forge-openclaw-plugin 0.2.25 → 0.2.26

package/dist/server/server/src/services/google-calendar-oauth-config.js

@@ -0,0 +1,176 @@
+import { createDecipheriv, createHash } from "node:crypto";
+const GOOGLE_CALLBACK_PATH = "/api/v1/calendar/oauth/google/callback";
+const DEFAULT_APP_PORT = "4317";
+const DEFAULT_APP_BASE_URL = `http://127.0.0.1:${DEFAULT_APP_PORT}`;
+const PACKAGED_DEFAULT_GOOGLE_CREDENTIAL_KEY_MATERIAL = [
+    "forge",
+    "desktop",
+    "oauth",
+    "default",
+    "google",
+    "bundle",
+    "2026",
+    "local"
+];
+const PACKAGED_DEFAULT_GOOGLE_CLIENT_ID_ENCRYPTED = {
+    iv: "2fc1a6723312a10b7d176f13",
+    data: "9fbdf9dfcd1cc8674fa46150dd0f4678df8ce1ba52cdf0ceb4d4a76c9c5df01b3d8a21f194201c827524a6e06b0d4a55c7002edb3fa20b76b67f540e46ba28f506a73edaf6559a1d",
+    tag: "1965dfe1213ecd888e46ea59241d03a9"
+};
+const PACKAGED_DEFAULT_GOOGLE_CLIENT_SECRET_ENCRYPTED = {
+    iv: "5a6ca66625e0ff5559b34f99",
+    data: "b80dec231f029d92a13426ad3f0b851e20a5b35ec6691e517744fd65349144e75005f1",
+    tag: "9d2cfd8a153d91f60d8c628bbe1c2f25"
+};
+const DEFAULT_DEV_WEB_ORIGINS = [
+    "http://127.0.0.1:3027",
+    "http://localhost:3027"
+];
+function decryptPackagedGoogleOauthValue(payload) {
+    const key = createHash("sha256")
+        .update(PACKAGED_DEFAULT_GOOGLE_CREDENTIAL_KEY_MATERIAL.join(":"))
+        .digest();
+    const decipher = createDecipheriv("aes-256-gcm", key, Buffer.from(payload.iv, "hex"));
+    decipher.setAuthTag(Buffer.from(payload.tag, "hex"));
+    const decrypted = Buffer.concat([
+        decipher.update(Buffer.from(payload.data, "hex")),
+        decipher.final()
+    ]);
+    return decrypted.toString("utf8");
+}
+const PACKAGED_DEFAULT_GOOGLE_CLIENT_ID = decryptPackagedGoogleOauthValue(PACKAGED_DEFAULT_GOOGLE_CLIENT_ID_ENCRYPTED);
+const PACKAGED_DEFAULT_GOOGLE_CLIENT_SECRET = decryptPackagedGoogleOauthValue(PACKAGED_DEFAULT_GOOGLE_CLIENT_SECRET_ENCRYPTED);
+function runtimeOriginFromEnv(env) {
+    const port = env.PORT?.trim() || DEFAULT_APP_PORT;
+    return `http://127.0.0.1:${port}`;
+}
+function normalizeOrigin(value, fieldLabel) {
+    let url;
+    try {
+        url = new URL(value);
+    }
+    catch {
+        throw new Error(`${fieldLabel} must be a full URL.`);
+    }
+    if (url.protocol !== "http:") {
+        throw new Error(`${fieldLabel} must use http in local Forge mode.`);
+    }
+    if (url.pathname !== "/" && url.pathname !== "") {
+        throw new Error(`${fieldLabel} must not include a path.`);
+    }
+    return url.origin;
+}
+function isLoopbackHostname(hostname) {
+    return hostname === "127.0.0.1" || hostname === "localhost";
+}
+function normalizeLoopbackOrigin(value, fieldLabel) {
+    const origin = normalizeOrigin(value, fieldLabel);
+    const url = new URL(origin);
+    if (!isLoopbackHostname(url.hostname)) {
+        throw new Error(`${fieldLabel} must use localhost or 127.0.0.1 in local Forge mode.`);
+    }
+    return origin;
+}
+function normalizeRedirectUri(value, appBaseUrl) {
+    let url;
