crewly 1.5.22 → 1.6.1

package/dist/backend/backend/src/services/credential/helpers/gemini-cli-workspace.helper.d.ts

@@ -0,0 +1,105 @@
+/**
+ * Gemini CLI Workspace Credential Helper
+ *
+ * Piggybacks on the Google Workspace extension for Gemini CLI
+ * (https://github.com/gemini-cli-extensions/workspace) for Google OAuth
+ * credential acquisition and refresh.
+ *
+ * **Capture** reads the extension's file-storage token file (written when
+ * the user runs the extension with `GEMINI_CLI_WORKSPACE_FORCE_FILE_STORAGE=true`)
+ * and imports the tokens into Crewly's own encrypted store.
+ *
+ * **Refresh** POSTs the stored `refresh_token` to the extension's Cloud
+ * Function `/refreshToken` endpoint — no client_secret needed on our side.
+ *
+ * After capture, Crewly owns the tokens; the extension's own state is not
+ * depended on for day-to-day operation.
+ *
+ * @module services/credential/helpers/gemini-cli-workspace.helper
+ */
+import { CredentialHelper, CredentialHelperName, CredentialRegistryEntry, GoogleOAuthPayload } from '../../../types/credential.types.js';
+import { CredentialStoreService } from '../credential-store.service.js';
+import { FetchLike as UserinfoFetchLike } from '../../../utils/google-userinfo.utils.js';
+/**
+ * Minimal fetch-compatible function shape (for test injection). Re-exported
+ * from the google-userinfo utility so callers can import a single type.
+ */
+export type FetchLike = UserinfoFetchLike;
+/**
+ * Helper configuration — all fields optional; defaults match production.
+ */
+export interface GeminiCliHelperConfig {
+    /** Path to the extension install directory (default: `~/.gemini/extensions/google-workspace`). */
+    extensionPath?: string;
+    /** Cloud Function base URL. */
+    cloudFunctionUrl?: string;
+    /** Path on the cloud function for refresh calls. */
+    refreshPath?: string;
+    /** Client ID to store on the credential (for later refresh identification). */
+    clientId?: string;
+    /** Refresh buffer in ms — refresh if token expires within this window. */
+    expiryBufferMs?: number;
+    /** Fetch implementation (injectable for tests). */
+    fetch?: FetchLike;
+}
+/**
+ * Credential helper that reads tokens from the gemini-cli-workspace extension
+ * and refreshes them via the extension's Cloud Function.
+ */
+export declare class GeminiCliWorkspaceHelper implements CredentialHelper {
+    readonly name: CredentialHelperName;
+    private readonly extensionPath;
+    private readonly cloudFunctionUrl;
+    private readonly refreshPath;
+    private readonly clientId;
+    private readonly expiryBufferMs;
+    private readonly fetchFn;
+    private readonly store;
+    /** Per-credential refresh in-flight promises (serializes concurrent refreshes). */
+    private readonly refreshInFlight;
+    /** Per-credential last refresh attempt timestamp (for cooldown). */
+    private readonly lastRefreshAttempt;
+    constructor(store: CredentialStoreService, config?: GeminiCliHelperConfig);
+    /**
+     * Read the extension's current token file and return its contents as a
+     * `GoogleOAuthPayload` ready to persist in Crewly's store.
+     *
+     * The user must have completed extension login with
+     * `GEMINI_CLI_WORKSPACE_FORCE_FILE_STORAGE=true` before calling this.
+     */
+    captureFromFile(): Promise<GoogleOAuthPayload>;
+    /**
+     * Remove the extension's token file. Call after `captureFromFile()` to
+     * prepare for the next account's login (the extension otherwise returns
+     * cached credentials if scopes match, skipping the login prompt).
+     * Leaves the master.key file untouched so existing ciphertexts remain
+     * decryptable if needed.
+     */
+    clearExtensionFile(): Promise<void>;
+    /**
+     * Return a valid `GoogleOAuthPayload`, refreshing via the extension's
+     * cloud function if the access token is within the expiry buffer.
+     *
+     * Concurrent calls for the same credential share a single refresh.
+     *
+     * @throws CredentialRevokedError if the refresh token is no longer valid
+     */
+    getAccessToken(entry: CredentialRegistryEntry, payload: GoogleOAuthPayload): Promise<GoogleOAuthPayload>;
+    private doRefresh;
+    /**
+     * Decrypt the extension's `{iv_hex}:{authTag_hex}:{ciphertext_hex}`
+     * format (AES-256-GCM).
+     */
+    private decryptExtensionFormat;
+}
+/**
+ * Encrypt a plaintext string with the extension's file format. Used in
+ * tests to generate fake token files.
+ */
+export declare function encryptExtensionFormatForTesting(plaintext: string, key: Buffer): string;
+/**
+ * Derive the extension's encryption key using the real scrypt + salt.
+ * Test-only export.
