@open-everywhere/adapters 0.4.0 → 0.6.0

package/agent/sandbox/long-lived-box.ts

@@ -0,0 +1,464 @@
+// The long-lived box on each sandbox backend — the vendor half of core's sandbox/long-lived-box.ts seam.
+// One implementation per backend `resolveSandboxBackend()` can pick, so a box runs where the conversation
+// sandbox runs. A box carries the `oeBox` label and never `sessionId`, so the turn-end stopper
+// (backend-stop.ts) cannot match it.
+//
+// A PERSISTENT box (a `persist` spec — the person's browser, OPE-2441) keeps its files between opens: a
+// NAMED, persistent Vercel Sandbox whose filesystem snapshot survives each stop, or a docker container on a
+// named volume. Before it starts one, the backend stops any box still running on the same key, because two
+// programs on one browser profile corrupt it.
+
+import { Sandbox } from "@vercel/sandbox";
+import {
+  BOX_LABEL,
+  BOX_REF_LABEL,
+  boxLabels,
+  clampBoxMinutes,
+  registerLongLivedBoxBackend,
+  resolveSandboxBackend,
+  type BoxListing,
+  type BoxPurpose,
+  type BoxSpec,
+  type LongLivedBoxBackend,
+  type OpenedBox,
+} from "@open-everywhere/core/agent/adapter-api.js";
+import { dockerStatusToSandboxStatus } from "./backend-stop.js";
+import { execFile } from "node:child_process";
+
+/** Vercel Sandbox's plan ceiling per session on Pro and Enterprise (vercel.com/docs/sandbox/pricing). */
+export const VERCEL_BOX_CEILING_MINUTES = 24 * 60;
+/** Docker has no platform ceiling. OE still caps a box, at the same 24 h, so one rule bounds both stacks. */
+const DOCKER_BOX_CEILING_MINUTES = 24 * 60;
+
+function isPurpose(v: string | undefined): v is BoxPurpose {
+  return v === "meeting" || v === "browser";
+}
+
+// ── Vercel ────────────────────────────────────────────────────────────────────────────────────
+
+/** The raw `@vercel/sandbox` surface the Vercel box needs. Injected in tests. */
+export interface VercelBoxSdk {
+  create(params: {
+    image: string;
+    vcpus: number;
+    timeoutMs: number;
+    tags: Record<string, string>;
+    env: Record<string, string>;
+    networkPolicy: "allow-all" | "deny-all" | { allow: string[] };
+  }): Promise<{ name: string; createdAt: number }>;
+  /** `env` (a persistent box) goes to this one command only, never into the sandbox's stored config. */
+  runDetached(name: string, cmd: string, args: string[], timeoutMs: number, env?: Record<string, string>): Promise<void>;
+  get(name: string): Promise<BoxListing | undefined>;
+  /** Every sandbox carrying the `oeBox` tag with this purpose. */
+  listByPurpose(purpose: BoxPurpose): Promise<BoxListing[]>;
+  stop(name: string): Promise<void>;
+  /**
+   * A persistent, NAMED sandbox: create it, or update the one that exists (and stop it first when it is
+   * running, so the program that starts next is the only one on its files). The next command resumes it
+   * from its snapshot. `createdAt` is the start of THIS session, for billing.
+   */
+  openPersistent?(params: {
+    name: string;
+    image: string;
+    vcpus: number;
+    timeoutMs: number;
+    tags: Record<string, string>;
+    networkPolicy: "allow-all" | "deny-all" | { allow: string[] };
+    snapshotExpirationMs: number;
+    ports: number[];
+  }): Promise<{ name: string; createdAt: number }>;
+  /** The public HTTPS URL of an exposed port. */
+  domain?(name: string, port: number): Promise<string>;
+  /** Delete a persistent sandbox and its snapshots. Idempotent. */
+  remove?(name: string): Promise<void>;
+}
+
+const defaultVercelBoxSdk: VercelBoxSdk = {
+  async create(p) {
+    const sandbox = await Sandbox.create({
+      image: p.image,
+      resources: { vcpus: p.vcpus },
+      timeout: p.timeoutMs,
+      tags: p.tags,
+      env: p.env,
+      networkPolicy: p.networkPolicy,
+      // A box is single-use. Nothing resumes it, so it keeps no snapshot.
