@bivy/bivy 0.0.0 → 0.1.0-staging.2

package/dist/integrations/manager.js

@@ -0,0 +1,279 @@
+// SPDX-License-Identifier: FSL-1.1-ALv2
+// Copyright (c) 2026 Petter André Sjulstad
+import { randomUUID } from "node:crypto";
+import { IntegrationStore } from "./store.js";
+import { BUILT_IN_INTEGRATIONS } from "./registry.js";
+import { buildAuthorizeUrl, createPkce, exchangeCode, refreshToken, } from "./oauth.js";
+import { SecretVault } from "../secrets.js";
+/**
+ * Owns integration connections and exposes them to any agent as tools.
+ *
+ * - REST handlers in server.ts call `list / connectApiKey / startOAuth /
+ *   completeOAuth / disconnect`.
+ * - `toolProvider()` exposes the connected integrations' tools as a
+ *   runtime-agnostic ToolProvider handed to each session; the tools execute here
+ *   on the daemon (where credentials live) for in-process AND remote agents alike.
+ */
+export class IntegrationManager {
+    store;
+    registry;
+    secrets;
+    pending = new Map();
+    /** Names of tools flagged risky (approval-gated), regardless of connection. */
+    riskyTools;
+    constructor(appDir, registry = BUILT_IN_INTEGRATIONS) {
+        this.store = new IntegrationStore(appDir);
+        this.secrets = new SecretVault(appDir);
+        this.registry = registry;
+        this.riskyTools = new Set(registry.flatMap((d) => d.tools.filter((t) => t.risky).map((t) => t.name)));
+    }
+    // --- helpers ------------------------------------------------------------
+    def(id) {
+        return this.registry.find((d) => d.id === id);
+    }
+    oauthClient(spec) {
+        const clientId = process.env[spec.clientIdEnv];
+        const clientSecret = process.env[spec.clientSecretEnv];
+        if (!clientId)
+            return undefined;
+        return { clientId, clientSecret: clientSecret ?? "" };
+    }
+    /** Whether the operator has supplied the credentials needed to connect this integration. */
+    isConfigured(def) {
+        if (def.auth.kind === "oauth2")
+            return Boolean(this.oauthClient(def.auth));
+        return true; // apiKey / none are always "configurable" by the user
+    }
+    isRiskyTool(toolName) {
+        return this.riskyTools.has(toolName);
+    }
+    // --- public views -------------------------------------------------------
+    list() {
+        return this.registry.map((def) => {
+            const conn = this.store.get(def.id);
+            const status = conn ? conn.status : "disconnected";
+            return {
+                id: def.id,
+                name: def.name,
+                description: def.description,
+                icon: def.icon,
+                docsUrl: def.docsUrl,
+                authKind: def.auth.kind,
+                apiKeyLabel: def.auth.kind === "apiKey" ? def.auth.label : undefined,
+                apiKeyHelp: def.auth.kind === "apiKey" ? def.auth.help : undefined,
+                configured: this.isConfigured(def),
+                status,
+                accountLabel: conn?.accountLabel,
+                toolNames: def.tools.map((t) => t.name),
+            };
+        });
+    }
+    // --- connect / disconnect ----------------------------------------------
+    async connectApiKey(id, key) {
+        const def = this.def(id);
+        if (!def)
+            throw new Error(`Unknown integration: ${id}`);
+        if (def.auth.kind !== "apiKey")
+            throw new Error(`${id} does not use an API key`);
+        if (!key.trim())
+            throw new Error("API key is required");
+        const secretId = `integration.${id}.api-key`;
+        this.secrets.setLocal(secretId, key.trim(), `${def.name} API key`);
+        const conn = { id, status: "connected", apiKeyRef: `secret://${secretId}`, connectedAt: Date.now() };
+        this.store.set(conn);
+        return conn;
+    }
+    /** Begin an OAuth2 flow; returns the URL the user should open. */
+    startOAuth(id, redirectUri) {
+        const def = this.def(id);
+        if (!def || def.auth.kind !== "oauth2")
+            throw new Error(`${id} is not an OAuth integration`);
+        const client = this.oauthClient(def.auth);
+        if (!client) {
+            throw new Error(`Set ${def.auth.clientIdEnv} (and ${def.auth.clientSecretEnv}) to connect ${def.name}`);
+        }
+        const state = randomUUID();
+        const pkce = def.auth.pkce ? createPkce() : undefined;