+ */
+export declare function deriveExtensionKeyForTesting(masterKey: Buffer): Buffer;
+//# sourceMappingURL=gemini-cli-workspace.helper.d.ts.map

package/dist/backend/backend/src/services/credential/helpers/gemini-cli-workspace.helper.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"gemini-cli-workspace.helper.d.ts","sourceRoot":"","sources":["../../../../../../../backend/src/services/credential/helpers/gemini-cli-workspace.helper.ts"],"names":[],"mappings":"AAAA;;;;;;;;;;;;;;;;;;GAkBG;AAOH,OAAO,EACL,gBAAgB,EAChB,oBAAoB,EACpB,uBAAuB,EACvB,kBAAkB,EAEnB,MAAM,oCAAoC,CAAC;AAC5C,OAAO,EAAE,sBAAsB,EAAE,MAAM,gCAAgC,CAAC;AAMxE,OAAO,EAEL,SAAS,IAAI,iBAAiB,EAC/B,MAAM,yCAAyC,CAAC;AA2CjD;;;GAGG;AACH,MAAM,MAAM,SAAS,GAAG,iBAAiB,CAAC;AAE1C;;GAEG;AACH,MAAM,WAAW,qBAAqB;IACpC,kGAAkG;IAClG,aAAa,CAAC,EAAE,MAAM,CAAC;IACvB,+BAA+B;IAC/B,gBAAgB,CAAC,EAAE,MAAM,CAAC;IAC1B,oDAAoD;IACpD,WAAW,CAAC,EAAE,MAAM,CAAC;IACrB,+EAA+E;IAC/E,QAAQ,CAAC,EAAE,MAAM,CAAC;IAClB,0EAA0E;IAC1E,cAAc,CAAC,EAAE,MAAM,CAAC;IACxB,mDAAmD;IACnD,KAAK,CAAC,EAAE,SAAS,CAAC;CACnB;AAMD;;;GAGG;AACH,qBAAa,wBAAyB,YAAW,gBAAgB;IAC/D,QAAQ,CAAC,IAAI,EAAE,oBAAoB,CAA0B;IAE7D,OAAO,CAAC,QAAQ,CAAC,aAAa,CAAS;IACvC,OAAO,CAAC,QAAQ,CAAC,gBAAgB,CAAS;IAC1C,OAAO,CAAC,QAAQ,CAAC,WAAW,CAAS;IACrC,OAAO,CAAC,QAAQ,CAAC,QAAQ,CAAS;IAClC,OAAO,CAAC,QAAQ,CAAC,cAAc,CAAS;IACxC,OAAO,CAAC,QAAQ,CAAC,OAAO,CAAY;IACpC,OAAO,CAAC,QAAQ,CAAC,KAAK,CAAyB;IAE/C,mFAAmF;IACnF,OAAO,CAAC,QAAQ,CAAC,eAAe,CAG5B;IACJ,oEAAoE;IACpE,OAAO,CAAC,QAAQ,CAAC,kBAAkB,CAA6B;gBAG9D,KAAK,EAAE,sBAAsB,EAC7B,MAAM,CAAC,EAAE,qBAAqB;IAkBhC;;;;;;OAMG;IACG,eAAe,IAAI,OAAO,CAAC,kBAAkB,CAAC;IAoEpD;;;;;;OAMG;IACG,kBAAkB,IAAI,OAAO,CAAC,IAAI,CAAC;IAczC;;;;;;;OAOG;IACG,cAAc,CAClB,KAAK,EAAE,uBAAuB,EAC9B,OAAO,EAAE,kBAAkB,GAC1B,OAAO,CAAC,kBAAkB,CAAC;YA4BhB,SAAS;IAuEvB;;;OAGG;IACH,OAAO,CAAC,sBAAsB;CAoB/B;AAMD;;;GAGG;AACH,wBAAgB,gCAAgC,CAC9C,SAAS,EAAE,MAAM,EACjB,GAAG,EAAE,MAAM,GACV,MAAM,CAOR;AAED;;;GAGG;AACH,wBAAgB,4BAA4B,CAAC,SAAS,EAAE,MAAM,GAAG,MAAM,CAGtE"}

package/dist/backend/backend/src/services/credential/helpers/gemini-cli-workspace.helper.js

@@ -0,0 +1,272 @@
+/**
+ * Gemini CLI Workspace Credential Helper
+ *
+ * Piggybacks on the Google Workspace extension for Gemini CLI
+ * (https://github.com/gemini-cli-extensions/workspace) for Google OAuth
+ * credential acquisition and refresh.
+ *
+ * **Capture** reads the extension's file-storage token file (written when
+ * the user runs the extension with `GEMINI_CLI_WORKSPACE_FORCE_FILE_STORAGE=true`)
+ * and imports the tokens into Crewly's own encrypted store.
+ *
+ * **Refresh** POSTs the stored `refresh_token` to the extension's Cloud
+ * Function `/refreshToken` endpoint — no client_secret needed on our side.
+ *
+ * After capture, Crewly owns the tokens; the extension's own state is not
+ * depended on for day-to-day operation.
+ *
+ * @module services/credential/helpers/gemini-cli-workspace.helper
+ */
+import { promises as fs } from 'fs';
+import path from 'path';
+import os from 'os';
+import crypto from 'crypto';
+import { CredentialRevokedError, } from '../../../types/credential.types.js';
+import { GEMINI_CLI_CLOUD_FUNCTION_URL, GEMINI_CLI_REFRESH_PATH, GOOGLE_OAUTH_CLIENT_ID, } from '../../../config/oauth.config.js';
+import { fetchGoogleAccountEmail, } from '../../../utils/google-userinfo.utils.js';
+// ============================================================================
+// Constants — extension-specific file layout and refresh tuning
+// (github.com/gemini-cli-extensions/workspace)
+// ============================================================================
+const DEFAULT_EXTENSION_PATH = path.join(os.homedir(), '.gemini', 'extensions', 'google-workspace');
+const TOKEN_FILENAME = 'gemini-cli-workspace-token.json';
+const MASTER_KEY_FILENAME = '.gemini-cli-workspace-master-key';
+const MAIN_ACCOUNT_KEY = 'main-account';
+const SALT_SUFFIX = '-gemini-cli-workspace';
+/** Refresh if the current access token expires within this window. */
+const DEFAULT_EXPIRY_BUFFER_MS = 60_000;
+/** Minimum gap between refresh attempts for the same credential. */
+const REFRESH_COOLDOWN_MS = 30_000;
+// ============================================================================
+// Helper
+// ============================================================================
+/**
+ * Credential helper that reads tokens from the gemini-cli-workspace extension
+ * and refreshes them via the extension's Cloud Function.
+ */
+export class GeminiCliWorkspaceHelper {
+    name = 'gemini-cli-workspace';
+    extensionPath;
+    cloudFunctionUrl;
+    refreshPath;
+    clientId;
+    expiryBufferMs;
+    fetchFn;
+    store;
+    /** Per-credential refresh in-flight promises (serializes concurrent refreshes). */
+    refreshInFlight = new Map();
+    /** Per-credential last refresh attempt timestamp (for cooldown). */
+    lastRefreshAttempt = new Map();
+    constructor(store, config) {
+        this.store = store;
+        this.extensionPath = config?.extensionPath ?? DEFAULT_EXTENSION_PATH;
+        this.cloudFunctionUrl =
+            config?.cloudFunctionUrl ?? GEMINI_CLI_CLOUD_FUNCTION_URL;
+        this.refreshPath = config?.refreshPath ?? GEMINI_CLI_REFRESH_PATH;
+        this.clientId = config?.clientId ?? GOOGLE_OAUTH_CLIENT_ID;
+        this.expiryBufferMs = config?.expiryBufferMs ?? DEFAULT_EXPIRY_BUFFER_MS;
+        this.fetchFn =
+            config?.fetch ??
