@agentforge-io/core 2.0.14 → 2.0.16

package/dist/domain/conversation.d.ts

@@ -24,3 +24,25 @@ export interface Message {
 }
 export type NewConversation = Pick<Conversation, 'userId' | 'agentId'> & Partial<Omit<Conversation, 'id' | 'createdAt' | 'updatedAt'>>;
 export type NewMessage = Omit<Message, 'id' | 'createdAt'>;
+/**
+ * Minimal payload for the agent-editor's conversation sidebar. The full
+ * `Conversation + messages[]` is too heavy to ship for 50 rows; this
+ * shape carries the bare minimum the UI needs to render a row and
+ * decide which one to load in full.
+ *
+ * `intent` is the first user message of the conversation, truncated to
+ * 120 chars server-side. `null` when the conversation has no user
+ * message yet (rare but possible mid-create).
+ */
+export interface ConversationListItem {
+    id: string;
+    userId: string;
+    agentId: string;
+    status: ConversationStatus;
+    intent: string | null;
+    messageCount: number;
+    totalInputTokens: number;
+    totalOutputTokens: number;
+    createdAt: Date;
+    updatedAt: Date;
+}

package/dist/repositories/in-memory.d.ts

@@ -1,5 +1,5 @@
 import type { ConversationRepository, MessageRepository } from './index';
-import type { Conversation, NewConversation, Message, NewMessage } from '../domain/conversation';
+import type { Conversation, ConversationListItem, NewConversation, Message, NewMessage } from '../domain/conversation';
 import type { ConversationStatus } from '../types/agent.types';
 export declare class InMemoryConversationRepository implements ConversationRepository {
     private byId;
@@ -11,6 +11,13 @@ export declare class InMemoryConversationRepository implements ConversationRepos
         limit?: number;
         offset?: number;
     }): Promise<Conversation[]>;
+    listForAgent(agentId: string, opts?: {
+        limit?: number;
+        offset?: number;
+    }): Promise<{
+        items: ConversationListItem[];
+        totalCount: number;
+    }>;
     updateStats(id: string, patch: {
         status?: ConversationStatus;
         addInputTokens?: number;

package/dist/repositories/in-memory.js

@@ -41,6 +41,32 @@ class InMemoryConversationRepository {
         const end = opts.limit ? start + opts.limit : undefined;
         return items.slice(start, end);
     }
+    async listForAgent(agentId, opts = {}) {
+        // In-memory variant doesn't have access to the message store —
+        // those live in a sibling repo. We return `intent: null` here; the
+        // TypeORM impl is the one that materializes intent from messages.
+        // Good enough for tests + demos that just want to exercise the
+        // listing contract.
+        const all = Array.from(this.byId.values()).filter((c) => c.agentId === agentId);
+        all.sort((a, b) => b.updatedAt.getTime() - a.updatedAt.getTime());
+        const start = opts.offset ?? 0;
+        const end = opts.limit ? start + opts.limit : undefined;
+        return {
+            items: all.slice(start, end).map((c) => ({
+                id: c.id,
+                userId: c.userId,
+                agentId: c.agentId,
+                status: c.status,
+                intent: null,
+                messageCount: c.messageCount,
+                totalInputTokens: c.totalInputTokens,
+                totalOutputTokens: c.totalOutputTokens,
+                createdAt: c.createdAt,
+                updatedAt: c.updatedAt,
+            })),
+            totalCount: all.length,
+        };
+    }
     async updateStats(id, patch) {
         const c = this.byId.get(id);
         if (!c)

package/dist/repositories/index.d.ts

@@ -1,4 +1,4 @@
-import type { Conversation, NewConversation, Message, NewMessage } from '../domain/conversation';
+import type { Conversation, ConversationListItem, NewConversation, Message, NewMessage } from '../domain/conversation';
 import type { ChatToken, NewChatToken, ChatTokenPatch } from '../domain/chat-token';
 import type { McpServerRecord, NewMcpServerRecord, McpServerRecordPatch } from '../domain/mcp-server';
 import type { ConnectorAuth, NewConnectorAuth, ConnectorAuthPatch } from '../domain/connector-auth';
@@ -22,6 +22,26 @@ export interface ConversationRepository {
         limit?: number;
         offset?: number;
     }): Promise<Conversation[]>;
+    /**
+     * List every conversation an agent has had, regardless of user. Used by
+     * the agent-editor's "Conversations" panel — operators need visibility
+     * into all traffic the agent saw, not just their own.
+     *
+     * Tenant scoping is enforced one layer up (host service), since the SDK
+     * doesn't carry tenant context. Pass `agentId` only after verifying it
+     * belongs to the caller's tenant.
+     *
+     * The optional `intent` field on each item is the first user message's
+     * content, truncated to 120 chars — server-side so the wire payload
+     * stays small (the list is for a sidebar, not for replaying messages).
+     */
+    listForAgent(agentId: string, opts?: {
+        limit?: number;
+        offset?: number;
+    }): Promise<{
+        items: ConversationListItem[];
+        totalCount: number;
+    }>;
     updateStats(id: string, patch: {
         status?: ConversationStatus;
         addInputTokens?: number;

