@ryuu-reinzz/ryuu-cli 0.4.3 → 0.5.0

package/plugins/google-drive/secret.js

@@ -0,0 +1,50 @@
+import crypto from 'node:crypto';
+
+/**
+ * Kunci khusus login Google Drive.
+ *
+ * Terpisah total dari root key proyek API (`ROOT_KEY_SECRET`): root key itu
+ * membuka seluruh endpoint admin, sedangkan kunci ini hanya menerima satu
+ * endpoint OAuth Drive dan tidak berlaku di tempat lain.
+ *
+ * Penyimpanan: 32 byte bahan dipecah menjadi empat potongan 8 byte, tiap
+ * potongan di-XOR dengan mask sendiri, lalu ditulis sebagai hex supaya tidak
+ * terlihat sebagai kunci saat file dibaca sekilas. Nilai yang dikirim ke
+ * jaringan bukan bahan itu sendiri, melainkan turunan HMAC-SHA256-nya,
+ * sehingga string di dalam file tidak bisa langsung dipakai sebagai header.
+ *
+ * Tidak ada command, config, atau environment variable yang dapat mengubah
+ * kunci ini: nilainya bawaan aplikasi dan hanya dipakai saat `/drive login`
+ * (serta refresh/revoke token, yang tetap bagian dari siklus login).
+ */
+export const DRIVE_LOGIN_HEADER = 'x-ryuu-drive-auth';
+
+// 4 x 8 byte. `_m` = mask XOR tiap potongan.
+const _p = [
+  ['4fbd2524004ef3b6', 90],
+  ['61d480876c0cfe13', 63],
+  ['906bb071fff129ea', 199],
+  ['d581636291c5b1f4', 145],
+];
+const _l = 'ryuu.drive.login.v1';
+
+let _cached = null;
+
+function material() {
+  if (!_cached) {
+    _cached = Buffer.concat(
+      _p.map(([hex, mask]) => Buffer.from(hex, 'hex').map((byte) => byte ^ mask)),
+    );
+  }
+  return _cached;
+}
+
+/** Token header turunan (base64url, 43 karakter). Tidak pernah dicetak. */
+export function driveLoginToken() {
+  return crypto.createHmac('sha256', material()).update(_l).digest('base64url');
+}
+
+/** Header siap pakai untuk backend API. */
+export function driveLoginHeaders() {
+  return { [DRIVE_LOGIN_HEADER]: driveLoginToken() };
+}

