@alfe.ai/openclaw-google-chat 0.0.28 → 0.0.30

package/README.md

@@ -0,0 +1,27 @@
+# `@alfe.ai/openclaw-google-chat`
+
+OpenClaw service plugin that polls direct-message spaces for the connected
+Google account, dispatches inbound messages through OpenClaw, and sends the
+agent's replies back through the Google Chat API.
+
+The poller uses adaptive per-space intervals plus a discovery loop. Google API
+calls have deadlines, response and pagination limits, runtime shape checks, and
+shared rate-limit backoff. An inbound message is checkpointed only after the
+dispatch pipeline accepts it; failures remain behind the timestamp cursor for
+retry in order.
+
+Poll state is stored atomically at `~/.alfe/state/google-chat-poller.json` with
+owner-only permissions. OAuth credentials remain in memory and are never
+written into this state file.
+
+## Development
+
+```bash
+pnpm --filter @alfe.ai/openclaw-google-chat test
+pnpm --filter @alfe.ai/openclaw-google-chat lint
+pnpm --filter @alfe.ai/openclaw-google-chat typecheck
+pnpm --filter @alfe.ai/openclaw-google-chat build
+```
+
+See [DEVELOPING.md](./DEVELOPING.md) and the repository root
+`DEVELOPING.md` before changing lifecycle, delivery, or provider behavior.

package/dist/gchat-token.cjs

@@ -1,6 +1,16 @@
 //#region src/gchat-token.ts
 const GOOGLE_TOKEN_URL = "https://oauth2.googleapis.com/token";
 const REFRESH_MARGIN_MS = 300 * 1e3;
+const TOKEN_REQUEST_TIMEOUT_MS = 2e4;
+const MAX_TOKEN_RESPONSE_BYTES = 65536;
+var GoogleTokenError = class extends Error {
+	constructor(message, status, code) {
+		super(message);
+		this.status = status;
+		this.code = code;
+		this.name = "GoogleTokenError";
+	}
+};
 var TokenManager = class {
 	refreshToken;
 	clientId;
@@ -9,6 +19,7 @@ var TokenManager = class {
 	cached = null;
 	refreshPromise = null;
 	constructor(init, log) {
+		if (!init.refreshToken.trim() || !init.clientId.trim() || !init.clientSecret.trim()) throw new Error("Google OAuth credentials must be non-empty");
 		this.refreshToken = init.refreshToken;
 		this.clientId = init.clientId;
 		this.clientSecret = init.clientSecret;
@@ -34,6 +45,7 @@ var TokenManager = class {
 		const response = await fetch(GOOGLE_TOKEN_URL, {
 			method: "POST",
 			headers: { "Content-Type": "application/x-www-form-urlencoded" },
+			signal: AbortSignal.timeout(TOKEN_REQUEST_TIMEOUT_MS),
 			body: new URLSearchParams({
 				client_id: this.clientId,
 				client_secret: this.clientSecret,
@@ -41,19 +53,57 @@ var TokenManager = class {
 				grant_type: "refresh_token"
 			})
 		});
+		const responseBody = await readTokenResponse(response);
 		if (!response.ok) {
-			const body = await response.text().catch(() => "");
-			this.log.error(`Token refresh failed (${String(response.status)}): ${body}`);
-			throw new Error(`Google token refresh failed: ${String(response.status)}`);
+			const oauthCode = readOAuthErrorCode(responseBody);
+			this.log.error(`Token refresh failed (${String(response.status)}${oauthCode ? `, ${oauthCode}` : ""})`);
+			throw new GoogleTokenError(`Google token refresh failed: ${String(response.status)}${oauthCode ? ` (${oauthCode})` : ""}`, response.status, oauthCode);
 		}
-		const data = await response.json();
+		if (!isTokenResponse(responseBody)) throw new GoogleTokenError("Google token refresh returned an invalid response");
 		this.cached = {
-			accessToken: data.access_token,
-			expiresAt: Date.now() + data.expires_in * 1e3
+			accessToken: responseBody.access_token,
+			expiresAt: Date.now() + responseBody.expires_in * 1e3
 		};
 		this.log.debug("Google access token refreshed");
 		return this.cached.accessToken;
 	}
 };
+function isTokenResponse(value) {
+	return typeof value === "object" && value !== null && "access_token" in value && typeof value.access_token === "string" && value.access_token.length > 0 && "expires_in" in value && typeof value.expires_in === "number" && Number.isFinite(value.expires_in) && value.expires_in > 0;
+}
+async function readTokenResponse(response) {
+	const declaredLength = response.headers.get("content-length");
+	if (declaredLength) {
+		const length = Number(declaredLength);
+		if (!Number.isFinite(length) || length < 0 || length > MAX_TOKEN_RESPONSE_BYTES) {
+			await response.body?.cancel().catch(() => void 0);
+			throw new GoogleTokenError("Google token response exceeded the size limit", response.status);
+		}
+	}
+	if (!response.body) return void 0;
+	const reader = response.body.getReader();
+	const decoder = new TextDecoder();
+	let total = 0;
+	let raw = "";
+	let chunk = await reader.read();
+	while (!chunk.done) {
+		total += chunk.value.byteLength;
+		if (total > MAX_TOKEN_RESPONSE_BYTES) {
+			await reader.cancel().catch(() => void 0);
+			throw new GoogleTokenError("Google token response exceeded the size limit", response.status);
+		}
+		raw += decoder.decode(chunk.value, { stream: true });
+		chunk = await reader.read();
+	}
+	raw += decoder.decode();
+	try {
+		return JSON.parse(raw);
+	} catch {
+		return;
+	}
+}
+function readOAuthErrorCode(data) {
+	if (typeof data === "object" && data !== null && "error" in data && typeof data.error === "string" && /^[a-z0-9_]{1,64}$/i.test(data.error)) return data.error;
+}
 //#endregion
 exports.TokenManager = TokenManager;