+    try {
+        url = new URL(value);
+    }
+    catch {
+        throw new Error("GOOGLE_REDIRECT_URI must be a full URL.");
+    }
+    if (url.protocol !== "http:") {
+        throw new Error("GOOGLE_REDIRECT_URI must use http in local Forge mode.");
+    }
+    if (!isLoopbackHostname(url.hostname)) {
+        throw new Error("GOOGLE_REDIRECT_URI must use localhost or 127.0.0.1 in local Forge mode.");
+    }
+    if (url.pathname !== GOOGLE_CALLBACK_PATH) {
+        throw new Error(`GOOGLE_REDIRECT_URI must end with ${GOOGLE_CALLBACK_PATH}.`);
+    }
+    if (url.origin !== appBaseUrl) {
+        throw new Error(`GOOGLE_REDIRECT_URI must use the same origin as APP_BASE_URL (${appBaseUrl}).`);
+    }
+    return url.toString();
+}
+function normalizeAllowedOrigins(value, appBaseUrl) {
+    const rawValues = value && value.trim().length > 0
+        ? value
+            .split(",")
+            .map((entry) => entry.trim())
+            .filter((entry) => entry.length > 0)
+        : [appBaseUrl, ...DEFAULT_DEV_WEB_ORIGINS];
+    const normalized = rawValues.map((entry) => normalizeLoopbackOrigin(entry, "GOOGLE_ALLOWED_ORIGINS"));
+    return Array.from(new Set(normalized));
+}
+export function getGoogleCalendarOauthCallbackPath() {
+    return GOOGLE_CALLBACK_PATH;
+}
+export function resolveGoogleCalendarOauthPublicConfig(env = process.env, overrides) {
+    const runtimeOrigin = runtimeOriginFromEnv(env);
+    const appBaseUrl = normalizeLoopbackOrigin(env.APP_BASE_URL?.trim() ||
+        env.APP_URL?.trim() ||
+        DEFAULT_APP_BASE_URL, env.APP_BASE_URL?.trim() ? "APP_BASE_URL" : "APP_URL");
+    const redirectUri = normalizeRedirectUri(env.GOOGLE_REDIRECT_URI?.trim() || `${appBaseUrl}${GOOGLE_CALLBACK_PATH}`, appBaseUrl);
+    const allowedOrigins = normalizeAllowedOrigins(env.GOOGLE_ALLOWED_ORIGINS, appBaseUrl);
+    const storedClientId = overrides?.clientId?.trim() || "";
+    const storedClientSecret = overrides?.clientSecret?.trim() || "";
+    const envClientId = env.GOOGLE_CLIENT_ID?.trim() || "";
+    const envClientSecret = env.GOOGLE_CLIENT_SECRET?.trim() || "";
+    const hasStoredOverride = storedClientId.length > 0 || storedClientSecret.length > 0;
+    const hasEnvOverride = envClientId.length > 0 || envClientSecret.length > 0;
+    const clientId = hasStoredOverride
+        ? storedClientId
+        : hasEnvOverride
+            ? envClientId
+            : PACKAGED_DEFAULT_GOOGLE_CLIENT_ID.trim();
+    const clientSecret = hasStoredOverride
+        ? storedClientSecret
+        : hasEnvOverride
+            ? envClientSecret
+            : PACKAGED_DEFAULT_GOOGLE_CLIENT_SECRET.trim();
+    const isConfigured = clientId.length > 0;
+    const hasIncompleteStoredOverride = storedClientId.length > 0 !== storedClientSecret.length > 0;
+    const setupMessage = hasIncompleteStoredOverride
+        ? "Google OAuth override is incomplete for this Forge install. Save both the client ID and client secret together, or clear both fields to use the packaged default."
