fix(auth): use production cloud and tolerate whoami latency

Author: kjgbot

src/main/auth.test.ts

@@ -127,6 +127,11 @@ describe('getAccountWorkspaceId', () => {
     expect(mock.fetchMock).not.toHaveBeenCalled()
   })
 
+  it('uses the production cloud URL by default', async () => {
+    const { getApiUrl } = await import('./auth')
+    expect(getApiUrl()).toBe('https://agentrelay.com/cloud')
+  })
+
   it('returns the workspace id from currentWorkspace.id and persists the cache', async () => {
     writeAuthJson(userDataDir, {
       accessToken: 'cld_at_abc',
@@ -335,6 +340,47 @@ describe('getAccountWorkspaceId', () => {
     expect(mock.fetchMock).toHaveBeenCalledTimes(2)
   })
 
+  it('retries when whoami temporarily times out', async () => {
+    writeAuthJson(userDataDir, {
+      accessToken: 'cld_at_timeout_retry',
+      refreshToken: 'cld_rt_timeout_retry',
+      apiUrl: 'https://cloud.example'
+    })
+    mock.fetchMock
+      .mockRejectedValueOnce(Object.assign(new Error('aborted'), { name: 'AbortError' }))
+      .mockResolvedValueOnce({
+        ok: true,
+        status: 200,
+        statusText: 'OK',
+        json: async () => ({ currentWorkspace: { id: 'ws-after-timeout' } })
+      })
+
+    const { getAccountWorkspaceId } = await import('./auth')
+    await expect(getAccountWorkspaceId({ retryAttempts: 2, retryDelayMs: 0 })).resolves.toBe('ws-after-timeout')
+    expect(mock.fetchMock).toHaveBeenCalledTimes(2)
+  })
+
+  it('canonicalizes legacy agentrelay.dev auth records to production', async () => {
+    writeAuthJson(userDataDir, {
+      accessToken: 'cld_at_legacy_dev',
+      refreshToken: 'cld_rt_legacy_dev',
+      apiUrl: 'https://agentrelay.dev/cloud'
+    })
+    mock.fetchMock.mockResolvedValue({
+      ok: true,
+      status: 200,
+      statusText: 'OK',
+      json: async () => ({ currentWorkspace: { id: 'ws-prod' } })
+    })
+
+    const { getAccountWorkspaceId } = await import('./auth')
+    await expect(getAccountWorkspaceId()).resolves.toBe('ws-prod')
+    expect(mock.fetchMock).toHaveBeenCalledWith(
+      'https://agentrelay.com/cloud/api/v1/auth/whoami',
+      expect.any(Object)
+    )
+  })
+
   it('throws cloud-auth-required when whoami rejects the access token', async () => {
     writeAuthJson(userDataDir, {
       accessToken: 'cld_at_401',

src/main/auth.ts

@@ -14,8 +14,9 @@ import {
   type UserInfo
 } from './schemas'
 
-const CLOUD_API_URL = process.env.RELAY_CLOUD_URL || 'https://agentrelay.dev/cloud'
+const CLOUD_API_URL = process.env.RELAY_CLOUD_URL || 'https://agentrelay.com/cloud'
 const TOKEN_EXPIRY_BUFFER_MS = 60_000
+const WHOAMI_REQUEST_TIMEOUT_MS = 10_000
 const ACCOUNT_WORKSPACE_RETRY_ATTEMPTS = 8
 const ACCOUNT_WORKSPACE_RETRY_DELAY_MS = 500
 const warnedWhoamiWorkspaceFailures = new Set<string>()
@@ -277,7 +278,7 @@ function warnWhoamiWorkspaceFailure(failureClass: string): void {
 
 async function fetchWhoamiPayload(apiUrl: string, accessToken: string): Promise<WhoamiPayloadResult> {
   const controller = new AbortController()
-  const timeout = setTimeout(() => controller.abort(), 2500)
+  const timeout = setTimeout(() => controller.abort(), WHOAMI_REQUEST_TIMEOUT_MS)
 
   try {
     const res = await fetch(`${apiUrl}/api/v1/auth/whoami`, {
@@ -598,7 +599,9 @@ function cloudAuthFromStored(tokens: StoredTokens): CloudAuth {
 }
 
 function normalizeCloudApiUrl(url: string | undefined): string {
-  return (url || getApiUrl()).trim().replace(/\/+$/, '')
+  const normalized = (url || getApiUrl()).trim().replace(/\/+$/, '')
+  if (normalized === 'https://agentrelay.dev/cloud') return CLOUD_API_URL
+  return normalized
 }
 
 function readJwtPayload(token: string): Record<string, unknown> | null {