@chibitek/chibi 0.1.173 → 0.1.175

package/dist-server/shared/oauth-providers.js

@@ -9,7 +9,8 @@ export const OAUTH_PROVIDER_IDS = ["google", "microsoft"];
  * docs/chibitek/google-verification/scope-map.md):
  *   gmail      gmail_search, gmail_read          gmail.readonly   (restricted)
  *   gmailSend  gmail_create_draft, gmail_send_draft  gmail.compose (restricted)
- *   calendar   calendar_list_events, calendar_create_event  calendar.events (sensitive)
+ *   calendar   calendar_list_events, calendar_get_event, calendar_create_event,
+ *              calendar_update_event, calendar_delete_event  calendar.events (sensitive)
  *   drive      drive_search, drive_read          drive.readonly   (restricted)
  * drive.file cannot serve drive_search: it only reaches files Atomic created
  * or the person picked in Google's file picker. */

package/dist-server/shared/vault-csv.js

@@ -0,0 +1,94 @@
+import { vaultOrigin } from "./vault.js";
+export class VaultCsvError extends Error {
+}
+/** RFC 4180: quoted fields, doubled quotes, commas and newlines inside quotes. */
+export function parseCsv(text) {
+    const rows = [];
+    let row = [];
+    let field = "";
+    let quoted = false;
+    const s = text.replace(/^/, "");
+    for (let i = 0; i < s.length; i++) {
+        const c = s[i];
+        if (quoted) {
+            if (c === '"' && s[i + 1] === '"') {
+                field += '"';
+                i++;
+            }
+            else if (c === '"')
+                quoted = false;
+            else
+                field += c;
+        }
+        else if (c === '"')
+            quoted = true;
+        else if (c === ",") {
+            row.push(field);
+            field = "";
+        }
+        else if (c === "\n" || c === "\r") {
+            if (c === "\r" && s[i + 1] === "\n")
+                i++;
+            row.push(field);
+            rows.push(row);
+            row = [];
+            field = "";
+        }
+        else
+            field += c;
+    }
+    if (field || row.length) {
+        row.push(field);
+        rows.push(row);
+    }
+    return rows.filter((r) => r.some((cell) => cell.trim()));
+}
+// Header names used by Chrome, Edge, Safari/Apple Passwords, Firefox,
+// 1Password, Bitwarden, LastPass, Dashlane, Proton Pass, NordPass, RoboForm.
+// Earlier names win, so a "username" column beats an "email" column.
+const COLUMNS = {
+    url: ["url", "login_uri", "website", "web site", "uri", "login url"],
+    username: ["username", "login_username", "user name", "login", "user", "login name", "email", "e-mail"],
+    password: ["password", "login_password", "pwd", "pass"],
+    name: ["name", "title", "account"],
+    type: ["type"],
+};
+/** Logins from a password manager's CSV export. Notes, TOTP seeds and custom
+ * fields are dropped: they can hold secrets and hints are not secret. Rows
+ * without a website, username and password, or that are not logins, are
+ * counted in `skipped`. Imported items are private to the person (no bots). */
+export function vaultLoginsFromCsv(text) {
+    const [header, ...rows] = parseCsv(text);
+    if (!header)
+        return { logins: [], skipped: 0 };
+    const names = header.map((cell) => cell.trim().toLowerCase());
+    const col = (key) => {
+        for (const name of COLUMNS[key]) {
+            const index = names.indexOf(name);
+            if (index >= 0)
+                return index;
+        }
+        return -1;
+    };
+    const at = { url: col("url"), username: col("username"), password: col("password"), name: col("name"), type: col("type") };
+    if (at.url < 0 || at.password < 0 || at.username < 0)
+        throw new VaultCsvError("This CSV has no website, username and password columns.");
+    const logins = [];
+    let skipped = 0;
+    for (const row of rows) {
+        const cell = (index) => (index >= 0 ? row[index] ?? "" : "").trim();
+        const type = cell(at.type).toLowerCase();
+        const raw = cell(at.url).split(/[\s,]+/)[0] ?? "";
+        // Old entries saved as http:// or a bare domain are filled over HTTPS.
+        const website = vaultOrigin(/^[a-z][a-z0-9+.-]*:\/\//i.test(raw) ? raw.replace(/^http:\/\//i, "https://") : `https://${raw}`);
+        const username = cell(at.username);
+        const password = row[at.password] ?? "";
+        if ((type && type !== "login") || !raw || !website || !username || !password || username.length > 320 || password.length > 4096) {
+            skipped++;
+            continue;
+        }
+        const label = (cell(at.name) || new URL(website).hostname).slice(0, 200);
+        logins.push({ kind: "login", label, hints: "", botIds: [], expiresAt: null, website, username, password });
+    }
+    return { logins, skipped };
+}

package/dist-server/vps-container-mcp.js

@@ -17055,6 +17055,7 @@ var appConfigSchema = external_exports.object({
   icm: external_exports.object({
     enabled: external_exports.boolean().optional(),
     aboutMePrefilled: external_exports.boolean().optional(),
+    // no longer read (About me syncs with PAW); kept so older configs parse
     path: external_exports.string().trim().max(4096).refine(
       (value) => !["\r", "\n", "\0"].some((character) => value.includes(character)),
       "Use a folder path without control characters"

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "@chibitek/chibi",
-  "version": "0.1.173",
+  "version": "0.1.175",
   "description": "Atomic by Chibitek: run your AI team's server anywhere and pair your devices to it",
   "license": "Apache-2.0",
   "type": "module",

package/dist/assets/channel-sBYHnjxz.js

@@ -1 +0,0 @@
-import{U as a,C as n}from"./mermaid.core-DC5051S_.js";const t=(r,o)=>a.lang.round(n.parse(r)[o]);export{t as c};