+      persistent: false,
+    });
+    return { name: sandbox.name, createdAt: sandbox.createdAt.getTime() };
+  },
+  async runDetached(name, cmd, args, timeoutMs, env) {
+    const sandbox = await Sandbox.get({ name, resume: false });
+    await sandbox.runCommand({ cmd, args, detached: true, timeoutMs, ...(env !== undefined ? { env } : {}) });
+  },
+  async get(name) {
+    try {
+      const s = await Sandbox.get({ name, resume: false });
+      const purpose = s.tags?.[BOX_LABEL];
+      return {
+        name: s.name,
+        status: s.status,
+        createdAt: s.createdAt.getTime(),
+        ...(isPurpose(purpose) ? { purpose } : {}),
+        ...(s.tags?.[BOX_REF_LABEL] !== undefined ? { ref: s.tags[BOX_REF_LABEL] } : {}),
+      };
+    } catch {
+      return undefined;
+    }
+  },
+  async listByPurpose(purpose) {
+    const result = await Sandbox.list({ tags: { oeBox: purpose } });
+    const out: BoxListing[] = [];
+    for await (const s of result) out.push({ name: s.name, status: s.status, createdAt: s.createdAt, purpose });
+    return out;
+  },
+  async stop(name) {
+    try {
+      await (await Sandbox.get({ name, resume: false })).stop();
+    } catch {
+      // Idempotent: a box that is already gone is stopped.
+    }
+  },
+  async openPersistent(p) {
+    let existing: Sandbox | undefined;
+    try {
+      existing = await Sandbox.get({ name: p.name, resume: false });
+    } catch {
+      existing = undefined;
+    }
+    if (existing === undefined) {
+      await Sandbox.create({
+        name: p.name,
+        image: p.image,
+        resources: { vcpus: p.vcpus },
+        timeout: p.timeoutMs,
+        tags: p.tags,
+        networkPolicy: p.networkPolicy,
+        ports: p.ports,
+        // The filesystem (the browser profile) survives each stop as a snapshot, and expires unused.
+        persistent: true,
+        snapshotExpiration: p.snapshotExpirationMs,
+      });
+      return { name: p.name, createdAt: Date.now() };
+    }
+    // A program still running on these files would share the profile with the one about to start. A stop
+    // snapshots the filesystem; the next command resumes from it with no process left over.
+    if (existing.status === "running" || existing.status === "pending") await existing.stop();
+    await existing.update({ timeout: p.timeoutMs, networkPolicy: p.networkPolicy, ports: p.ports, tags: p.tags, snapshotExpiration: p.snapshotExpirationMs });
+    return { name: p.name, createdAt: Date.now() };
+  },
+  async domain(name, port) {
+    return (await Sandbox.get({ name, resume: false })).domain(port);
+  },
+  async remove(name) {
+    try {
+      await (await Sandbox.get({ name, resume: false })).delete({ deleteOrphanSnapshots: true });
+    } catch {
+      // Idempotent: a sandbox that is already gone is deleted.
+    }
+  },
+};
+
+/** The Vercel firewall form of a box's egress. */
+function vercelNetworkPolicy(egress: BoxSpec["egress"]): "allow-all" | "deny-all" | { allow: string[] } {
+  return egress === "open" ? "allow-all" : egress.allow.length === 0 ? "deny-all" : { allow: [...egress.allow] };
+}
+
+export function createVercelBoxBackend(sdk: VercelBoxSdk = defaultVercelBoxSdk): LongLivedBoxBackend {
+  return {
+    backend: "vercel",
+    metered: true,
+    maxMinutesCeiling: VERCEL_BOX_CEILING_MINUTES,
+    // The Vercel Sandbox firewall holds an `{ allow }` list at the network, outside the box.
+    enforcesHostAllowList: true,
+    async open(spec: BoxSpec): Promise<OpenedBox> {
+      const [cmd, ...args] = spec.command;
+      if (cmd === undefined) throw new Error("a box needs a command to run");
+      const maxMinutes = clampBoxMinutes(spec.maxMinutes, VERCEL_BOX_CEILING_MINUTES);
+      const timeoutMs = maxMinutes * 60_000;
+      if (spec.persist !== undefined) {
+        if (sdk.openPersistent === undefined || sdk.domain === undefined) throw new Error("this Vercel box SDK cannot keep a box's files between opens");
+        const opened = await sdk.openPersistent({
+          name: spec.persist.key,
+          image: spec.image,
+          vcpus: Math.max(1, Math.floor(spec.vcpus)),
+          timeoutMs,
+          tags: boxLabels(spec),
+          networkPolicy: vercelNetworkPolicy(spec.egress),
+          snapshotExpirationMs: Math.max(1, Math.floor(spec.persist.keepDays)) * 24 * 60 * 60_000,
+          ports: spec.port !== undefined ? [spec.port] : [],
+        });
+        try {
+          // The per-open secrets go to this command only. A persistent sandbox stores its create-time env in its
+          // config, so a key placed there would outlive the box it was minted for.
