js.map

package/dist/backend/backend/src/controllers/workspace/workspace.controller.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"workspace.controller.js","sourceRoot":"","sources":["../../../../../../backend/src/controllers/workspace/workspace.controller.ts"],"names":[],"mappings":"AAAA;;;;;;;;;;;GAWG;AAGH,OAAO,EAAE,sBAAsB,EAAE,MAAM,oBAAoB,CAAC;AAC5D,OAAO,EAAE,mBAAmB,EAAE,MAAM,8CAA8C,CAAC;AACnF,OAAO,EAAE,aAAa,EAAE,MAAM,uCAAuC,CAAC;AAEtE,MAAM,MAAM,GAAG,aAAa,CAAC,WAAW,EAAE,CAAC,qBAAqB,CAAC,qBAAqB,CAAC,CAAC;AAcxF;;;;;;;;;;;;;GAaG;AACH,MAAM,CAAC,KAAK,UAAU,iBAAiB,CAAC,GAAY,EAAE,GAAa,EAAE,IAAkB;IACrF,IAAI,CAAC;QACH,MAAM,MAAM,GAAG,GAAG,CAAC,KAAK,CAAC,MAAM,CAAC,CAAC,CAAC,MAAM,CAAC,GAAG,CAAC,KAAK,CAAC,MAAM,CAAC,CAAC,CAAC,CAAC,EAAE,CAAC;QAChE,IAAI,CAAC,MAAM,EAAE,CAAC;YACZ,GAAG,CAAC,MAAM,CAAC,GAAG,CAAC,CAAC,IAAI,CAAC,EAAE,OAAO,EAAE,KAAK,EAAE,KAAK,EAAE,0CAA0C,EAAE,CAAC,CAAC;YAC5F,OAAO;QACT,CAAC;QAED,MAAM,QAAQ,GAAG,OAAO,CAAC,GAAG,CAAC,sBAAsB,IAAI,EAAE,CAAC;QAC1D,MAAM,YAAY,GAAG,OAAO,CAAC,GAAG,CAAC,0BAA0B,IAAI,EAAE,CAAC;QAClE,IAAI,CAAC,QAAQ,IAAI,CAAC,YAAY,EAAE,CAAC;YAC/B,GAAG,CAAC,MAAM,CAAC,GAAG,CAAC,CAAC,IAAI,CAAC,EAAE,OAAO,EAAE,KAAK,EAAE,KAAK,EAAE,6CAA6C,EAAE,CAAC,CAAC;YAC/F,OAAO;QACT,CAAC;QAED,MAAM,KAAK,GAAG,mBAAmB,CAAC,WAAW,EAAE,CAAC;QAChD,MAAM,IAAI,GAAG,MAAM,KAAK,CAAC,WAAW,CAAC,MAAM,CAAC,CAAC;QAC7C,IAAI,CAAC,IAAI,EAAE,CAAC;YACV,GAAG,CAAC,MAAM,CAAC,GAAG,CAAC,CAAC,IAAI,CAAC,EAAE,OAAO,EAAE,KAAK,EAAE,KAAK,EAAE,mBAAmB,MAAM,EAAE,EAAE,CAAC,CAAC;YAC7E,OAAO;QACT,CAAC;QAED,MAAM,aAAa,GAAG,IAAI,CAAC,iBAAiB,CAAC,IAAI,CAAC,CAAC,CAAC,EAAE,EAAE,CAAC,CAAC,CAAC,QAAQ,KAAK,QAAQ,CAAC,CAAC;QAClF,IAAI,CAAC,aAAa,EAAE,CAAC;YACnB,GAAG,CAAC,MAAM,CAAC,GAAG,CAAC,CAAC,IAAI,CAAC,EAAE,OAAO,EAAE,KAAK,EAAE,KAAK,EAAE,2CAA2C,EAAE,CAAC,CAAC;YAC7F,OAAO;QACT,CAAC;QAED,mCAAmC;QACnC,MAAM,YAAY,GAAG,KAAK,CAAC,YAAY,CAAC,aAAa,CAAC,qBAAqB,CAAC,CAAC;QAE7E,kDAAkD;QAClD,MAAM,SAAS,GAAG,MAAM,KAAK,CAAC,sBAAsB,CAAC,cAAc,EAAE;YACnE,MAAM,EAAE,MAAM;YACd,OAAO,EAAE,EAAE,cAAc,EAAE,mCAAmC,EAAE;YAChE,IAAI,EAAE,IAAI,eAAe,CAAC;gBACxB,SAAS,EAAE,QAAQ;gBACnB,aAAa,EAAE,YAAY;gBAC3B,aAAa,EAAE,YAAY;gBAC3B,UAAU,EAAE,eAAe;aAC5B,CAAC;SACH,CAAC,CAAC;QAEH,MAAM,SAAS,GAAG,MAAM,SAAS,CAAC,IAAI,EAAyB,CAAC;QAEhE,IAAI,CAAC,SAAS,CAAC,EAAE,IAAI,SAAS,CAAC,KAAK,EAAE,CAAC;YACrC,MAAM,CAAC,KAAK,CAAC,uCAAuC,EAAE;gBACpD,MAAM;gBACN,KAAK,EAAE,SAAS,CAAC,KAAK,IAAI,SAAS;gBACnC,WAAW,EAAE,SAAS,CAAC,iBAAiB;aACzC,CAAC,CAAC;YACH,GAAG,CAAC,MAAM,CAAC,GAAG,CAAC,CAAC,IAAI,CAAC;gBACnB,OAAO,EAAE,KAAK;gBACd,KAAK,EAAE,yBAAyB,SAAS,CAAC,iBAAiB,IAAI,SAAS,CAAC,KAAK,IAAI,eAAe,EAAE;aACpG,CAAC,CAAC;YACH,OAAO;QACT,CAAC;QAED,MAAM,CAAC,IAAI,CAAC,4CAA4C,EAAE;YACxD,MAAM;YACN,SAAS,EAAE,SAAS,CAAC,UAAU;YAC/B,MAAM,EAAE,SAAS,CAAC,KAAK;SACxB,CAAC,CAAC;QAEH,GAAG,CAAC,IAAI,CAAC;YACP,OAAO,EAAE,IAAI;YACb,IAAI,EAAE;gBACJ,WAAW,EAAE,SAAS,CAAC,YAAY;gBACnC,SAAS,EAAE,SAAS,CAAC,UAAU;gBAC/B,SAAS,EAAE,SAAS,CAAC,UAAU;gBAC/B,MAAM,EAAE,SAAS,CAAC,KAAK,CAAC,CAAC,CAAC,SAAS,CAAC,KAAK,CAAC,KAAK,CAAC,GAAG,CAAC,CAAC,CAAC,CAAC,aAAa,CAAC,MAAM;aAC5E;SACF,CAAC,CAAC;IACL,CAAC;IAAC,OAAO,KAAK,EAAE,CAAC;QACf,MAAM,CAAC,KAAK,CAAC,gCAAgC,EAAE;YAC7C,KAAK,EAAE,KAAK,YAAY,KAAK,CAAC,CAAC,CAAC,KAAK,CAAC,OAAO,CAAC,CAAC,CAAC,MAAM,CAAC,KAAK,CAAC;SAC9D,CAAC,CAAC;QACH,IAAI,CAAC,KAAK,CAAC,CAAC;IACd,CAAC;AACH,CAAC;AAED;;;;;;;;GAQG;AACH,MAAM,UAAU,mBAAmB,CAAC,IAAa,EAAE,GAAa;IAC9D,GAAG,CAAC,IAAI,CAAC;QACP,OAAO,EAAE,IAAI;QACb,IAAI,EAAE;YACJ,MAAM,EAAE,CAAC,GAAG,sBAAsB,CAAC,gBAAgB,CAAC;SACrD;KACF,CAAC,CAAC;AACL,CAAC"}

package/dist/backend/backend/src/controllers/workspace/workspace.routes.d.ts

@@ -0,0 +1,18 @@
+/**
+ * Google Workspace API Routes
+ *
+ * Mounts workspace-related endpoints under /api/workspace/.
+ *
+ * @module controllers/workspace/workspace.routes
+ */
+import { Router } from 'express';
+/**
+ * Create the Workspace API router.
+ *
+ * All endpoints are protected by requireAuth middleware to ensure
+ * only authenticated users/agents can access Workspace tokens.