+        this.pending.set(state, { id: state, integrationId: id, redirectUri, verifier: pkce?.verifier, createdAt: Date.now() });
+        const authUrl = buildAuthorizeUrl(def.auth, {
+            clientId: client.clientId,
+            redirectUri,
+            state,
+            codeChallenge: pkce?.challenge,
+        });
+        return { authUrl, state };
+    }
+    /** Complete an OAuth2 flow from the redirect callback. */
+    async completeOAuth(state, code) {
+        const pending = this.pending.get(state);
+        if (!pending)
+            throw new Error("Unknown or expired OAuth state");
+        this.pending.delete(state);
+        const def = this.def(pending.integrationId);
+        if (!def || def.auth.kind !== "oauth2")
+            throw new Error("Integration is no longer available");
+        const client = this.oauthClient(def.auth);
+        if (!client)
+            throw new Error("OAuth client credentials are no longer configured");
+        const token = await exchangeCode(def.auth, client, {
+            code,
+            redirectUri: pending.redirectUri,
+            codeVerifier: pending.verifier,
+        });
+        const secretId = `integration.${def.id}.oauth`;
+        this.secrets.setLocal(secretId, JSON.stringify(token), `${def.name} OAuth token set`);
+        const conn = {
+            id: def.id,
+            status: "connected",
+            oauthRef: `secret://${secretId}`,
+            connectedAt: Date.now(),
+        };
+        this.store.set(conn);
+        // Best-effort: label the connection with the account email/workspace.
+        if (def.auth.accountLabel) {
+            try {
+                const label = await def.auth.accountLabel(this.httpFor(def, conn));
+                if (label) {
+                    conn.accountLabel = label;
+                    this.store.set(conn);
+                }
+            }
+            catch {
+                // ignore labeling failures
+            }
+        }
+        return conn;
+    }
+    disconnect(id) {
+        this.secrets.delete(`integration.${id}.api-key`);
+        this.secrets.delete(`integration.${id}.oauth`);
+        return this.store.remove(id);
+    }
+    // --- auth'd HTTP --------------------------------------------------------
+    /** Build a fetch helper bound to a connection: auth header + baseUrl + refresh. */
+    httpFor(def, conn) {
+        const resolve = (input) => /^https?:\/\//i.test(input) ? input : `${(def.baseUrl ?? "").replace(/\/$/, "")}${input.startsWith("/") ? "" : "/"}${input}`;
+        const oauthToken = async () => {
+            if (conn.oauthRef) {
+                const raw = await this.secrets.resolve(conn.oauthRef);
+                return raw ? JSON.parse(raw) : undefined;
+            }
+            return conn.oauth;
+        };
+        const authHeaders = async () => {
+            if (def.auth.kind === "apiKey") {
+                const key = conn.apiKeyRef ? await this.secrets.resolve(conn.apiKeyRef) : conn.apiKey;
+                if (key)
+                    return def.auth.header ? def.auth.header(key) : { authorization: `Bearer ${key}` };
+            }
+            const token = await oauthToken();
+            if (token?.accessToken) {
+                return { authorization: `${token.tokenType || "Bearer"} ${token.accessToken}` };
+            }
+            return {};
+        };
+        const ensureFreshToken = async () => {
+            if (def.auth.kind !== "oauth2")
+                return;
+            const token = await oauthToken();
+            if (!token)
+                return;
+            const expiringSoon = token.expiresAt !== undefined && token.expiresAt - Date.now() < 60_000;
+            if (!expiringSoon || !token.refreshToken)
+                return;
+            const client = this.oauthClient(def.auth);
+            if (!client)
+                return;
+            await this.applyRefresh(def, conn, client, token.refreshToken);
+        };
+        const send = async (input, init = {}, didRefresh = false) => {
+            await ensureFreshToken();
+            const res = await fetch(resolve(input), {
+                ...init,
+                headers: { ...(await authHeaders()), ...init.headers },
+            });
+            // Reactive refresh: token rejected unexpectedly -> refresh once and retry.