+          await sdk.runDetached(opened.name, cmd, args, timeoutMs, { ...spec.env });
+        } catch (err) {
+          await sdk.stop(opened.name);
+          throw err;
+        }
+        const url = spec.port !== undefined ? await sdk.domain(opened.name, spec.port) : undefined;
+        return { name: opened.name, backend: "vercel", createdAt: opened.createdAt, maxMinutes, ...(url !== undefined ? { url } : {}) };
+      }
+      const created = await sdk.create({
+        image: spec.image,
+        // Vercel sizes memory from vCPUs (2 GiB each), so `memoryMb` has no field to land in.
+        vcpus: Math.max(1, Math.floor(spec.vcpus)),
+        // The session timeout IS the cap: Vercel stops the VM at it whatever the bot does.
+        timeoutMs,
+        tags: boxLabels(spec),
+        env: { ...spec.env },
+        networkPolicy: vercelNetworkPolicy(spec.egress),
+      });
+      try {
+        await sdk.runDetached(created.name, cmd, args, timeoutMs);
+      } catch (err) {
+        // A box whose program never started must not idle out its whole cap.
+        await sdk.stop(created.name);
+        throw err;
+      }
+      return { name: created.name, backend: "vercel", createdAt: created.createdAt, maxMinutes };
+    },
+    status: async (name) => await sdk.get(name),
+    list: async (purpose) => await sdk.listByPurpose(purpose),
+    stop: async (name) => await sdk.stop(name),
+    async forget(key) {
+      if (sdk.remove === undefined) throw new Error("this Vercel box SDK cannot delete a persistent box");
+      await sdk.remove(key);
+    },
+  };
+}
+
+// ── docker ────────────────────────────────────────────────────────────────────────────────────
+
+/** The pid ceiling of a docker box: Chromium's threads count against it, so it is generous. */
+const DOCKER_BOX_PIDS_LIMIT = 2048;
+
+/** The docker label keys. Prefixed like eve's own `eve.sandbox.tag.*`, but never its `sessionId` key. */
+export const DOCKER_BOX_LABEL = `oe.box.${BOX_LABEL}`;
+const DOCKER_BOX_REF_LABEL = `oe.box.${BOX_REF_LABEL}`;
+/** The label naming a persistent box's volume, so a second open finds the box still on it. */
+export const DOCKER_BOX_PERSIST_LABEL = "oe.box.oePersist";
+
+/** A docker volume name from a persistence key: lowercase, `[a-z0-9_.-]`, never empty. */
+function dockerVolumeName(key: string): string {
+  const clean = key.toLowerCase().replace(/[^a-z0-9_.-]/g, "-").slice(0, 60);
+  return clean.length > 0 ? clean : "oe-box-data";
+}
+
+/**
+ * The docker CLI for boxes. `env` carries the VALUES of the box's `--env NAME` flags: docker reads each named
+ * variable from its own environment, so a value (the meeting's callback key, a meeting passcode) never sits
+ * on the argv, where `ps` shows it and Node's `execFile` error message would repeat it.
+ */
+export type BoxDockerRunner = (args: readonly string[], env?: Readonly<Record<string, string>>) => Promise<string>;
+
+const defaultDockerRunner: BoxDockerRunner = async (args, env) =>
+  await new Promise<string>((resolve, reject) => {
+    const bin = process.env.EVE_DOCKER_PATH?.trim() || "docker";
+    execFile(bin, [...args], { encoding: "utf8", maxBuffer: 8 * 1024 * 1024, ...(env !== undefined ? { env: { ...process.env, ...env } } : {}) }, (err, stdout, stderr) => {
+      // A SANITISED error: the verb and docker's own first stderr line, never the argv. The message reaches
+      // an approval card's outcome line and the `approval.failed` audit row.
+      if (err) reject(new Error(`docker ${args[0] ?? ""} failed: ${String(stderr).split("\n")[0]?.trim() || "no error output"}`));
+      else resolve(stdout);
+    });
+  });
+
+/** A docker container name from the box ref: lowercase, `[a-z0-9_.-]`, unique per open. */
+function dockerBoxName(spec: Pick<BoxSpec, "purpose" | "ref">, nonce: string): string {
+  const ref = spec.ref.toLowerCase().replace(/[^a-z0-9_.-]/g, "-").slice(0, 40);
+  return `oe-box-${spec.purpose}-${ref}-${nonce}`;
+}
+
+/** The `docker run` argument list for a box. Pure, so the sizing and the labels are unit-tested. */
+export function dockerRunArgs(spec: BoxSpec, name: string, maxMinutes: number): string[] {
+  if (spec.egress !== "open" && spec.egress.allow.length > 0) {
+    // docker's own network has no host allow-list, and a box outside the egress proxy cannot be
+    // filtered by it (OPE-2407). Refuse rather than run a box open that asked to be closed.
