@mavea/mavea 1.0.7

package/gateway/tokenStore.mjs

@@ -0,0 +1,134 @@
+// tokenStore.mjs — persistent OAuth token storage for the actions gateway.
+// Tokens are written to a JSON file on a Docker volume so they survive restarts.
+// Env vars always win over stored tokens for backward compat (set env → skip OAuth UI).
+import { readFileSync, writeFileSync, mkdirSync, chmodSync, statSync } from 'node:fs';
+import { dirname, join } from 'node:path';
+import { fileURLToPath } from 'node:url';
+
+// Docker sets TOKEN_STORE_PATH to a writable volume (/gateway-data). For a bare host run
+// (`pnpm actions`) fall back to a gitignored dir beside this module, NOT the root-owned
+// /gateway-data — anchored to the module path so it's stable regardless of the cwd.
+const DEFAULT_PATH = join(dirname(fileURLToPath(import.meta.url)), '.gateway-data', 'tokens.json');
+const PATH = process.env.TOKEN_STORE_PATH || DEFAULT_PATH;
+
+function load() {
+  try {
+    return JSON.parse(readFileSync(PATH, 'utf8'));
+  } catch {
+    return {};
+  }
+}
+
+// Low 12 bits of st_mode are the permission bits; mask off the file-type bits before comparing.
+const PERM_MASK = 0o777;
+
+/**
+ * Decide whether the token file's on-disk permissions are still owner-only. chmod can be a silent
+ * no-op on some filesystems (notably a Docker volume mounted where the process lacks ownership), so
+ * we re-stat after writing rather than trusting the chmod call. Pure for testability — pass the raw
+ * st_mode. Returns null when the mode is fine, or a prominent warning string to log when it isn't.
+ */
+export function tokenPermWarning(rawMode) {
+  const mode = rawMode & PERM_MASK;
+  if (mode === 0o600) return null;
+  return (
+    `tokenStore: SECURITY — token file is mode ${mode.toString(8)}, expected 600. OAuth tokens ` +
+    'may be readable by other users; fix the filesystem permissions or volume ownership.'
+  );
+}
+
+function save(data) {
+  try {
+    // OAuth access/refresh tokens live here — keep them owner-only so other users on the
+    // host (or another container sharing the volume) can't read them off disk.
+    mkdirSync(dirname(PATH), { recursive: true, mode: 0o700 });
+    writeFileSync(PATH, JSON.stringify(data, null, 2), { encoding: 'utf8', mode: 0o600 });
+    chmodSync(PATH, 0o600); // writeFile's mode only applies on create — enforce it on rewrites too
+  } catch (e) {
+    console.error('tokenStore: failed to write', e.message);
+    return;
+  }
+  // Verify the on-disk mode actually took, so a swallowed chmod failure can't leave the token file
+  // world-readable without anyone noticing — a credential leak we must never pass over quietly.
+  try {
+    const warning = tokenPermWarning(statSync(PATH).mode);
+    if (warning) console.error(warning);
+  } catch (e) {
+    // If we can't even stat the file we just wrote, we can't vouch for its permissions — say so.