+            const token = await oauthToken();
+            if (res.status === 401 && !didRefresh && def.auth.kind === "oauth2" && token?.refreshToken) {
+                const client = this.oauthClient(def.auth);
+                if (client) {
+                    await this.applyRefresh(def, conn, client, token.refreshToken);
+                    return send(input, init, true);
+                }
+            }
+            return res;
+        };
+        const http = ((input, init) => send(input, init ?? {}));
+        http.json = async (input, init) => {
+            const res = await send(input, init ?? {});
+            const body = await res.text();
+            if (!res.ok)
+                throw new Error(`${def.name} request failed (${res.status}): ${body.slice(0, 300)}`);
+            return (body ? JSON.parse(body) : undefined);
+        };
+        return http;
+    }
+    async applyRefresh(def, conn, client, refresh) {
+        if (def.auth.kind !== "oauth2")
+            return;
+        let next;
+        try {
+            next = await refreshToken(def.auth, client, refresh);
+        }
+        catch (error) {
+            conn.status = "error";
+            conn.error = error instanceof Error ? error.message : String(error);
+            this.store.set(conn);
+            throw error;
+        }
+        if (conn.oauthRef?.startsWith("secret://"))
+            this.secrets.setLocal(conn.oauthRef.slice("secret://".length), JSON.stringify(next));
+        else
+            conn.oauth = next;
+        conn.status = "connected";
+        conn.error = undefined;
+        this.store.set(conn);
+    }
+    // --- agent-agnostic tool provider ---------------------------------------
+    /**
+     * A runtime-agnostic ToolProvider exposing every connected integration's tools.
+     * This is the seam the daemon hands to a session (in-process OR remote) so any
+     * agent can use the tools without the IntegrationManager knowing which agent it
+     * is — the tools execute HERE, on the daemon, where the credentials/HTTP clients
+     * live. A snapshot of the connected set is taken per call (at session start),
+     * mirroring the previous per-session behavior; disconnected integrations
+     * contribute nothing, so the tool surface and system prompt stay clean.
+     */
+    toolProvider() {
+        const specs = [];
+        const executors = new Map();
+        for (const def of this.registry) {
+            const conn = this.store.get(def.id);
+            if (!conn || conn.status !== "connected")
+                continue;
+            const http = this.httpFor(def, conn);
+            for (const tool of def.tools) {
+                specs.push({ name: tool.name, label: tool.label, description: tool.description, promptSnippet: tool.description, parameters: tool.parameters });
+                executors.set(tool.name, async (params, signal) => {
+                    try {
+                        const result = await tool.execute(params, http, signal);
+                        return { details: {}, ...result };
+                    }
+                    catch (error) {
+                        const message = error instanceof Error ? error.message : String(error);
+                        return { content: [{ type: "text", text: `${tool.name} failed: ${message}` }], details: {}, isError: true };
+                    }
+                });
+            }
+        }
+        return {
+            list: () => specs,
+            invoke: async (toolName, _toolCallId, params, signal) => {
+                const exec = executors.get(toolName);
+                if (!exec)
+                    return { content: [{ type: "text", text: `Unknown integration tool: ${toolName}` }], details: {}, isError: true };
+                return exec(params, signal);
+            },
+        };
+    }
+}