+    throw new Error("the docker backend cannot enforce a host allow-list on a box — refusing to open it with open network");
+  }
+  const labels = boxLabels(spec);
+  const args = [
+    "run",
+    "-d",
+    // The box removes itself when its program exits, so nothing accumulates on the host.
+    "--rm",
+    "--name",
+    name,
+    "--label",
+    `${DOCKER_BOX_LABEL}=${labels[BOX_LABEL]}`,
+    "--label",
+    `${DOCKER_BOX_REF_LABEL}=${labels[BOX_REF_LABEL]}`,
+    "--cpus",
+    String(Math.max(0.5, spec.vcpus)),
+    "--memory",
+    `${Math.max(256, Math.floor(spec.memoryMb))}m`,
+    "--shm-size",
+    `${Math.max(64, Math.floor(spec.shmMb ?? 64))}m`,
+    // Hardening every box gets: no Linux capabilities, no privilege gain through setuid binaries, and a pid
+    // ceiling (Chromium runs a few hundred threads; a fork bomb stops here). The box program runs as the
+    // image's non-root user when the spec names one.
+    "--cap-drop",
+    "ALL",
+    "--security-opt",
+    "no-new-privileges",
+    "--pids-limit",
+    String(DOCKER_BOX_PIDS_LIMIT),
+    ...(spec.user !== undefined ? ["--user", spec.user] : []),
+  ];
+  if (spec.persist !== undefined) {
+    args.push("--label", `${DOCKER_BOX_PERSIST_LABEL}=${dockerVolumeName(spec.persist.key)}`, "--volume", `${dockerVolumeName(spec.persist.key)}:${spec.persist.mount}`);
+  }
+  if (spec.egress !== "open") {
+    // A closed box has no network, so nothing could reach its port either.
+    if (spec.port !== undefined) throw new Error("a docker box with no network cannot serve a port — refusing to open it");
+    args.push("--network", "none");
+  } else if (spec.network !== undefined) {
+    args.push("--network", spec.network);
+  }
+  // Off a named network the port is published on the loopback interface only, never on the host's others.
+  if (spec.port !== undefined && spec.network === undefined) args.push("--publish", `127.0.0.1::${spec.port}`);
+  // Names only: the values travel in the CLI's own environment (BoxDockerRunner), never on the argv.
+  for (const k of Object.keys(spec.env)) args.push("--env", k);
+  // `timeout` is the cap on this backend: coreutils kills the program at it, and `--rm` removes the box.
+  args.push("--entrypoint", "timeout", spec.image, `${maxMinutes * 60}s`, ...spec.command);
+  return args;
+}
+
+export function createDockerBoxBackend(run: BoxDockerRunner = defaultDockerRunner, nonce: () => string = () => Date.now().toString(36)): LongLivedBoxBackend {
+  async function inspect(names: readonly string[]): Promise<BoxListing[]> {
+    if (names.length === 0) return [];
+    let out: string;
+    try {
+      out = await run([
+        "inspect",
+        "--format",
+        `{{.Name}}\t{{.State.Status}}\t{{.State.StartedAt}}\t{{index .Config.Labels "${DOCKER_BOX_LABEL}"}}\t{{index .Config.Labels "${DOCKER_BOX_REF_LABEL}"}}`,
+        ...names,
+      ]);
+    } catch {
+      return [];
+    }
+    const listings: BoxListing[] = [];
+    for (const line of out.split("\n")) {
+      const [rawName, state, startedAt, purpose, ref] = line.trim().split("\t");
+      if (rawName === undefined || state === undefined) continue;
+      const parsed = startedAt === undefined ? Number.NaN : Date.parse(startedAt);
+      listings.push({
+        name: rawName.replace(/^\//, ""),
+        status: dockerStatusToSandboxStatus(state),
+        createdAt: Number.isFinite(parsed) ? parsed : Date.now(),
+        ...(isPurpose(purpose) ? { purpose } : {}),
+        ...(ref !== undefined && ref.length > 0 ? { ref } : {}),
+      });
+    }
+    return listings;
+  }
+  /** Stop every box still running on a persistent key's volume. */
+  async function stopOnVolume(volume: string): Promise<void> {
+    const ids = (await run(["ps", "-q", "--filter", `label=${DOCKER_BOX_PERSIST_LABEL}=${volume}`]))
+      .split("\n")
+      .map((l) => l.trim())
+      .filter((l) => l.length > 0);
+    for (const id of ids) {
+      try {
+        await run(["stop", "-t", "10", id]);
+      } catch {
+        // Already gone.
