groove-dev 0.17.0 → 0.17.2

package/packages/daemon/src/integrations.js

@@ -235,6 +235,8 @@ export class IntegrationStore {
   /**
    * Build MCP config object for a set of integration IDs.
    * Returns the mcpServers object to merge into .mcp.json.
+   * SECURITY: credentials are NOT included in the config file.
+   * They are injected at spawn time via process environment only.
    */
   buildMcpConfig(integrationIds) {
     const mcpServers = {};
@@ -244,23 +246,33 @@ export class IntegrationStore {
       if (!entry) continue;
       if (!this._isInstalled(id)) continue;
 
-      // Build environment with credentials
-      const env = {};
-      for (const ek of (entry.envKeys || [])) {
-        const val = this.getCredential(id, ek.key);
-        if (val) env[ek.key] = val;
-      }
-
+      // No env block — credentials stay out of .mcp.json
       mcpServers[`groove-${id}`] = {
         command: entry.command || 'npx',
         args: entry.args || ['-y', entry.npmPackage],
-        env,
       };
     }
 
     return mcpServers;
   }
 
+  /**
+   * Get environment variables with decrypted credentials for a set of integration IDs.
+   * These are passed to the agent process at spawn time (in-memory only, never written to disk).
+   */
+  getSpawnEnv(integrationIds) {
+    const env = {};
+    for (const id of integrationIds) {
+      const entry = this.registry.find((s) => s.id === id);
+      if (!entry) continue;
+      for (const ek of (entry.envKeys || [])) {
+        const val = this.getCredential(id, ek.key);
+        if (val) env[ek.key] = val;
+      }
+    }
+    return env;
+  }
+
   /**
    * Write/merge MCP config into the project root .mcp.json.
    * Only adds/updates groove-* entries, preserves user's own MCP configs.
@@ -359,6 +371,92 @@ export class IntegrationStore {
     }
   }
 
+  /**
+   * Start an OAuth flow for a Google integration.
+   * Returns the authorization URL to open in a browser.
+   */
+  getOAuthUrl(integrationId) {
+    const entry = this.registry.find((s) => s.id === integrationId);
+    if (!entry) throw new Error(`Integration not found: ${integrationId}`);
+    if (entry.authType !== 'oauth-google') throw new Error('Integration does not use OAuth');
+
+    // Check if user has provided their own Google OAuth client (stored globally)
+    const clientId = this.getCredential('google-oauth', 'GOOGLE_CLIENT_ID');
+    const clientSecret = this.getCredential('google-oauth', 'GOOGLE_CLIENT_SECRET');
+    if (!clientId || !clientSecret) {
+      throw new Error('Google OAuth not configured. Set up your Google Cloud project first.');
+    }
+
+    const port = this.daemon.port || 31415;
+    const redirectUri = `http://localhost:${port}/api/integrations/oauth/callback`;
+    const scopes = entry.oauthScopes || [];
+
+    const params = new URLSearchParams({
+      client_id: clientId,
+      redirect_uri: redirectUri,
+      response_type: 'code',
+      scope: scopes.join(' '),
+      access_type: 'offline',
+      prompt: 'consent',
+      state: integrationId,
+    });
+
+    return `https://accounts.google.com/o/oauth2/v2/auth?${params}`;
+  }
+
+  /**
+   * Handle OAuth callback — exchange code for tokens.
+   */
+  async handleOAuthCallback(code, integrationId) {
+    const clientId = this.getCredential('google-oauth', 'GOOGLE_CLIENT_ID');
+    const clientSecret = this.getCredential('google-oauth', 'GOOGLE_CLIENT_SECRET');
+    if (!clientId || !clientSecret) {
+      throw new Error('Google OAuth credentials not found');
+    }
+
+    const port = this.daemon.port || 31415;
+    const redirectUri = `http://localhost:${port}/api/integrations/oauth/callback`;
+
+    const res = await fetch('https://oauth2.googleapis.com/token', {
+      method: 'POST',
+      headers: { 'Content-Type': 'application/x-www-form-urlencoded' },
+      body: new URLSearchParams({
+        code,
+        client_id: clientId,
+        client_secret: clientSecret,
+        redirect_uri: redirectUri,
+        grant_type: 'authorization_code',
+      }),
+    });
+
+    if (!res.ok) {
+      const err = await res.json().catch(() => ({}));
+      throw new Error(`OAuth token exchange failed: ${err.error_description || err.error || 'unknown'}`);
+    }
+
+    const tokens = await res.json();
+
+    // Store the tokens for this integration
+    this.setCredential(integrationId, 'GOOGLE_CLIENT_ID', clientId);
+    this.setCredential(integrationId, 'GOOGLE_CLIENT_SECRET', clientSecret);
+    if (tokens.refresh_token) {
+      this.setCredential(integrationId, 'GOOGLE_REFRESH_TOKEN', tokens.refresh_token);
+    }
+
+    this.daemon.audit.log('integration.oauth.complete', { id: integrationId });
+
+    return { ok: true, integrationId };
+  }
+
+  /**
+   * Check if Google OAuth is configured (user has set up their Cloud project).
+   */
+  isGoogleOAuthConfigured() {
+    const clientId = this.getCredential('google-oauth', 'GOOGLE_CLIENT_ID');
+    const clientSecret = this.getCredential('google-oauth', 'GOOGLE_CLIENT_SECRET');
+    return !!(clientId && clientSecret);
+  }
+
   // --- Internal ---
 
   _isInstalled(integrationId) {

package/packages/daemon/src/process.js

@@ -201,9 +201,12 @@ For normal file edits within your scope, proceed without review.
       }
     }
 
-    // Write MCP config for agent integrations
+    // Write MCP config for agent integrations (command/args only, no secrets)
+    // Credentials are injected via process environment below
+    let integrationEnv = {};
     if (config.integrations?.length > 0 && this.daemon.integrations) {
       this.daemon.integrations.writeMcpJson(config.integrations);
+      integrationEnv = this.daemon.integrations.getSpawnEnv(config.integrations);
     }
 
     const { command, args, env } = provider.buildSpawnCommand(spawnConfig);
@@ -232,7 +235,7 @@ For normal file edits within your scope, proceed without review.
     // Spawn the process
     const proc = cpSpawn(command, args, {
       cwd: agent.workingDir || this.daemon.projectDir,
-      env: { ...process.env, ...env, GROOVE_AGENT_ID: agent.id, GROOVE_AGENT_NAME: agent.name },
+      env: { ...process.env, ...env, ...integrationEnv, GROOVE_AGENT_ID: agent.id, GROOVE_AGENT_NAME: agent.name },
       stdio: ['ignore', 'pipe', 'pipe'],
       // Don't let agent process prevent daemon from exiting
       detached: false,