package/dist/integrations/oauth.js

@@ -0,0 +1,78 @@
+// SPDX-License-Identifier: FSL-1.1-ALv2
+// Copyright (c) 2026 Petter André Sjulstad
+import { createHash, randomBytes } from "node:crypto";
+function base64url(buf) {
+    return buf.toString("base64").replace(/\+/g, "-").replace(/\//g, "_").replace(/=+$/, "");
+}
+export function createPkce() {
+    const verifier = base64url(randomBytes(32));
+    const challenge = base64url(createHash("sha256").update(verifier).digest());
+    return { verifier, challenge };
+}
+export function buildAuthorizeUrl(spec, opts) {
+    const url = new URL(spec.authUrl);
+    url.searchParams.set("response_type", "code");
+    url.searchParams.set("client_id", opts.clientId);
+    url.searchParams.set("redirect_uri", opts.redirectUri);
+    url.searchParams.set("state", opts.state);
+    if (spec.scopes.length)
+        url.searchParams.set("scope", spec.scopes.join(" "));
+    if (opts.codeChallenge) {
+        url.searchParams.set("code_challenge", opts.codeChallenge);
+        url.searchParams.set("code_challenge_method", "S256");
+    }
+    for (const [k, v] of Object.entries(spec.extraAuthParams ?? {}))
+        url.searchParams.set(k, v);
+    return url.toString();
+}
+function normalizeToken(payload) {
+    const expiresIn = Number(payload.expires_in);
+    return {
+        accessToken: String(payload.access_token),
+        refreshToken: payload.refresh_token ? String(payload.refresh_token) : undefined,
+        expiresAt: Number.isFinite(expiresIn) && expiresIn > 0 ? Date.now() + expiresIn * 1000 : undefined,
+        scope: payload.scope ? String(payload.scope) : undefined,
+        tokenType: payload.token_type ? String(payload.token_type) : "Bearer",
+    };
+}
+async function postToken(spec, body) {
+    const res = await fetch(spec.tokenUrl, {
+        method: "POST",
+        headers: { "content-type": "application/x-www-form-urlencoded", accept: "application/json" },
+        body: new URLSearchParams(body).toString(),
+    });
+    const text = await res.text();
+    let payload;
+    try {
+        payload = JSON.parse(text);
+    }
+    catch {
+        throw new Error(`Token endpoint returned non-JSON (${res.status}): ${text.slice(0, 200)}`);
+    }
+    if (!res.ok || !payload.access_token) {
+        throw new Error(`Token exchange failed (${res.status}): ${payload.error_description || payload.error || text.slice(0, 200)}`);
+    }
+    return normalizeToken(payload);
+}
+export function exchangeCode(spec, client, opts) {
+    return postToken(spec, {
+        grant_type: "authorization_code",
+        code: opts.code,
+        redirect_uri: opts.redirectUri,
+        client_id: client.clientId,
+        client_secret: client.clientSecret,
+        ...(opts.codeVerifier ? { code_verifier: opts.codeVerifier } : {}),
+    });
+}
+export async function refreshToken(spec, client, refresh) {
+    const next = await postToken(spec, {
+        grant_type: "refresh_token",
+        refresh_token: refresh,
+        client_id: client.clientId,
+        client_secret: client.clientSecret,
+    });
+    // Providers often omit the refresh_token on refresh; keep the existing one.
+    if (!next.refreshToken)
+        next.refreshToken = refresh;
+    return next;
+}

package/dist/integrations/registry.js

@@ -0,0 +1,239 @@
+// SPDX-License-Identifier: FSL-1.1-ALv2
+// Copyright (c) 2026 Petter André Sjulstad
+import { Type } from "typebox";
+// ---------------------------------------------------------------------------
+// Built-in integrations.
+//
+// Each entry is fully declarative: an auth spec + a handful of tools. The tool
+// `execute` receives an already-authenticated `http` helper (auth header +
+// baseUrl + token refresh handled by the manager), so a tool is usually a
+// single fetch + format. To add a service, append one object to this array.
