@aitne/daemon 0.1.6 → 0.1.8

package/dist/api/routes/dashboard/oauth-google.js

@@ -0,0 +1,293 @@
+import { randomUUID } from "node:crypto";
+import { getGoogleOAuthClientConfig, parseGoogleCredentialsJson, } from "../../../services/google-auth.js";
+import { createLogger, toSafeErrorMessage } from "../../../logging.js";
+const MAX_UPLOAD_SIZE = 100 * 1024; // 100 KB — credential files are small
+const MAX_OAUTH_STATE_AGE_MS = 10 * 60 * 1000;
+/** Escape HTML special characters to prevent XSS */
+function escapeHtml(s) {
+    return s
+        .replace(/&/g, "&")
+        .replace(/</g, "&lt;")
+        .replace(/>/g, "&gt;")
+        .replace(/"/g, "&quot;")
+        .replace(/'/g, "&#039;");
+}
+const logger = createLogger("dashboard-api");
+export function registerOauthGoogleRoutes(app, deps) {
+    const { config, services, secretBroker } = deps;
+    const oauthStates = new Map();
+    // Dashboard-origin allowlist for OAuth start / callback.
+    //
+    // The OAuth callback HTML uses `window.opener.postMessage(..., target)`
+    // to notify the dashboard that auth succeeded. `target` was previously
+    // derived from the Origin/Referer headers at start time with a
+    // `http://localhost:3000` fallback when neither was present. Both
+    // headers are attacker-controlled in the request that *initiates* the
+    // flow (the attacker's page can be `http://attacker.com`), so the
+    // postMessage notification could be steered off the trusted dashboard.
+    //
+    // The notification body is just `{type: "google-auth-success"}` — no
+    // tokens — but the attacker would still learn the user completed auth,
+    // and a future widening of the payload would leak silently. Defence is
+    // a closed allowlist: only same-origin localhost variants on the
+    // configured dashboard port are accepted; anything else rejects the
+    // OAuth start with 403.
+    const dashboardPort = Number.parseInt(process.env.PA_DASHBOARD_PORT ?? "", 10) || 3000;
+    const allowedDashboardOrigins = new Set([
+        `http://localhost:${dashboardPort}`,
+        `http://127.0.0.1:${dashboardPort}`,
+        // IPv6 loopback — some dev environments (Docker desktop with IPv6
+        // preference, certain Node IPv6-first configurations) emit origins
+        // in this form. URL.origin returns the bracketed literal.
+        `http://[::1]:${dashboardPort}`,
+    ]);
+    function parseOriginSafely(value) {
+        if (!value)
+            return null;
+        try {
+            return new URL(value).origin;
+        }
+        catch {
+            return null;
+        }
+    }
+    /**
+     * Return the request's claimed dashboard origin only if it matches the
+     * hardcoded allowlist. Origin is preferred (browser-set, never spoofable
+     * from page JS); Referer is the fallback for browsers / configurations
+     * that don't emit Origin on top-level navigations. Returns `null` when
+     * neither header maps to an allowed origin — callers must reject the
+     * request in that case rather than silently defaulting.
+     */
+    function resolveAllowedDashboardOrigin(originHeader, refererHeader) {
+        const fromOrigin = parseOriginSafely(originHeader);
+        if (fromOrigin && allowedDashboardOrigins.has(fromOrigin))
+            return fromOrigin;
+        const fromReferer = parseOriginSafely(refererHeader);
+        if (fromReferer && allowedDashboardOrigins.has(fromReferer))
+            return fromReferer;
+        return null;
+    }
+    function pruneOauthStates(now = Date.now()) {
+        for (const [state, data] of oauthStates.entries()) {
+            if (now - data.createdAt > MAX_OAUTH_STATE_AGE_MS) {
+                oauthStates.delete(state);
+            }
+        }
+    }
+    /** POST /config/upload/google-credentials — upload Google Calendar credentials JSON */
+    app.post("/config/upload/google-credentials", async (c) => {
+        const body = await c.req.parseBody();
+        const file = body["file"];
+        if (!file || !(file instanceof File)) {
+            return c.json({ error: "No file uploaded. Send as multipart with field name 'file'" }, 400);
+        }
+        if (file.size > MAX_UPLOAD_SIZE) {
+            return c.json({ error: `File too large (max ${MAX_UPLOAD_SIZE / 1024} KB)` }, 400);
+        }
+        const content = await file.text();
+        let parsed;
+        try {
+            parsed = JSON.parse(content);
+        }
+        catch {
+            return c.json({ error: "Invalid JSON file" }, 400);
+        }
+        // Basic validation: must be OAuth2 (installed/web) or service account
+        const obj = parsed;
+        if (!obj.installed && !obj.web && obj.type !== "service_account") {
+            return c.json({ error: "Invalid credentials format. Expected OAuth2 credentials JSON (with 'installed' or 'web' key) or a service account JSON." }, 400);
+        }
+        await secretBroker.set("googleCredentialsJson", content);
+        if (parsed.type === "service_account") {
+            await secretBroker.delete("googleTokenJson");
+        }
+        await deps.onSecretChanged?.("google");
+        deps.onGoogleServicesReady?.();
+        return c.json({
+            status: "uploaded",
+            path: "keychain://google-credentials",
+            requiresRestart: false,
+            message: "Credentials saved.",
+        });
+    });
+    /** POST /config/upload/google-token — upload Google Calendar OAuth token JSON */
+    app.post("/config/upload/google-token", async (c) => {
+        const body = await c.req.parseBody();
+        const file = body["file"];
+        if (!file || !(file instanceof File)) {
+            return c.json({ error: "No file uploaded. Send as multipart with field name 'file'" }, 400);
+        }
+        if (file.size > MAX_UPLOAD_SIZE) {
+            return c.json({ error: `File too large (max ${MAX_UPLOAD_SIZE / 1024} KB)` }, 400);
+        }
+        const content = await file.text();
+        // Validate JSON
+        try {
+            JSON.parse(content);
+        }
+        catch {
+            return c.json({ error: "Invalid JSON file" }, 400);
+        }
+        await secretBroker.saveGoogleTokenJson(content);
+        await deps.onSecretChanged?.("google");
+        deps.onGoogleServicesReady?.();
+        return c.json({
+            status: "uploaded",
+            path: "keychain://google-token",
+            requiresRestart: false,
+            message: "Token saved.",
+        });
+    });
+    // ── Google OAuth2 Authorization Flow ──
+    // Allows users to authenticate with just credentials.json — the daemon
+    // handles the full OAuth2 flow and saves the token automatically.
