crewly 1.20.264 → 1.20.266

package/dist/backend/backend/src/constants.js

@@ -3927,6 +3927,35 @@ export const SLACK_RECONNECT_CONSTANTS = {
     /** Number of consecutive ping failures before forcing a reconnect */
     PING_FAILURES_BEFORE_RECONNECT: 2,
 };
+/**
+ * Fetching a Slack file by link or id (`slack-file get`, and files linked
+ * in an inbound message). Local bot tokens first, then Crewly Cloud, which
+ * holds every bot of the account (`POST /api/cloud/slack/files/fetch`).
+ */
+export const SLACK_FILE_FETCH_CONSTANTS = {
+    /** Largest file fetched (bytes) — same cap as Cloud */
+    MAX_BYTES: 25 * 1024 * 1024,
+    /** Cloud endpoint, appended to the cloud URL */
+    CLOUD_FETCH_PATH: '/api/cloud/slack/files/fetch',
+    /** Header carrying the file metadata on Cloud's raw answer (base64url JSON) */
+    CLOUD_META_HEADER: 'x-crewly-slack-file',
+    /** Local bot tokens tried at most */
+    MAX_LOCAL_CANDIDATES: 12,
+    /** Slack API / Cloud call timeout (ms) */
+    API_TIMEOUT_MS: 15_000,
+    /** Download timeout (ms) */
+    DOWNLOAD_TIMEOUT_MS: 60_000,
+    /** Redirect hops followed on a download */
+    MAX_REDIRECTS: 5,
+    /** Linked files auto-fetched per inbound message */
+    MAX_LINKED_PER_MESSAGE: 3,
+    /** Linked files larger than this are not auto-fetched (the agent can still run `slack-file get`) */
+    MAX_LINKED_BYTES: 5 * 1024 * 1024,
+    /** Lines of a text file shown inline by the skill */
+    PREVIEW_LINES: 20,
+    /** Characters of a text file shown inline by the skill */
+    PREVIEW_CHARS: 2000,
+};
 export const SLACK_FILE_DOWNLOAD_CONSTANTS = {
     /** Temp directory for downloaded files (relative to ~/.crewly/) */
     TEMP_DIR: 'tmp/slack-files',
@@ -4328,6 +4357,27 @@ export const GOOGLE_WORKSPACE_CONSTANTS = {
      * accept only `drive` or `drive.file`). Optional on the Cloud grant.
      */
     DRIVE_FULL_SCOPE: 'https://www.googleapis.com/auth/drive',
+    /**
+     * Gmail compose scope. `drafts.create` / `drafts.send` need it; grants made
+     * before 2026-10-08 carry only `gmail.readonly` + `gmail.send` and answer
+     * drafts with 403 "insufficient authentication scopes". Optional on the
+     * Cloud grant, like {@link DRIVE_FULL_SCOPE}.
+     */
+    GMAIL_COMPOSE_SCOPE: 'https://www.googleapis.com/auth/gmail.compose',
+    /**
+     * Reconnect cards the harness posts to the owner when a Google call fails
+     * for want of a scope, or because the grant expired / was revoked.
+     */
+    REAUTH: {
+        /** At most one card per product + Google account in this window (ms) */
+        CARD_THROTTLE_MS: 6 * 60 * 60 * 1000,
+        /** How often to check whether the owner reconnected (ms) */
+        POLL_INTERVAL_MS: 30_000,
+        /** Keep checking this long after the card's link expires (consent may still be finishing) (ms) */
+        POLL_GRACE_MS: 10 * 60 * 1000,
+        /** Give up posting the card after this long, so the skill call is not held (ms) */
+        POST_TIMEOUT_MS: 8_000,
+    },
     /** Comments fetched per Drive `comments.list` page (Google's max is 100) */
     COMMENTS_PAGE_SIZE: 100,
     /** Pages read per `docs-comment list` before stopping (caps a huge thread) */
@@ -7120,6 +7170,33 @@ export const REMOTE_MCP_CONSTANTS = {
     MAX_TOOL_NAMES: 50,
     /** Catalog presets the add form offers. */
     PROVIDERS: ['zoho', 'custom'],
+    /**
+     * OAuth state (clients, tokens, pending sign-ins) under CREWLY_HOME:
+     * AES-256-GCM with the install's master key, mode 0600.
+     */
+    OAUTH_STORE_FILE: 'remote-mcp-oauth.enc',
+    /** Master key the OAuth store is encrypted with (under CREWLY_HOME). */
+    OAUTH_MASTER_KEY_FILE: 'credentials/master.key',
+    /** Cloud broker that hosts the public redirect URI (crewly-services auth). */
+    OAUTH_CLOUD_PATH: '/api/cloud/mcp-oauth',
+    /** Client name sent in dynamic client registration. */
+    OAUTH_CLIENT_NAME: 'Crewly',
+    /** Refresh an access token this long before it expires (Zoho's last ~1 h). */
+    OAUTH_REFRESH_MARGIN_MS: 5 * 60_000,
+    /** Assumed lifetime when the token endpoint omits expires_in. */
+    OAUTH_DEFAULT_TOKEN_TTL_MS: 60 * 60_000,
+    /** Discovery / registration / token request timeout. */
+    OAUTH_REQUEST_TIMEOUT_MS: 15_000,
+    /** Poll the Cloud broker this often while the link is untapped. */
+    OAUTH_POLL_SLOW_MS: 20_000,
+    /** ...and this often once the owner has opened it. */
+    OAUTH_POLL_FAST_MS: 2_000,
+    /** Post the "sign in" card for a server at most this often while its link is unused. */
+    OAUTH_CARD_THROTTLE_MS: 6 * 60 * 60_000,
+    /** Agent → backend proxy path suffix: `/api/connectors/remote-mcp/<id>/mcp`. */
+    PROXY_SUFFIX: '/mcp',
+    /** JSON-RPC error code the proxy answers with when the owner must sign in. */
+    PROXY_NEEDS_AUTH_RPC_CODE: -32001,
 };
 /**
  * Reconciler wake pacing (CREW-304). On 2026-10-06 the reconciler traced