+ *
+ * @returns Express Router with workspace endpoints
+ */
+export declare function createWorkspaceRouter(): Router;
+//# sourceMappingURL=workspace.routes.d.ts.map

package/dist/backend/backend/src/controllers/workspace/workspace.routes.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"workspace.routes.d.ts","sourceRoot":"","sources":["../../../../../../backend/src/controllers/workspace/workspace.routes.ts"],"names":[],"mappings":"AAAA;;;;;;GAMG;AAEH,OAAO,EAAE,MAAM,EAAE,MAAM,SAAS,CAAC;AAIjC;;;;;;;GAOG;AACH,wBAAgB,qBAAqB,IAAI,MAAM,CAU9C"}

package/dist/backend/backend/src/controllers/workspace/workspace.routes.js

@@ -0,0 +1,27 @@
+/**
+ * Google Workspace API Routes
+ *
+ * Mounts workspace-related endpoints under /api/workspace/.
+ *
+ * @module controllers/workspace/workspace.routes
+ */
+import { Router } from 'express';
+import { getWorkspaceToken, listWorkspaceScopes } from './workspace.controller.js';
+import { requireAuth } from '../../middleware/require-auth.middleware.js';
+/**
+ * Create the Workspace API router.
+ *
+ * All endpoints are protected by requireAuth middleware to ensure
+ * only authenticated users/agents can access Workspace tokens.
+ *
+ * @returns Express Router with workspace endpoints
+ */
+export function createWorkspaceRouter() {
+    const router = Router();
+    // GET /api/workspace/token?userId=xxx — Get a fresh Google access token
+    router.get('/token', requireAuth, getWorkspaceToken);
+    // GET /api/workspace/scopes — List available Workspace scopes
+    router.get('/scopes', requireAuth, listWorkspaceScopes);
+    return router;
+}
+//# sourceMappingURL=workspace.routes.js.map

package/dist/backend/backend/src/controllers/workspace/workspace.routes.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"workspace.routes.js","sourceRoot":"","sources":["../../../../../../backend/src/controllers/workspace/workspace.routes.ts"],"names":[],"mappings":"AAAA;;;;;;GAMG;AAEH,OAAO,EAAE,MAAM,EAAE,MAAM,SAAS,CAAC;AACjC,OAAO,EAAE,iBAAiB,EAAE,mBAAmB,EAAE,MAAM,2BAA2B,CAAC;AACnF,OAAO,EAAE,WAAW,EAAE,MAAM,6CAA6C,CAAC;AAE1E;;;;;;;GAOG;AACH,MAAM,UAAU,qBAAqB;IACnC,MAAM,MAAM,GAAG,MAAM,EAAE,CAAC;IAExB,wEAAwE;IACxE,MAAM,CAAC,GAAG,CAAC,QAAQ,EAAE,WAAW,EAAE,iBAAiB,CAAC,CAAC;IAErD,8DAA8D;IAC9D,MAAM,CAAC,GAAG,CAAC,SAAS,EAAE,WAAW,EAAE,mBAAmB,CAAC,CAAC;IAExD,OAAO,MAAM,CAAC;AAChB,CAAC"}

package/dist/backend/backend/src/index.d.ts.map

@@ -1 +1 @@
