crewly 1.5.22 → 1.6.1

package/dist/cli/backend/src/services/credential/credential-store.service.d.ts

@@ -0,0 +1,161 @@
+/**
+ * Credential Store Service
+ *
+ * Manages the workspace-level credential registry and per-credential
+ * encrypted payload files under `~/.crewly/credentials/`.
+ *
+ * The store is split into two surfaces:
+ *
+ * - **Metadata API** (`listCredentials`, `getCredential`, `findCredentialsByProvider`):
+ *   returns `CredentialRegistryEntry` objects containing only non-secret
+ *   information (id, name, provider, scopes, email, timestamps). Safe to
+ *   expose to agent / LLM context and over MCP.
+ *
+ * - **Payload API** (`getPayload`, `setPayload`): decrypts the per-credential
+ *   `.enc` file to return the actual token value(s). **Intended only for
+ *   credential helpers and the skill executor** (which injects values into
+ *   skill subprocess env vars). Callers must never return payload contents
+ *   to agent/LLM context.
+ *
+ * Encrypted file format and threat model: see `utils/encryption.utils.ts`.
+ *
+ * @module services/credential/credential-store.service
+ */
+import { CredentialRegistryEntry, CredentialPayload, GoogleOAuthPayload, CredentialType, CredentialHelperName, CredentialStatus } from '../../types/credential.types.js';
+/**
+ * Arguments for adding an API key credential.
+ */
+export interface AddApiKeyInput {
+    /** User-provided display name (must be unique recommended, not enforced). */
+    name: string;
+    /** Provider identifier (e.g., "gemini", "openai"). */
+    provider: string;
+    /** The actual API key value — never logged or returned to agent. */
+    value: string;
+}
+/**
+ * Arguments for adding an OAuth credential (usually produced by a helper's
+ * capture flow).
+ */
+export interface AddOAuthInput {
+    /** User-provided display name. */
+    name: string;
+    /** Provider identifier (e.g., "google"). */
+    provider: string;
+    /** Which helper manages refresh for this credential. */
+    helper: CredentialHelperName;
+    /** Full OAuth token payload captured from the helper's login flow. */
+    payload: GoogleOAuthPayload;
+}
+/**
+ * Updatable metadata fields on a credential. Other fields are managed
+ * internally (id, type, provider, encFile, createdAt).
+ */
+export interface UpdateCredentialMetadata {
+    name?: string;
+    status?: CredentialStatus;
+    lastUsedAt?: string;
+    expiresAt?: number;
+    scopes?: string[];
+    accountEmail?: string;
+}
+/**
+ * Options for constructing a `CredentialStoreService`. Intended mainly for
+ * tests — production uses the default paths under `~/.crewly/credentials/`.
+ */
+export interface CredentialStoreOptions {
+    /** Override the credentials directory (default: `~/.crewly/credentials`). */
+    dir?: string;
+    /** Override the master.key file path (default: `<dir>/master.key`). */
+    masterKeyPath?: string;
+}
+/**
+ * File-based credential store.
+ */
+export declare class CredentialStoreService {
+    private readonly dir;
+    private readonly registryPath;
+    private readonly masterKeyPath;
+    private initialized;
+    constructor(options?: CredentialStoreOptions);
+    /**
+     * Ensure the credentials directory and master.key exist. Called
+     * automatically by every public method — safe to invoke explicitly
+     * for eager initialization.
+     */
+    init(): Promise<void>;
+    /**
+     * List all credentials' metadata. Does not include secret values.
+     */
+    listCredentials(): Promise<CredentialRegistryEntry[]>;
+    /**
+     * Get a single credential's metadata by id.
+     *
+     * @throws CredentialNotFoundError if no entry with that id exists
+     */
+    getCredential(id: string): Promise<CredentialRegistryEntry>;
+    /**
+     * Find all credentials for a given provider, optionally filtered by type.
+     */
+    findCredentialsByProvider(provider: string, type?: CredentialType): Promise<CredentialRegistryEntry[]>;
+    /**
+     * Add a new API key credential. The value is encrypted on disk and
+     * never exposed back through the metadata API.
+     */
+    addApiKey(input: AddApiKeyInput): Promise<CredentialRegistryEntry>;
+    /**
+     * Add a new OAuth credential. Typically called by a helper's capture
+     * flow after completing an OAuth exchange.
+     */
+    addOAuth(input: AddOAuthInput): Promise<CredentialRegistryEntry>;
+    /**
+     * Update a credential's metadata. Does not touch the encrypted payload.
+     * Use `setPayload` to rewrite the secret material (e.g., after refresh).
+     *
+     * @throws CredentialNotFoundError if no entry with that id exists
+     */
+    updateCredential(id: string, patch: UpdateCredentialMetadata): Promise<CredentialRegistryEntry>;
+    /**
+     * Delete a credential (removes registry entry and encrypted payload).
+     * The registry removal is authoritative — if the `.enc` file is missing
+     * for any reason, that is not an error.
+     *
+     * @throws CredentialNotFoundError if no entry with that id exists
+     */
+    deleteCredential(id: string): Promise<void>;
+    /**
+     * Decrypt and return the credential's payload. **Do not return the
+     * result to agent / LLM contexts** — intended only for helpers
+     * refreshing tokens and the skill executor injecting env vars.
+     *
+     * @throws CredentialNotFoundError if no entry with that id exists
+     */
+    getPayload(id: string): Promise<CredentialPayload>;
+    /**
+     * Encrypt and write a new payload for an existing credential. Used by
+     * helpers after a successful token refresh.
+     *
+     * @throws CredentialNotFoundError if no entry with that id exists
+     */
+    setPayload(id: string, payload: CredentialPayload): Promise<void>;
+    private readRegistry;
+    private writeRegistry;
+    private appendEntry;
+    private encFilePath;
+    private writePayload;
+    private newId;
+}
+/**
+ * Get the process-wide CredentialStoreService singleton.
+ */
+export declare function getCredentialStoreService(): CredentialStoreService;
+/**
+ * Reset the singleton — for tests only.