package/plugins/google-drive/token-client.js

@@ -0,0 +1,80 @@
+import { request as gaxiosRequest } from 'gaxios';
+import { RyuuError } from '../../src/utils/errors.js';
+
+/**
+ * Auth client minimal untuk googleapis.
+ *
+ * googleapis hanya butuh objek dengan `request()` (dan `getRequestHeaders()`
+ * untuk HTTP/2), jadi plugin tidak memakai google-auth-library sama sekali:
+ * tidak ada client id, client secret, atau refresh langsung ke Google. Saat
+ * access token kedaluwarsa, `onRefresh` meminta token baru ke backend API
+ * (satu-satunya pemegang Client Secret).
+ */
+
+const AUTH_ERROR = 'DRIVE_AUTH';
+const REFRESH_MARGIN_MS = 60 * 1000;
+
+export class BackendTokenAuth {
+  constructor({ accessToken, expiresAt = null, onRefresh = null, logger = null }) {
+    this.accessToken = accessToken || null;
+    this.expiresAt = Number.isFinite(expiresAt) ? expiresAt : null;
+    this.onRefresh = onRefresh;
+    this.logger = logger;
+    this.refreshing = null;
+  }
+
+  setTokens({ accessToken, expiresAt = null }) {
+    this.accessToken = accessToken || null;
+    this.expiresAt = Number.isFinite(expiresAt) ? expiresAt : null;
+    return this;
+  }
+
+  get expired() {
+    if (!this.expiresAt) return false;
+    return Date.now() > this.expiresAt - REFRESH_MARGIN_MS;
+  }
+
+  async ensureToken() {
+    if (!this.accessToken) {
+      throw new RyuuError('Access token Google Drive tidak tersedia. Jalankan /drive login.', {
+        code: 'DRIVE_UNAUTHORIZED',
+      });
+    }
+    if (!this.expired || typeof this.onRefresh !== 'function') return this.accessToken;
+    if (!this.refreshing) {
+      this.refreshing = Promise.resolve()
+        .then(() => this.onRefresh())
+        .then((tokens) => {
+          if (tokens?.accessToken) {
+            this.setTokens({ accessToken: tokens.accessToken, expiresAt: tokens.expiryDate });
+          }
+          return this.accessToken;
+        })
+        .finally(() => {
+          this.refreshing = null;
+        });
+    }
+    return this.refreshing;
+  }
+
+  async getRequestHeaders() {
+    const token = await this.ensureToken();
+    return { Authorization: `Bearer ${token}` };
+  }
+
+  async getAccessToken() {
+    return { token: await this.ensureToken() };
+  }
+
+  async getUniverseDomain() {
+    return undefined;
+  }
+
+  /** Dipakai googleapis-common: setiap request Drive lewat jalur ini. */
+  async request(options = {}) {
+    const token = await this.ensureToken();
+    const headers = { ...(options.headers || {}), Authorization: `Bearer ${token}` };
+    const response = await gaxiosRequest({ ...options, headers });
+    return response;
+  }
+}

package/plugins/google-drive/tool-helpers.js

@@ -0,0 +1,46 @@
+import path from 'node:path';
+import { RyuuError, PathEscapeError } from '../../src/utils/errors.js';
+
+/** Shared helpers for the Google Drive tool definitions. */
+
+const KB = 1024;
+const MB = KB * 1024;
+const GB = MB * 1024;
+
+export function formatBytes(bytes) {
+  if (bytes === null || bytes === undefined || Number.isNaN(Number(bytes))) return 'tidak diketahui';
+  const value = Number(bytes);
+  if (value < KB) return `${value} B`;
+  if (value < MB) return `${(value / KB).toFixed(1)} KB`;
+  if (value < GB) return `${(value / MB).toFixed(1)} MB`;
+  return `${(value / GB).toFixed(2)} GB`;
+}
+
+/** Resolve a model-supplied local path inside the workspace, or refuse it. */
+export function resolveLocal(ctx, plugin, inputPath, { mustExist = false } = {}) {
+  const workspace = ctx?.workspace || plugin.workspace;
+  if (!workspace) {
+    throw new RyuuError('Workspace tidak tersedia untuk memvalidasi path lokal.', { code: 'DRIVE_PATH' });
+  }
+  const requested = String(inputPath ?? '').trim();
+  if (!requested) throw new RyuuError('Path lokal wajib diisi.', { code: 'DRIVE_PATH' });
+  if (path.isAbsolute(requested)) {
+    throw new PathEscapeError(
+      `Path lokal harus relatif terhadap workspace, bukan absolut: ${requested}`,
+      { workspace: workspace.root, requested },
+    );
+  }
+  const resolved = workspace.resolve(requested, { mustExist });
+  workspace.assertNotSecret?.(resolved.relPath);
+  return resolved;
+}
+
+/** Settings needed by the tools, loaded once per call. */
+export async function loadSettings(plugin) {
+  return plugin.loadConfig();
+}
+
+export function fileLine(file) {
+  const kind = file.isFolder ? 'folder' : formatBytes(file.size);
+  return `  ${file.name}  ·  ${kind}  ·  id: ${file.id}  ·  ${file.modifiedTime || '-'}`;
+}