-{"version":3,"file":"index.d.ts","sourceRoot":"","sources":["../../../../backend/src/index.ts"],"names":[],"mappings":";AAyCA,OAAO,EAAE,aAAa,EAAE,MAAM,kBAAkB,CAAC;AA4FjD,qBAAa,YAAY;IACxB,OAAO,CAAC,GAAG,CAAsB;IACjC,OAAO,CAAC,UAAU,CAAkC;IACpD,OAAO,CAAC,EAAE,CAAiB;IAC3B,OAAO,CAAC,MAAM,CAAgB;IAC9B,OAAO,CAAC,MAAM,CAAqE;IAEnF,OAAO,CAAC,cAAc,CAAkB;IACxC,OAAO,CAAC,WAAW,CAAe;IAClC,OAAO,CAAC,gBAAgB,CAAoB;IAC5C,OAAO,CAAC,uBAAuB,CAA2B;IAC1D,OAAO,CAAC,sBAAsB,CAA0B;IACxD,OAAO,CAAC,mBAAmB,CAAuB;IAClD,OAAO,CAAC,4BAA4B,CAAgC;IACpE,OAAO,CAAC,uBAAuB,CAA2B;IAC1D,OAAO,CAAC,aAAa,CAAiB;IACtC,OAAO,CAAC,eAAe,CAAmB;IAC1C,OAAO,CAAC,mBAAmB,CAAuB;IAClD,OAAO,CAAC,qBAAqB,CAAyB;IACtD,OAAO,CAAC,eAAe,CAAmB;IAC1C,OAAO,CAAC,2BAA2B,CAA+B;IAClE,OAAO,CAAC,0BAA0B,CAA8B;IAGhE,OAAO,CAAC,cAAc,CAAS;IAC/B,OAAO,CAAC,wBAAwB,CAA+B;gBAEnD,MAAM,CAAC,EAAE,OAAO,CAAC,aAAa,CAAC;IAkD3C,OAAO,CAAC,kBAAkB;IAuH1B,OAAO,CAAC,mBAAmB;IAkC3B,OAAO,CAAC,eAAe;IAqFvB,OAAO,CAAC,kBAAkB;IAwBpB,KAAK,IAAI,OAAO,CAAC,IAAI,CAAC;IAyW5B;;;OAGG;YACW,2BAA2B;IA4BzC;;;OAGG;YACW,8BAA8B;IAsB5C;;;OAGG;YACW,gCAAgC;IAsB9C;;;;OAIG;YACW,8BAA8B;IAoE5C;;;;;OAKG;YACW,iCAAiC;IAuF/C;;;;OAIG;YACW,2BAA2B;YA0B3B,qBAAqB;YAsBrB,eAAe;YAiCf,kBAAkB;IAgBhC,OAAO,CAAC,WAAW,CAAK;IAExB,OAAO,CAAC,sBAAsB;IAqD9B,OAAO,CAAC,qBAAqB;IAS7B,OAAO,CAAC,cAAc;IAchB,QAAQ,IAAI,OAAO,CAAC,IAAI,CAAC;IAkL/B,SAAS,IAAI,aAAa;CAG1B;AAeD,eAAe,YAAY,CAAC"}
+{"version":3,"file":"index.d.ts","sourceRoot":"","sources":["../../../../backend/src/index.ts"],"names":[],"mappings":";AAyCA,OAAO,EAAE,aAAa,EAAE,MAAM,kBAAkB,CAAC;AA2FjD,qBAAa,YAAY;IACxB,OAAO,CAAC,GAAG,CAAsB;IACjC,OAAO,CAAC,UAAU,CAAkC;IACpD,OAAO,CAAC,EAAE,CAAiB;IAC3B,OAAO,CAAC,MAAM,CAAgB;IAC9B,OAAO,CAAC,MAAM,CAAqE;IAEnF,OAAO,CAAC,cAAc,CAAkB;IACxC,OAAO,CAAC,WAAW,CAAe;IAClC,OAAO,CAAC,gBAAgB,CAAoB;IAC5C,OAAO,CAAC,uBAAuB,CAA2B;IAC1D,OAAO,CAAC,sBAAsB,CAA0B;IACxD,OAAO,CAAC,mBAAmB,CAAuB;IAClD,OAAO,CAAC,4BAA4B,CAAgC;IACpE,OAAO,CAAC,uBAAuB,CAA2B;IAC1D,OAAO,CAAC,aAAa,CAAiB;IACtC,OAAO,CAAC,eAAe,CAAmB;IAC1C,OAAO,CAAC,mBAAmB,CAAuB;IAClD,OAAO,CAAC,qBAAqB,CAAyB;IACtD,OAAO,CAAC,eAAe,CAAmB;IAC1C,OAAO,CAAC,2BAA2B,CAA+B;IAClE,OAAO,CAAC,0BAA0B,CAA8B;IAGhE,OAAO,CAAC,cAAc,CAAS;IAC/B,OAAO,CAAC,wBAAwB,CAA+B;gBAEnD,MAAM,CAAC,EAAE,OAAO,CAAC,aAAa,CAAC;IAoD3C,OAAO,CAAC,kBAAkB;IAiH1B,OAAO,CAAC,mBAAmB;IA0C3B,OAAO,CAAC,eAAe;IAqFvB,OAAO,CAAC,kBAAkB;IAwBpB,KAAK,IAAI,OAAO,CAAC,IAAI,CAAC;IAqZ5B;;;OAGG;YACW,2BAA2B;IA4BzC;;;OAGG;YACW,8BAA8B;IAsB5C;;;OAGG;YACW,gCAAgC;IAsB9C;;;;OAIG;YACW,8BAA8B;IA2F5C;;;;;OAKG;YACW,iCAAiC;IAqG/C;;;;OAIG;YACW,2BAA2B;YA0B3B,qBAAqB;YAsBrB,eAAe;YAiCf,kBAAkB;IAgBhC,OAAO,CAAC,WAAW,CAAK;IAExB,OAAO,CAAC,sBAAsB;IAqD9B,OAAO,CAAC,qBAAqB;IAS7B,OAAO,CAAC,cAAc;IAchB,QAAQ,IAAI,OAAO,CAAC,IAAI,CAAC;IAqM/B,SAAS,IAAI,aAAa;CAG1B;AAeD,eAAe,YAAY,CAAC"}