+      }
+    }
+  }
+  /** Where the app reaches a box's port: by name on a shared network, else the loopback port docker picked. */
+  async function boxUrl(spec: BoxSpec, name: string): Promise<string | undefined> {
+    if (spec.port === undefined) return undefined;
+    if (spec.network !== undefined) return `http://${name}:${spec.port}`;
+    const mapped = (await run(["port", name, `${spec.port}/tcp`])).split("\n").map((l) => l.trim()).find((l) => /^127\.0\.0\.1:\d+$/.test(l));
+    return mapped === undefined ? undefined : `http://${mapped}`;
+  }
+  return {
+    backend: "docker",
+    metered: false,
+    maxMinutesCeiling: DOCKER_BOX_CEILING_MINUTES,
+    // docker has no host firewall for a box: `dockerRunArgs` refuses a non-empty `{ allow }` list.
+    enforcesHostAllowList: false,
+    async open(spec) {
+      if (spec.command.length === 0) throw new Error("a box needs a command to run");
+      const maxMinutes = clampBoxMinutes(spec.maxMinutes, DOCKER_BOX_CEILING_MINUTES);
+      const name = dockerBoxName(spec, nonce());
+      const args = dockerRunArgs(spec, name, maxMinutes);
+      if (spec.persist !== undefined) await stopOnVolume(dockerVolumeName(spec.persist.key));
+      await run(args, spec.env);
+      const [listing] = await inspect([name]);
+      let url: string | undefined;
+      try {
+        url = await boxUrl(spec, name);
+      } catch (err) {
+        await run(["stop", "-t", "10", name]).catch(() => "");
+        throw err;
+      }
+      return { name, backend: "docker", createdAt: listing?.createdAt ?? Date.now(), maxMinutes, ...(url !== undefined ? { url } : {}) };
+    },
+    async status(name) {
+      const [listing] = await inspect([name]);
+      return listing;
+    },
+    async list(purpose) {
+      const names = (await run(["ps", "-a", "--no-trunc", "--filter", `label=${DOCKER_BOX_LABEL}=${purpose}`, "--format", "{{.Names}}"]))
+        .split("\n")
+        .map((l) => l.trim())
+        .filter((l) => l.length > 0);
+      return await inspect(names);
+    },
+    async stop(name) {
+      try {
+        await run(["stop", "-t", "10", name]);
+      } catch {
+        // Idempotent: `--rm` already removed a box whose program exited.
+      }
+    },
+    async forget(key) {
+      const volume = dockerVolumeName(key);
+      await stopOnVolume(volume);
+      // `-f` makes a missing volume a success, so a forget is idempotent.
+      await run(["volume", "rm", "-f", volume]);
+    },
+  };
+}
+
+// ── just-bash ─────────────────────────────────────────────────────────────────────────────────
+
+/** just-bash is an in-process interpreter: it has no VM, no container and no browser. It refuses. */
+export const justBashBoxBackend: LongLivedBoxBackend = {
+  backend: "justbash",
+  metered: false,
+  maxMinutesCeiling: 0,
+  unavailable:
+    "this deployment's sandbox backend is just-bash, which runs inside the app process and cannot run a long-lived box (no VM, no container, no browser). Declare `sandbox.selfHostBackend: \"docker\"` or run on Vercel Sandbox",
+  async open() {
+    throw new Error(justBashBoxBackend.unavailable);
+  },
+  async status() {
+    return undefined;
+  },
+  async list() {
+    return [];
+  },
+  async stop() {
+    // Nothing to stop: this backend never opens a box.
+  },
+};
+
+// ── selection ─────────────────────────────────────────────────────────────────────────────────
+
+/** The box backend for this deployment: the SAME rule `resolveSandboxStopper()` reads, so they never disagree. */
+export function selectLongLivedBoxBackend(): LongLivedBoxBackend {
+  const backend = resolveSandboxBackend();
+  if (backend === "vercel") return createVercelBoxBackend();
+  return backend === "justbash" ? justBashBoxBackend : createDockerBoxBackend();
+}
+
+/** Boot registration, from `registerDefaultAdapters`. */
+export function registerLongLivedBoxes(): string {
+  const backend = selectLongLivedBoxBackend();
+  registerLongLivedBoxBackend(backend);
+  return backend.backend;
+}

package/dist/agent/meetings/native-http.d.ts

@@ -0,0 +1,22 @@
+/** The fetch a reader uses. Injected in tests with recorded fixtures; the live one is the global fetch. */
+export type NativeFetch = (url: string, init?: RequestInit) => Promise<Response>;
+/** The live fetch every reader uses by default: the global fetch with a per-call timeout. */
+export declare const timedFetch: NativeFetch;
+/** Read a response body as text, refusing one larger than the cap. */
+export declare function readCappedText(res: Response): Promise<string>;
+/** Read a JSON body, or `{}` when it does not parse (an error body need not be JSON). */
+export declare function readJsonLoose(res: Response): Promise<Record<string, unknown>>;
+/** A thrown error a reader turns into "the platform did not answer, check again later". Never echoes a body. */
+export declare function unexpectedStatus(what: string, status: number): Error;
+/**
+ * A per-process access-token cache, keyed by the caller (credential + subject). A token is reused until one
+ * minute before it expires. The key never holds the secret itself: callers pass a non-secret key.