+ */
+export declare function resetCredentialStoreService(): void;
+/**
+ * Replace the singleton with a specific instance — for tests only.
+ * Allows route/controller tests to point the store at a scratch directory.
+ */
+export declare function _setCredentialStoreForTesting(svc: CredentialStoreService): void;
+//# sourceMappingURL=credential-store.service.d.ts.map

package/dist/cli/backend/src/services/credential/credential-store.service.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"credential-store.service.d.ts","sourceRoot":"","sources":["../../../../../../backend/src/services/credential/credential-store.service.ts"],"names":[],"mappings":"AAAA;;;;;;;;;;;;;;;;;;;;;;GAsBG;AAMH,OAAO,EAEL,uBAAuB,EACvB,iBAAiB,EAEjB,kBAAkB,EAClB,cAAc,EACd,oBAAoB,EACpB,gBAAgB,EAEjB,MAAM,iCAAiC,CAAC;AAgCzC;;GAEG;AACH,MAAM,WAAW,cAAc;IAC7B,6EAA6E;IAC7E,IAAI,EAAE,MAAM,CAAC;IACb,sDAAsD;IACtD,QAAQ,EAAE,MAAM,CAAC;IACjB,oEAAoE;IACpE,KAAK,EAAE,MAAM,CAAC;CACf;AAED;;;GAGG;AACH,MAAM,WAAW,aAAa;IAC5B,kCAAkC;IAClC,IAAI,EAAE,MAAM,CAAC;IACb,4CAA4C;IAC5C,QAAQ,EAAE,MAAM,CAAC;IACjB,wDAAwD;IACxD,MAAM,EAAE,oBAAoB,CAAC;IAC7B,sEAAsE;IACtE,OAAO,EAAE,kBAAkB,CAAC;CAC7B;AAED;;;GAGG;AACH,MAAM,WAAW,wBAAwB;IACvC,IAAI,CAAC,EAAE,MAAM,CAAC;IACd,MAAM,CAAC,EAAE,gBAAgB,CAAC;IAC1B,UAAU,CAAC,EAAE,MAAM,CAAC;IACpB,SAAS,CAAC,EAAE,MAAM,CAAC;IACnB,MAAM,CAAC,EAAE,MAAM,EAAE,CAAC;IAClB,YAAY,CAAC,EAAE,MAAM,CAAC;CACvB;AAMD;;;GAGG;AACH,MAAM,WAAW,sBAAsB;IACrC,6EAA6E;IAC7E,GAAG,CAAC,EAAE,MAAM,CAAC;IACb,uEAAuE;IACvE,aAAa,CAAC,EAAE,MAAM,CAAC;CACxB;AAED;;GAEG;AACH,qBAAa,sBAAsB;IACjC,OAAO,CAAC,QAAQ,CAAC,GAAG,CAAS;IAC7B,OAAO,CAAC,QAAQ,CAAC,YAAY,CAAS;IACtC,OAAO,CAAC,QAAQ,CAAC,aAAa,CAAS;IACvC,OAAO,CAAC,WAAW,CAAS;gBAEhB,OAAO,CAAC,EAAE,sBAAsB;IAW5C;;;;OAIG;IACG,IAAI,IAAI,OAAO,CAAC,IAAI,CAAC;IAW3B;;OAEG;IACG,eAAe,IAAI,OAAO,CAAC,uBAAuB,EAAE,CAAC;IAM3D;;;;OAIG;IACG,aAAa,CAAC,EAAE,EAAE,MAAM,GAAG,OAAO,CAAC,uBAAuB,CAAC;IAQjE;;OAEG;IACG,yBAAyB,CAC7B,QAAQ,EAAE,MAAM,EAChB,IAAI,CAAC,EAAE,cAAc,GACpB,OAAO,CAAC,uBAAuB,EAAE,CAAC;IAYrC;;;OAGG;IACG,SAAS,CACb,KAAK,EAAE,cAAc,GACpB,OAAO,CAAC,uBAAuB,CAAC;IAwBnC;;;OAGG;IACG,QAAQ,CAAC,KAAK,EAAE,aAAa,GAAG,OAAO,CAAC,uBAAuB,CAAC;IA+BtE;;;;;OAKG;IACG,gBAAgB,CACpB,EAAE,EAAE,MAAM,EACV,KAAK,EAAE,wBAAwB,GAC9B,OAAO,CAAC,uBAAuB,CAAC;IAsBnC;;;;;;OAMG;IACG,gBAAgB,CAAC,EAAE,EAAE,MAAM,GAAG,OAAO,CAAC,IAAI,CAAC;IAwBjD;;;;;;OAMG;IACG,UAAU,CAAC,EAAE,EAAE,MAAM,GAAG,OAAO,CAAC,iBAAiB,CAAC;IASxD;;;;;OAKG;IACG,UAAU,CAAC,EAAE,EAAE,MAAM,EAAE,OAAO,EAAE,iBAAiB,GAAG,OAAO,CAAC,IAAI,CAAC;YAUzD,YAAY;YAOZ,aAAa;YAIb,WAAW;IAQzB,OAAO,CAAC,WAAW;YAIL,YAAY;IAW1B,OAAO,CAAC,KAAK;CAGd;AAQD;;GAEG;AACH,wBAAgB,yBAAyB,IAAI,sBAAsB,CAGlE;AAED;;GAEG;AACH,wBAAgB,2BAA2B,IAAI,IAAI,CAElD;AAED;;;GAGG;AACH,wBAAgB,6BAA6B,CAC3C,GAAG,EAAE,sBAAsB,GAC1B,IAAI,CAEN"}

package/dist/cli/backend/src/services/credential/credential-store.service.js

@@ -0,0 +1,298 @@
+/**
+ * Credential Store Service
+ *
+ * Manages the workspace-level credential registry and per-credential
+ * encrypted payload files under `~/.crewly/credentials/`.