+                ((url, init) => fetch(url, init));
+    }
+    // ------------------------------------------------------------------
+    //  Capture
+    // ------------------------------------------------------------------
+    /**
+     * Read the extension's current token file and return its contents as a
+     * `GoogleOAuthPayload` ready to persist in Crewly's store.
+     *
+     * The user must have completed extension login with
+     * `GEMINI_CLI_WORKSPACE_FORCE_FILE_STORAGE=true` before calling this.
+     */
+    async captureFromFile() {
+        const tokenPath = path.join(this.extensionPath, TOKEN_FILENAME);
+        const masterKeyPath = path.join(this.extensionPath, MASTER_KEY_FILENAME);
+        // Surface a user-friendly error if login hasn't happened yet
+        try {
+            await fs.access(tokenPath);
+        }
+        catch {
+            throw new Error(`Gemini CLI Workspace token file not found at ${tokenPath}. ` +
+                `Please run 'GEMINI_CLI_WORKSPACE_FORCE_FILE_STORAGE=true gemini' ` +
+                `and complete Google sign-in first, then retry.`);
+        }
+        try {
+            await fs.access(masterKeyPath);
+        }
+        catch {
+            throw new Error(`Gemini CLI Workspace master key file not found at ${masterKeyPath}. ` +
+                `The extension should create this on first login.`);
+        }
+        const encryptedText = await fs.readFile(tokenPath, 'utf8');
+        const masterKey = await fs.readFile(masterKeyPath);
+        // Derive the extension's encryption key (scrypt with hostname-username salt).
+        // Must match `file-token-storage.ts` exactly.
+        const salt = `${os.hostname()}-${os.userInfo().username}${SALT_SUFFIX}`;
+        const encryptionKey = crypto.scryptSync(masterKey, salt, 32);
+        const decrypted = this.decryptExtensionFormat(encryptedText, encryptionKey);
+        const parsed = JSON.parse(decrypted);
+        const entry = parsed[MAIN_ACCOUNT_KEY];
+        if (!entry) {
+            throw new Error(`Extension token file does not contain a '${MAIN_ACCOUNT_KEY}' entry. ` +
+                `Did login complete successfully?`);
+        }
+        const { accessToken, refreshToken, tokenType, scope, expiresAt } = entry.token;
+        if (!accessToken || !refreshToken) {
+            throw new Error(`Extension token is missing accessToken or refreshToken — login may be incomplete.`);
+        }
+        const scopes = typeof scope === 'string' ? scope.split(' ').filter(Boolean) : [];
+        const accountEmail = await fetchGoogleAccountEmail(accessToken, this.fetchFn);
+        return {
+            type: 'google-oauth',
+            accessToken,
+            refreshToken,
+            tokenType: tokenType ?? 'Bearer',
+            expiresAt: expiresAt ?? Date.now() + 3600_000,
+            scopes,
+            accountEmail,
+            clientId: this.clientId,
+        };
+    }
+    /**
+     * Remove the extension's token file. Call after `captureFromFile()` to
+     * prepare for the next account's login (the extension otherwise returns
+     * cached credentials if scopes match, skipping the login prompt).
+     * Leaves the master.key file untouched so existing ciphertexts remain
+     * decryptable if needed.
+     */
+    async clearExtensionFile() {
+        const tokenPath = path.join(this.extensionPath, TOKEN_FILENAME);
+        try {
+            await fs.unlink(tokenPath);
+        }
+        catch (err) {
+            if (err.code === 'ENOENT')
+                return;
+            throw err;
+        }
+    }
+    // ------------------------------------------------------------------
+    //  Refresh / getAccessToken
+    // ------------------------------------------------------------------
+    /**
+     * Return a valid `GoogleOAuthPayload`, refreshing via the extension's
+     * cloud function if the access token is within the expiry buffer.
+     *
+     * Concurrent calls for the same credential share a single refresh.
+     *
+     * @throws CredentialRevokedError if the refresh token is no longer valid
+     */
+    async getAccessToken(entry, payload) {
+        // Fast path: still valid
+        if (payload.expiresAt - Date.now() > this.expiryBufferMs) {
+            return payload;
+        }
+        // Coalesce concurrent refreshes for the same credential
+        const existing = this.refreshInFlight.get(entry.id);
+        if (existing)
+            return existing;
+        // Cooldown — avoid hammering the refresh endpoint
+        const last = this.lastRefreshAttempt.get(entry.id) ?? 0;
+        if (Date.now() - last < REFRESH_COOLDOWN_MS) {
+            // Within cooldown — return the (possibly expired) payload; caller will
+            // get a fresh attempt after the cooldown window.
+            return payload;
+        }
+        const promise = this.doRefresh(entry, payload);
+        this.refreshInFlight.set(entry.id, promise);
+        this.lastRefreshAttempt.set(entry.id, Date.now());
+        try {
+            return await promise;
+        }
+        finally {
+            this.refreshInFlight.delete(entry.id);
+        }
+    }
+    async doRefresh(entry, payload) {
+        const url = this.cloudFunctionUrl.replace(/\/$/, '') + this.refreshPath;
+        const response = await this.fetchFn(url, {
+            method: 'POST',
+            headers: { 'Content-Type': 'application/json' },
+            body: JSON.stringify({ refresh_token: payload.refreshToken }),
+        });
+        if (!response.ok) {
+            const body = await response.text().catch(() => '');
+            // Google responds 400 with body containing "invalid_grant" when the
+            // refresh token is revoked/expired beyond recovery.