package/plugins/google-drive/tools-backup.js

@@ -0,0 +1,204 @@
+import { defineTool } from '../../src/tools/registry.js';
+import { formatBytes, resolveLocal } from './tool-helpers.js';
+import { backupToDrive, deleteBackup, listBackups, restoreFromDrive } from './backup.js';
+
+/**
+ * Backup, restore and Drive-information tools.
+ *
+ * `drive_delete_backup` and a restore that overwrites local files are declared
+ * as `destructive`, so the CLI approval manager asks the user before they run.
+ */
+export function createBackupTools(plugin) {
+  const destructiveRestore = (args) => (args?.overwrite ? 'critical' : 'normal');
+
+  return [
+    defineTool({
+      name: 'drive_backup',
+      description:
+        'Backup a local project directory into a ZIP archive on Google Drive. Use this instead of making an archive yourself: it walks the directory, applies exclusion patterns, streams the ZIP, uploads it and returns the file id and Drive link.',
+      risk: 'write',
+      requiresApproval: true,
+      schema: {
+        type: 'object',
+        properties: {
+          sourcePath: {
+            type: 'string',
+            description: 'Directory to back up, relative to the workspace root. Default ".".',
+          },
+          destinationFolderId: {
+            type: 'string',
+            description: 'Google Drive folder id for the archive. Omit to use the default backup folder, or "root".',
+          },
+          archiveName: {
+            type: 'string',
+            description: 'Archive file name; must end in .zip. Omit for <name>-backup-YYYYMMDD-HHmmss.zip.',
+          },
+          excludePatterns: {
+            type: 'array',
+            items: { type: 'string' },
+            description:
+              'Extra glob patterns to exclude (e.g. ["dist", "*.sqlite"]). node_modules, .git, .env, keys and caches are always excluded.',
+          },
+          includePatterns: {
+            type: 'array',
+            items: { type: 'string' },
+            description: 'Optional allow-list of glob patterns; when set, only matching files are archived.',
+          },
+          compressionLevel: {
+            type: 'integer',
+            minimum: 0,
+            maximum: 9,
+            description: 'Deflate level 0-9 (0 stores files without compression). Default 6.',
+          },
+        },
+        required: ['sourcePath'],
+      },
+      async handler(args, ctx) {
+        const drive = await plugin.requireClient();
+        const settings = await plugin.loadConfig();
+        const source = resolveLocal(ctx, plugin, args.sourcePath || '.', { mustExist: true });
+        const result = await backupToDrive({
+          drive,
+          sourceRoot: source.realPath,
+          destinationFolderId: args.destinationFolderId || settings.defaultBackupFolder || 'root',
+          archiveName: args.archiveName || null,
+          excludePatterns: [...(args.excludePatterns || [])],
+          includePatterns: args.includePatterns || [],
+          compressionLevel: args.compressionLevel ?? 6,
+          maxUploadSize: settings.maxUploadSize,
+          signal: ctx?.signal || null,
+          logger: plugin.logger,
+        });
+        return {
+          ok: true,
+          ...result,
+          sizeLabel: formatBytes(result.size),
+          excludedPatterns: result.excludedPatterns,
+        };
+      },
+    }),
+
+    defineTool({
+      name: 'drive_restore',
+      description:
+        'Download a backup ZIP from Google Drive and extract it into a local directory. Use drive_list_backups first to pick the right archive. Existing files are never replaced unless overwrite=true is passed explicitly.',
+      risk: 'write',
+      requiresApproval: true,
+      assess: destructiveRestore,
+      schema: {
+        type: 'object',
+        properties: {
+          fileId: { type: 'string', description: 'Google Drive file id of the backup archive.' },
+          destinationPath: {
+            type: 'string',
+            description: 'Destination directory relative to the workspace root (created when missing). Default "restore".',
+          },
+          overwrite: {
+            type: 'boolean',