+ *
+ * The store is split into two surfaces:
+ *
+ * - **Metadata API** (`listCredentials`, `getCredential`, `findCredentialsByProvider`):
+ *   returns `CredentialRegistryEntry` objects containing only non-secret
+ *   information (id, name, provider, scopes, email, timestamps). Safe to
+ *   expose to agent / LLM context and over MCP.
+ *
+ * - **Payload API** (`getPayload`, `setPayload`): decrypts the per-credential
+ *   `.enc` file to return the actual token value(s). **Intended only for
+ *   credential helpers and the skill executor** (which injects values into
+ *   skill subprocess env vars). Callers must never return payload contents
+ *   to agent/LLM context.
+ *
+ * Encrypted file format and threat model: see `utils/encryption.utils.ts`.
+ *
+ * @module services/credential/credential-store.service
+ */
+import { promises as fs } from 'fs';
+import path from 'path';
+import crypto from 'crypto';
+import { CredentialNotFoundError, } from '../../types/credential.types.js';
+import { ensureDir, atomicWriteFile, atomicWriteJson, safeReadJson, withOperationLock, } from '../../utils/file-io.utils.js';
+import { encrypt, decrypt, ensureMasterKey, defaultCredentialsDir, } from '../../utils/encryption.utils.js';
+// ============================================================================
+// Constants
+// ============================================================================
+const REGISTRY_FILENAME = 'registry.json';
+const EMPTY_REGISTRY = {
+    schemaVersion: 1,
+    credentials: [],
+};
+/**
+ * File-based credential store.
+ */
+export class CredentialStoreService {
+    dir;
+    registryPath;
+    masterKeyPath;
+    initialized = false;
+    constructor(options) {
+        this.dir = options?.dir ?? defaultCredentialsDir();
+        this.registryPath = path.join(this.dir, REGISTRY_FILENAME);
+        this.masterKeyPath =
+            options?.masterKeyPath ?? path.join(this.dir, 'master.key');
+    }
+    // ------------------------------------------------------------------
+    //  Initialization (idempotent, lazy)
+    // ------------------------------------------------------------------
+    /**
+     * Ensure the credentials directory and master.key exist. Called
+     * automatically by every public method — safe to invoke explicitly
+     * for eager initialization.
+     */
+    async init() {
+        if (this.initialized)
+            return;
+        await ensureDir(this.dir);
+        await ensureMasterKey(this.masterKeyPath);
+        this.initialized = true;
+    }
+    // ------------------------------------------------------------------
+    //  Metadata API (safe to expose to agent/LLM)
+    // ------------------------------------------------------------------
+    /**
+     * List all credentials' metadata. Does not include secret values.
+     */
+    async listCredentials() {
+        await this.init();
+        const reg = await this.readRegistry();
+        return reg.credentials;
+    }
+    /**
+     * Get a single credential's metadata by id.
+     *
+     * @throws CredentialNotFoundError if no entry with that id exists
+     */
+    async getCredential(id) {
+        await this.init();
+        const reg = await this.readRegistry();
+        const entry = reg.credentials.find((c) => c.id === id);
+        if (!entry)
+            throw new CredentialNotFoundError(id);
+        return entry;
+    }
+    /**
+     * Find all credentials for a given provider, optionally filtered by type.
+     */
+    async findCredentialsByProvider(provider, type) {
+        await this.init();
+        const reg = await this.readRegistry();
+        return reg.credentials.filter((c) => c.provider === provider && (!type || c.type === type));
+    }
+    // ------------------------------------------------------------------
+    //  Add
+    // ------------------------------------------------------------------
+    /**
+     * Add a new API key credential. The value is encrypted on disk and
+     * never exposed back through the metadata API.
+     */
+    async addApiKey(input) {
+        await this.init();
+        const id = this.newId();
+        const encFile = `${id}.enc`;
+        const payload = { type: 'api-key', value: input.value };
+        const now = new Date().toISOString();
+        const entry = {
+            id,
+            name: input.name,
+            type: 'api-key',
+            provider: input.provider,
+            createdAt: now,
+            updatedAt: now,
+            status: 'active',
+            encFile,
+        };
+        await this.writePayload(encFile, payload);
+        await this.appendEntry(entry);
+        return entry;
+    }
+    /**
+     * Add a new OAuth credential. Typically called by a helper's capture
+     * flow after completing an OAuth exchange.
+     */
+    async addOAuth(input) {
+        await this.init();
+        const id = this.newId();
+        const encFile = `${id}.enc`;
+        const now = new Date().toISOString();
+        const entry = {
+            id,
+            name: input.name,
+            type: 'google-oauth',
+            provider: input.provider,
+            helper: input.helper,
+            scopes: input.payload.scopes,
+            accountEmail: input.payload.accountEmail,
+            expiresAt: input.payload.expiresAt,
+            createdAt: now,
+            updatedAt: now,
+            status: 'active',
+            encFile,
+        };
+        await this.writePayload(encFile, input.payload);
+        await this.appendEntry(entry);
+        return entry;
+    }
+    // ------------------------------------------------------------------
+    //  Update
+    // ------------------------------------------------------------------
+    /**
+     * Update a credential's metadata. Does not touch the encrypted payload.
+     * Use `setPayload` to rewrite the secret material (e.g., after refresh).
+     *
+     * @throws CredentialNotFoundError if no entry with that id exists
+     */
+    async updateCredential(id, patch) {
+        await this.init();
+        let updated;
+        await withOperationLock(this.registryPath, async () => {
+            const reg = await this.readRegistry();
+            const idx = reg.credentials.findIndex((c) => c.id === id);
+            if (idx < 0)
+                throw new CredentialNotFoundError(id);
+            updated = {
+                ...reg.credentials[idx],
+                ...patch,
+                updatedAt: new Date().toISOString(),
+            };
+            reg.credentials[idx] = updated;
+            await this.writeRegistry(reg);
+        });
+        return updated;
+    }
+    // ------------------------------------------------------------------
+    //  Delete
+    // ------------------------------------------------------------------
+    /**
+     * Delete a credential (removes registry entry and encrypted payload).