+            if (response.status === 400 &&
+                /invalid_grant/i.test(body)) {
+                await this.store.updateCredential(entry.id, { status: 'revoked' });
+                throw new CredentialRevokedError(entry.id, entry.name, `Log in to the Gemini CLI Workspace extension again and re-import this credential in Crewly.`);
+            }
+            throw new Error(`Token refresh failed (${response.status}): ${body.slice(0, 500)}`);
+        }
+        const data = (await response.json());
+        if (!data.access_token) {
+            throw new Error('Token refresh response missing access_token');
+        }
+        const expiresAt = Date.now() + (data.expires_in ?? 3600) * 1000;
+        const updated = {
+            ...payload,
+            accessToken: data.access_token,
+            expiresAt,
+            // Google typically does NOT issue a new refresh_token on refresh,
+            // but honor it if present
+            refreshToken: data.refresh_token ?? payload.refreshToken,
+            scopes: typeof data.scope === 'string'
+                ? data.scope.split(' ').filter(Boolean)
+                : payload.scopes,
+        };
+        await this.store.setPayload(entry.id, updated);
+        await this.store.updateCredential(entry.id, {
+            expiresAt,
+            lastUsedAt: new Date().toISOString(),
+        });
+        return updated;
+    }
+    // ------------------------------------------------------------------
+    //  Internals
+    // ------------------------------------------------------------------
+    /**
+     * Decrypt the extension's `{iv_hex}:{authTag_hex}:{ciphertext_hex}`
+     * format (AES-256-GCM).
+     */
+    decryptExtensionFormat(encryptedText, key) {
+        const parts = encryptedText.split(':');
+        if (parts.length !== 3) {
+            throw new Error('Invalid extension token format (expected iv:tag:ciphertext)');
+        }
+        const iv = Buffer.from(parts[0], 'hex');
+        const authTag = Buffer.from(parts[1], 'hex');
+        const ciphertextHex = parts[2];
+        const decipher = crypto.createDecipheriv('aes-256-gcm', key, iv);
+        decipher.setAuthTag(authTag);
+        let decrypted = decipher.update(ciphertextHex, 'hex', 'utf8');
+        decrypted += decipher.final('utf8');
+        return decrypted;
+    }
+}
+// ============================================================================
+// Test helpers (not exported from public barrel — intended for tests only)
+// ============================================================================
+/**
+ * Encrypt a plaintext string with the extension's file format. Used in
+ * tests to generate fake token files.
+ */
+export function encryptExtensionFormatForTesting(plaintext, key) {
+    const iv = crypto.randomBytes(16);
+    const cipher = crypto.createCipheriv('aes-256-gcm', key, iv);
+    let encrypted = cipher.update(plaintext, 'utf8', 'hex');
+    encrypted += cipher.final('hex');
+    const authTag = cipher.getAuthTag();
+    return iv.toString('hex') + ':' + authTag.toString('hex') + ':' + encrypted;
+}
+/**
+ * Derive the extension's encryption key using the real scrypt + salt.
+ * Test-only export.
+ */
+export function deriveExtensionKeyForTesting(masterKey) {
+    const salt = `${os.hostname()}-${os.userInfo().username}${SALT_SUFFIX}`;
+    return crypto.scryptSync(masterKey, salt, 32);
+}
+//# sourceMappingURL=gemini-cli-workspace.helper.js.map