+// ---------------------------------------------------------------------------
+function text(s, details) {
+    return { content: [{ type: "text", text: s }], details };
+}
+function toRfc822({ to, subject, body }) {
+    const lines = [`To: ${to}`, `Subject: ${subject}`, "Content-Type: text/plain; charset=UTF-8", "", body];
+    return Buffer.from(lines.join("\r\n")).toString("base64").replace(/\+/g, "-").replace(/\//g, "_").replace(/=+$/, "");
+}
+export const BUILT_IN_INTEGRATIONS = [
+    {
+        id: "notion",
+        name: "Notion",
+        description: "Search your Notion workspace and read pages.",
+        icon: "📝",
+        docsUrl: "https://www.notion.so/my-integrations",
+        baseUrl: "https://api.notion.com/v1",
+        auth: {
+            kind: "apiKey",
+            label: "Notion internal integration token",
+            help: "Create an internal integration at notion.so/my-integrations, then share the pages you want reachable with it.",
+            placeholder: "secret_…",
+        },
+        tools: [
+            {
+                name: "notion_search",
+                label: "Notion: Search",
+                description: "Search pages and databases shared with the Notion integration.",
+                parameters: Type.Object({ query: Type.String({ description: "Search text" }) }),
+                async execute(params, http) {
+                    const data = await http.json("/search", {
+                        method: "POST",
+                        headers: { "Notion-Version": "2022-06-28" },
+                        body: JSON.stringify({ query: params.query, page_size: 10 }),
+                    });
+                    const results = (data.results ?? []).map((r) => {
+                        const title = r?.properties?.title?.title?.[0]?.plain_text ||
+                            r?.properties?.Name?.title?.[0]?.plain_text ||
+                            r?.title?.[0]?.plain_text ||
+                            "(untitled)";
+                        return `- ${title} [${r.object}] ${r.url ?? r.id}`;
+                    });
+                    return text(results.length ? results.join("\n") : "No matches.", { count: results.length });
+                },
+            },
+            {
+                name: "notion_get_page",
+                label: "Notion: Read page",
+                description: "Read the block contents of a Notion page by id.",
+                parameters: Type.Object({ pageId: Type.String({ description: "Notion page id" }) }),
+                async execute(params, http) {
+                    const data = await http.json(`/blocks/${encodeURIComponent(params.pageId)}/children?page_size=100`, {
+                        headers: { "Notion-Version": "2022-06-28" },
+                    });
+                    const lines = (data.results ?? []).flatMap((b) => {
+                        const rich = b?.[b.type]?.rich_text;
+                        return Array.isArray(rich) ? rich.map((t) => t.plain_text).join("") : [];
+                    });
+                    return text(lines.filter(Boolean).join("\n") || "(no readable text blocks)");
+                },
+            },
+        ],
+    },
+    {
+        id: "google",
+        name: "Google (Gmail)",
+        description: "Search and send Gmail. The same connection covers other Google APIs (Docs, Drive).",
+        icon: "✉️",
+        docsUrl: "https://console.cloud.google.com/apis/credentials",
+        baseUrl: "https://gmail.googleapis.com/gmail/v1",
+        auth: {
+            kind: "oauth2",
+            authUrl: "https://accounts.google.com/o/oauth2/v2/auth",
+            tokenUrl: "https://oauth2.googleapis.com/token",
+            clientIdEnv: "BIVY_GOOGLE_CLIENT_ID",
+            clientSecretEnv: "BIVY_GOOGLE_CLIENT_SECRET",
+            pkce: true,
+            // offline + consent so Google returns a refresh token.