+     * The registry removal is authoritative — if the `.enc` file is missing
+     * for any reason, that is not an error.
+     *
+     * @throws CredentialNotFoundError if no entry with that id exists
+     */
+    async deleteCredential(id) {
+        await this.init();
+        let encFileToDelete = null;
+        await withOperationLock(this.registryPath, async () => {
+            const reg = await this.readRegistry();
+            const idx = reg.credentials.findIndex((c) => c.id === id);
+            if (idx < 0)
+                throw new CredentialNotFoundError(id);
+            encFileToDelete = reg.credentials[idx].encFile;
+            reg.credentials.splice(idx, 1);
+            await this.writeRegistry(reg);
+        });
+        if (encFileToDelete) {
+            try {
+                await fs.unlink(this.encFilePath(encFileToDelete));
+            }
+            catch {
+                // registry is source of truth — ignore missing .enc file
+            }
+        }
+    }
+    // ------------------------------------------------------------------
+    //  Payload API (INTERNAL — helpers + executor only)
+    // ------------------------------------------------------------------
+    /**
+     * Decrypt and return the credential's payload. **Do not return the
+     * result to agent / LLM contexts** — intended only for helpers
+     * refreshing tokens and the skill executor injecting env vars.
+     *
+     * @throws CredentialNotFoundError if no entry with that id exists
+     */
+    async getPayload(id) {
+        await this.init();
+        const entry = await this.getCredential(id);
+        const b64 = await fs.readFile(this.encFilePath(entry.encFile), 'utf8');
+        const encBuffer = Buffer.from(b64, 'base64');
+        const plaintext = await decrypt(encBuffer, this.masterKeyPath);
+        return JSON.parse(plaintext);
+    }
+    /**
+     * Encrypt and write a new payload for an existing credential. Used by
+     * helpers after a successful token refresh.
+     *
+     * @throws CredentialNotFoundError if no entry with that id exists
+     */
+    async setPayload(id, payload) {
+        await this.init();
+        const entry = await this.getCredential(id);
+        await this.writePayload(entry.encFile, payload);
+    }
+    // ------------------------------------------------------------------
+    //  Internals
+    // ------------------------------------------------------------------
+    async readRegistry() {
+        return safeReadJson(this.registryPath, {
+            ...EMPTY_REGISTRY,
+            credentials: [],
+        });
+    }
+    async writeRegistry(reg) {
+        await atomicWriteJson(this.registryPath, reg);
+    }
+    async appendEntry(entry) {
+        await withOperationLock(this.registryPath, async () => {
+            const reg = await this.readRegistry();
+            reg.credentials.push(entry);
+            await this.writeRegistry(reg);
+        });
+    }
+    encFilePath(encFile) {
+        return path.join(this.dir, encFile);
+    }
+    async writePayload(encFile, payload) {
+        const json = JSON.stringify(payload);
+        const enc = await encrypt(json, this.masterKeyPath);
+        // Encrypted bytes are stored base64-encoded so they go through
+        // atomicWriteFile's utf8 serializer safely.
+        await atomicWriteFile(this.encFilePath(encFile), enc.toString('base64'));
+    }
+    newId() {
+        return `cred-${crypto.randomUUID()}`;
+    }
+}
+// ============================================================================
+// Singleton
+// ============================================================================