+    /** POST /config/google-auth/start — begin OAuth2 authorization */
+    app.post("/config/google-auth/start", async (c) => {
+        const credRaw = await secretBroker.getGoogleCredentialsJson();
+        if (!credRaw) {
+            return c.json({ error: "Upload credentials.json first" }, 400);
+        }
+        let cred;
+        try {
+            cred = parseGoogleCredentialsJson(credRaw);
+        }
+        catch {
+            return c.json({ error: "Credentials JSON is invalid. Upload it again." }, 400);
+        }
+        // Service accounts don't need OAuth2 authorization
+        if (cred.type === "service_account") {
+            return c.json({ error: "Service account credentials don't require OAuth authorization. Restart the daemon to activate." }, 400);
+        }
+        const clientConfig = getGoogleOAuthClientConfig(cred);
+        if (!clientConfig) {
+            return c.json({ error: "Invalid credentials format" }, 400);
+        }
+        // eslint-disable-next-line @typescript-eslint/no-explicit-any
+        let google;
+        try {
+            const mod = await import("googleapis");
+            google = mod.google;
+        }
+        catch {
+            return c.json({ error: "googleapis package not installed" }, 500);
+        }
+        // Use daemon's own port for the OAuth callback
+        const redirectUri = `http://localhost:${config.apiPort}/api/config/google-auth/callback`;
+        const oauth2Client = new google.auth.OAuth2(clientConfig.client_id, clientConfig.client_secret, redirectUri);
+        // Request scopes for Calendar + Gmail
+        const scopes = [
+            "https://www.googleapis.com/auth/calendar",
+            "https://www.googleapis.com/auth/gmail.modify",
+            "https://www.googleapis.com/auth/gmail.send",
+        ];
+        pruneOauthStates();
+        const state = randomUUID();
+        // Capture the dashboard origin so the callback can postMessage to the
+        // correct window. Origin/Referer must match the closed allowlist or
+        // the flow is refused — defending the postMessage target from the
+        // class of attacks described next to `allowedDashboardOrigins`.
+        const dashboardOrigin = resolveAllowedDashboardOrigin(c.req.header("origin"), c.req.header("referer"));
+        if (!dashboardOrigin) {
+            return c.json({
+                error: "untrusted_origin",
+                message: "OAuth flows must be initiated from the configured dashboard origin",
+            }, 403);
+        }
+        oauthStates.set(state, { createdAt: Date.now(), dashboardOrigin });
+        const authUrl = oauth2Client.generateAuthUrl({
+            access_type: "offline",
+            scope: scopes,
+            prompt: "consent", // Force consent to always get a refresh_token
+            state,
+        });
+        return c.json({ authUrl, redirectUri, scopes });
+    });
+    /** GET /config/google-auth/callback — OAuth2 redirect handler */
+    app.get("/config/google-auth/callback", async (c) => {
+        const code = c.req.query("code");
+        const error = c.req.query("error");
+        const state = c.req.query("state");
+        if (error) {
+            return c.html(`<!DOCTYPE html><html><body style="font-family:system-ui;text-align:center;padding:60px">
+        <h2 style="color:#dc2626">Authorization Failed</h2>
+        <p>${escapeHtml(error)}</p>
+        <p style="color:#666;font-size:14px">You can close this window.</p>
+      </body></html>`);
+        }
+        pruneOauthStates();
+        const stateData = state ? oauthStates.get(state) : undefined;
+        if (!state || !stateData) {
+            return c.html(`<!DOCTYPE html><html><body style="font-family:system-ui;text-align:center;padding:60px">
+        <h2 style="color:#dc2626">Authorization Failed</h2>
+        <p>Invalid or expired OAuth state.</p>
+        <p style="color:#666;font-size:14px">Start the authorization flow again from the dashboard.</p>
+      </body></html>`);
+        }
+        const { dashboardOrigin } = stateData;
+        oauthStates.delete(state);
+        // Defence-in-depth: the start handler already gates Origin/Referer
+        // against `allowedDashboardOrigins`, so a stored value should always
+        // pass this check. Re-validate before injecting into the callback
+        // HTML so a future code change that drops the start-side gate
+        // doesn't silently regress the postMessage target.