+        : isConfigured
+            ? "Google Calendar sign-in is configured for local Forge. Open Forge on localhost or 127.0.0.1 on the same machine that is running Forge, because Google will redirect back to the local callback on that machine."
+            : "Google client ID is not set for this Forge install.";
+    return {
+        clientId,
+        clientSecret,
+        storedClientId,
+        storedClientSecret,
+        appBaseUrl,
+        redirectUri,
+        allowedOrigins,
+        usesPkce: true,
+        requiresServerClientSecret: false,
+        oauthClientType: "desktop_app",
+        authMode: "localhost_pkce",
+        isConfigured,
+        isReadyForPairing: isConfigured && !hasIncompleteStoredOverride,
+        isLocalOnly: true,
+        runtimeOrigin,
+        setupMessage
+    };
+}
+export function resolveGoogleCalendarOauthPrivateConfig(env = process.env, overrides) {
+    return resolveGoogleCalendarOauthPublicConfig(env, overrides);
+}
+export function isGoogleCalendarOriginAllowed(origin, allowedOrigins) {
+    try {
+        return allowedOrigins.includes(new URL(origin).origin);
+    }
+    catch {
+        return false;
+    }
+}
+export function isGoogleCalendarLoopbackOrigin(origin) {
+    try {
+        return isLoopbackHostname(new URL(origin).hostname);
+    }
+    catch {
+        return false;
+    }
+}

package/dist/server/{types.js → server/src/types.js}

@@ -1220,6 +1220,9 @@ export const themePreferenceSchema = z.enum([
     "solar",
     "aurora",
     "ember",
+    "paper",
+    "dawn",
+    "atelier",
     "custom",
     "system"
 ]);
@@ -1249,6 +1252,24 @@ export const microsoftCalendarAuthSettingsSchema = z.object({
     isReadyForSignIn: z.boolean(),
     setupMessage: z.string()
 });
+export const googleCalendarAuthSettingsSchema = z.object({
+    clientId: z.string(),
+    clientSecret: z.string(),
+    storedClientId: z.string(),
+    storedClientSecret: z.string(),
+    appBaseUrl: z.string(),
+    redirectUri: z.string(),
+    allowedOrigins: z.array(z.string()),
+    usesPkce: z.literal(true),
+    requiresServerClientSecret: z.literal(false),
+    oauthClientType: z.literal("desktop_app"),
+    authMode: z.literal("localhost_pkce"),
+    isConfigured: z.boolean(),
+    isReadyForPairing: z.boolean(),
+    isLocalOnly: z.literal(true),
+    runtimeOrigin: z.string(),
+    setupMessage: z.string()
+});
 export const aiModelProviderSchema = z.enum([
     "openai-api",
     "openai-codex",
@@ -1416,15 +1437,32 @@ export const forgeBoxToolAdapterSchema = z.object({
     description: trimmedString.default(""),
     accessMode: aiProcessorAccessModeSchema.default("read")
 });
+export const forgeBoxPortDefinitionSchema = z.object({
+    key: nonEmptyTrimmedString,
+    label: nonEmptyTrimmedString,
+    kind: nonEmptyTrimmedString.default("content"),
+    required: z.boolean().default(false),
+    expandableKeys: z.array(nonEmptyTrimmedString).default([])
+});
 export const forgeBoxCatalogEntrySchema = z.object({
-    boxId: nonEmptyTrimmedString,
+    id: nonEmptyTrimmedString,
+    boxId: trimmedString.optional(),
     surfaceId: trimmedString.nullable(),
     routePath: trimmedString.nullable(),
-    label: nonEmptyTrimmedString,
+    title: nonEmptyTrimmedString,
+    label: trimmedString.optional(),
+    icon: trimmedString.nullable().optional(),
     description: trimmedString.default(""),
     category: nonEmptyTrimmedString,
-    capabilityModes: z.array(forgeBoxCapabilityModeSchema).default(["content"]),
-    toolAdapters: z.array(forgeBoxToolAdapterSchema).default([])
+    tags: z.array(nonEmptyTrimmedString).default([]),