+ */
+export declare class TokenCache {
+    #private;
+    get(key: string, now: number): string | undefined;
+    set(key: string, token: string, expiresInSeconds: unknown, now: number): void;
+}
+/** True when `raw` is an https URL on `host` or one of its subdomains. A reader sends its token only there. */
+export declare function onHost(raw: string, host: string): boolean;
+//# sourceMappingURL=native-http.d.ts.map

package/dist/agent/meetings/native-http.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"native-http.d.ts","sourceRoot":"","sources":["../../../agent/meetings/native-http.ts"],"names":[],"mappings":"AAIA,2GAA2G;AAC3G,MAAM,MAAM,WAAW,GAAG,CAAC,GAAG,EAAE,MAAM,EAAE,IAAI,CAAC,EAAE,WAAW,KAAK,OAAO,CAAC,QAAQ,CAAC,CAAC;AAOjF,6FAA6F;AAC7F,eAAO,MAAM,UAAU,EAAE,WAAyG,CAAC;AAKnI,sEAAsE;AACtE,wBAAsB,cAAc,CAAC,GAAG,EAAE,QAAQ,GAAG,OAAO,CAAC,MAAM,CAAC,CAMnE;AAED,yFAAyF;AACzF,wBAAsB,aAAa,CAAC,GAAG,EAAE,QAAQ,GAAG,OAAO,CAAC,MAAM,CAAC,MAAM,EAAE,OAAO,CAAC,CAAC,CAOnF;AAED,gHAAgH;AAChH,wBAAgB,gBAAgB,CAAC,IAAI,EAAE,MAAM,EAAE,MAAM,EAAE,MAAM,GAAG,KAAK,CAEpE;AAOD;;;GAGG;AACH,qBAAa,UAAU;;IAErB,GAAG,CAAC,GAAG,EAAE,MAAM,EAAE,GAAG,EAAE,MAAM,GAAG,MAAM,GAAG,SAAS,CAGhD;IACD,GAAG,CAAC,GAAG,EAAE,MAAM,EAAE,KAAK,EAAE,MAAM,EAAE,gBAAgB,EAAE,OAAO,EAAE,GAAG,EAAE,MAAM,GAAG,IAAI,CAG5E;CACF;AAED,+GAA+G;AAC/G,wBAAgB,MAAM,CAAC,GAAG,EAAE,MAAM,EAAE,IAAI,EAAE,MAAM,GAAG,OAAO,CAOzD"}

package/dist/agent/meetings/native-http.js

@@ -0,0 +1,61 @@
+// Shared plumbing for the native-transcript readers (OPE-2471): an injectable fetch, a capped body read, and
+// a small token cache. Every reader is host code that calls one vendor API with the organisation's own
+// credential; nothing here enters a sandbox, and no response text is ever echoed into a thread.
+/** How long ONE vendor call may take. A call that runs out throws, and core counts the read as "the platform
+ *  did not answer": OE checks again on the next sweep. It bounds each call only: a read makes up to a few calls
+ *  in sequence, and the meeting sweep bounds a whole tick with its own time budget (meetings/native-recap.ts). */
+const NATIVE_CALL_TIMEOUT_MS = 30_000;
+/** The live fetch every reader uses by default: the global fetch with a per-call timeout. */
+export const timedFetch = (url, init) => fetch(url, { ...init, signal: AbortSignal.timeout(NATIVE_CALL_TIMEOUT_MS) });
+/** The largest body a reader accepts: a three-hour transcript is well under 2 MB. */
+const MAX_NATIVE_BODY_BYTES = 8 * 1024 * 1024;
+/** Read a response body as text, refusing one larger than the cap. */
+export async function readCappedText(res) {
+    const declared = Number(res.headers.get("content-length") ?? "0");
+    if (Number.isFinite(declared) && declared > MAX_NATIVE_BODY_BYTES)
+        throw new Error(`response body is ${declared} bytes, over the ${MAX_NATIVE_BODY_BYTES}-byte cap`);
+    const text = await res.text();
+    if (text.length > MAX_NATIVE_BODY_BYTES)
+        throw new Error(`response body is over the ${MAX_NATIVE_BODY_BYTES}-byte cap`);
+    return text;
+}
+/** Read a JSON body, or `{}` when it does not parse (an error body need not be JSON). */
+export async function readJsonLoose(res) {
+    try {
+        const v = JSON.parse(await readCappedText(res));
+        return v !== null && typeof v === "object" && !Array.isArray(v) ? v : {};
+    }
+    catch {
+        return {};
+    }
+}
+/** A thrown error a reader turns into "the platform did not answer, check again later". Never echoes a body. */
+export function unexpectedStatus(what, status) {
+    return new Error(`${what} answered HTTP ${status}`);
+}
+/**
+ * A per-process access-token cache, keyed by the caller (credential + subject). A token is reused until one
+ * minute before it expires. The key never holds the secret itself: callers pass a non-secret key.
