clavarium-tether 0.1.0-next.13 → 0.1.0-next.15

package/host/connectors/contacts.mjs

@@ -65,10 +65,18 @@ export function contacts({ fetch: fetchImpl = globalThis.fetch } = {}) {
 
     async function googleList(target, ctx) {
         const base = CARDDAV(userOf(target));
+        const basePath = (() => { try { return new URL(base).pathname.replace(/\/+$/, ''); } catch { return ''; } })();
         const listed = await req(target, ctx, 'PROPFIND', base, { headers: { Depth: '1', 'Content-Type': 'application/xml; charset=utf-8' }, body: PROPFIND });
         if (!listed.ok) no(`${target.title}: the address book could not be read (${listed.status})`);
-        /* The collection lists itself and its contacts; keep the vCard entries. */
-        const hrefs = hrefsIn(await listed.text()).filter((h) => /\.vcf(\?|$)/i.test(h)).slice(0, LIST_MAX);
+        /* The collection lists itself and its contacts; keep the entries, whatever
+           they are named (Google uses an id, not a .vcf suffix). A contact is any
+           href under the collection that is not the collection itself. */
+        const hrefs = hrefsIn(await listed.text()).filter((h) => {
+            const clean = h.replace(/[?#].*$/, '');
+            if (!clean || clean.endsWith('/')) return false;
+            let p; try { p = new URL(h, base).pathname.replace(/\/+$/, ''); } catch { p = clean.replace(/\/+$/, ''); }
+            return p !== basePath;
+        }).slice(0, LIST_MAX);
         if (!hrefs.length) return [];
         const body = `<?xml version="1.0" encoding="utf-8"?><C:addressbook-multiget xmlns:D="DAV:" xmlns:C="urn:ietf:params:xml:ns:carddav"><D:prop><D:getetag/><C:address-data/></D:prop>${hrefs.map((h) => `<D:href>${h.replace(/&/g, '&amp;').replace(/</g, '&lt;')}</D:href>`).join('')}</C:addressbook-multiget>`;
         const res = await req(target, ctx, 'REPORT', base, { headers: { Depth: '1', 'Content-Type': 'application/xml; charset=utf-8' }, body });

package/host/oauth.mjs

@@ -35,11 +35,13 @@ const b64url = (buf) => Buffer.from(buf).toString('base64url');
    field, kept by that name for its callers). WHICH client matters: a client is
    only granted the scopes its app was verified for. For GOOGLE we borrow GNOME
    Online Accounts' client, verified for mail AND calendar AND contacts, so one
-   consent gives all three. For MICROSOFT we use Thunderbird's client, verified
-   for mail (IMAP) only; Microsoft calendar/contacts go over Graph and need a
-   Graph-verified client. `consentExtra` is what a provider needs on the consent
-   URL to return a refresh token; `offlineScope` is the same thing when it is a
-   scope rather than a parameter (Microsoft). */
+   consent gives all three. For MICROSOFT we use Thunderbird's own client; both
+   are multitenant public clients that take any delegated scope the person
+   consents to, and both registered the loopback 127.0.0.1 redirect (any port), so
+   mail, calendar and contacts go over Graph on the same copy-pastable address.
+   `consentExtra` is what a provider needs on the consent URL to return a refresh
+   token; `offlineScope` is the same thing when it is a scope rather than a
+   parameter (Microsoft). */
 export const PROVIDERS = {
     google: {
         label: 'Google',
@@ -68,17 +70,21 @@ export const PROVIDERS = {
         pkce: true,
         consentExtra: {},
         offlineScope: 'offline_access',
-        /* Microsoft over Graph: GNOME Online Accounts' client is a Graph client,
-           so mail, calendar and contacts all go through graph.microsoft.com (the
-           mail connector uses its Graph path for Microsoft). mail.send is needed
-           to send. GOA's client is verified for all of these. */
+        /* Microsoft over Graph: mail, calendar and contacts all go through
+           graph.microsoft.com (the mail connector uses its Graph path for
+           Microsoft). mail.send is needed to send. Thunderbird's public client
+           takes these delegated scopes by dynamic consent. */
         scopes: {
             mail: 'mail.readwrite mail.send',
             calendar: 'calendars.readwrite',
             contacts: 'contacts.readwrite',
         },
+        /* Thunderbird's built-in Microsoft client (open source, public, no secret;
+           comm-central OAuth2Providers.sys.mjs). It registered the loopback
+           127.0.0.1 redirect on ANY port, so we reuse the same http://127.0.0.1
+           address as Google. */
         thunderbird: {
-            clientId: 'b155a604-3c31-4079-93b0-6bb6aa9d5464',
+            clientId: '9e5f94bc-e8a4-4e73-b8be-63364c29d753',
             clientSecret: null,
         },
     },

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "clavarium-tether",
-  "version": "0.1.0-next.13",
+  "version": "0.1.0-next.15",
   "description": "Clavarium Tether: an AI agent acts outside its own machine on a tether: levels per target, a person's approval, a journal and a stop (a command and an MCP server for agents, a keeper and a screen for the application). One dependency: ssh2, for the SSH connector.",
   "license": "MIT",
   "homepage": "https://github.com/clavarium/clavarium-tether#readme",

package/server/name.mjs

@@ -6,7 +6,7 @@
 export const NAME = 'tether';
 export const PRODUCT = 'Clavarium Tether';
 export const PACKAGE = `clavarium-${NAME}`;
-export const VERSION = '0.1.0-next.13';
+export const VERSION = '0.1.0-next.15';
 /* The agent's folder: where its asks and the keeper's answers are written. */
 export const FOLDER = `.${NAME}`;
 /* $TETHER_DIR: the agent's folder; $TETHER_STORE: the keeper's store (serve). */