package/dist/backend/backend/src/services/credential/helpers/gemini-cli-workspace.helper.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"gemini-cli-workspace.helper.js","sourceRoot":"","sources":["../../../../../../../backend/src/services/credential/helpers/gemini-cli-workspace.helper.ts"],"names":[],"mappings":"AAAA;;;;;;;;;;;;;;;;;;GAkBG;AAEH,OAAO,EAAE,QAAQ,IAAI,EAAE,EAAE,MAAM,IAAI,CAAC;AACpC,OAAO,IAAI,MAAM,MAAM,CAAC;AACxB,OAAO,EAAE,MAAM,IAAI,CAAC;AACpB,OAAO,MAAM,MAAM,QAAQ,CAAC;AAE5B,OAAO,EAKL,sBAAsB,GACvB,MAAM,oCAAoC,CAAC;AAE5C,OAAO,EACL,6BAA6B,EAC7B,uBAAuB,EACvB,sBAAsB,GACvB,MAAM,iCAAiC,CAAC;AACzC,OAAO,EACL,uBAAuB,GAExB,MAAM,yCAAyC,CAAC;AAEjD,+EAA+E;AAC/E,gEAAgE;AAChE,+CAA+C;AAC/C,+EAA+E;AAE/E,MAAM,sBAAsB,GAAG,IAAI,CAAC,IAAI,CACtC,EAAE,CAAC,OAAO,EAAE,EACZ,SAAS,EACT,YAAY,EACZ,kBAAkB,CACnB,CAAC;AACF,MAAM,cAAc,GAAG,iCAAiC,CAAC;AACzD,MAAM,mBAAmB,GAAG,kCAAkC,CAAC;AAC/D,MAAM,gBAAgB,GAAG,cAAc,CAAC;AACxC,MAAM,WAAW,GAAG,uBAAuB,CAAC;AAE5C,sEAAsE;AACtE,MAAM,wBAAwB,GAAG,MAAM,CAAC;AACxC,oEAAoE;AACpE,MAAM,mBAAmB,GAAG,MAAM,CAAC;AA8CnC,+EAA+E;AAC/E,SAAS;AACT,+EAA+E;AAE/E;;;GAGG;AACH,MAAM,OAAO,wBAAwB;IAC1B,IAAI,GAAyB,sBAAsB,CAAC;IAE5C,aAAa,CAAS;IACtB,gBAAgB,CAAS;IACzB,WAAW,CAAS;IACpB,QAAQ,CAAS;IACjB,cAAc,CAAS;IACvB,OAAO,CAAY;IACnB,KAAK,CAAyB;IAE/C,mFAAmF;IAClE,eAAe,GAAG,IAAI,GAAG,EAGvC,CAAC;IACJ,oEAAoE;IACnD,kBAAkB,GAAG,IAAI,GAAG,EAAkB,CAAC;IAEhE,YACE,KAA6B,EAC7B,MAA8B;QAE9B,IAAI,CAAC,KAAK,GAAG,KAAK,CAAC;QACnB,IAAI,CAAC,aAAa,GAAG,MAAM,EAAE,aAAa,IAAI,sBAAsB,CAAC;QACrE,IAAI,CAAC,gBAAgB;YACnB,MAAM,EAAE,gBAAgB,IAAI,6BAA6B,CAAC;QAC5D,IAAI,CAAC,WAAW,GAAG,MAAM,EAAE,WAAW,IAAI,uBAAuB,CAAC;QAClE,IAAI,CAAC,QAAQ,GAAG,MAAM,EAAE,QAAQ,IAAI,sBAAsB,CAAC;QAC3D,IAAI,CAAC,cAAc,GAAG,MAAM,EAAE,cAAc,IAAI,wBAAwB,CAAC;QACzE,IAAI,CAAC,OAAO;YACV,MAAM,EAAE,KAAK;gBACb,CAAC,CAAC,GAAG,EAAE,IAAI,EAAE,EAAE,CAAC,KAAK,CAAC,GAAG,EAAE,IAAmB,CAAqC,CAAC,CAAC;IACzF,CAAC;IAED,qEAAqE;IACrE,WAAW;IACX,qEAAqE;IAErE;;;;;;OAMG;IACH,KAAK,CAAC,eAAe;QACnB,MAAM,SAAS,GAAG,IAAI,CAAC,IAAI,CAAC,IAAI,CAAC,aAAa,EAAE,cAAc,CAAC,CAAC;QAChE,MAAM,aAAa,GAAG,IAAI,CAAC,IAAI,CAAC,IAAI,CAAC,aAAa,EAAE,mBAAmB,CAAC,CAAC;QAEzE,6DAA6D;QAC7D,IAAI,CAAC;YACH,MAAM,EAAE,CAAC,MAAM,CAAC,SAAS,CAAC,CAAC;QAC7B,CAAC;QAAC,MAAM,CAAC;YACP,MAAM,IAAI,KAAK,CACb,gDAAgD,SAAS,IAAI;gBAC3D,mEAAmE;gBACnE,gDAAgD,CACnD,CAAC;QACJ,CAAC;QACD,IAAI,CAAC;YACH,MAAM,EAAE,CAAC,MAAM,CAAC,aAAa,CAAC,CAAC;QACjC,CAAC;QAAC,MAAM,CAAC;YACP,MAAM,IAAI,KAAK,CACb,qDAAqD,aAAa,IAAI;gBACpE,kDAAkD,CACrD,CAAC;QACJ,CAAC;QAED,MAAM,aAAa,GAAG,MAAM,EAAE,CAAC,QAAQ,CAAC,SAAS,EAAE,MAAM,CAAC,CAAC;QAC3D,MAAM,SAAS,GAAG,MAAM,EAAE,CAAC,QAAQ,CAAC,aAAa,CAAC,CAAC;QAEnD,8EAA8E;QAC9E,8CAA8C;QAC9C,MAAM,IAAI,GAAG,GAAG,EAAE,CAAC,QAAQ,EAAE,IAAI,EAAE,CAAC,QAAQ,EAAE,CAAC,QAAQ,GAAG,WAAW,EAAE,CAAC;QACxE,MAAM,aAAa,GAAG,MAAM,CAAC,UAAU,CAAC,SAAS,EAAE,IAAI,EAAE,EAAE,CAAC,CAAC;QAE7D,MAAM,SAAS,GAAG,IAAI,CAAC,sBAAsB,CAAC,aAAa,EAAE,aAAa,CAAC,CAAC;QAC5E,MAAM,MAAM,GAAG,IAAI,CAAC,KAAK,CAAC,SAAS,CAGlC,CAAC;QACF,MAAM,KAAK,GAAG,MAAM,CAAC,gBAAgB,CAAC,CAAC;QACvC,IAAI,CAAC,KAAK,EAAE,CAAC;YACX,MAAM,IAAI,KAAK,CACb,4CAA4C,gBAAgB,WAAW;gBACrE,kCAAkC,CACrC,CAAC;QACJ,CAAC;QAED,MAAM,EAAE,WAAW,EAAE,YAAY,EAAE,SAAS,EAAE,KAAK,EAAE,SAAS,EAAE,GAC9D,KAAK,CAAC,KAAK,CAAC;QACd,IAAI,CAAC,WAAW,IAAI,CAAC,YAAY,EAAE,CAAC;YAClC,MAAM,IAAI,KAAK,CACb,mFAAmF,CACpF,CAAC;QACJ,CAAC;QAED,MAAM,MAAM,GAAG,OAAO,KAAK,KAAK,QAAQ,CAAC,CAAC,CAAC,KAAK,CAAC,KAAK,CAAC,GAAG,CAAC,CAAC,MAAM,CAAC,OAAO,CAAC,CAAC,CAAC,CAAC,EAAE,CAAC;QAEjF,MAAM,YAAY,GAAG,MAAM,uBAAuB,CAAC,WAAW,EAAE,IAAI,CAAC,OAAO,CAAC,CAAC;QAE9E,OAAO;YACL,IAAI,EAAE,cAAc;YACpB,WAAW;YACX,YAAY;YACZ,SAAS,EAAG,SAAsB,IAAI,QAAQ;YAC9C,SAAS,EAAE,SAAS,IAAI,IAAI,CAAC,GAAG,EAAE,GAAG,QAAQ;YAC7C,MAAM;YACN,YAAY;YACZ,QAAQ,EAAE,IAAI,CAAC,QAAQ;SACxB,CAAC;IACJ,CAAC;IAED;;;;;;OAMG;IACH,KAAK,CAAC,kBAAkB;QACtB,MAAM,SAAS,GAAG,IAAI,CAAC,IAAI,CAAC,IAAI,CAAC,aAAa,EAAE,cAAc,CAAC,CAAC;QAChE,IAAI,CAAC;YACH,MAAM,EAAE,CAAC,MAAM,CAAC,SAAS,CAAC,CAAC;QAC7B,CAAC;QAAC,OAAO,GAAG,EAAE,CAAC;YACb,IAAK,GAA6B,CAAC,IAAI,KAAK,QAAQ;gBAAE,OAAO;YAC7D,MAAM,GAAG,CAAC;QACZ,CAAC;IACH,CAAC;IAED,qEAAqE;IACrE,4BAA4B;IAC5B,qEAAqE;IAErE;;;;;;;OAOG;IACH,KAAK,CAAC,cAAc,CAClB,KAA8B,EAC9B,OAA2B;QAE3B,yBAAyB;QACzB,IAAI,OAAO,CAAC,SAAS,GAAG,IAAI,CAAC,GAAG,EAAE,GAAG,IAAI,CAAC,cAAc,EAAE,CAAC;YACzD,OAAO,OAAO,CAAC;QACjB,CAAC;QAED,wDAAwD;QACxD,MAAM,QAAQ,GAAG,IAAI,CAAC,eAAe,CAAC,GAAG,CAAC,KAAK,CAAC,EAAE,CAAC,CAAC;QACpD,IAAI,QAAQ;YAAE,OAAO,QAAQ,CAAC;QAE9B,kDAAkD;QAClD,MAAM,IAAI,GAAG,IAAI,CAAC,kBAAkB,CAAC,GAAG,CAAC,KAAK,CAAC,EAAE,CAAC,IAAI,CAAC,CAAC;QACxD,IAAI,IAAI,CAAC,GAAG,EAAE,GAAG,IAAI,GAAG,mBAAmB,EAAE,CAAC;YAC5C,uEAAuE;YACvE,iDAAiD;YACjD,OAAO,OAAO,CAAC;QACjB,CAAC;QAED,MAAM,OAAO,GAAG,IAAI,CAAC,SAAS,CAAC,KAAK,EAAE,OAAO,CAAC,CAAC;QAC/C,IAAI,CAAC,eAAe,CAAC,GAAG,CAAC,KAAK,CAAC,EAAE,EAAE,OAAO,CAAC,CAAC;QAC5C,IAAI,CAAC,kBAAkB,CAAC,GAAG,CAAC,KAAK,CAAC,EAAE,EAAE,IAAI,CAAC,GAAG,EAAE,CAAC,CAAC;QAClD,IAAI,CAAC;YACH,OAAO,MAAM,OAAO,CAAC;QACvB,CAAC;gBAAS,CAAC;YACT,IAAI,CAAC,eAAe,CAAC,MAAM,CAAC,KAAK,CAAC,EAAE,CAAC,CAAC;QACxC,CAAC;IACH,CAAC;IAEO,KAAK,CAAC,SAAS,CACrB,KAA8B,EAC9B,OAA2B;QAE3B,MAAM,GAAG,GAAG,IAAI,CAAC,gBAAgB,CAAC,OAAO,CAAC,KAAK,EAAE,EAAE,CAAC,GAAG,IAAI,CAAC,WAAW,CAAC;QACxE,MAAM,QAAQ,GAAG,MAAM,IAAI,CAAC,OAAO,CAAC,GAAG,EAAE;YACvC,MAAM,EAAE,MAAM;YACd,OAAO,EAAE,EAAE,cAAc,EAAE,kBAAkB,EAAE;YAC/C,IAAI,EAAE,IAAI,CAAC,SAAS,CAAC,EAAE,aAAa,EAAE,OAAO,CAAC,YAAY,EAAE,CAAC;SAC9D,CAAC,CAAC;QAEH,IAAI,CAAC,QAAQ,CAAC,EAAE,EAAE,CAAC;YACjB,MAAM,IAAI,GAAG,MAAM,QAAQ,CAAC,IAAI,EAAE,CAAC,KAAK,CAAC,GAAG,EAAE,CAAC,EAAE,CAAC,CAAC;YACnD,oEAAoE;YACpE,oDAAoD;YACpD,IACE,QAAQ,CAAC,MAAM,KAAK,GAAG;gBACvB,gBAAgB,CAAC,IAAI,CAAC,IAAI,CAAC,EAC3B,CAAC;gBACD,MAAM,IAAI,CAAC,KAAK,CAAC,gBAAgB,CAAC,KAAK,CAAC,EAAE,EAAE,EAAE,MAAM,EAAE,SAAS,EAAE,CAAC,CAAC;gBACnE,MAAM,IAAI,sBAAsB,CAC9B,KAAK,CAAC,EAAE,EACR,KAAK,CAAC,IAAI,EACV,6FAA6F,CAC9F,CAAC;YACJ,CAAC;YACD,MAAM,IAAI,KAAK,CACb,yBAAyB,QAAQ,CAAC,MAAM,MAAM,IAAI,CAAC,KAAK,CAAC,CAAC,EAAE,GAAG,CAAC,EAAE,CACnE,CAAC;QACJ,CAAC;QAED,MAAM,IAAI,GAAG,CAAC,MAAM,QAAQ,CAAC,IAAI,EAAE,CAMlC,CAAC;QACF,IAAI,CAAC,IAAI,CAAC,YAAY,EAAE,CAAC;YACvB,MAAM,IAAI,KAAK,CAAC,6CAA6C,CAAC,CAAC;QACjE,CAAC;QAED,MAAM,SAAS,GACb,IAAI,CAAC,GAAG,EAAE,GAAG,CAAC,IAAI,CAAC,UAAU,IAAI,IAAI,CAAC,GAAG,IAAI,CAAC;QAEhD,MAAM,OAAO,GAAuB;YAClC,GAAG,OAAO;YACV,WAAW,EAAE,IAAI,CAAC,YAAY;YAC9B,SAAS;YACT,kEAAkE;YAClE,0BAA0B;YAC1B,YAAY,EAAE,IAAI,CAAC,aAAa,IAAI,OAAO,CAAC,YAAY;YACxD,MAAM,EACJ,OAAO,IAAI,CAAC,KAAK,KAAK,QAAQ;gBAC5B,CAAC,CAAC,IAAI,CAAC,KAAK,CAAC,KAAK,CAAC,GAAG,CAAC,CAAC,MAAM,CAAC,OAAO,CAAC;gBACvC,CAAC,CAAC,OAAO,CAAC,MAAM;SACrB,CAAC;QAEF,MAAM,IAAI,CAAC,KAAK,CAAC,UAAU,CAAC,KAAK,CAAC,EAAE,EAAE,OAAO,CAAC,CAAC;QAC/C,MAAM,IAAI,CAAC,KAAK,CAAC,gBAAgB,CAAC,KAAK,CAAC,EAAE,EAAE;YAC1C,SAAS;YACT,UAAU,EAAE,IAAI,IAAI,EAAE,CAAC,WAAW,EAAE;SACrC,CAAC,CAAC;QAEH,OAAO,OAAO,CAAC;IACjB,CAAC;IAED,qEAAqE;IACrE,aAAa;IACb,qEAAqE;IAErE;;;OAGG;IACK,sBAAsB,CAC5B,aAAqB,EACrB,GAAW;QAEX,MAAM,KAAK,GAAG,aAAa,CAAC,KAAK,CAAC,GAAG,CAAC,CAAC;QACvC,IAAI,KAAK,CAAC,MAAM,KAAK,CAAC,EAAE,CAAC;YACvB,MAAM,IAAI,KAAK,CAAC,6DAA6D,CAAC,CAAC;QACjF,CAAC;QACD,MAAM,EAAE,GAAG,MAAM,CAAC,IAAI,CAAC,KAAK,CAAC,CAAC,CAAC,EAAE,KAAK,CAAC,CAAC;QACxC,MAAM,OAAO,GAAG,MAAM,