+let instance = null;
+/**
+ * Get the process-wide CredentialStoreService singleton.
+ */
+export function getCredentialStoreService() {
+    if (!instance)
+        instance = new CredentialStoreService();
+    return instance;
+}
+/**
+ * Reset the singleton — for tests only.
+ */
+export function resetCredentialStoreService() {
+    instance = null;
+}
+/**
+ * Replace the singleton with a specific instance — for tests only.
+ * Allows route/controller tests to point the store at a scratch directory.
+ */
+export function _setCredentialStoreForTesting(svc) {
+    instance = svc;
+}
+//# sourceMappingURL=credential-store.service.js.map

package/dist/cli/backend/src/services/credential/credential-store.service.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"credential-store.service.js","sourceRoot":"","sources":["../../../../../../backend/src/services/credential/credential-store.service.ts"],"names":[],"mappings":"AAAA;;;;;;;;;;;;;;;;;;;;;;GAsBG;AAEH,OAAO,EAAE,QAAQ,IAAI,EAAE,EAAE,MAAM,IAAI,CAAC;AACpC,OAAO,IAAI,MAAM,MAAM,CAAC;AACxB,OAAO,MAAM,MAAM,QAAQ,CAAC;AAE5B,OAAO,EASL,uBAAuB,GACxB,MAAM,iCAAiC,CAAC;AAEzC,OAAO,EACL,SAAS,EACT,eAAe,EACf,eAAe,EACf,YAAY,EACZ,iBAAiB,GAClB,MAAM,8BAA8B,CAAC;AAEtC,OAAO,EACL,OAAO,EACP,OAAO,EACP,eAAe,EACf,qBAAqB,GAEtB,MAAM,iCAAiC,CAAC;AAEzC,+EAA+E;AAC/E,YAAY;AACZ,+EAA+E;AAE/E,MAAM,iBAAiB,GAAG,eAAe,CAAC;AAC1C,MAAM,cAAc,GAAuB;IACzC,aAAa,EAAE,CAAC;IAChB,WAAW,EAAE,EAAE;CAChB,CAAC;AA6DF;;GAEG;AACH,MAAM,OAAO,sBAAsB;IAChB,GAAG,CAAS;IACZ,YAAY,CAAS;IACrB,aAAa,CAAS;IAC/B,WAAW,GAAG,KAAK,CAAC;IAE5B,YAAY,OAAgC;QAC1C,IAAI,CAAC,GAAG,GAAG,OAAO,EAAE,GAAG,IAAI,qBAAqB,EAAE,CAAC;QACnD,IAAI,CAAC,YAAY,GAAG,IAAI,CAAC,IAAI,CAAC,IAAI,CAAC,GAAG,EAAE,iBAAiB,CAAC,CAAC;QAC3D,IAAI,CAAC,aAAa;YAChB,OAAO,EAAE,aAAa,IAAI,IAAI,CAAC,IAAI,CAAC,IAAI,CAAC,GAAG,EAAE,YAAY,CAAC,CAAC;IAChE,CAAC;IAED,qEAAqE;IACrE,qCAAqC;IACrC,qEAAqE;IAErE;;;;OAIG;IACH,KAAK,CAAC,IAAI;QACR,IAAI,IAAI,CAAC,WAAW;YAAE,OAAO;QAC7B,MAAM,SAAS,CAAC,IAAI,CAAC,GAAG,CAAC,CAAC;QAC1B,MAAM,eAAe,CAAC,IAAI,CAAC,aAAa,CAAC,CAAC;QAC1C,IAAI,CAAC,WAAW,GAAG,IAAI,CAAC;IAC1B,CAAC;IAED,qEAAqE;IACrE,8CAA8C;IAC9C,qEAAqE;IAErE;;OAEG;IACH,KAAK,CAAC,eAAe;QACnB,MAAM,IAAI,CAAC,IAAI,EAAE,CAAC;QAClB,MAAM,GAAG,GAAG,MAAM,IAAI,CAAC,YAAY,EAAE,CAAC;QACtC,OAAO,GAAG,CAAC,WAAW,CAAC;IACzB,CAAC;IAED;;;;OAIG;IACH,KAAK,CAAC,aAAa,CAAC,EAAU;QAC5B,MAAM,IAAI,CAAC,IAAI,EAAE,CAAC;QAClB,MAAM,GAAG,GAAG,MAAM,IAAI,CAAC,YAAY,EAAE,CAAC;QACtC,MAAM,KAAK,GAAG,GAAG,CAAC,WAAW,CAAC,IAAI,CAAC,CAAC,CAAC,EAAE,EAAE,CAAC,CAAC,CAAC,EAAE,KAAK,EAAE,CAAC,CAAC;QACvD,IAAI,CAAC,KAAK;YAAE,MAAM,IAAI,uBAAuB,CAAC,EAAE,CAAC,CAAC;QAClD,OAAO,KAAK,CAAC;IACf,CAAC;IAED;;OAEG;IACH,KAAK,CAAC,yBAAyB,CAC7B,QAAgB,EAChB,IAAqB;QAErB,MAAM,IAAI,CAAC,IAAI,EAAE,CAAC;QAClB,MAAM,GAAG,GAAG,MAAM,IAAI,CAAC,YAAY,EAAE,CAAC;QACtC,OAAO,GAAG,CAAC,WAAW,CAAC,MAAM,CAC3B,CAAC,CAAC,EAAE,EAAE,CAAC,CAAC,CAAC,QAAQ,KAAK,QAAQ,IAAI,CAAC,CAAC,IAAI,IAAI,CAAC,CAAC,IAAI,KAAK,IAAI,CAAC,CAC7D,CAAC;IACJ,CAAC;IAED,qEAAqE;IACrE,OAAO;IACP,qEAAqE;IAErE;;;OAGG;IACH,KAAK,CAAC,SAAS,CACb,KAAqB;QAErB,MAAM,IAAI,CAAC,IAAI,EAAE,CAAC;QAClB,MAAM,EAAE,GAAG,IAAI,CAAC,KAAK,EAAE,CAAC;QACxB,MAAM,OAAO,GAAG,GAAG,EAAE,MAAM,CAAC;QAC5B,MAAM,OAAO,GAAkB,EAAE,IAAI,EAAE,SAAS,EAAE,KAAK,EAAE,KAAK,CAAC,KAAK,EAAE,CAAC;QAEvE,MAAM,GAAG,GAAG,IAAI,IAAI,EAAE,CAAC,WAAW,EAAE,CAAC;QACrC,MAAM,KAAK,GAA4B;YACrC,EAAE;YACF,IAAI,EAAE,KAAK,CAAC,IAAI;YAChB,IAAI,EAAE,SAAS;YACf,QAAQ,EAAE,KAAK,CAAC,QAAQ;YACxB,SAAS,EAAE,GAAG;YACd,SAAS,EAAE,GAAG;YACd,MAAM,EAAE,QAAQ;YAChB,OAAO;SACR,CAAC;QAEF,MAAM,IAAI,CAAC,YAAY,CAAC,OAAO,EAAE,OAAO,CAAC,CAAC;QAC1C,MAAM,IAAI,CAAC,WAAW,CAAC,KAAK,CAAC,CAAC;QAE9B,OAAO,KAAK,CAAC;IACf,CAAC;IAED;;;OAGG;IACH,KAAK,CAAC,QAAQ,CAAC,KAAoB;QACjC,MAAM,IAAI,CAAC,IAAI,EAAE,CAAC;QAClB,MAAM,EAAE,GAAG,IAAI,CAAC,KAAK,EAAE,CAAC;QACxB,MAAM,OAAO,GAAG,GAAG,EAAE,MAAM,CAAC;QAE5B,MAAM,GAAG,GAAG,IAAI,IAAI,EAAE,CAAC,WAAW,EAAE,CAAC;QACrC,MAAM,KAAK,GAA4B;YACrC,EAAE;YACF,IAAI,EAAE,KAAK,CAAC,IAAI;YAChB,IAAI,EAAE,cAAc;YACpB,QAAQ,EAAE,KAAK,CAAC,QAAQ;YACxB,MAAM,EAAE,KAAK,CAAC,MAAM;YACpB,MAAM,EAAE,KAAK,CAAC,OAAO,CAAC,MAAM;YAC5B,YAAY,EAAE,KAAK,CAAC,OAAO,CAAC,YAAY;YACxC,SAAS,EAAE,KAAK,CAAC,OAAO,CAAC,SAAS;YAClC,SAAS,EAAE,GAAG;YACd,SAAS,EAAE,GAAG;YACd,MAAM,EAAE,QAAQ;YAChB,OAAO;SACR,CAAC;QAEF,MAAM,IAAI,CAAC,YAAY,CAAC,OAAO,EAAE,KAAK,CAAC,OAAO,CAAC,CAAC;QAChD,MAAM,IAAI,CAAC,WAAW,CAAC,KAAK,CAAC,CAAC;QAE9B,OAAO,KAAK,CAAC;IACf,CAAC;IAED,qEAAqE;IACrE,UAAU;IACV,qEAAqE;IAErE;;;;;OAKG;IACH,KAAK,CAAC,gBAAgB,CACpB,EAAU,EACV,KAA+B;QAE/B,MAAM,IAAI,CAAC,IAAI,EAAE,CAAC;QAClB,IAAI,OAAiC,CAAC;QACtC,MAAM,iBAAiB,CAAC,IAAI,CAAC,YAAY,EAAE,KAAK,IAAI,EAAE;YACpD,MAAM,GAAG,GAAG,MAAM,IAAI,CAAC,YAAY,EAAE,CAAC;YACtC,MAAM,GAAG,GAAG,GAAG,CAAC,WAAW,CAAC,SAAS,CAAC,CAAC,CAAC,EAAE,EAAE,CAAC,CAAC,CAAC,EAAE,KAAK,EAAE,CAAC,CAAC;YAC1D,IAAI,GAAG,GAAG,CAAC;gBAAE,MAAM,IAAI,uBAAuB,CAAC,EAAE,CAAC,CAAC;YACnD,OAAO,GAAG;gBACR,GAAG,GAAG,CAAC,WAAW,CAAC,GAAG,CAAC;gBACvB,GAAG,KAAK;gBACR,SAAS,EAAE,IAAI,IAAI,EAAE,CAAC,WAAW,EAAE;aACpC,CAAC;YACF,GAAG,CAAC,WAAW,CAAC,GAAG,CAAC,GAAG,OAAO,CAAC;YAC/B,MAAM,IAAI,CAAC,aAAa,CAAC,GAAG,CAAC,CAAC;QAChC,CAAC,CAAC,CAAC;QACH,OAAO,OAAO,CAAC;IACjB,CAAC;IAED,qEAAqE;IACrE,UAAU;IACV,qEAAqE;IAErE;;;;;;OAMG;IACH,KAAK,CAAC,gBAAgB,CAAC,EAAU;QAC/B,MAAM,IAAI,CAAC,IAAI,EAAE,CAAC;QAClB,IAAI,eAAe,GAAkB,IAAI,CAAC;QAC1C,MAAM,iBAAiB,CAAC,IAAI,CAAC,YAAY,EAAE,KAAK,IAAI,EAAE;YACpD,MAAM,GAAG,GAAG,MAAM,IAAI,CAAC,YAAY,EAAE,CAAC;YACtC,MAAM,GAAG,GAAG,GAAG,CAAC,WAAW,CAAC,SAAS,CAAC,CAAC,CAAC,EAAE,EAAE,CAAC,CAAC,CAAC,EAAE,KAAK,EAAE,CAAC,CAAC;YAC1D,IAAI,GAAG,GAAG,CAAC;gBAAE,MAAM,IAAI,uBAAuB,CAAC,EAAE,CAAC,CAAC;YACnD,eAAe,GAAG,GAAG,CAAC,WAAW,CAAC,GAAG,CAAC,CAAC,OAAO,CAAC;YAC/C,GAAG,CAAC,WAAW,CAAC,MAAM,CAAC,GAAG,EAAE,CAAC,CAAC,CAAC;YAC/B,MAAM,IAAI,CAAC,aAAa,CAAC,GAAG,CAAC,CAAC;QAChC,CAAC,CAAC,CAAC;QACH,IAAI,eAAe,EAAE,CAAC;YACpB,IAAI,CAAC;gBACH,MAAM,EAAE,CAAC,MAAM,CAAC,IAAI,CAAC,WAAW,CAAC,eAAe,CAAC,CAAC,CAAC;YACrD,CAAC;YAAC,MAAM,CAAC;gBACP,yDAAyD;YAC3D,CAAC;QACH,CAAC;IACH,CAAC;IAED,qEAAqE;IACrE,oDAAoD;IACpD,qEAAqE;IAErE;;;;;;OAMG;IACH,KAAK,CAAC,UAAU,CAAC,EAAU;QACzB,MAAM,IAAI,CAAC,IAAI,EAAE,CAAC;QAClB,MAAM,KAAK,GAAG,MAAM,IAAI,CAAC,aAAa,CAAC,EAAE,CAAC,CAAC;QAC3C,MAAM,GAAG,GAAG,MAAM,EAAE,CAAC,QAAQ,CAAC,IAAI,CAAC,WAAW,CAAC,KAAK,CAAC,OAAO,CAAC,EAAE,MAAM,CAAC,CAAC;QACvE,MAAM,SAAS,GAAG,MAAM,CAAC,IAAI,CAAC,GAAG,EAAE,QAAQ,CAAC,CAAC;QAC7C,MAAM,SAAS,GAAG,MAAM,OAAO,CAAC,SAAS,EAAE,IAAI,CAAC,aAAa,CAAC,CAAC;QAC/D,OAAO,IAAI,CAAC,KAAK,CAAC,SAAS,CAAsB,CAAC;IACpD,CAAC;IAED;;;;;OAKG;IACH,KAAK,CAAC,UAAU,CAAC,EAAU,EAAE,OAA0B;QACrD,MAAM,IAAI,CAAC,IAAI,EAAE,CAAC;QAClB,MAAM,KAAK,GAAG,MAAM,IAAI,CAAC,aAAa,CAAC,EAAE,CAAC,CAAC;QAC3C,MAAM,IAAI,CAAC,YAAY,CAAC,KAAK,CAAC,OAAO,EAAE,OAAO,CAAC,CAAC;IAClD,CAAC;IAED,qEAAqE;IACrE,aAAa;IACb,qEAAqE;IAE7D,KAAK,CAAC,YAAY;QACxB,OAAO,YAAY,CAAqB,IAAI,CAAC,YAAY,EAAE;YACzD,GAAG,cAAc;YACjB,WAAW,EAAE,EAAE;SAChB,CAAC,CAAC;IACL,CAAC;IAEO,KAAK,CAAC,aAAa,CAAC,GAAuB;QACjD,MAAM,eAAe,CAAC,IAAI,CAAC,YAAY,EAAE,GAAG,CAAC,CAAC;IAChD,CAAC;IAEO,KAAK,CAAC,WAAW,CAAC,KAA8B;QACtD,MAAM,iBAAiB,CAAC,IAAI,CAAC,YAAY,EAAE,KAAK,IAAI,EAAE;YACpD,MAAM,GAAG,GAAG,MAAM,IAAI,CAAC,YAAY,EAAE,CAAC;YACtC,GAAG,CAAC,WAAW,CAAC,IAAI,CAAC,KAAK,CAAC,CAAC;YAC5B,MAAM,IAAI,CAAC,aAAa,CAAC,GAAG,CAAC,CAAC;QAChC,CAAC,CAAC,CAAC;IACL,CAAC;IAEO,WAAW,CAAC,OAAe;QACjC,OAAO,IAAI,CAAC,IAAI,CAAC,IAAI,CAAC,GAAG,EAAE,OAAO,CAAC,CAAC;IACtC,CAAC;IAEO,KAAK,CAAC,YAAY,CACxB,OAAe,EACf,OAA0B;QAE1B,MAAM,IAAI,GAAG,IAAI,CAAC,SAAS,CAAC,OAAO,CAAC,CAAC;QACrC,MAAM,GAAG,GAAG,MAAM,OAAO,CAAC,IAAI,EAAE,IAAI,CAAC,aAAa,CAAC,CAAC;QACpD,+DAA+D;QAC/D,4CAA4C;QAC5C,MAAM,eAAe,CAAC,IAAI,CAAC,WAAW,CAAC,OAAO,CAAC,EAAE,GAAG,CAAC,QAAQ,CAAC,QAAQ,CAAC,CAAC,CAAC;IAC3E,CAAC;IAEO,KAAK;QACX,OAAO,QAAQ,MAAM,CAAC,UAAU,EAAE,EAAE,CAAC;IACvC,CAAC;CACF;AAED,+EAA+E;AAC/E,YAAY;AACZ,+EAA+E;AAE/E,IAAI,QAAQ,GAAkC,IAAI,CAAC;AAEnD;;GAEG;AACH,MAAM,UAAU,yBAAyB;IACvC,IAAI,CAAC,QAAQ;QAAE,QAAQ,GAAG,IAAI,sBAAsB,EAAE,CAAC;IACvD,OAAO,QAAQ,CAAC;AAClB,CAAC;AAED;;GAEG;AACH,MAAM,UAAU,2BAA2B;IACzC,QAAQ,GAAG,IAAI,CAAC;AAClB,CAAC;AAED;;;GAGG;AACH,MAAM,UAAU,6BAA6B,CAC3C,GAA2B;IAE3B,QAAQ,GAAG,GAAG,CAAC;AACjB,CAAC"}

