feat(auth): consume hosted fixed-path credentials

[khaliqgant]

Outcome

Give the built Factory CLI a non-interactive hosted credential path without local Cloud login and without invoking AGENT_RELAY_BIN.

When FACTORY_CLOUD_ACCESS_TOKEN_URL is present, RelayfileCloudMountClient.fromConfig() uses that private endpoint as its Cloud token provider. The provider:

• accepts only an absolute HTTP(S) endpoint;
• requests with a bounded timeout and no-store semantics;
• accepts only a relay_pa_ access-token class;
• bypasses ensureCloudSession() entirely;
• never reads or logs a token response body on failure.

An explicit in-process provider remains available to alternate hosts. Existing local Cloud-session behavior is unchanged when neither hosted option is configured.

Verification

• npm test -- --run src/mount/relayfile-cloud-mount-client.test.ts — 59/59, exit 0
• npm run build — exit 0
• git diff --check — exit 0

The tests prove both sides: the private hosted endpoint works even when AGENT_RELAY_BIN points at the wrong executable, and a workspace/mint credential (relay_ws) is rejected rather than silently starting.

Cutover dependencies

This is the Factory-side consumer only. Live cutover remains fail-closed until:

1. Cloud's workspace join verifies and accepts the fixed relay_pa identity for the exact workspace/agent/scopes/audience; and
2. factory-cloud's private Durable Object endpoint serializes refresh, durably commits each rotated pair before returning the new access token, and exposes only the access half to the Container.

No live deploy and no merge is performed by this PR.

Related: #268

---

Summary by cubic

Consumes hosted, fixed RelayAuth path credentials and bypasses local Cloud login and workspace discovery. Previously the client always used the local Cloud session (and could invoke AGENT_RELAY_BIN); now hosted mode validates and uses relay_pa_* tokens from a private provider and fails closed on errors.

• Enable hosted mode via cloudAccessTokenProvider, cloudAccessTokenUrl, or FACTORY_CLOUD_ACCESS_TOKEN_URL; in hosted mode we never call ensureCloudSession() or resolve the laptop workspace and join with the default rw_7ccfea89.

• Require a Cloud API URL: when injecting cloudAccessTokenProvider you must pass cloudApiUrl; when using cloudAccessTokenUrl/FACTORY_CLOUD_ACCESS_TOKEN_URL, we use cloudApiUrl or infer from CLOUD_API_URL/defaultApiUrl().

• Enforce token class for both injected and fetched tokens: reject non-relay_pa_* before workspace join.

• Hosted endpoint fetch: 10s timeout, absolute http/https only, no-store headers; cancel body on non-2xx; never read or log failure bodies.

• Local session path is unchanged when no hosted option is set.

• New config: cloudAccessTokenUrl, cloudAccessTokenFetch, cloudAccessTokenTimeoutMs.

• Rollout: Hosts set FACTORY_CLOUD_ACCESS_TOKEN_URL and CLOUD_API_URL, or inject cloudAccessTokenProvider with cloudApiUrl; providers must return relay_pa_* or startup fails; no action for local development.

^{Written for commit d409a2f. Summary will update on new commits.}

[cursor]

Bugbot is not enabled for your account, so this pull request was not reviewed.

Enable Bugbot in the Cursor dashboard to get automatic reviews on future PRs.

[coderabbitai]

Warning

Review limit reached

@khaliqgant, you've reached your PR review limit, so we couldn't start this review.

Next review available in: 3 minutes

Limit details: You’ve used all 1 included review currently available under your plan.

You've used all free OSS reviews for now. Wait for the free limit to reset to keep reviewing this public repository.

How can I continue?

After more reviews become available, a review can be triggered using the @coderabbitai review command as a PR comment. Alternatively, push new commits to this PR.

To avoid repeated limits, reduce automatic review volume by pausing incremental auto-reviews earlier, using label-based review opt-in, excluding WIP or generated PR titles, or requesting reviews manually when the PR is ready. If your team needs uninterrupted high-volume reviews, an organization admin can enable usage-based reviews.

How do review limits work?

CodeRabbit enforces per-developer PR review limits for each organization. Most developers receive the normal plan review availability.

For paid Pro and Pro+ PR reviews, CodeRabbit uses adaptive limits for sustained high-volume activity. When a developer's recent PR review activity reaches the 95th percentile or higher among CodeRabbit users, additional reviews become available more gradually as earlier reviews age out of the rolling window.

Please refer docs for additional details.

Review details

⚙️ Run configuration

Configuration used: Organization UI

Review profile: CHILL

Plan: Pro Plus

Run ID: 3cfdab58-30b7-40c7-9ce8-381a12a9f61f

📥 Commits

Reviewing files that changed from the base of the PR and between eaaa076 and d409a2f.

📒 Files selected for processing (2)

• src/mount/relayfile-cloud-mount-client.test.ts
• src/mount/relayfile-cloud-mount-client.ts

---

Thanks for using CodeRabbit! It's free for OSS, and your support helps us grow. If you like it, consider giving us a shout-out.

❤️ Share

• X
• Mastodon
• Reddit
• LinkedIn

_{Comment @coderabbitai help to get the list of available commands.}

[chatgpt-codex-connector]

💡 Codex Review

Here are some automated review suggestions for this pull request.

Reviewed commit: d6ceddbf1a

ℹ️ About Codex in GitHub

Your team has set up Codex to review pull requests in this repo. Reviews are triggered when you

• Open a pull request for review
• Mark a draft as ready
• Comment "@codex review".

If Codex has suggestions, it will comment; otherwise it will react with 👍.

Codex can also answer questions or update the PR. Try commenting "@codex address that feedback".

[cubic-dev-ai]

All reported issues were addressed across 2 files

<sub>Reply with feedback, questions, or to request a fix.

Re-trigger cubic</sub>

[cubic-dev-ai]

1 issue found across 2 files (changes from recent commits).

Prompt for AI agents (unresolved issues)

Check if these issues are valid — if so, understand the root cause of each and fix them. If appropriate, use sub-agents to investigate and fix each issue separately.


<file name="src/mount/relayfile-cloud-mount-client.ts">

<violation number="1" location="src/mount/relayfile-cloud-mount-client.ts:120">
P1: When hosted credentials are supplied through `cloudAccessTokenUrl` or `cloudAccessTokenProvider`, this guard does not bypass local workspace resolution. Thread the hosted configuration into `resolveFactoryWorkspace()` or skip that resolver for direct hosted providers, otherwise `AGENT_RELAY_BIN` can still run before `fromConfig()`.</violation>
</file>

<sub>Tip: Review your code locally with the cubic CLI to iterate faster.

Re-trigger cubic</sub>