package/dist/gchat-token.js

@@ -1,6 +1,16 @@
 //#region src/gchat-token.ts
 const GOOGLE_TOKEN_URL = "https://oauth2.googleapis.com/token";
 const REFRESH_MARGIN_MS = 300 * 1e3;
+const TOKEN_REQUEST_TIMEOUT_MS = 2e4;
+const MAX_TOKEN_RESPONSE_BYTES = 65536;
+var GoogleTokenError = class extends Error {
+	constructor(message, status, code) {
+		super(message);
+		this.status = status;
+		this.code = code;
+		this.name = "GoogleTokenError";
+	}
+};
 var TokenManager = class {
 	refreshToken;
 	clientId;
@@ -9,6 +19,7 @@ var TokenManager = class {
 	cached = null;
 	refreshPromise = null;
 	constructor(init, log) {
+		if (!init.refreshToken.trim() || !init.clientId.trim() || !init.clientSecret.trim()) throw new Error("Google OAuth credentials must be non-empty");
 		this.refreshToken = init.refreshToken;
 		this.clientId = init.clientId;
 		this.clientSecret = init.clientSecret;
@@ -34,6 +45,7 @@ var TokenManager = class {
 		const response = await fetch(GOOGLE_TOKEN_URL, {
 			method: "POST",
 			headers: { "Content-Type": "application/x-www-form-urlencoded" },
+			signal: AbortSignal.timeout(TOKEN_REQUEST_TIMEOUT_MS),
 			body: new URLSearchParams({
 				client_id: this.clientId,
 				client_secret: this.clientSecret,
@@ -41,19 +53,57 @@ var TokenManager = class {
 				grant_type: "refresh_token"
 			})
 		});
+		const responseBody = await readTokenResponse(response);
 		if (!response.ok) {
-			const body = await response.text().catch(() => "");
-			this.log.error(`Token refresh failed (${String(response.status)}): ${body}`);
-			throw new Error(`Google token refresh failed: ${String(response.status)}`);
+			const oauthCode = readOAuthErrorCode(responseBody);
+			this.log.error(`Token refresh failed (${String(response.status)}${oauthCode ? `, ${oauthCode}` : ""})`);
+			throw new GoogleTokenError(`Google token refresh failed: ${String(response.status)}${oauthCode ? ` (${oauthCode})` : ""}`, response.status, oauthCode);
 		}
-		const data = await response.json();
+		if (!isTokenResponse(responseBody)) throw new GoogleTokenError("Google token refresh returned an invalid response");
 		this.cached = {
-			accessToken: data.access_token,
-			expiresAt: Date.now() + data.expires_in * 1e3
+			accessToken: responseBody.access_token,
+			expiresAt: Date.now() + responseBody.expires_in * 1e3
 		};
 		this.log.debug("Google access token refreshed");
 		return this.cached.accessToken;
 	}
 };
+function isTokenResponse(value) {
+	return typeof value === "object" && value !== null && "access_token" in value && typeof value.access_token === "string" && value.access_token.length > 0 && "expires_in" in value && typeof value.expires_in === "number" && Number.isFinite(value.expires_in) && value.expires_in > 0;
+}
+async function readTokenResponse(response) {
+	const declaredLength = response.headers.get("content-length");
+	if (declaredLength) {
+		const length = Number(declaredLength);
+		if (!Number.isFinite(length) || length < 0 || length > MAX_TOKEN_RESPONSE_BYTES) {
+			await response.body?.cancel().catch(() => void 0);
+			throw new GoogleTokenError("Google token response exceeded the size limit", response.status);
+		}
+	}
+	if (!response.body) return void 0;
+	const reader = response.body.getReader();
+	const decoder = new TextDecoder();
+	let total = 0;
+	let raw = "";
+	let chunk = await reader.read();
+	while (!chunk.done) {
+		total += chunk.value.byteLength;
+		if (total > MAX_TOKEN_RESPONSE_BYTES) {
+			await reader.cancel().catch(() => void 0);
+			throw new GoogleTokenError("Google token response exceeded the size limit", response.status);
+		}
+		raw += decoder.decode(chunk.value, { stream: true });
+		chunk = await reader.read();
+	}
+	raw += decoder.decode();
+	try {
+		return JSON.parse(raw);
+	} catch {
+		return;
+	}
+}
+function readOAuthErrorCode(data) {
+	if (typeof data === "object" && data !== null && "error" in data && typeof data.error === "string" && /^[a-z0-9_]{1,64}$/i.test(data.error)) return data.error;
+}
 //#endregion
 export { TokenManager };

package/dist/plugin.d.cts

@@ -50,7 +50,7 @@ declare const plugin: {
   description: string;
   version: string;
   activate(api: PluginApi): void;
-  deactivate(api: PluginApi): void;
+  deactivate(api: PluginApi): Promise<void>;
 };
 //#endregion
 export { plugin as default };

package/dist/plugin.d.ts

@@ -50,7 +50,7 @@ declare const plugin: {
   description: string;
   version: string;
   activate(api: PluginApi): void;
-  deactivate(api: PluginApi): void;
+  deactivate(api: PluginApi): Promise<void>;
 };
 //#endregion
 export { plugin as default };