+    capabilityModes: z.array(forgeBoxCapabilityModeSchema).default(["content"]).optional(),
+    inputs: z.array(forgeBoxPortDefinitionSchema).default([]),
+    params: z.array(forgeBoxPortDefinitionSchema).default([]),
+    output: z.array(forgeBoxPortDefinitionSchema).default([]),
+    tools: z.array(forgeBoxToolAdapterSchema).default([]),
+    outputs: z.array(forgeBoxPortDefinitionSchema).default([]).optional(),
+    toolAdapters: z.array(forgeBoxToolAdapterSchema).default([]).optional(),
+    snapshotResolverKey: trimmedString.optional()
 });
 export const forgeBoxSnapshotSchema = z.object({
     boxId: nonEmptyTrimmedString,
@@ -1436,11 +1474,16 @@ export const forgeBoxSnapshotSchema = z.object({
 });
 export const aiConnectorKindSchema = z.enum(["functor", "chat"]);
 export const aiConnectorNodeTypeSchema = z.enum([
+    "box",
     "box_input",
+    "value",
     "user_input",
     "functor",
     "chat",
-    "output"
+    "output",
+    "merge",
+    "template",
+    "pick_key"
 ]);
 export const aiConnectorNodeModelConfigSchema = z.object({
     connectionId: trimmedString.nullable().default(null),
@@ -1462,9 +1505,20 @@ export const aiConnectorNodeSchema = z.object({
         description: trimmedString.default(""),
         boxId: trimmedString.nullable().optional(),
         prompt: trimmedString.optional(),
+        promptTemplate: trimmedString.optional(),
         systemPrompt: trimmedString.optional(),
         outputKey: trimmedString.optional(),
         enabledToolKeys: z.array(nonEmptyTrimmedString).default([]),
+        inputs: z.array(forgeBoxPortDefinitionSchema).default([]).optional(),
+        outputs: z.array(forgeBoxPortDefinitionSchema).default([]).optional(),
+        params: z.array(forgeBoxPortDefinitionSchema).default([]).optional(),
+        paramValues: z.record(z.string(), z.unknown()).default({}).optional(),
+        template: trimmedString.optional(),
+        selectedKey: trimmedString.optional(),
+        valueType: z
+            .enum(["string", "number", "boolean", "null", "array", "object"])
+            .optional(),
+        valueLiteral: trimmedString.optional(),
         modelConfig: aiConnectorNodeModelConfigSchema.optional()
     })
 });
@@ -1488,7 +1542,31 @@ export const aiConnectorRunResultSchema = z.object({
         label: z.string(),
         text: z.string(),
         json: z.record(z.string(), z.unknown()).nullable()
-    }))
+    })),
+    debugTrace: z
+        .object({
+        nodes: z.array(z.object({
+            nodeId: nonEmptyTrimmedString,
+            nodeType: aiConnectorNodeTypeSchema,
+            label: nonEmptyTrimmedString,
+            input: z.array(z.object({
+                sourceNodeId: nonEmptyTrimmedString,
+                sourceHandle: trimmedString.nullable(),
+                targetHandle: trimmedString.nullable(),
+                text: z.string(),
+                json: z.record(z.string(), z.unknown()).nullable()
+            })),
+            output: z.object({
+                text: z.string(),
+                json: z.record(z.string(), z.unknown()).nullable()
+            }),
+            tools: z.array(z.string()).default([]),
+            logs: z.array(z.string()).default([]),
+            error: z.string().nullable()
+        })),
+        errors: z.array(z.string()).default([])
+    })
+        .optional()
 });
 export const aiConnectorRunSchema = z.object({
     id: nonEmptyTrimmedString,
@@ -1792,6 +1870,7 @@ export const settingsPayloadSchema = z.object({
         psycheAuthRequired: z.boolean()
     }),
     calendarProviders: z.object({