+            extraAuthParams: { access_type: "offline", prompt: "consent" },
+            scopes: [
+                "https://www.googleapis.com/auth/gmail.readonly",
+                "https://www.googleapis.com/auth/gmail.send",
+                "https://www.googleapis.com/auth/userinfo.email",
+            ],
+            async accountLabel(http) {
+                try {
+                    const me = await http.json("https://www.googleapis.com/oauth2/v2/userinfo");
+                    return me?.email;
+                }
+                catch {
+                    return undefined;
+                }
+            },
+        },
+        tools: [
+            {
+                name: "gmail_search",
+                label: "Gmail: Search",
+                description: "Search Gmail messages and return subjects and snippets. Supports Gmail query syntax.",
+                parameters: Type.Object({
+                    query: Type.String({ description: "Gmail search query, e.g. 'from:boss is:unread'" }),
+                    max: Type.Optional(Type.Number({ description: "Max messages (default 5)" })),
+                }),
+                async execute(params, http) {
+                    const max = Math.min(Math.max(Number(params.max) || 5, 1), 20);
+                    const list = await http.json(`/users/me/messages?maxResults=${max}&q=${encodeURIComponent(params.query)}`);
+                    const ids = (list.messages ?? []).map((m) => m.id);
+                    const summaries = [];
+                    for (const id of ids) {
+                        const msg = await http.json(`/users/me/messages/${id}?format=metadata&metadataHeaders=Subject&metadataHeaders=From`);
+                        const headers = msg.payload?.headers ?? [];
+                        const subject = headers.find((h) => h.name === "Subject")?.value ?? "(no subject)";
+                        const from = headers.find((h) => h.name === "From")?.value ?? "";
+                        summaries.push(`- ${subject} — ${from}\n  ${msg.snippet ?? ""}`);
+                    }
+                    return text(summaries.length ? summaries.join("\n") : "No messages matched.", { count: summaries.length });
+                },
+            },
+            {
+                name: "gmail_send",
+                label: "Gmail: Send",
+                description: "Send a plain-text email from the connected Gmail account.",
+                risky: true,
+                parameters: Type.Object({
+                    to: Type.String({ description: "Recipient email address" }),
+                    subject: Type.String(),
+                    body: Type.String({ description: "Plain text body" }),
+                }),
+                async execute(params, http) {
+                    const raw = toRfc822(params);
+                    const res = await http.json("/users/me/messages/send", {
+                        method: "POST",
+                        headers: { "content-type": "application/json" },
+                        body: JSON.stringify({ raw }),
+                    });
+                    return text(`Sent. Message id ${res.id}.`, { id: res.id });
+                },
+            },
+        ],
+    },
+    {
+        id: "dropbox",
+        name: "Dropbox",
+        description: "List and read files in your Dropbox.",
+        icon: "📦",
+        docsUrl: "https://www.dropbox.com/developers/apps",
+        baseUrl: "https://api.dropboxapi.com/2",
+        auth: {
+            kind: "oauth2",
+            authUrl: "https://www.dropbox.com/oauth2/authorize",
+            tokenUrl: "https://api.dropboxapi.com/oauth2/token",
+            clientIdEnv: "BIVY_DROPBOX_CLIENT_ID",
+            clientSecretEnv: "BIVY_DROPBOX_CLIENT_SECRET",
+            // offline so Dropbox returns a refresh token (its access tokens are short-lived).