+        if (!allowedDashboardOrigins.has(dashboardOrigin)) {
+            logger.warn({ dashboardOrigin }, "OAuth callback refused — stored dashboard origin not in allowlist");
+            return c.html(`<!DOCTYPE html><html><body style="font-family:system-ui;text-align:center;padding:60px">
+        <h2 style="color:#dc2626">Authorization Failed</h2>
+        <p>Untrusted dashboard origin.</p>
+      </body></html>`);
+        }
+        if (!code) {
+            return c.html(`<!DOCTYPE html><html><body style="font-family:system-ui;text-align:center;padding:60px">
+        <h2 style="color:#dc2626">Error</h2>
+        <p>No authorization code received.</p>
+      </body></html>`);
+        }
+        // Re-create OAuth2 client from stored credentials
+        const credRaw = await secretBroker.getGoogleCredentialsJson();
+        if (!credRaw) {
+            return c.html(`<!DOCTYPE html><html><body style="font-family:system-ui;text-align:center;padding:60px">
+        <h2 style="color:#dc2626">Error</h2>
+        <p>Credentials not configured.</p>
+      </body></html>`);
+        }
+        try {
+            const cred = parseGoogleCredentialsJson(credRaw);
+            const clientConfig = getGoogleOAuthClientConfig(cred);
+            if (!clientConfig)
+                throw new Error("Invalid credentials");
+            const mod = await import("googleapis");
+            const google = mod.google;
+            const redirectUri = `http://localhost:${config.apiPort}/api/config/google-auth/callback`;
+            const oauth2Client = new google.auth.OAuth2(clientConfig.client_id, clientConfig.client_secret, redirectUri);
+            // Exchange authorization code for tokens
+            const { tokens } = await oauth2Client.getToken(code);
+            await secretBroker.saveGoogleTokenJson(JSON.stringify(tokens));
+            await deps.onSecretChanged?.("google");
+            deps.onGoogleServicesReady?.();
+            const statusMsg = services.calendar || services.gmail
+                ? "Services activated."
+                : "Token saved.";
+            return c.html(`<!DOCTYPE html><html><body style="font-family:system-ui;text-align:center;padding:60px">
+        <h2 style="color:#059669">Authorization Successful</h2>
+        <p>${escapeHtml(statusMsg)}</p>
+        <p style="color:#666;font-size:14px">You can close this window.</p>
+        <script>
+          if (window.opener) {
+            window.opener.postMessage({ type: "google-auth-success" }, ${JSON.stringify(dashboardOrigin)});
+          }
+        </script>
+      </body></html>`);
+        }
+        catch (err) {
+            const msg = toSafeErrorMessage(err, "Unknown error");
+            return c.html(`<!DOCTYPE html><html><body style="font-family:system-ui;text-align:center;padding:60px">
+        <h2 style="color:#dc2626">Token Exchange Failed</h2>
+        <p>${escapeHtml(msg)}</p>
+        <p style="color:#666;font-size:14px">You can close this window and try again.</p>
+      </body></html>`);
+        }
+    });
+}