+        google: googleCalendarAuthSettingsSchema,
         microsoft: microsoftCalendarAuthSettingsSchema
     }),
     modelSettings: modelSettingsPayloadSchema,
@@ -2008,10 +2087,7 @@ export const createCalendarConnectionSchema = z.discriminatedUnion("provider", [
     z.object({
         provider: z.literal("google"),
         label: nonEmptyTrimmedString,
-        username: nonEmptyTrimmedString,
-        clientId: nonEmptyTrimmedString,
-        clientSecret: nonEmptyTrimmedString,
-        refreshToken: nonEmptyTrimmedString,
+        authSessionId: nonEmptyTrimmedString,
         selectedCalendarUrls: z.array(nonEmptyTrimmedString.url()).min(1),
         forgeCalendarUrl: nonEmptyTrimmedString.url().nullable().optional(),
         createForgeCalendar: z.boolean().optional().default(false)
@@ -2043,13 +2119,6 @@ export const createCalendarConnectionSchema = z.discriminatedUnion("provider", [
     })
 ]);
 export const discoverCalendarConnectionSchema = z.discriminatedUnion("provider", [
-    z.object({
-        provider: z.literal("google"),
-        username: nonEmptyTrimmedString,
-        clientId: nonEmptyTrimmedString,
-        clientSecret: nonEmptyTrimmedString,
-        refreshToken: nonEmptyTrimmedString
-    }),
     z.object({
         provider: z.literal("apple"),
         username: nonEmptyTrimmedString,
@@ -2065,6 +2134,10 @@ export const discoverCalendarConnectionSchema = z.discriminatedUnion("provider",
 export const startMicrosoftCalendarOauthSchema = z.object({
     label: nonEmptyTrimmedString.optional()
 });
+export const startGoogleCalendarOauthSchema = z.object({
+    label: nonEmptyTrimmedString.optional(),
+    browserOrigin: trimmedString.optional()
+});
 export const testMicrosoftCalendarOauthConfigurationSchema = z.object({
     clientId: nonEmptyTrimmedString.regex(/^[0-9a-fA-F]{8}-[0-9a-fA-F]{4}-[0-9a-fA-F]{4}-[0-9a-fA-F]{4}-[0-9a-fA-F]{12}$/, "Microsoft client IDs must use the standard app registration GUID format."),
     tenantId: trimmedString.default("common"),
@@ -2078,6 +2151,14 @@ export const microsoftCalendarOauthSessionSchema = z.object({
     error: z.string().nullable(),
     discovery: calendarDiscoveryPayloadSchema.nullable()
 });
+export const googleCalendarOauthSessionSchema = z.object({
+    sessionId: nonEmptyTrimmedString,
+    status: z.enum(["pending", "authorized", "error", "consumed", "expired"]),
+    authUrl: z.string().url().nullable(),
+    accountLabel: z.string().nullable(),
+    error: z.string().nullable(),
+    discovery: calendarDiscoveryPayloadSchema.nullable()
+});
 export const updateCalendarConnectionSchema = z.object({
     label: nonEmptyTrimmedString.optional(),
     selectedCalendarUrls: z.array(nonEmptyTrimmedString.url()).optional()
@@ -2595,6 +2676,12 @@ export const updateSettingsSchema = z.object({
         .optional(),
     calendarProviders: z
         .object({
+        google: z
+            .object({
+            clientId: trimmedString.optional(),
+            clientSecret: trimmedString.optional()
+        })
+            .optional(),
         microsoft: z
             .object({
             clientId: trimmedString.optional(),
@@ -2603,7 +2690,37 @@ export const updateSettingsSchema = z.object({
         })
             .optional()
     })
-        .optional(),
+        .optional()
+        .superRefine((value, context) => {
+        if (!value) {
+            return;
+        }
+        const google = value.google;
+        if (!google) {
+            return;
+        }
+        const hasClientIdField = google.clientId !== undefined;
+        const hasClientSecretField = google.clientSecret !== undefined;