+    console.error('tokenStore: could not verify token-file permissions', e.message);
+  }
+}
+
+export function getToken(service) {
+  return load()[service] ?? null;
+}
+
+export function setToken(service, value) {
+  const data = load();
+  data[service] = value;
+  save(data);
+}
+
+export function clearToken(service) {
+  const data = load();
+  delete data[service];
+  save(data);
+}
+
+/** Is this service ready to use? Checks env vars first, then stored tokens. */
+export function isConfigured(service) {
+  const stored = load();
+  switch (service) {
+    case 'google':
+      return !!(process.env.GOOGLE_OAUTH_TOKEN || stored.google?.token);
+    case 'github':
+      return !!(process.env.GITHUB_OAUTH_TOKEN || stored.github?.token);
+    default:
+      return false;
+  }
+}
+
+/** Merge stored tokens over env so connectors see credentials without knowing their source. */
+export function augmentEnv(env) {
+  const stored = load();
+  const out = { ...env };
+  if (!out.GOOGLE_OAUTH_TOKEN && stored.google?.token) out.GOOGLE_OAUTH_TOKEN = stored.google.token;
+  if (!out.GITHUB_OAUTH_TOKEN && stored.github?.token) out.GITHUB_OAUTH_TOKEN = stored.github.token;
+  if (!out.GITHUB_DEFAULT_REPO && stored.github?.repo) out.GITHUB_DEFAULT_REPO = stored.github.repo;
+  return out;
+}
+
+/** Return a fresh Google access token, transparently refreshing if needed. */
+export async function freshGoogleToken(fetchImpl = fetch) {
+  const stored = load();
+  const g = stored.google;
+  if (!g?.token) return process.env.GOOGLE_OAUTH_TOKEN || null;
+  const nowMs = Date.now();
+  if ((g.expiresAt ?? 0) - nowMs > 5 * 60 * 1000) return g.token;
+  if (!g.refreshToken) return g.token;
+
+  const clientId = process.env.GOOGLE_OAUTH_CLIENT_ID;
+  const clientSecret = process.env.GOOGLE_OAUTH_CLIENT_SECRET;
+  if (!clientId || !clientSecret) return g.token;
+
+  try {
+    const res = await fetchImpl('https://oauth2.googleapis.com/token', {
+      method: 'POST',
+      headers: { 'content-type': 'application/x-www-form-urlencoded' },
+      body: new URLSearchParams({
+        grant_type: 'refresh_token',
+        refresh_token: g.refreshToken,
+        client_id: clientId,
+        client_secret: clientSecret,
+      }),
+    });
+    if (!res.ok) return g.token;
+    const data = await res.json();
+    const newToken = data.access_token;
+    const expiresAt = nowMs + (data.expires_in ?? 3600) * 1000;
+    setToken('google', { ...g, token: newToken, expiresAt });
+    return newToken;
+  } catch {
+    return g.token;
+  }
+}

package/package.json

@@ -0,0 +1,143 @@
+{
+  "name": "@mavea/mavea",
+  "version": "1.0.7",
+  "type": "module",
+  "description": "Mavéa — an AI Presence interface. Talk to AI. See what it means.",
+  "license": "PolyForm-Noncommercial-1.0.0",
+  "bin": {
+    "mavea": "./bin/mavea.mjs"
+  },
+  "files": [
+    "dist",
+    "!dist/**/*.map",
+    "!dist/ort-wasm-simd-threaded.wasm",
+    "!dist/silero_vad_v5.onnx",
+    "bin",
+    "docker-compose.yml",
+    "gateway",
+    "!gateway/.gateway-data/**",
+    "README.md",
+    "CHANGELOG.md",
+    "LICENSE",
+    "TERMS.md",
+    "DISCLAIMER.md",
+    "PRIVACY.md",
+    "TRADEMARKS.md",
+    "SUPPORT.md",
+    "SECURITY.md",
+    "THIRD-PARTY.txt"
+  ],
+  "publishConfig": {
+    "access": "public"
+  },
+  "homepage": "https://github.com/TryMaveaAI/mavea#readme",
+  "bugs": {
+    "url": "https://github.com/TryMaveaAI/mavea/issues"
+  },
+  "repository": {
+    "type": "git",
+    "url": "git+https://github.com/TryMaveaAI/mavea.git"
+  },
+  "engines": {
+    "node": ">=20.19"
+  },
+  "lint-staged": {
+    "*.{ts,tsx}": [
+      "eslint --fix",
+      "prettier --write"
+    ],
+    "*.{js,cjs,mjs,mts,cts,json,css,md,yml,yaml}": [
+      "prettier --write"
+    ]
+  },
+  "devDependencies": {
+    "@babel/core": "8.0.1",
+    "@commitlint/cli": "21.0.2",
+    "@commitlint/config-conventional": "21.0.2",
+    "@eslint/js": "10.0.1",
+    "@ricky0123/vad-web": "0.0.30",
+    "@rolldown/plugin-babel": "0.2.3",
+    "@testing-library/jest-dom": "6.9.1",