package/dist/cli/backend/src/services/credential/helpers/gemini-cli-workspace.helper.d.ts

@@ -0,0 +1,105 @@
+/**
+ * Gemini CLI Workspace Credential Helper
+ *
+ * Piggybacks on the Google Workspace extension for Gemini CLI
+ * (https://github.com/gemini-cli-extensions/workspace) for Google OAuth
+ * credential acquisition and refresh.
+ *
+ * **Capture** reads the extension's file-storage token file (written when
+ * the user runs the extension with `GEMINI_CLI_WORKSPACE_FORCE_FILE_STORAGE=true`)
+ * and imports the tokens into Crewly's own encrypted store.
+ *
+ * **Refresh** POSTs the stored `refresh_token` to the extension's Cloud
+ * Function `/refreshToken` endpoint — no client_secret needed on our side.
+ *
+ * After capture, Crewly owns the tokens; the extension's own state is not
+ * depended on for day-to-day operation.
+ *
+ * @module services/credential/helpers/gemini-cli-workspace.helper
+ */
+import { CredentialHelper, CredentialHelperName, CredentialRegistryEntry, GoogleOAuthPayload } from '../../../types/credential.types.js';
+import { CredentialStoreService } from '../credential-store.service.js';
+import { FetchLike as UserinfoFetchLike } from '../../../utils/google-userinfo.utils.js';
+/**
+ * Minimal fetch-compatible function shape (for test injection). Re-exported
+ * from the google-userinfo utility so callers can import a single type.
+ */
+export type FetchLike = UserinfoFetchLike;
+/**
+ * Helper configuration — all fields optional; defaults match production.
+ */
+export interface GeminiCliHelperConfig {
+    /** Path to the extension install directory (default: `~/.gemini/extensions/google-workspace`). */
+    extensionPath?: string;
+    /** Cloud Function base URL. */
+    cloudFunctionUrl?: string;
+    /** Path on the cloud function for refresh calls. */
+    refreshPath?: string;
+    /** Client ID to store on the credential (for later refresh identification). */
+    clientId?: string;
+    /** Refresh buffer in ms — refresh if token expires within this window. */
+    expiryBufferMs?: number;
+    /** Fetch implementation (injectable for tests). */
+    fetch?: FetchLike;
+}
+/**
+ * Credential helper that reads tokens from the gemini-cli-workspace extension
+ * and refreshes them via the extension's Cloud Function.
+ */
+export declare class GeminiCliWorkspaceHelper implements CredentialHelper {
+    readonly name: CredentialHelperName;
+    private readonly extensionPath;
+    private readonly cloudFunctionUrl;
+    private readonly refreshPath;
+    private readonly clientId;
+    private readonly expiryBufferMs;
+    private readonly fetchFn;
+    private readonly store;
+    /** Per-credential refresh in-flight promises (serializes concurrent refreshes). */
+    private readonly refreshInFlight;
+    /** Per-credential last refresh attempt timestamp (for cooldown). */
+    private readonly lastRefreshAttempt;
+    constructor(store: CredentialStoreService, config?: GeminiCliHelperConfig);
+    /**
+     * Read the extension's current token file and return its contents as a
+     * `GoogleOAuthPayload` ready to persist in Crewly's store.
