feat(deploy): surface daytona connect + gate in agentworkforce deploy

Merged
KH
5mo ago
+254-0

What

Surfaces the Daytona connect step in agentworkforce deploy, mirroring how slack/github are gated — so a persona that declares integrations.daytona (e.g. daytona-monitor) can't deploy until the daytona credential exists in the cloud credential-store.

Daytona's credential is captured out-of-band by the relay CLI (agent-relay cloud connect daytona → local daytona login → normalized token uploaded to the cloud credential-store), not the browser connect-session OAuth flow other providers use. So the generic walker can't drive it inline (the cloud returns 409 unknown_provider for daytona's connect-session).

Change

packages/deploy/src/connect.ts:

  • Add CLI_CAPTURED_PROVIDERS = {daytona} + isCliCapturedProvider().
  • New walker branch: when daytona is not connected (interactive or --reconnect), instead of the misleading "(opens browser)" prompt + connect-session call, it errors integrations.daytona: not connected. Run \agent-relay cloud connect daytona` to capture the credential, then re-deploy.` and gates the deploy.
  • already-connected / --no-prompt / --no-connect paths stay generic and identical to slack/github.

Gating keys on credential existence via the existing GET /api/v1/workspaces/<ws>/integrations/daytona/status?scope=deployer_user route — connected requires connectionMatched !== false AND (oauth.connected:true | status/state:'ready' | ready:true), matching the cloud credential-store contract.

Tests

packages/deploy/src/connect.test.ts — 6 daytona tests:

  • 2 resolver-contract tests locking the connected/pending status shape against the real relayfileIntegrationResolver.
  • 4 walker tests: already-connected (no prompt), --no-prompt gate, interactive instruct-and-gate, --reconnect instruct-and-gate.

Local verification: full deploy package suite 193/193 green, tsc -p clean. This branch is a clean cherry-pick of the source commit onto main, touching only connect.ts/connect.test.ts (disjoint from main's other deploy changes).

Context

Part of the daytona connect end-to-end effort (capture via relay CLI → cloud credential-store + status route + runtime env-injection → deploy gating here). Reviewable independently of the workforce catalog-refresh work.

🤖 Generated with Claude Code