package/dist/backend/backend/src/index.js

@@ -39,7 +39,6 @@ import { setTeamControllerEventBusService } from './controllers/team/team.contro
 import { SkillCatalogService } from './services/skill/skill-catalog.service.js';
 import { setMessageQueueService as setChatMessageQueueService } from './controllers/chat/chat.controller.js';
 import { setMessageQueueService as setMessagingControllerQueueService } from './controllers/messaging/messaging.controller.js';
-import { setMessengerRouterQueueService } from './controllers/messaging/messenger.routes.js';
 import { SystemResourceAlertService } from './services/monitoring/system-resource-alert.service.js';
 import { agentHeartbeatMiddleware } from './middleware/agent-heartbeat.middleware.js';
 import { OrchestratorRestartService } from './services/orchestrator/orchestrator-restart.service.js';
@@ -141,7 +140,9 @@ export class CrewlyServer {
         this.httpServer = createServer(this.app);
         this.io = new SocketIOServer(this.httpServer, {
             cors: {
-                origin: process.env.NODE_ENV === 'production' ? false : '*',
+                origin: process.env.NODE_ENV === 'production'
+                    ? ['https://crewlyai.com', 'https://www.crewlyai.com']
+                    : '*',
                 methods: ['GET', 'POST'],
             },
             // Configure ping/pong to keep connections alive
@@ -176,16 +177,11 @@ export class CrewlyServer {
         this.schedulerService.setTaskTrackingService(this.taskTrackingService);
         this.schedulerService.setMessageQueueService(this.messageQueueService);
         this.schedulerService.setActivityMonitor(this.activityMonitorService);
+        // #167: Wire scheduler into agent registration for DLQ drain on activation
+        this.apiController.agentRegistrationService.setSchedulerService(this.schedulerService);
         this.terminalGateway = new TerminalGateway(this.io);
         // Set terminal gateway singleton for chat integration
         setTerminalGateway(this.terminalGateway);
-        // Pre-load Gemini CLI session names so NOTIFY processing is skipped
-        // for existing sessions before registerGeminiCliSession fires.