CAAC,IAAI,CAAC,KAAK,CAAC,CAAC,CAAC,EAAE,KAAK,CAAC,CAAC;QAC7C,MAAM,aAAa,GAAG,KAAK,CAAC,CAAC,CAAC,CAAC;QAE/B,MAAM,QAAQ,GAAG,MAAM,CAAC,gBAAgB,CAAC,aAAa,EAAE,GAAG,EAAE,EAAE,CAAC,CAAC;QACjE,QAAQ,CAAC,UAAU,CAAC,OAAO,CAAC,CAAC;QAE7B,IAAI,SAAS,GAAG,QAAQ,CAAC,MAAM,CAAC,aAAa,EAAE,KAAK,EAAE,MAAM,CAAC,CAAC;QAC9D,SAAS,IAAI,QAAQ,CAAC,KAAK,CAAC,MAAM,CAAC,CAAC;QACpC,OAAO,SAAS,CAAC;IACnB,CAAC;CAEF;AAED,+EAA+E;AAC/E,2EAA2E;AAC3E,+EAA+E;AAE/E;;;GAGG;AACH,MAAM,UAAU,gCAAgC,CAC9C,SAAiB,EACjB,GAAW;IAEX,MAAM,EAAE,GAAG,MAAM,CAAC,WAAW,CAAC,EAAE,CAAC,CAAC;IAClC,MAAM,MAAM,GAAG,MAAM,CAAC,cAAc,CAAC,aAAa,EAAE,GAAG,EAAE,EAAE,CAAC,CAAC;IAC7D,IAAI,SAAS,GAAG,MAAM,CAAC,MAAM,CAAC,SAAS,EAAE,MAAM,EAAE,KAAK,CAAC,CAAC;IACxD,SAAS,IAAI,MAAM,CAAC,KAAK,CAAC,KAAK,CAAC,CAAC;IACjC,MAAM,OAAO,GAAG,MAAM,CAAC,UAAU,EAAE,CAAC;IACpC,OAAO,EAAE,CAAC,QAAQ,CAAC,KAAK,CAAC,GAAG,GAAG,GAAG,OAAO,CAAC,QAAQ,CAAC,KAAK,CAAC,GAAG,GAAG,GAAG,SAAS,CAAC;AAC9E,CAAC;AAED;;;GAGG;AACH,MAAM,UAAU,4BAA4B,CAAC,SAAiB;IAC5D,MAAM,IAAI,GAAG,GAAG,EAAE,CAAC,QAAQ,EAAE,IAAI,EAAE,CAAC,QAAQ,EAAE,CAAC,QAAQ,GAAG,WAAW,EAAE,CAAC;IACxE,OAAO,MAAM,CAAC,UAAU,CAAC,SAAS,EAAE,IAAI,EAAE,EAAE,CAAC,CAAC;AAChD,CAAC"}

package/dist/backend/backend/src/services/mcp-server.d.ts

@@ -64,10 +64,12 @@ export interface CrewlyMcpServerConfig {
  */
 export declare class CrewlyMcpServer {
     private server;
-    private storage;
-    private memory;
+    private readonly storage;
+    private readonly memory;
     private transport;
     private stdioTransportCtor;
+    private geminiCliHelper;
+    private getGeminiCliHelper;
     /**
      * Creates a new CrewlyMcpServer instance.
      *
@@ -78,6 +80,14 @@ export declare class CrewlyMcpServer {
      * Register MCP request handlers for tool listing and tool calling.
      */
     private registerHandlers;
+    /**
+     * Build the Server + transport + handlers from already-loaded SDK modules.
+     * Returns false if any expected SDK symbol is missing (so the caller can
+     * decide whether to throw or silently fall back). Both `ensureInitialized`
+     * (dynamic import) and `tryInitializeWithRequire` (CommonJS require) feed
+     * their loaded modules through here.
+     */
+    private installSdkModules;
     private ensureInitialized;
     private tryInitializeWithRequire;
     /**
@@ -88,6 +98,14 @@ export declare class CrewlyMcpServer {
      * @returns Tool result with content blocks
      */
     private handleToolCall;
+    /**
+     * Format a TeamMember for an MCP response. Three variants share the
+     * same base (id/name/role/agentStatus/workingStatus); `includeRuntime`
+     * adds `runtimeType` + `sessionName`, and `includeTickets` adds
+     * `currentTickets`. Keeping all three paths in one place so that a
+     * field added to the member shape only needs to be surfaced once.
+     */
+    private formatMember;
     /**
      * Handle crewly_get_teams: list all teams and their members.
      *
@@ -134,6 +152,32 @@ export declare class CrewlyMcpServer {
      * @returns Confirmation with message ID
      */
     private handleSendMessage;
+    /**
+     * Handle crewly_credential_list: return credential metadata (no values).
+     */
+    private handleCredentialList;
+    /**
+     * Handle crewly_credential_add_api_key: store an API key.
+     */
+    private handleCredentialAddApiKey;
+    /**
+     * Handle crewly_credential_oauth_import_gemini_cli: capture the current
+     * gemini-cli-workspace extension login into an encrypted Crewly credential.