+ */
+export class TokenCache {
+    #tokens = new Map();
+    get(key, now) {
+        const t = this.#tokens.get(key);
+        return t !== undefined && t.expiresAt - 60_000 > now ? t.token : undefined;
+    }
+    set(key, token, expiresInSeconds, now) {
+        const s = typeof expiresInSeconds === "number" && Number.isFinite(expiresInSeconds) && expiresInSeconds > 0 ? expiresInSeconds : 300;
+        this.#tokens.set(key, { token, expiresAt: now + s * 1000 });
+    }
+}
+/** True when `raw` is an https URL on `host` or one of its subdomains. A reader sends its token only there. */
+export function onHost(raw, host) {
+    try {
+        const u = new URL(raw);
+        return u.protocol === "https:" && u.port === "" && (u.hostname === host || u.hostname.endsWith(`.${host}`));
+    }
+    catch {
+        return false;
+    }
+}
+//# sourceMappingURL=native-http.js.map

package/dist/agent/meetings/native-http.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"native-http.js","sourceRoot":"","sources":["../../../agent/meetings/native-http.ts"],"names":[],"mappings":"AAAA,6GAA6G;AAC7G,uGAAuG;AACvG,gGAAgG;AAKhG;;kHAEkH;AAClH,MAAM,sBAAsB,GAAG,MAAM,CAAC;AAEtC,6FAA6F;AAC7F,MAAM,CAAC,MAAM,UAAU,GAAgB,CAAC,GAAG,EAAE,IAAI,EAAE,EAAE,CAAC,KAAK,CAAC,GAAG,EAAE,EAAE,GAAG,IAAI,EAAE,MAAM,EAAE,WAAW,CAAC,OAAO,CAAC,sBAAsB,CAAC,EAAE,CAAC,CAAC;AAEnI,qFAAqF;AACrF,MAAM,qBAAqB,GAAG,CAAC,GAAG,IAAI,GAAG,IAAI,CAAC;AAE9C,sEAAsE;AACtE,MAAM,CAAC,KAAK,UAAU,cAAc,CAAC,GAAa;IAChD,MAAM,QAAQ,GAAG,MAAM,CAAC,GAAG,CAAC,OAAO,CAAC,GAAG,CAAC,gBAAgB,CAAC,IAAI,GAAG,CAAC,CAAC;IAClE,IAAI,MAAM,CAAC,QAAQ,CAAC,QAAQ,CAAC,IAAI,QAAQ,GAAG,qBAAqB;QAAE,MAAM,IAAI,KAAK,CAAC,oBAAoB,QAAQ,oBAAoB,qBAAqB,WAAW,CAAC,CAAC;IACrK,MAAM,IAAI,GAAG,MAAM,GAAG,CAAC,IAAI,EAAE,CAAC;IAC9B,IAAI,IAAI,CAAC,MAAM,GAAG,qBAAqB;QAAE,MAAM,IAAI,KAAK,CAAC,6BAA6B,qBAAqB,WAAW,CAAC,CAAC;IACxH,OAAO,IAAI,CAAC;AACd,CAAC;AAED,yFAAyF;AACzF,MAAM,CAAC,KAAK,UAAU,aAAa,CAAC,GAAa;IAC/C,IAAI,CAAC;QACH,MAAM,CAAC,GAAG,IAAI,CAAC,KAAK,CAAC,MAAM,cAAc,CAAC,GAAG,CAAC,CAAY,CAAC;QAC3D,OAAO,CAAC,KAAK,IAAI,IAAI,OAAO,CAAC,KAAK,QAAQ,IAAI,CAAC,KAAK,CAAC,OAAO,CAAC,CAAC,CAAC,CAAC,CAAC,CAAE,CAA6B,CAAC,CAAC,CAAC,EAAE,CAAC;IACxG,CAAC;IAAC,MAAM,CAAC;QACP,OAAO,EAAE,CAAC;IACZ,CAAC;AACH,CAAC;AAED,gHAAgH;AAChH,MAAM,UAAU,gBAAgB,CAAC,IAAY,EAAE,MAAc;IAC3D,OAAO,IAAI,KAAK,CAAC,GAAG,IAAI,kBAAkB,MAAM,EAAE,CAAC,CAAC;AACtD,CAAC;AAOD;;;GAGG;AACH,MAAM,OAAO,UAAU;IACZ,OAAO,GAAG,IAAI,GAAG,EAAuB,CAAC;IAClD,GAAG,CAAC,GAAW,EAAE,GAAW;QAC1B,MAAM,CAAC,GAAG,IAAI,CAAC,OAAO,CAAC,GAAG,CAAC,GAAG,CAAC,CAAC;QAChC,OAAO,CAAC,KAAK,SAAS,IAAI,CAAC,CAAC,SAAS,GAAG,MAAM,GAAG,GAAG,CAAC,CAAC,CAAC,CAAC,CAAC,KAAK,CAAC,CAAC,CAAC,SAAS,CAAC;IAC7E,CAAC;IACD,GAAG,CAAC,GAAW,EAAE,KAAa,EAAE,gBAAyB,EAAE,GAAW;QACpE,MAAM,CAAC,GAAG,OAAO,gBAAgB,KAAK,QAAQ,IAAI,MAAM,CAAC,QAAQ,CAAC,gBAAgB,CAAC,IAAI,gBAAgB,GAAG,CAAC,CAAC,CAAC,CAAC,gBAAgB,CAAC,CAAC,CAAC,GAAG,CAAC;QACrI,IAAI,CAAC,OAAO,CAAC,GAAG,CAAC,GAAG,EAAE,EAAE,KAAK,EAAE,SAAS,EAAE,GAAG,GAAG,CAAC,GAAG,IAAI,EAAE,CAAC,CAAC;IAC9D,CAAC;CACF;AAED,+GAA+G;AAC/G,MAAM,UAAU,MAAM,CAAC,GAAW,EAAE,IAAY;IAC9C,IAAI,CAAC;QACH,MAAM,CAAC,GAAG,IAAI,GAAG,CAAC,GAAG,CAAC,CAAC;QACvB,OAAO,CAAC,CAAC,QAAQ,KAAK,QAAQ,IAAI,CAAC,CAAC,IAAI,KAAK,EAAE,IAAI,CAAC,CAAC,CAAC,QAAQ,KAAK,IAAI,IAAI,CAAC,CAAC,QAAQ,CAAC,QAAQ,CAAC,IAAI,IAAI,EAAE,CAAC,CAAC,CAAC;IAC9G,CAAC;IAAC,MAAM,CAAC;QACP,OAAO,KAAK,CAAC;IACf,CAAC;AACH,CAAC"}

package/dist/agent/meetings/native-meet.d.ts

@@ -0,0 +1,6 @@
+import type { NativeTranscriptSource } from "@open-everywhere/core/agent/adapter-api.js";
+import { type NativeFetch } from "./native-http.js";
+export declare const MEET_SCOPE = "https://www.googleapis.com/auth/meetings.space.readonly";
+export declare const MEET_ACCESS_HINT = "In the Google Workspace Admin console, grant the service account's client id domain-wide delegation of https://www.googleapis.com/auth/meetings.space.readonly, and enable the Google Meet REST API in its Cloud project.";
+export declare function meetTranscriptSource(fetchImpl?: NativeFetch, now?: () => number): NativeTranscriptSource;
+//# sourceMappingURL=native-meet.d.ts.map

package/dist/agent/meetings/native-meet.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"native-meet.d.ts","sourceRoot":"","sources":["../../../agent/meetings/native-meet.ts"],"names":[],"mappings":"AAgBA,OAAO,KAAK,EAA0B,sBAAsB,EAAgE,MAAM,4CAA4C,CAAC;AAC/K,OAAO,EAAuD,KAAK,WAAW,EAAc,MAAM,kBAAkB,CAAC;AAIrH,eAAO,MAAM,UAAU,4DAA4D,CAAC;AAGpF,eAAO,MAAM,gBAAgB,8NACgM,CAAC;AA0B9N,wBAAgB,oBAAoB,CAAC,SAAS,GAAE,WAAwB,EAAE,GAAG,GAAE,MAAM,MAAiB,GAAG,sBAAsB,CAyH9H"}