+//# sourceMappingURL=oauth-google.js.map

package/dist/api/routes/dashboard/oauth-google.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"oauth-google.js","sourceRoot":"","sources":["../../../../src/api/routes/dashboard/oauth-google.ts"],"names":[],"mappings":"AACA,OAAO,EAAE,UAAU,EAAE,MAAM,aAAa,CAAC;AAEzC,OAAO,EACL,0BAA0B,EAC1B,0BAA0B,GAC3B,MAAM,kCAAkC,CAAC;AAC1C,OAAO,EAAE,YAAY,EAAE,kBAAkB,EAAE,MAAM,qBAAqB,CAAC;AAEvE,MAAM,eAAe,GAAG,GAAG,GAAG,IAAI,CAAC,CAAC,sCAAsC;AAC1E,MAAM,sBAAsB,GAAG,EAAE,GAAG,EAAE,GAAG,IAAI,CAAC;AAE9C,oDAAoD;AACpD,SAAS,UAAU,CAAC,CAAS;IAC3B,OAAO,CAAC;SACL,OAAO,CAAC,IAAI,EAAE,OAAO,CAAC;SACtB,OAAO,CAAC,IAAI,EAAE,MAAM,CAAC;SACrB,OAAO,CAAC,IAAI,EAAE,MAAM,CAAC;SACrB,OAAO,CAAC,IAAI,EAAE,QAAQ,CAAC;SACvB,OAAO,CAAC,IAAI,EAAE,QAAQ,CAAC,CAAC;AAC7B,CAAC;AAED,MAAM,MAAM,GAAG,YAAY,CAAC,eAAe,CAAC,CAAC;AAE7C,MAAM,UAAU,yBAAyB,CAAC,GAAS,EAAE,IAAqB;IACxE,MAAM,EAAE,MAAM,EAAE,QAAQ,EAAE,YAAY,EAAE,GAAG,IAAI,CAAC;IAChD,MAAM,WAAW,GAAG,IAAI,GAAG,EAA0D,CAAC;IAEtF,yDAAyD;IACzD,EAAE;IACF,wEAAwE;IACxE,uEAAuE;IACvE,+DAA+D;IAC/D,kEAAkE;IAClE,sEAAsE;IACtE,kEAAkE;IAClE,uEAAuE;IACvE,EAAE;IACF,qEAAqE;IACrE,uEAAuE;IACvE,uEAAuE;IACvE,iEAAiE;IACjE,oEAAoE;IACpE,wBAAwB;IACxB,MAAM,aAAa,GACjB,MAAM,CAAC,QAAQ,CAAC,OAAO,CAAC,GAAG,CAAC,iBAAiB,IAAI,EAAE,EAAE,EAAE,CAAC,IAAI,IAAI,CAAC;IACnE,MAAM,uBAAuB,GAAwB,IAAI,GAAG,CAAC;QAC3D,oBAAoB,aAAa,EAAE;QACnC,oBAAoB,aAAa,EAAE;QACnC,kEAAkE;QAClE,mEAAmE;QACnE,0DAA0D;QAC1D,gBAAgB,aAAa,EAAE;KAChC,CAAC,CAAC;IAEH,SAAS,iBAAiB,CAAC,KAAyB;QAClD,IAAI,CAAC,KAAK;YAAE,OAAO,IAAI,CAAC;QACxB,IAAI,CAAC;YACH,OAAO,IAAI,GAAG,CAAC,KAAK,CAAC,CAAC,MAAM,CAAC;QAC/B,CAAC;QAAC,MAAM,CAAC;YACP,OAAO,IAAI,CAAC;QACd,CAAC;IACH,CAAC;IAED;;;;;;;OAOG;IACH,SAAS,6BAA6B,CACpC,YAAgC,EAChC,aAAiC;QAEjC,MAAM,UAAU,GAAG,iBAAiB,CAAC,YAAY,CAAC,CAAC;QACnD,IAAI,UAAU,IAAI,uBAAuB,CAAC,GAAG,CAAC,UAAU,CAAC;YAAE,OAAO,UAAU,CAAC;QAC7E,MAAM,WAAW,GAAG,iBAAiB,CAAC,aAAa,CAAC,CAAC;QACrD,IAAI,WAAW,IAAI,uBAAuB,CAAC,GAAG,CAAC,WAAW,CAAC;YAAE,OAAO,WAAW,CAAC;QAChF,OAAO,IAAI,CAAC;IACd,CAAC;IAED,SAAS,gBAAgB,CAAC,GAAG,GAAG,IAAI,CAAC,GAAG,EAAE;QACxC,KAAK,MAAM,CAAC,KAAK,EAAE,IAAI,CAAC,IAAI,WAAW,CAAC,OAAO,EAAE,EAAE,CAAC;YAClD,IAAI,GAAG,GAAG,IAAI,CAAC,SAAS,GAAG,sBAAsB,EAAE,CAAC;gBAClD,WAAW,CAAC,MAAM,CAAC,KAAK,CAAC,CAAC;YAC5B,CAAC;QACH,CAAC;IACH,CAAC;IAED,uFAAuF;IACvF,GAAG,CAAC,IAAI,CAAC,mCAAmC,EAAE,KAAK,EAAE,CAAC,EAAE,EAAE;QACxD,MAAM,IAAI,GAAG,MAAM,CAAC,CAAC,GAAG,CAAC,SAAS,EAAE,CAAC;QACrC,MAAM,IAAI,GAAG,IAAI,CAAC,MAAM,CAAC,CAAC;QAC1B,IAAI,CAAC,IAAI,IAAI,CAAC,CAAC,IAAI,YAAY,IAAI,CAAC,EAAE,CAAC;YACrC,OAAO,CAAC,CAAC,IAAI,CAAC,EAAE,KAAK,EAAE,4DAA4D,EAAE,EAAE,GAAG,CAAC,CAAC;QAC9F,CAAC;QACD,IAAI,IAAI,CAAC,IAAI,GAAG,eAAe,EAAE,CAAC;YAChC,OAAO,CAAC,CAAC,IAAI,CAAC,EAAE,KAAK,EAAE,uBAAuB,eAAe,GAAG,IAAI,MAAM,EAAE,EAAE,GAAG,CAAC,CAAC;QACrF,CAAC;QAED,MAAM,OAAO,GAAG,MAAM,IAAI,CAAC,IAAI,EAAE,CAAC;QAElC,IAAI,MAA+B,CAAC;QACpC,IAAI,CAAC;YACH,MAAM,GAAG,IAAI,CAAC,KAAK,CAAC,OAAO,CAA4B,CAAC;QAC1D,CAAC;QAAC,MAAM,CAAC;YACP,OAAO,CAAC,CAAC,IAAI,CAAC,EAAE,KAAK,EAAE,mBAAmB,EAAE,EAAE,GAAG,CAAC,CAAC;QACrD,CAAC;QAED,sEAAsE;QACtE,MAAM,GAAG,GAAG,MAAiC,CAAC;QAC9C,IAAI,CAAC,GAAG,CAAC,SAAS,IAAI,CAAC,GAAG,CAAC,GAAG,IAAI,GAAG,CAAC,IAAI,KAAK,iBAAiB,EAAE,CAAC;YACjE,OAAO,CAAC,CAAC,IAAI,CAAC,EAAE,KAAK,EAAE,yHAAyH,EAAE,EAAE,GAAG,CAAC,CAAC;QAC3J,CAAC;QAED,MAAM,YAAY,CAAC,GAAG,CAAC,uBAAuB,EAAE,OAAO,CAAC,CAAC;QACzD,IAAI,MAAM,CAAC,IAAI,KAAK,iBAAiB,EAAE,CAAC;YACtC,MAAM,YAAY,CAAC,MAAM,CAAC,iBAAiB,CAAC,CAAC;QAC/C,CAAC;QACD,MAAM,IAAI,CAAC,eAAe,EAAE,CAAC,QAAQ,CAAC,CAAC;QACvC,IAAI,CAAC,qBAAqB,EAAE,EAAE,CAAC;QAE/B,OAAO,CAAC,CAAC,IAAI,CAAC;YACZ,MAAM,EAAE,UAAU;YAClB,IAAI,EAAE,+BAA+B;YACrC,eAAe,EAAE,KAAK;YACtB,OAAO,EAAE,oBAAoB;SAC9B,CAAC,CAAC;IACL,CAAC,CAAC,CAAC;IAEH,iFAAiF;IACjF,GAAG,CAAC,IAAI,CAAC,6BAA6B,EAAE,KAAK,EAAE,CAAC,EAAE,EAAE;QAClD,MAAM,IAAI,GAAG,MAAM,CAAC,CAAC,GAAG,CAAC,SAAS,EAAE,CAAC;QACrC,MAAM,IAAI,GAAG,IAAI,CAAC,MAAM,CAAC,CAAC;QAC1B,IAAI,CAAC,IAAI,IAAI,CAAC,CAAC,IAAI,YAAY,IAAI,CAAC,EAAE,CAAC;YACrC,OAAO,CAAC,CAAC,IAAI,CAAC,EAAE,KAAK,EAAE,4DAA4D,EAAE,EAAE,GAAG,CAAC,CAAC;QAC9F,CAAC;QACD,IAAI,IAAI,CAAC,IAAI,GAAG,eAAe,EAAE,CAAC;YAChC,OAAO,CAAC,CAAC,IAAI,CAAC,EAAE,KAAK,EAAE,uBAAuB,eAAe,GAAG,IAAI,MAAM,EAAE,EAAE,GAAG,CAAC,CAAC;QACrF,CAAC;QAED,MAAM,OAAO,GAAG,MAAM,IAAI,CAAC,IAAI,EAAE,CAAC;QAElC,gBAAgB;QAChB,IAAI,CAAC;YACH,IAAI,CAAC,KAAK,CAAC,OAAO,CAAC,CAAC;QACtB,CAAC;QAAC,MAAM,CAAC;YACP,OAAO,CAAC,CAAC,IAAI,CAAC,EAAE,KAAK,EAAE,mBAAmB,EAAE,EAAE,GAAG,CAAC,CAAC;QACrD,CAAC;QAED,MAAM,YAAY,CAAC,mBAAmB,CAAC,OAAO,CAAC,CAAC;QAChD,MAAM,IAAI,CAAC,eAAe,EAAE,CAAC,QAAQ,CAAC,CAAC;QACvC,IAAI,CAAC,qBAAqB,EAAE,EAAE,CAAC;QAE/B,OAAO,CAAC,CAAC,IAAI,CAAC;YACZ,MAAM,EAAE,UAAU;YAClB,IAAI,EAAE,yBAAyB;YAC/B,eAAe,EAAE,KAAK;YACtB,OAAO,EAAE,cAAc;SACxB,CAAC,CAAC;IACL,CAAC,CAAC,CAAC;IAEH,yCAAyC;IACzC,uEAAuE;IACvE,kEAAkE;IAElE,kEAAkE;IAClE,GAAG,CAAC,IAAI,CAAC,2BAA2B,EAAE,KAAK,EAAE,CAAC,EAAE,EAAE;QAChD,MAAM,OAAO,GAAG,MAAM,YAAY,CAAC,wBAAwB,EAAE,CAAC;QAC9D,IAAI,CAAC,OAAO,EAAE,CAAC;YACb,OAAO,CAAC,CAAC,IAAI,CAAC,EAAE,KAAK,EAAE,+BAA+B,EAAE,EAAE,GAAG,CAAC,CAAC;QACjE,CAAC;QAED,IAAI,IAA6B,CAAC;QAClC,IAAI,CAAC;YACH,IAAI,GAAG,0BAA0B,CAAC,OAAO,CAAC,CAAC;QAC7C,CAAC;QAAC,MAAM,CAAC;YACP,OAAO,CAAC,CAAC,IAAI,CAAC,EAAE,KAAK,EAAE,+CAA+C,EAAE,EAAE,GAAG,CAAC,CAAC;QACjF,CAAC;QAED,mDAAmD;QACnD,IAAI,IAAI,CAAC,IAAI,KAAK,iBAAiB,EAAE,CAAC;YACpC,OAAO,CAAC,CAAC,IAAI,CAAC,EAAE,KAAK,EAAE,gGAAgG,EAAE,EAAE,GAAG,CAAC,CAAC;QAClI,CAAC;QAED,MAAM,YAAY,GAAG,0BAA0B,CAAC,IAAI,CAAC,CAAC;QACtD,IAAI,CAAC,YAAY,EAAE,CAAC;YAClB,OAAO,CAAC,CAAC,IAAI,CAAC,EAAE,KAAK,EAAE,4BAA4B,EAAE,EAAE,GAAG,CAAC,CAAC;QAC9D,CAAC;QAED,8DAA8D;QAC9D,IAAI,MAAW,CAAC;QAChB,IAAI,CAAC;YACH,MAAM,GAAG,GAAG,MAAM,MAAM,CAAC,YAAsB,CAAC,CAAC;YACjD,MAAM,GAAG,GAAG,CAAC,MAAM,CAAC;QACtB,CAAC;QAAC,MAAM,CAAC;YACP,OAAO,CAAC,CAAC,IAAI,CAAC,EAAE,KAAK,EAAE,kCAAkC,EAAE,EAAE,GAAG,CAAC,CAAC;QACpE,CAAC;QAED,+CAA+C;QAC/C,MAAM,WAAW,GAAG,oBAAoB,MAAM,CAAC,OAAO,kCAAkC,CAAC;QAEzF,MAAM,YAAY,GAAG,IAAI,MAAM,CAAC,IAAI,CAAC,MAAM,CACzC,YAAY,CAAC,SAAS,EACtB,YAAY,CAAC,aAAa,EAC1B,WAAW,CACZ,CAAC;QAEF,sCAAsC;QACtC,MAAM,MAAM,GAAG;YACb,0CAA0C;YAC1C,8CAA8C;YAC9C,4CAA4C;SAC7C,CAAC;QAEF,gBAAgB,EAAE,CAAC;QACnB,MAAM,KAAK,GAAG,UAAU,EAAE,CAAC;QAC3B,sEAAsE;QACtE,oEAAoE;QACpE,kEAAkE;QAClE,gEAAgE;QAChE,MAAM,eAAe,GAAG,6BAA6B,CACnD,CAAC,CAAC,GAAG,CAAC,MAAM,CAAC,QAAQ,CAAC,EACtB,CAAC,CAAC,GAAG,CAAC,MAAM,CAAC,SAAS,CAAC,CACxB,CAAC;QACF,IAAI,CAAC,eAAe,EAAE,CAAC;YACrB,OAAO,CAAC,CAAC,IAAI,CACX;gBACE,KAAK,EAAE,kBAAkB;gBACzB,OAAO,EACL,oEAAoE;aACvE,EACD,GAAG,CACJ,CAAC;QACJ,CAAC;QACD,WAAW,CAAC,GAAG,CAAC,KAAK,EAAE,EAAE,SAAS,EAAE,IAAI,CAAC,GAAG,EAAE,EAAE,eAAe,EAAE,CAAC,CAAC;QAEnE,MAAM,OAAO,GAAG,YAAY,CAAC,eAAe,CAAC;YAC3C,WAAW,EAAE,SAAS;YACtB,KAAK,EAAE,MAAM;YACb,MAAM,EAAE,SAAS,EAAE,8CAA8C;YACjE,KAAK;SACN,CAAC,CAAC;QAEH,OAAO,CAAC,CAAC,IAAI,CAAC,EAAE,OAAO,EAAE,WAAW,EAAE,MAAM,EAAE,CAAC,CAAC;IAClD,CAAC,CAAC,CAAC;IAEH,iEAAiE;IACjE,GAAG,CAAC,GAAG,CAAC,8BAA8B,EAAE,KAAK,EAAE,CAAC,EAAE,EAAE;QAClD,MAAM,IAAI,GAAG,CAAC,CAAC,GAAG,CAAC,KAAK,CAAC,MAAM,CAAC,CAAC;QACjC,MAAM,KAAK,GAAG,CAAC,CAAC,GAAG,CAAC,KAAK,CAAC,OAAO,CAAC,CAAC;QACnC,MAAM,KAAK,GAAG,CAAC,CAAC,GAAG,CAAC,KAAK,CAAC,OAAO,CAAC,CAAC;QAEnC,IAAI,KAAK,EAAE,CAAC;YACV,OAAO,CAAC,CAAC,IAAI,CAAC;;aAEP,UAAU,CAAC,KAAK,CAAC;;qBAET,CAAC,CAAC;QACnB,CAAC;QAED,gBAAgB,EAAE,CAAC;QACnB,MAAM,SAAS,GAAG,KAAK,CAAC,CAAC,CAAC,WAAW,CAAC,GAAG,CAAC,KAAK,CAAC,CAAC,CAAC,CAAC,SAAS,CAAC;QAC7D,IAAI,CAAC,KAAK,IAAI,CAAC,SAAS,EAAE,CAAC;YACzB,OAAO,CAAC,CAAC,IAAI,CAAC;;;;qBAIC,CAAC,CAAC;QACnB,CAAC;QACD,MAAM,EAAE,eAAe,EAAE,GAAG,SAAS,CAAC;QACtC,WAAW,CAAC,MAAM,CAAC,KAAK,CAAC,CAAC;QAE1B,mEAAmE;QACnE,qEAAqE;QACrE,kEAAkE;QAClE,8DAA8D;QAC9D,mDAAmD;QACnD,IAAI,CAAC,uBAAuB,CAAC,GAAG,CAAC,eAAe,CAAC,EAAE,CAAC;YAClD,MAAM,CAAC,IAAI,CACT,EAAE,eAAe,EAAE,EACnB,mEAAmE,CACpE,CAAC;YACF,OAAO,CAAC,CAAC,IAAI,CAAC;;;qBAGC,CAAC,CAAC;QACnB,CAAC;QAED,IAAI,CAAC,IAAI,EAAE,CAAC;YACV,OAAO,CAAC,CAAC,IAAI,CAAC;;;qBAGC,CAAC,CAAC;QACnB,CAAC;QAED,kDAAkD;QAClD,MAAM,OAAO,GAAG,MAAM,YAAY,CAAC,wBAAwB,EAAE,CAAC;QAC9D,IAAI,CAAC,OAAO,EAAE,CAAC;YACb,OAAO,CAAC,CAAC,IAAI,CAAC;;;qBAGC,CAAC,CAAC;QACnB,CAAC;QAED,IAAI,CAAC;YACH,MAAM,IAAI,GAAG,0BAA0B,CAAC,OAAO,CAAC,CAAC;YACjD,MAAM,YAAY,GAAG,0BAA0B,CAAC,IAAI,CAAC,CAAC;YACtD,IAAI,CAAC,YAAY;gBAAE,MAAM,IAAI,KAAK,CAAC,qBAAqB,CAAC,CAAC;YAE1D,MAAM,GAAG,GAAG,MAAM,MAAM,CAAC,YAAsB,CAAC,CAAC;YACjD,MAAM,MAAM,GAAG,GAAG,CAAC,MAAM,CAAC;YAE1B,MAAM,WAAW,GAAG,oBAAoB,MAAM,CAAC,OAAO,kCAAkC,CAAC;YACzF,MAAM,YAAY,GAAG,IAAI,MAAM,CAAC,IAAI,CAAC,MAAM,CACzC,YAAY,CAAC,SAAS,EACtB,YAAY,CAAC,aAAa,EAC1B,WAAW,CACZ,CAAC;YAEF,yCAAyC;YACzC,MAAM,EAAE,MAAM,EAAE,GAAG,MAAM,YAAY,CAAC,QAAQ,CAAC,IAAI,CAAC,CAAC;YACrD,MAAM,YAAY,CAAC,mBAAmB,CAAC,IAAI,CAAC,SAAS,CAAC,MAAM,CAAC,CAAC,CAAC;YAC/D,MAAM,IAAI,CAAC,eAAe,EAAE,CAAC,QAAQ,CAAC,CAAC;YACvC,IAAI,CAAC,qBAAqB,EAAE,EAAE,CAAC;YAE/B,MAAM,SAAS,GACb,QAAQ,CAAC,QAAQ,IAAI,QAAQ,CAAC,KAAK;gBACjC,CAAC,CAAC,qBAAqB;gBACvB,CAAC,CAAC,cAAc,CAAC;YAErB,OAAO,CAAC,CAAC,IAAI,CAAC;;aAEP,UAAU,CAAC,SAAS,CAAC;;;;yEAIuC,IAAI,CAAC,SAAS,CAAC,eAAe,CAAC;;;qBAGnF,CAAC,CAAC;QACnB,CAAC;QAAC,OAAO,GAAG,EAAE,CAAC;YACb,MAAM,GAAG,GAAG,kBAAkB,CAAC,GAAG,EAAE,eAAe,CAAC,CAAC;YACrD,OAAO,CAAC,CAAC,IAAI,CAAC;;aAEP,UAAU,CAAC,GAAG,CAAC;;qBAEP,CAAC,CAAC;QACnB,CAAC;IACH,CAAC,CAAC,CAAC;AACL,CAAC"}

package/dist/api/routes/dashboard/schedule-readonly.d.ts

@@ -0,0 +1,4 @@
+import type { Hono } from "hono";
+import type { ApiDependencies } from "../../server.js";
+export declare function registerScheduleReadonlyRoutes(app: Hono, deps: ApiDependencies): void;
+//# sourceMappingURL=schedule-readonly.d.ts.map