+        const hasClientIdValue = (google.clientId?.length ?? 0) > 0;
+        const hasClientSecretValue = (google.clientSecret?.length ?? 0) > 0;
+        if (hasClientIdField !== hasClientSecretField) {
+            const message = "When overriding Google OAuth credentials, provide both the client ID and client secret together, or clear both fields together.";
+            context.addIssue({
+                code: z.ZodIssueCode.custom,
+                path: ["google", hasClientIdField ? "clientSecret" : "clientId"],
+                message
+            });
+            return;
+        }
+        if (hasClientIdValue !== hasClientSecretValue) {
+            const message = "When overriding Google OAuth credentials, provide both the client ID and client secret together, or clear both fields together.";
+            context.addIssue({
+                code: z.ZodIssueCode.custom,
+                path: ["google", hasClientIdValue ? "clientSecret" : "clientId"],
+                message
+            });
+        }
+    }),
     modelSettings: z
         .object({
         forgeAgent: z
@@ -2748,7 +2865,8 @@ export const runAiConnectorSchema = z.object({
     userInput: trimmedString.default(""),
     context: z.record(z.string(), z.unknown()).default({}),
     boxSnapshots: z.record(z.string(), z.unknown()).default({}),
-    conversationId: trimmedString.nullable().default(null)
+    conversationId: trimmedString.nullable().default(null),
+    debug: z.boolean().default(false)
 });
 export const createAgentTokenSchema = z.object({
     label: nonEmptyTrimmedString,

package/dist/server/{web.js → server/src/web.js}

@@ -2,7 +2,6 @@ import { access, readFile } from "node:fs/promises";
 import path from "node:path";
 const distDir = path.join(process.cwd(), "dist");
 const packagedRuntimeDistDir = path.join(process.cwd(), "plugins", "forge-codex", "runtime", "dist");
-const defaultBasePath = process.env.FORGE_BASE_PATH ?? "/forge/";
 const contentTypes = {
     ".css": "text/css; charset=utf-8",
     ".html": "text/html; charset=utf-8",
@@ -20,6 +19,18 @@ function normalizeBasePath(value) {
     const withLeadingSlash = value.startsWith("/") ? value : `/${value}`;
     return withLeadingSlash.endsWith("/") ? withLeadingSlash : `${withLeadingSlash}/`;
 }
+function normalizeAbsoluteUrl(value) {
+    const url = new URL(value);
+    url.pathname = normalizeBasePath(url.pathname);
+    return url;
+}
+function getDefaultBasePath() {
+    return process.env.FORGE_BASE_PATH ?? "/forge/";
+}
+function getDevWebOrigin() {
+    const value = process.env.FORGE_DEV_WEB_ORIGIN?.trim();
+    return value && value.length > 0 ? value : null;
+}
 function stripBasePath(requestPath, basePath) {
     const normalizedBasePath = normalizeBasePath(basePath);
     if (normalizedBasePath === "/") {
@@ -57,8 +68,16 @@ async function serveAsset(requestPath, reply) {
         reply.code(404);
         return { error: "Not found" };
     }
+    const normalizedRequestPath = stripBasePath(requestPath, getDefaultBasePath());
+    const devWebOrigin = getDevWebOrigin();
+    if (devWebOrigin) {
+        const target = new URL(normalizedRequestPath.startsWith("/")
+            ? normalizedRequestPath.slice(1)
+            : normalizedRequestPath, normalizeAbsoluteUrl(devWebOrigin));
+        reply.code(307).redirect(target.toString());
+        return reply;
+    }
     const clientDir = await getClientDir();
-    const normalizedRequestPath = stripBasePath(requestPath, defaultBasePath);
     const assetPath = resolveAsset(clientDir, normalizedRequestPath);
     const ext = path.extname(assetPath);
     try {