-        this.terminalGateway.loadGeminiCliSessions().catch((error) => {
-            this.logger.warn('Failed to pre-load Gemini CLI sessions', {
-                error: error instanceof Error ? error.message : String(error),
-            });
-        });
         // Initialize ChatGateway for chat message forwarding
         // This sets up the event listeners that forward chat messages to WebSocket clients
         initializeChatGateway(this.io).catch((error) => {
@@ -204,7 +200,6 @@ export class CrewlyServer {
         // Wire queue service into controllers
         setChatMessageQueueService(this.messageQueueService);
         setMessagingControllerQueueService(this.messageQueueService);
-        setMessengerRouterQueueService(this.messageQueueService);
         // Initialize system resource alert service for proactive monitoring
         this.systemResourceAlertService = new SystemResourceAlertService();
         // Initialize event bus service for agent lifecycle pub/sub
@@ -252,12 +247,20 @@ export class CrewlyServer {
                     scriptSrc: ["'self'"],
                     imgSrc: ["'self'", 'data:', 'https:'],
                     connectSrc: ["'self'", 'ws:', 'wss:'],
+                    // Disable upgrade-insecure-requests for HTTP-only deployments (ESTestNode)
+                    // Without this, browsers on HTTP upgrade all asset requests to HTTPS → ERR_SSL_PROTOCOL_ERROR
+                    upgradeInsecureRequests: null,
                 },
             },
         }));
-        // CORS
+        // CORS — allow Cloud Console frontend and localhost OSS instances
+        const CORS_ALLOWED_ORIGINS = process.env['CORS_ALLOWED_ORIGINS']
+            ? process.env['CORS_ALLOWED_ORIGINS'].split(',')
+            : ['https://crewlyai.com', 'https://www.crewlyai.com', 'http://localhost:8787', 'http://localhost:3000'];
         this.app.use(cors({
-            origin: process.env.NODE_ENV === 'production' ? false : '*',
+            origin: process.env.NODE_ENV === 'production'
+                ? CORS_ALLOWED_ORIGINS
+                : '*',
             credentials: true,
         }));
         // Logging
@@ -364,6 +367,9 @@ export class CrewlyServer {
             if (!envValidation.valid) {
                 throw new Error('Environment configuration validation failed — see errors above');
             }
+            // Initialize OpenTelemetry tracing (early, before other services)
+            const { TracingService } = await import('./services/core/tracing.service.js');
+            TracingService.getInstance().initialize();
             this.logger.info('Starting Crewly server...');
             this.logger.info('Server startup info', {
                 pid: process.pid,
@@ -633,6 +639,40 @@ export class CrewlyServer {
             await this.autoStartOrchestratorIfEnabled();
             // Auto-restore agent sessions that were running before the last shutdown
             await this.autoRestoreAgentSessionsIfEnabled();
+            // #166: Auto-recover in-progress tasks after restart
+            try {
+                const inProgressTasks = await this.taskTrackingService.getAllInProgressTasks();
+                const activeTasks = inProgressTasks.filter(t => t.status === 'assigned' || t.status === 'active' || t.status === 'working');
+                if (activeTasks.length > 0) {
+                    this.logger.info('Found in-progress tasks to recover after restart', {
+                        count: activeTasks.length,
+                    });
+                    for (const task of activeTasks) {
+                        try {
+                            const recoveryMessage = `[SYSTEM — TASK RECOVERY] You were working on this task before the server restarted. Please continue:\n\nTask: ${task.taskName}\nPriority: ${task.priority || 'normal'}\nFile: ${task.taskFilePath}\n\nPlease check the current state and continue working.`;
+                            await this.apiController.agentRegistrationService.sendMessageToAgent(task.assignedSessionName, recoveryMessage, undefined);
+                            this.logger.info('Task recovery message sent', {
+                                taskId: task.id,
+                                sessionName: task.assignedSessionName,
+                                taskName: task.taskName,
+                            });
+                        }
+                        catch (err) {
+                            // Agent might not be online yet — DLQ in scheduler will handle it
+                            this.logger.warn('Task recovery delivery deferred (agent may not be online yet)', {
+                                taskId: task.id,
+                                sessionName: task.assignedSessionName,
+                                error: err instanceof Error ? err.message : String(err),
+                            });
+                        }
+                    }
+                }
+            }
+            catch (err) {
+                this.logger.warn('Task auto-recovery failed (non-critical)', {
+                    error: err instanceof Error ? err.message : String(err),
+                });
+            }
             // Start log rotation service (non-critical — logs cleanup)
             try {
                 const logRotation = LogRotationService.getInstance();
@@ -649,10 +689,11 @@ export class CrewlyServer {
             // Start AuditorSchedulerService (non-critical — audit scheduling)
             try {
                 const auditorScheduler = AuditorSchedulerService.getInstance();
+                auditorScheduler.setAgentRegistrationService(this.apiController.agentRegistrationService);
                 auditorScheduler.setEventBusService(this.eventBusService);
                 setAuditorSchedulerService(auditorScheduler);
                 auditorScheduler.start();
-                this.logger.info('AuditorSchedulerService started');
+                this.logger.info('AuditorSchedulerService started (Claude Code PTY mode)');
             }
             catch (error) {
                 this.logger.warn('Failed to start AuditorSchedulerService (non-critical)', {
@@ -771,8 +812,10 @@ export class CrewlyServer {
                 return;
             }
             this.logger.info('Auto-start orchestrator is enabled, starting orchestrator...');
-            // Determine runtime type from orchestrator status
+            // Determine runtime type: env var OVERRIDES stored status > default (claude-code)
+            // DEFAULT_RUNTIME env var is the authoritative config for Docker/headless deployments.