+            description: 'Replace files that already exist. Default false, which stops the restore instead of overwriting.',
+          },
+        },
+        required: ['fileId'],
+      },
+      async handler(args, ctx) {
+        const drive = await plugin.requireClient();
+        const target = resolveLocal(ctx, plugin, args.destinationPath || 'restore');
+        const result = await restoreFromDrive({
+          drive,
+          fileId: args.fileId,
+          destinationRoot: target.realPath,
+          overwrite: Boolean(args.overwrite),
+          signal: ctx?.signal || null,
+          logger: plugin.logger,
+        });
+        return { ok: true, ...result, bytesLabel: formatBytes(result.bytes) };
+      },
+    }),
+
+    defineTool({
+      name: 'drive_list_backups',
+      description: 'List ZIP backup archives stored in a Google Drive folder, newest first.',
+      risk: 'read',
+      schema: {
+        type: 'object',
+        properties: {
+          folderId: { type: 'string', description: 'Folder id to list. Omit for the default backup folder, or "root".' },
+          pageSize: { type: 'integer', minimum: 1, maximum: 100, description: 'Maximum archives to return (default 25).' },
+          pageToken: { type: 'string', description: 'Opaque token from a previous call, for the next page.' },
+        },
+      },
+      async handler(args) {
+        const drive = await plugin.requireClient();
+        const settings = await plugin.loadConfig();
+        const result = await listBackups({
+          drive,
+          folderId: args.folderId || settings.defaultBackupFolder || 'root',
+          pageSize: args.pageSize ?? 25,
+          pageToken: args.pageToken || null,
+        });
+        return {
+          ok: true,
+          folderId: result.folderId ?? args.folderId ?? settings.defaultBackupFolder ?? 'root',
+          backups: result.backups.map((file) => ({ ...file, sizeLabel: formatBytes(file.size) })),
+          count: result.backups.length,
+          nextPageToken: result.nextPageToken,
+        };
+      },
+    }),
+
+    defineTool({
+      name: 'drive_delete_backup',
+      description:
+        'Permanently delete one backup archive (.zip) from Google Drive. This is destructive and only accepts archive files: ask the user for explicit confirmation before calling it.',
+      risk: 'destructive',
+      requiresApproval: true,
+      assess: () => 'critical',
+      schema: {
+        type: 'object',
+        properties: {
+          fileId: { type: 'string', description: 'Google Drive file id of the backup archive to delete.' },
+        },
+        required: ['fileId'],
+      },
+      async handler(args) {
+        const drive = await plugin.requireClient();
+        return { ok: true, ...(await deleteBackup({ drive, fileId: args.fileId })) };
+      },
+    }),
+
+    defineTool({
+      name: 'drive_storage_info',
+      description: 'Read the connected Google account storage quota from the Drive API (limit, usage and Drive usage).',
+      risk: 'read',
+      schema: { type: 'object', properties: {} },
+      async handler() {
+        const client = await plugin.requireClient();
+        const about = await client.getAbout();
+        const quota = about.storageQuota || {};
+        return {
+          ok: true,
+          email: about.email,
+          limit: quota.limit ?? null,
+          usage: quota.usage ?? null,
+          usageInDrive: quota.usageInDrive ?? null,
+          usageInDriveTrash: quota.usageInDriveTrash ?? null,
+          limitLabel: formatBytes(quota.limit),
+          usageLabel: formatBytes(quota.usage),
+          freeLabel: quota.limit && quota.usage !== null ? formatBytes(Math.max(quota.limit - quota.usage, 0)) : 'tidak tersedia',
+        };
+      },
+    }),
+
+    defineTool({
+      name: 'drive_get_account',
+      description: 'Return the Google account currently connected to Google Drive (name, email, permission id).',
+      risk: 'read',
+      schema: { type: 'object', properties: {} },
+      async handler() {
+        const client = await plugin.requireClient();
+        const about = await client.getAbout();
+        return { ok: true, ...about };
+      },
+    }),
+  ];
+}