+            extraAuthParams: { token_access_type: "offline" },
+            scopes: ["account_info.read", "files.metadata.read", "files.content.read"],
+            async accountLabel(http) {
+                try {
+                    const acct = await http.json("/users/get_current_account", { method: "POST" });
+                    return acct?.email || acct?.name?.display_name;
+                }
+                catch {
+                    return undefined;
+                }
+            },
+        },
+        tools: [
+            {
+                name: "dropbox_list_folder",
+                label: "Dropbox: List folder",
+                description: "List entries in a Dropbox folder. Use an empty path for the root.",
+                parameters: Type.Object({ path: Type.Optional(Type.String({ description: "Folder path, e.g. '/Documents'. Empty = root." })) }),
+                async execute(params, http) {
+                    const data = await http.json("/files/list_folder", {
+                        method: "POST",
+                        headers: { "content-type": "application/json" },
+                        body: JSON.stringify({ path: params.path ? params.path : "" }),
+                    });
+                    const entries = (data.entries ?? []).map((e) => `- [${e[".tag"]}] ${e.path_display}`);
+                    return text(entries.length ? entries.join("\n") : "(empty)", { count: entries.length });
+                },
+            },
+            {
+                name: "dropbox_read_file",
+                label: "Dropbox: Read file",
+                description: "Download a text file from Dropbox and return its contents.",
+                parameters: Type.Object({ path: Type.String({ description: "Full file path, e.g. '/notes.txt'" }) }),
+                async execute(params, http) {
+                    const res = await http("https://content.dropboxapi.com/2/files/download", {
+                        method: "POST",
+                        headers: { "Dropbox-API-Arg": JSON.stringify({ path: params.path }) },
+                    });
+                    if (!res.ok)
+                        return { content: [{ type: "text", text: `Download failed (${res.status})` }], isError: true };
+                    const body = await res.text();
+                    return text(body.slice(0, 20000));
+                },
+            },
+        ],
+    },
+    {
+        id: "github",
+        name: "GitHub",
+        description: "Search issues/PRs and read repository files.",
+        icon: "🐙",
+        docsUrl: "https://github.com/settings/tokens",
+        baseUrl: "https://api.github.com",
+        auth: {
+            kind: "apiKey",
+            label: "GitHub personal access token",
+            help: "Create a fine-grained or classic token with repo read scope at github.com/settings/tokens.",
+            placeholder: "github_pat_…",
+        },
+        tools: [
+            {
+                name: "github_search_issues",
+                label: "GitHub: Search issues",
+                description: "Search issues and pull requests across GitHub using the issues search syntax.",
+                parameters: Type.Object({ query: Type.String({ description: "e.g. 'repo:owner/name is:open label:bug'" }) }),
+                async execute(params, http) {
+                    const data = await http.json(`/search/issues?per_page=10&q=${encodeURIComponent(params.query)}`, {
+                        headers: { accept: "application/vnd.github+json" },
+                    });
+                    const items = (data.items ?? []).map((i) => `- #${i.number} ${i.title} [${i.state}] ${i.html_url}`);
+                    return text(items.length ? items.join("\n") : "No results.", { total: data.total_count });
+                },
+            },
+        ],
+    },
+];

package/dist/integrations/store.js

@@ -0,0 +1,54 @@
+// SPDX-License-Identifier: FSL-1.1-ALv2
+// Copyright (c) 2026 Petter André Sjulstad
+import fs from "node:fs";
+import path from "node:path";
+// Tiny persistent store for integration connections. Secrets (API keys, OAuth
+// tokens) live here, so the file is written 0600 and kept out of any agent's
+// config/session directory that ships with sessions.
+export class IntegrationStore {
+    file;
+    cache = new Map();
+    constructor(appDir) {
+        this.file = path.join(appDir, "integrations.json");
+        this.load();
+    }
+    load() {
+        try {
+            const raw = JSON.parse(fs.readFileSync(this.file, "utf8"));
+            for (const [id, conn] of Object.entries(raw))
+                this.cache.set(id, conn);
+        }
+        catch {
+            // Missing or unreadable: start empty.
+        }
+    }
+    persist() {
+        const obj = {};
+        for (const [id, conn] of this.cache)
+            obj[id] = conn;
+        fs.mkdirSync(path.dirname(this.file), { recursive: true });
+        fs.writeFileSync(this.file, `${JSON.stringify(obj, null, 2)}\n`, { mode: 0o600 });
+        try {
+            fs.chmodSync(this.file, 0o600);
+        }
+        catch {
+            // best effort on platforms without chmod
+        }
+    }
+    get(id) {
+        return this.cache.get(id);
+    }
+    list() {
+        return [...this.cache.values()];
+    }
+    set(conn) {
+        this.cache.set(conn.id, conn);
+        this.persist();
+    }
+    remove(id) {
+        const had = this.cache.delete(id);
+        if (had)
+            this.persist();
+        return had;
+    }
+}

package/dist/integrations/types.js

@@ -0,0 +1 @@
+export {};