package/dist/services/oauth2.service.d.ts

@@ -36,6 +36,24 @@ export interface OAuth2ProviderConfig {
      * instead of letting an empty string poison the encrypted-token row.
      */
     tokenExtractor?: (json: unknown) => TokenSet;
+    /**
+     * Where to put the client credentials on the token exchange request.
+     *
+     *   - `'body'` (default) — appends `client_id` + `client_secret` to the
+     *     form-encoded body. Works for the majority of providers (Google,
+     *     HubSpot, ClickUp, Slack, GitHub).
+     *
+     *   - `'basic'` — sends them as `Authorization: Basic
+     *     base64(client_id:client_secret)` instead. Required by Notion
+     *     (their `/v1/oauth/token` rejects body credentials with
+     *     `invalid_client`), Spotify, and a handful of other providers
+     *     whose docs say "Basic Auth" explicitly.
+     *
+     * RFC 6749 §2.3.1 allows both forms but recommends Basic when both are
+     * supported. We default to body because it was the legacy behavior and
+     * every existing connector relies on it.
+     */
+    tokenAuth?: 'body' | 'basic';
 }
 export interface AuthorizeUrlResult {
     url: string;

package/dist/services/oauth2.service.js

@@ -40,44 +40,62 @@ class OAuth2Service {
             grant_type: 'authorization_code',
             code,
             redirect_uri: redirectUri,
-            client_id: cfg.clientId,
-            client_secret: cfg.clientSecret,
         });
+        // Body-auth providers carry credentials in the form payload; basic-auth
+        // providers (Notion, Spotify) carry them in the Authorization header
+        // and reject body credentials with `invalid_client`. See
+        // OAuth2ProviderConfig.tokenAuth for the per-provider toggle.
+        if ((cfg.tokenAuth ?? 'body') === 'body') {
+            body.set('client_id', cfg.clientId);
+            body.set('client_secret', cfg.clientSecret);
+        }
         if (pkceVerifier)
             body.set('code_verifier', pkceVerifier);
-        return this.postToken(cfg.tokenUrl, body, cfg.tokenExtractor);
+        return this.postToken(cfg, body);
     }
     async refresh(cfg, refreshToken) {
         const body = new URLSearchParams({
             grant_type: 'refresh_token',
             refresh_token: refreshToken,
-            client_id: cfg.clientId,
-            client_secret: cfg.clientSecret,
         });
-        return this.postToken(cfg.tokenUrl, body, cfg.tokenExtractor);
+        if ((cfg.tokenAuth ?? 'body') === 'body') {
+            body.set('client_id', cfg.clientId);
+            body.set('client_secret', cfg.clientSecret);
+        }
+        return this.postToken(cfg, body);
     }
-    async postToken(tokenUrl, body, extractor) {
-        const res = await this.fetchImpl(tokenUrl, {
+    async postToken(cfg, body) {
+        const headers = {
+            'content-type': 'application/x-www-form-urlencoded',
+            accept: 'application/json',
+        };
+        // Basic-auth providers need credentials in the Authorization header
+        // instead of the body. RFC 6749 §2.3.1 — both forms are spec-legal
+        // but providers vary on which they accept.
+        if (cfg.tokenAuth === 'basic') {
+            const credentials = Buffer.from(`${cfg.clientId}:${cfg.clientSecret}`).toString('base64');
+            headers.authorization = `Basic ${credentials}`;
+        }
+        const res = await this.fetchImpl(cfg.tokenUrl, {
             method: 'POST',
-            headers: {
-                'content-type': 'application/x-www-form-urlencoded',
-                accept: 'application/json',
-            },
+            headers,
             body: body.toString(),
         });
         if (!res.ok) {
             const text = await res.text().catch(() => '');
-            throw new Error(`OAuth2 token endpoint ${tokenUrl} returned ${res.status}: ${text}`);
+            throw new Error(`OAuth2 token endpoint ${cfg.tokenUrl} returned ${res.status}: ${text}`);
         }
         const json = (await res.json());
-        const tokens = extractor ? extractor(json) : defaultExtractor(json);
+        const tokens = cfg.tokenExtractor
+            ? cfg.tokenExtractor(json)
+            : defaultExtractor(json);
         // Guard against accidentally persisting an empty-string token — that
         // would crash the cipher with "Received undefined" downstream and the
         // operator would chase a confusing stack trace. Better to fail fast
         // here with a descriptive error so the connector author knows their
         // extractor (or the default) missed the token.
         if (!tokens.accessToken) {
-            throw new Error(`OAuth2 token endpoint ${tokenUrl} returned a response without an access token. ` +
+            throw new Error(`OAuth2 token endpoint ${cfg.tokenUrl} returned a response without an access token. ` +
                 'If the provider uses a non-standard envelope, supply `tokenExtractor` on the ConnectorDefinition.');
         }
         return tokens;

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "@agentforge-io/core",
-  "version": "2.0.14",
+  "version": "2.0.16",
   "description": "Framework-free AI runtime SDK. Owns: agent loop (Anthropic), conversations, tools, streaming, agent-job queue, SdkHooks. Identity, billing, infra (email/uploads/secrets) live in the host's modules — not here.",
   "license": "MIT",
   "main": "dist/index.js",