package/dist/api/routes/dashboard/schedule-readonly.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"schedule-readonly.d.ts","sourceRoot":"","sources":["../../../../src/api/routes/dashboard/schedule-readonly.ts"],"names":[],"mappings":"AAAA,OAAO,KAAK,EAAE,IAAI,EAAE,MAAM,MAAM,CAAC;AACjC,OAAO,KAAK,EAAE,eAAe,EAAE,MAAM,iBAAiB,CAAC;AAEvD,wBAAgB,8BAA8B,CAAC,GAAG,EAAE,IAAI,EAAE,IAAI,EAAE,eAAe,GAAG,IAAI,CAiDrF"}

package/dist/api/routes/dashboard/schedule-readonly.js

@@ -0,0 +1,46 @@
+export function registerScheduleReadonlyRoutes(app, deps) {
+    const { db } = deps;
+    // ── Schedule API ──
+    /** GET /schedule/next — next pending scheduled task */
+    app.get("/schedule/next", (c) => {
+        const row = db
+            .prepare(`SELECT id, scheduled_for, task_type, task_description
+         FROM agent_schedule
+         WHERE status = 'pending' AND scheduled_for > datetime('now')
+         ORDER BY scheduled_for ASC LIMIT 1`)
+            .get();
+        return c.json({ next: row ?? null });
+    });
+    /** GET /schedule/list — all scheduled tasks (paginated) */
+    app.get("/schedule/list", (c) => {
+        const page = Math.max(1, Number(c.req.query("page") ?? "1"));
+        const limit = Math.min(Number(c.req.query("limit") ?? "20"), 50);
+        const status = c.req.query("status");
+        const type = c.req.query("type");
+        const offset = (page - 1) * limit;
+        let where = "1=1";
+        const params = [];
+        if (status) {
+            where += " AND status = ?";
+            params.push(status);
+        }
+        if (type) {
+            where += " AND task_type = ?";
+            params.push(type);
+        }
+        const total = db
+            .prepare(`SELECT COUNT(*) as count FROM agent_schedule WHERE ${where}`)
+            .get(...params).count;
+        params.push(limit, offset);
+        const schedules = db
+            .prepare(`SELECT id, scheduled_for, task_type, task_description, task_prompt, model, status, task_context, created_at
+         FROM agent_schedule WHERE ${where}
+         ORDER BY scheduled_for DESC LIMIT ? OFFSET ?`)
+            .all(...params);
+        return c.json({
+            schedules,
+            pagination: { page, limit, total, totalPages: Math.ceil(total / limit) },
+        });
+    });
+}
+//# sourceMappingURL=schedule-readonly.js.map

package/dist/api/routes/dashboard/schedule-readonly.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"schedule-readonly.js","sourceRoot":"","sources":["../../../../src/api/routes/dashboard/schedule-readonly.ts"],"names":[],"mappings":"AAGA,MAAM,UAAU,8BAA8B,CAAC,GAAS,EAAE,IAAqB;IAC7E,MAAM,EAAE,EAAE,EAAE,GAAG,IAAI,CAAC;IAEpB,qBAAqB;IAErB,uDAAuD;IACvD,GAAG,CAAC,GAAG,CAAC,gBAAgB,EAAE,CAAC,CAAC,EAAE,EAAE;QAC9B,MAAM,GAAG,GAAG,EAAE;aACX,OAAO,CACN;;;4CAGoC,CACrC;aACA,GAAG,EAAoG,CAAC;QAC3G,OAAO,CAAC,CAAC,IAAI,CAAC,EAAE,IAAI,EAAE,GAAG,IAAI,IAAI,EAAE,CAAC,CAAC;IACvC,CAAC,CAAC,CAAC;IAEH,2DAA2D;IAC3D,GAAG,CAAC,GAAG,CAAC,gBAAgB,EAAE,CAAC,CAAC,EAAE,EAAE;QAC9B,MAAM,IAAI,GAAG,IAAI,CAAC,GAAG,CAAC,CAAC,EAAE,MAAM,CAAC,CAAC,