             let runtimeType = RUNTIME_TYPES.CLAUDE_CODE;
+            // Step 1: Check stored orchestrator status (user changed via UI in previous session)
             try {
                 const orchestratorStatus = await this.storageService.getOrchestratorStatus();
                 if (orchestratorStatus?.runtimeType) {
@@ -782,6 +825,25 @@ export class CrewlyServer {
             catch {
                 // Use default runtime type
             }
+            // Step 2: DEFAULT_RUNTIME env var OVERRIDES stored status (product-level config)
+            // This ensures Docker/headless deployments always use the configured runtime
+            // regardless of what was stored from a previous (possibly different) deployment.
+            const envRuntime = process.env.DEFAULT_RUNTIME;
+            if (envRuntime && Object.values(RUNTIME_TYPES).includes(envRuntime)) {
+                const previousRuntime = runtimeType;
+                runtimeType = envRuntime;
+                this.logger.info('DEFAULT_RUNTIME env overrides stored runtime', { runtimeType, previousRuntime });
+                // #183: Persist the override so stored status stays in sync
+                if (previousRuntime !== runtimeType) {
+                    try {
+                        await this.storageService.updateOrchestratorRuntimeType(runtimeType);
+                        this.logger.info('Synced orchestrator runtime to storage', { runtimeType });
+                    }
+                    catch {
+                        this.logger.warn('Failed to sync orchestrator runtime to storage');
+                    }
+                }
+            }
             // Create orchestrator agent session
             const result = await this.apiController.agentRegistrationService.createAgentSession({
                 sessionName: ORCHESTRATOR_SESSION_NAME,
@@ -852,7 +914,18 @@ export class CrewlyServer {
             });
             let restored = 0;
             const failed = [];
-            for (const session of agentSessions) {
+            const RESTORE_DELAY_MS = 10_000; // 10 seconds between each session restore to avoid resource pressure
+            for (let i = 0; i < agentSessions.length; i++) {
+                const session = agentSessions[i];
+                // Wait between session restores to avoid SIGTERM from resource pressure
+                if (i > 0) {
+                    this.logger.info('Waiting before restoring next session to avoid resource pressure', {
+                        delayMs: RESTORE_DELAY_MS,
+                        nextSession: session.name,
+                        progress: `${i}/${agentSessions.length}`,
+                    });
+                    await new Promise((resolve) => setTimeout(resolve, RESTORE_DELAY_MS));
+                }
                 try {
                     const result = await this.apiController.agentRegistrationService.createAgentSession({
                         sessionName: session.name,
@@ -869,6 +942,7 @@ export class CrewlyServer {
                             name: session.name,
                             role: session.role,
                             runtimeType: session.runtimeType,
+                            progress: `${restored}/${agentSessions.length}`,
                         });
                     }
                     else {
@@ -1081,6 +1155,17 @@ export class CrewlyServer {
                 clearInterval(this.healthMonitoringInterval);
                 this.healthMonitoringInterval = null;
             }
+            // Generate session handoff summary before killing processes
+            // This captures active thread state and agent status for restart recovery
+            try {
+                const { SessionHandoffService } = await import('./services/session/session-handoff.service.js');
+                await SessionHandoffService.getInstance().generateSummary(this.storageService);
+            }
+            catch (error) {
+                this.logger.warn('Failed to generate session handoff summary', {
+                    error: error instanceof Error ? error.message : String(error),
+                });
+            }
             // Save PTY session state and force-kill all child processes
             this.logger.info('Saving PTY session state and force-killing child processes...');
             try {
@@ -1164,6 +1249,14 @@ export class CrewlyServer {
             LogRotationService.getInstance().stop();
             // Stop auditor scheduler
             AuditorSchedulerService.getInstance().stop();
+            // Flush and shutdown OpenTelemetry tracing
+            try {
+                const { TracingService: TracingSvc } = await import('./services/core/tracing.service.js');
+                await TracingSvc.getInstance().shutdown();
+            }
+            catch {
+                // Ignore if not initialized
+            }
             // Clean up tmux service resources
             this.tmuxService.destroy();
             // Stop Slack image cleanup timer