+     */
+    private handleCredentialImportGeminiCli;
+    /**
+     * Handle crewly_credential_clear_gemini_cli_file: delete the extension's
+     * cached token file so the next extension login captures a fresh account.
+     */
+    private handleCredentialClearGeminiCliFile;
+    /**
+     * Handle crewly_credential_delete: remove a credential.
+     */
+    private handleCredentialDelete;
+    /**
+     * Handle crewly_execute_skill: run a skill with optional credential bindings.
+     */
+    private handleExecuteSkill;
     /**
      * Create a success result with JSON-serialized content.
      *

package/dist/backend/backend/src/services/mcp-server.d.ts.map

@@ -1 +1 @@
-{"version":3,"file":"mcp-server.d.ts","sourceRoot":"","sources":["../../../../../backend/src/services/mcp-server.ts"],"names":[],"mappings":"AAAA;;;;;;;;;;;;;;;;;;;GAmBG;AASH;;GAEG;AACH,eAAO,MAAM,oBAAoB;IAC/B,sDAAsD;;;;;IAKtD,uCAAuC;;CAE/B,CAAC;AAIX;;GAEG;AACH,MAAM,WAAW,qBAAqB;IACpC,6DAA6D;IAC7D,UAAU,CAAC,EAAE,MAAM,CAAC;CACrB;AA0KD;;;;;;;;;;;;;;;;;;;;;;;;GAwBG;AACH,qBAAa,eAAe;IAC1B,OAAO,CAAC,MAAM,CAAoB;IAClC,OAAO,CAAC,OAAO,CAAiB;IAChC,OAAO,CAAC,MAAM,CAAgB;IAC9B,OAAO,CAAC,SAAS,CAAoB;IACrC,OAAO,CAAC,kBAAkB,CAAgC;IAE1D;;;;OAIG;gBACS,MAAM,CAAC,EAAE,qBAAqB;IAM1C;;OAEG;IACH,OAAO,CAAC,gBAAgB;YAwBV,iBAAiB;IAiC/B,OAAO,CAAC,wBAAwB;IA2ChC;;;;;;OAMG;YACW,cAAc;IA6B5B;;;;;OAKG;YACW,cAAc;IAoC5B;;;;;OAKG;YACW,gBAAgB;IA0D9B;;;;;;;;;OASG;YACW,gBAAgB;IA2C9B;;;;;OAKG;YACW,eAAe;IAiE7B;;;;;OAKG;YACW,kBAAkB;IAiChC;;;;;OAKG;YACW,iBAAiB;IAwB/B;;;;;OAKG;IACH,OAAO,CAAC,aAAa;IAMrB;;;;;OAKG;IACH,OAAO,CAAC,WAAW;IASnB;;;;;OAKG;IACG,KAAK,IAAI,OAAO,CAAC,IAAI,CAAC;IAS5B;;OAEG;IACG,IAAI,IAAI,OAAO,CAAC,IAAI,CAAC;IAO3B;;;;OAIG;IACH,SAAS,IAAI,GAAG;CAGjB"}
+{"version":3,"file":"mcp-server.d.ts","sourceRoot":"","sources":["../../../../../backend/src/services/mcp-server.ts"],"names":[],"mappings":"AAAA;;;;;;;;;;;;;;;;;;;GAmBG;AAcH;;GAEG;AACH,eAAO,MAAM,oBAAoB;IAC/B,sDAAsD;;;;;IAKtD,uCAAuC;;CAE/B,CAAC;AAIX;;GAEG;AACH,MAAM,WAAW,qBAAqB;IACpC,6DAA6D;IAC7D,UAAU,CAAC,EAAE,MAAM,CAAC;CACrB;AAeD;;;;;;;;;;;;;;;;;;;;;;;;GAwBG;AACH,qBAAa,eAAe;IAC1B,OAAO,CAAC,MAAM,CAAoB;IAClC,OAAO,CAAC,QAAQ,CAAC,OAAO,CAAiB;IACzC,OAAO,CAAC,QAAQ,CAAC,MAAM,CAAgB;IACvC,OAAO,CAAC,SAAS,CAAoB;IACrC,OAAO,CAAC,kBAAkB,CAAgC;IAC1D,OAAO,CAAC,eAAe,CAAyC;IAEhE,OAAO,CAAC,kBAAkB;IAO1B;;;;OAIG;gBACS,MAAM,CAAC,EAAE,qBAAqB;IAM1C;;OAEG;IACH,OAAO,CAAC,gBAAgB;IAwBxB;;;;;;OAMG;IACH,OAAO,CAAC,iBAAiB;YA2BX,iBAAiB;IAc/B,OAAO,CAAC,wBAAwB;IAsBhC;;;;;;OAMG;YACW,cAAc;IAyC5B;;;;;;OAMG;IACH,OAAO,CAAC,YAAY;IAuBpB;;;;;OAKG;YACW,cAAc;IA4B5B;;;;;OAKG;YACW,gBAAgB;IA8D9B;;;;;;;;;OASG;YACW,gBAAgB;IA4C9B;;;;;OAKG;YACW,eAAe;IAqD7B;;;;;OAKG;YACW,kBAAkB;IAiChC;;;;;OAKG;YACW,iBAAiB;IA0B/B;;OAEG;YACW,oBAAoB;IA6BlC;;OAEG;YACW,yBAAyB;IAqBvC;;;OAGG;YACW,+BAA+B;IA8B7C;;;OAGG;YACW,kCAAkC;IAKhD;;OAEG;YACW,sBAAsB;IAapC;;OAEG;YACW,kBAAkB;IA8BhC;;;;;OAKG;IACH,OAAO,CAAC,aAAa;IAMrB;;;;;OAKG;IACH,OAAO,CAAC,WAAW;IASnB;;;;;OAKG;IACG,KAAK,IAAI,OAAO,CAAC,IAAI,CAAC;IAS5B;;OAEG;IACG,IAAI,IAAI,OAAO,CAAC,IAAI,CAAC;IAO3B;;;;OAIG;IACH,SAAS,IAAI,GAAG;CAGjB"}