+     *
+     * The user must have completed extension login with
+     * `GEMINI_CLI_WORKSPACE_FORCE_FILE_STORAGE=true` before calling this.
+     */
+    captureFromFile(): Promise<GoogleOAuthPayload>;
+    /**
+     * Remove the extension's token file. Call after `captureFromFile()` to
+     * prepare for the next account's login (the extension otherwise returns
+     * cached credentials if scopes match, skipping the login prompt).
+     * Leaves the master.key file untouched so existing ciphertexts remain
+     * decryptable if needed.
+     */
+    clearExtensionFile(): Promise<void>;
+    /**
+     * Return a valid `GoogleOAuthPayload`, refreshing via the extension's
+     * cloud function if the access token is within the expiry buffer.
+     *
+     * Concurrent calls for the same credential share a single refresh.
+     *
+     * @throws CredentialRevokedError if the refresh token is no longer valid
+     */
+    getAccessToken(entry: CredentialRegistryEntry, payload: GoogleOAuthPayload): Promise<GoogleOAuthPayload>;
+    private doRefresh;
+    /**
+     * Decrypt the extension's `{iv_hex}:{authTag_hex}:{ciphertext_hex}`
+     * format (AES-256-GCM).
+     */
+    private decryptExtensionFormat;
+}
+/**
+ * Encrypt a plaintext string with the extension's file format. Used in
+ * tests to generate fake token files.
+ */
+export declare function encryptExtensionFormatForTesting(plaintext: string, key: Buffer): string;
+/**
+ * Derive the extension's encryption key using the real scrypt + salt.
+ * Test-only export.
+ */
+export declare function deriveExtensionKeyForTesting(masterKey: Buffer): Buffer;
+//# sourceMappingURL=gemini-cli-workspace.helper.d.ts.map

package/dist/cli/backend/src/services/credential/helpers/gemini-cli-workspace.helper.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"gemini-cli-workspace.helper.d.ts","sourceRoot":"","sources":["../../../../../../../backend/src/services/credential/helpers/gemini-cli-workspace.helper.ts"],"names":[],"mappings":"AAAA;;;;;;;;;;;;;;;;;;GAkBG;AAOH,OAAO,EACL,gBAAgB,EAChB,oBAAoB,EACpB,uBAAuB,EACvB,kBAAkB,EAEnB,MAAM,oCAAoC,CAAC;AAC5C,OAAO,EAAE,sBAAsB,EAAE,MAAM,gCAAgC,CAAC;AAMxE,OAAO,EAEL,SAAS,IAAI,iBAAiB,EAC/B,MAAM,yCAAyC,CAAC;AA2CjD;;;GAGG;AACH,MAAM,MAAM,SAAS,GAAG,iBAAiB,CAAC;AAE1C;;GAEG;AACH,MAAM,WAAW,qBAAqB;IACpC,kGAAkG;IAClG,aAAa,CAAC,EAAE,MAAM,CAAC;IACvB,+BAA+B;IAC/B,gBAAgB,CAAC,EAAE,MAAM,CAAC;IAC1B,oDAAoD;IACpD,WAAW,CAAC,EAAE,MAAM,CAAC;IACrB,+EAA+E;IAC/E,QAAQ,CAAC,EAAE,MAAM,CAAC;IAClB,0EAA0E;IAC1E,cAAc,CAAC,EAAE,MAAM,CAAC;IACxB,mDAAmD;IACnD,KAAK,CAAC,EAAE,SAAS,CAAC;CACnB;AAMD;;;GAGG;AACH,qBAAa,wBAAyB,YAAW,gBAAgB;IAC/D,QAAQ,CAAC,IAAI,EAAE,oBAAoB,CAA0B;IAE7D,OAAO,CAAC,QAAQ,CAAC,aAAa,CAAS;IACvC,OAAO,CAAC,QAAQ,CAAC,gBAAgB,CAAS;IAC1C,OAAO,CAAC,QAAQ,CAAC,WAAW,CAAS;IACrC,OAAO,CAAC,QAAQ,CAAC,QAAQ,CAAS;IAClC,OAAO,CAAC,QAAQ,CAAC,cAAc,CAAS;IACxC,OAAO,CAAC,QAAQ,CAAC,OAAO,CAAY;IACpC,OAAO,CAAC,QAAQ,CAAC,KAAK,CAAyB;IAE/C,mFAAmF;IACnF,OAAO,CAAC,QAAQ,CAAC,eAAe,CAG5B;IACJ,oEAAoE;IACpE,OAAO,CAAC,QAAQ,CAAC,kBAAkB,CAA6B;gBAG9D,KAAK,EAAE,sBAAsB,EAC7B,MAAM,CAAC,EAAE,qBAAqB;IAkBhC;;;;;;OAMG;IACG,eAAe,IAAI,OAAO,CAAC,kBAAkB,CAAC;IAoEpD;;;;;;OAMG;IACG,kBAAkB,IAAI,OAAO,CAAC,IAAI,CAAC;IAczC;;;;;;;OAOG;IACG,cAAc,CAClB,KAAK,EAAE,uBAAuB,EAC9B,OAAO,EAAE,kBAAkB,GAC1B,OAAO,CAAC,kBAAkB,CAAC;YA4BhB,SAAS;IAuEvB;;;OAGG;IACH,OAAO,CAAC,sBAAsB;CAoB/B;AAMD;;;GAGG;AACH,wBAAgB,gCAAgC,CAC9C,SAAS,EAAE,MAAM,EACjB,GAAG,EAAE,MAAM,GACV,MAAM,CAOR;AAED;;;GAGG;AACH,wBAAgB,4BAA4B,CAAC,SAAS,EAAE,MAAM,GAAG,MAAM,CAGtE"}