+    "@testing-library/react": "16.3.2",
+    "@types/babel__core": "7.20.5",
+    "@types/node": "26.0.0",
+    "@types/react": "19.2.17",
+    "@types/react-dom": "19.2.3",
+    "@vitejs/plugin-react": "6.0.2",
+    "babel-plugin-react-compiler": "1.0.0",
+    "eslint": "10.5.0",
+    "eslint-plugin-jsx-a11y": "6.10.2",
+    "eslint-plugin-react-hooks": "7.1.1",
+    "eslint-plugin-react-refresh": "0.5.3",
+    "globals": "17.6.0",
+    "husky": "9.1.7",
+    "jsdom": "29.1.1",
+    "jspdf": "4.2.1",
+    "katex": "0.17.0",
+    "knip": "6.17.1",
+    "leaflet": "1.9.4",
+    "lint-staged": "17.0.8",
+    "mediabunny": "1.50.6",
+    "modern-screenshot": "4.7.0",
+    "openchemlib": "9.24.0",
+    "pdfjs-dist": "4.10.38",
+    "playwright": "1.61.1",
+    "pptxgenjs": "4.0.1",
+    "prettier": "3.8.4",
+    "react": "19.2.7",
+    "react-dom": "19.2.7",
+    "rollup-plugin-visualizer": "7.0.1",
+    "shiki": "4.3.1",
+    "tsx": "4.23.0",
+    "typescript": "6.0.3",
+    "typescript-eslint": "8.61.1",
+    "vite": "8.0.16",
+    "vitest": "4.1.9"
+  },
+  "scripts": {
+    "dev": "node scripts/dev.mjs",
+    "build": "tsc --noEmit && vite build",
+    "analyze": "ANALYZE=1 vite build",
+    "size": "node scripts/check-bundle-size.mjs",
+    "check:artifact": "node scripts/check-public-artifact.mjs",
+    "check:package": "node scripts/check-package-artifact.mjs",
+    "check:deployment": "node scripts/check-deployment.mjs",
+    "check:licenses": "node scripts/check-licenses.mjs",
+    "check:release-policy": "node scripts/check-release-policy.mjs",
+    "check:vulnerabilities": "node scripts/check-vulnerabilities.mjs",
+    "preview": "node bin/mavea.mjs",
+    "typecheck": "tsc --noEmit",
+    "test": "vitest run",
+    "test:watch": "vitest",
+    "eval": "EVAL_LIVE=1 vitest run live-eval",
+    "eval:mindshape": "node --import tsx scripts/mindshape-eval.mts",
+    "eval:compare": "node --import tsx scripts/eval-compare.mts",
+    "semantic:build": "node --import tsx scripts/semantic-catalog-dump.mts > /tmp/mavea-semantic-catalog.json && python3 scripts/build-semantic-index.py --catalog /tmp/mavea-semantic-catalog.json --exemplars src/live/semantic/exemplars.json --out public/semantic",
+    "actions": "node --env-file-if-exists=.env gateway/actions-gateway.mjs",
+    "lint": "eslint . --cache --cache-location node_modules/.cache/eslint/",
+    "lint:fix": "eslint . --fix",
+    "format": "prettier --write .",
+    "format:check": "prettier --check .",
+    "knip": "knip",
+    "new:block": "node scripts/new-block.mjs",
+    "verify": "pnpm check:reference-examples && pnpm check:gallery-fixtures && pnpm typecheck && pnpm lint && pnpm format:check && pnpm test && vite build && pnpm size && pnpm check:artifact && pnpm check:package",
+    "verify:full": "pnpm verify && pnpm knip && pnpm check:licenses && pnpm check:vulnerabilities",
+    "dev:web": "vite",
+    "pairs:selection": "node --env-file=.env --import tsx scripts/selection-pairs.mts",
+    "weights:selection": "node --import tsx scripts/fit-selection-weights.mts",
+    "gen:reference-examples": "node --import tsx scripts/generate-reference-examples.mts --write",
+    "check:reference-examples": "node --import tsx scripts/generate-reference-examples.mts",
+    "gen:gallery-fixtures": "node --import tsx scripts/generate-gallery-fixtures.mjs --write",
+    "check:gallery-fixtures": "node --import tsx scripts/generate-gallery-fixtures.mjs",
+    "gen:catalog": "node --import tsx scripts/generate-catalog-index.mts",
+    "audit:reel": "node --import tsx scripts/reel-audit.mts",
+    "slides:gate": "node --import tsx scripts/slide-gate.mts",
+    "export:gate": "node --import tsx scripts/export-gate.mts",
+    "audit:ui": "node --import tsx scripts/ui-audit.mts",
+    "audit:browsers": "node --import tsx scripts/browser-matrix.mts",
+    "audit:interactions": "node --import tsx scripts/interaction-matrix.mts",
+    "perf": "node --import tsx scripts/perf-probe.mts",
+    "perf:memory": "node --import tsx scripts/memory-probe.mts",
+    "audit:tap": "node --import tsx scripts/tap-audit.mts"
+  }
+}