CAAC,GAAG,CAAC,KAAK,CAAC,MAAM,CAAC,IAAI,GAAG,CAAC,CAAC,CAAC;QAC7D,MAAM,KAAK,GAAG,IAAI,CAAC,GAAG,CAAC,MAAM,CAAC,CAAC,CAAC,GAAG,CAAC,KAAK,CAAC,OAAO,CAAC,IAAI,IAAI,CAAC,EAAE,EAAE,CAAC,CAAC;QACjE,MAAM,MAAM,GAAG,CAAC,CAAC,GAAG,CAAC,KAAK,CAAC,QAAQ,CAAC,CAAC;QACrC,MAAM,IAAI,GAAG,CAAC,CAAC,GAAG,CAAC,KAAK,CAAC,MAAM,CAAC,CAAC;QACjC,MAAM,MAAM,GAAG,CAAC,IAAI,GAAG,CAAC,CAAC,GAAG,KAAK,CAAC;QAElC,IAAI,KAAK,GAAG,KAAK,CAAC;QAClB,MAAM,MAAM,GAAc,EAAE,CAAC;QAC7B,IAAI,MAAM,EAAE,CAAC;YAAC,KAAK,IAAI,iBAAiB,CAAC;YAAC,MAAM,CAAC,IAAI,CAAC,MAAM,CAAC,CAAC;QAAC,CAAC;QAChE,IAAI,IAAI,EAAE,CAAC;YAAC,KAAK,IAAI,oBAAoB,CAAC;YAAC,MAAM,CAAC,IAAI,CAAC,IAAI,CAAC,CAAC;QAAC,CAAC;QAE/D,MAAM,KAAK,GAAI,EAAE;aACd,OAAO,CAAC,sDAAsD,KAAK,EAAE,CAAC;aACtE,GAAG,CAAC,GAAG,MAAM,CAAuB,CAAC,KAAK,CAAC;QAE9C,MAAM,CAAC,IAAI,CAAC,KAAK,EAAE,MAAM,CAAC,CAAC;QAC3B,MAAM,SAAS,GAAG,EAAE;aACjB,OAAO,CACN;qCAC6B,KAAK;sDACY,CAC/C;aACA,GAAG,CAAC,GAAG,MAAM,CAAC,CAAC;QAElB,OAAO,CAAC,CAAC,IAAI,CAAC;YACZ,SAAS;YACT,UAAU,EAAE,EAAE,IAAI,EAAE,KAAK,EAAE,KAAK,EAAE,UAAU,EAAE,IAAI,CAAC,IAAI,CAAC,KAAK,GAAG,KAAK,CAAC,EAAE;SACzE,CAAC,CAAC;IACL,CAAC,CAAC,CAAC;AACL,CAAC"}

package/dist/api/routes/dashboard/secrets.d.ts

@@ -0,0 +1,24 @@
+import type { Hono } from "hono";
+import type { ApiDependencies } from "../../server.js";
+export interface SecretConfigSummary {
+    slackConfigured: boolean;
+    telegramConfigured: boolean;
+    discordConfigured: boolean;
+    notionConfigured: boolean;
+    githubConfigured: boolean;
+    githubWebhookSecretConfigured: boolean;
+    apiTokenConfigured: boolean;
+    googleCalendarCredentialsConfigured: boolean;
+    googleCalendarTokenConfigured: boolean;
+    googleCredentialType: "oauth2" | "service_account" | null;
+    /**
+     * SETUP-FLOW-REDESIGN-PLAN §6.1 — true when the BYOA Outlook client
+     * config blob (`mail:outlook:client-config`) is present in the
+     * EncryptedBlobStore. Drives the dashboard's
+     * `directCredentialsPresent("outlook_*", config)` lookup.
+     */
+    outlookClientConfigConfigured: boolean;
+}
+export declare function getSecretConfigSummary(deps: ApiDependencies): Promise<SecretConfigSummary>;
+export declare function registerSecretsRoutes(app: Hono, deps: ApiDependencies): void;
+//# sourceMappingURL=secrets.d.ts.map

package/dist/api/routes/dashboard/secrets.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"secrets.d.ts","sourceRoot":"","sources":["../../../../src/api/routes/dashboard/secrets.ts"],"names":[],"mappings":"AAAA,OAAO,KAAK,EAAE,IAAI,EAAE,MAAM,MAAM,CAAC;AACjC,OAAO,KAAK,EAAE,eAAe,EAAE,MAAM,iBAAiB,CAAC;AAIvD,MAAM,WAAW,mBAAmB;IAClC,eAAe,EAAE,OAAO,CAAC;IACzB,kBAAkB,EAAE,OAAO,CAAC;IAC5B,iBAAiB,EAAE,OAAO,CAAC;IAC3B,gBAAgB,EAAE,OAAO,CAAC;IAC1B,gBAAgB,EAAE,OAAO,CAAC;IAC1B,6BAA6B,EAAE,OAAO,CAAC;IACvC,kBAAkB,EAAE,OAAO,CAAC;IAC5B,mCAAmC,EAAE,OAAO,CAAC;IAC7C,6BAA6B,EAAE,OAAO,CAAC;IACvC,oBAAoB,EAAE,QAAQ,GAAG,iBAAiB,GAAG,IAAI,CAAC;IAC1D;;;;;OAKG;IACH,6BAA6B,EAAE,OAAO,CAAC;CACxC;AAED,wBAAsB,sBAAsB,CAC1C,IAAI,EAAE,eAAe,GACpB,OAAO,CAAC,mBAAmB,CAAC,CAoD9B;AAED,wBAAgB,qBAAqB,CAAC,GAAG,EAAE,IAAI,EAAE,IAAI,EAAE,eAAe,GAAG,IAAI,CA+Q5E"}