madarx 2.15.1 → 2.16.1

package/lib/oauth/flow.js

@@ -0,0 +1,204 @@
+// lib/oauth/flow.js — OAuth2 authorization-code flow primitives.
+//
+// Local-first and provider-agnostic. Three responsibilities:
+//   1. CSRF state — a single-use, server-stored random state value (oauth_states
+//      table). createAuthState() issues one; consumeAuthState() validates +
+//      burns it exactly once. Replay or expiry is rejected.
+//   2. PKCE — S256 code_verifier/code_challenge generation (RFC 7636).
+//   3. Token I/O — exchangeCodeForTokens() and refreshAccessToken(), both taking
+//      an injectable fetchFn so tests use a mock and never hit a live provider.
+//
+// SECURITY: this module never persists access/refresh tokens — that is the
+// caller's job (the vault, via setSecret). The state ledger stores only the PKCE
+// verifier and non-secret scope metadata. Tokens never appear in audit/log here.
+
+import { createHash, randomBytes } from 'node:crypto';
+import { getDb, nowIso } from '../db.js';
+
+const DEFAULT_TTL_MS = 10 * 60 * 1000; // 10 minutes
+
+function base64url(buf) {
+  return Buffer.from(buf).toString('base64').replace(/\+/g, '-').replace(/\//g, '_').replace(/=+$/, '');
+}
+
+/** Generate a PKCE verifier + S256 challenge pair. */
+export function generatePkce() {
+  const verifier = base64url(randomBytes(32));
+  const challenge = base64url(createHash('sha256').update(verifier).digest());
+  return { code_verifier: verifier, code_challenge: challenge, code_challenge_method: 'S256' };
+}
+
+/**
+ * Issue a single-use state value and persist it (with the PKCE verifier and
+ * scope metadata) so the callback can validate the round-trip.
+ *
+ * @returns {{ state, code_verifier?, code_challenge?, code_challenge_method? }}
+ */
+export function createAuthState({ service_key, provider, scope = null, redirect_uri = null, pkce = false, ttl_ms = DEFAULT_TTL_MS } = {}) {
+  if (!service_key) throw new Error('service_key is required');
+  const db = getDb();
+  const state = base64url(randomBytes(24));
+  const now = Date.now();
+  const created_at = nowIso();
+  const expires_at = new Date(now + (Number(ttl_ms) || DEFAULT_TTL_MS)).toISOString();
+
+  let pkceParts = null;
+  if (pkce) pkceParts = generatePkce();
+
+  db.prepare(`
+    INSERT INTO oauth_states (state, service_key, provider, scope_json, code_verifier, redirect_uri, created_at, expires_at, consumed_at)
+    VALUES (?, ?, ?, ?, ?, ?, ?, ?, NULL)
+  `).run(
+    state,
+    String(service_key),
+    String(provider || 'custom'),
+    scope ? JSON.stringify(scope) : null,
+    pkceParts?.code_verifier || null,
+    redirect_uri || null,
+    created_at,
+    expires_at,
+  );
+
+  return {
+    state,
+    code_verifier: pkceParts?.code_verifier || null,
+    code_challenge: pkceParts?.code_challenge || null,
+    code_challenge_method: pkceParts?.code_challenge_method || null,
+  };
+}
+
+/**
+ * Validate + burn a state value. Returns the stored row (scope + verifier) on
+ * success, or throws. Single-use: a second call with the same state fails.
+ */
+export function consumeAuthState(state) {
+  if (!state) { const e = new Error('missing state'); e.code = 'state_invalid'; throw e; }
+  const db = getDb();
+  const row = db.prepare('SELECT * FROM oauth_states WHERE state = ?').get(String(state));
+  if (!row) { const e = new Error('unknown or already-consumed state'); e.code = 'state_invalid'; throw e; }
+  if (row.consumed_at) { const e = new Error('state already used'); e.code = 'state_replayed'; throw e; }
+  if (row.expires_at && Date.parse(row.expires_at) < Date.now()) {
+    const e = new Error('state expired'); e.code = 'state_expired'; throw e;
+  }
+  // Burn it. The WHERE clause guards against a concurrent double-consume.
+  const res = db.prepare('UPDATE oauth_states SET consumed_at = ? WHERE state = ? AND consumed_at IS NULL')
+    .run(nowIso(), String(state));
+  if (res.changes !== 1) { const e = new Error('state already used'); e.code = 'state_replayed'; throw e; }
+
+  let scope = null;
+  try { scope = row.scope_json ? JSON.parse(row.scope_json) : null; } catch { scope = null; }
+  return {
+    state: row.state,
+    service_key: row.service_key,
+    provider: row.provider,
+    scope,
+    code_verifier: row.code_verifier || null,
+    redirect_uri: row.redirect_uri || null,
+  };
+}
+
+/**
+ * Build the provider authorize URL the "Sign in with…" button redirects to.
+ *
+ * @param {object} provider  resolved provider (resolveProvider output)
+ * @param {object} opts      { client_id, redirect_uri, state, code_challenge }
+ */
+export function buildAuthorizeUrl(provider, opts = {}) {
+  if (!provider?.authorize_url) throw new Error('provider.authorize_url required');
+  if (!opts.client_id) throw new Error('client_id required');
+  if (!opts.redirect_uri) throw new Error('redirect_uri required');
+  const url = new URL(provider.authorize_url);
+  url.searchParams.set('response_type', 'code');
+  url.searchParams.set('client_id', String(opts.client_id));
+  url.searchParams.set('redirect_uri', String(opts.redirect_uri));
+  if (provider.scopes?.length) url.searchParams.set('scope', provider.scopes.join(' '));
+  if (opts.state) url.searchParams.set('state', String(opts.state));
+  if (provider.pkce && opts.code_challenge) {
+    url.searchParams.set('code_challenge', String(opts.code_challenge));
+    url.searchParams.set('code_challenge_method', 'S256');
+  }
+  for (const [k, v] of Object.entries(provider.extra_auth_params || {})) {
+    if (v != null) url.searchParams.set(k, String(v));
+  }
+  return url.toString();
+}
+
+function parseTokenResponse(data) {
+  if (!data || typeof data !== 'object') return null;
+  const access_token = data.access_token || null;
+  if (!access_token) return null;
+  return {
+    access_token,
+    refresh_token: data.refresh_token || null,
+    token_type: data.token_type || 'Bearer',
+    expires_in: Number.isFinite(data.expires_in) ? data.expires_in : null,
+    scope: data.scope || null,
+  };
+}
+
+async function postForm(tokenUrl, params, fetchFn) {
+  const body = new URLSearchParams(params).toString();
+  const res = await fetchFn(tokenUrl, {
+    method: 'POST',
+    headers: { 'Content-Type': 'application/x-www-form-urlencoded', Accept: 'application/json' },
+    body,
+  });
+  let data = null;
+  try { data = await res.json(); } catch { data = null; }
+  return { res, data };
+}
+
+/**
+ * Exchange an authorization code for tokens.
+ *
+ * @param {object} provider  resolved provider config (needs token_url)
+ * @param {object} opts      { code, client_id, client_secret, redirect_uri, code_verifier }
+ * @param {Function} fetchFn injectable fetch (tests pass a mock)
+ */
+export async function exchangeCodeForTokens(provider, opts = {}, fetchFn = fetch) {
+  if (!provider?.token_url) throw new Error('provider.token_url required');
+  if (!opts.code) throw new Error('code required');
+  const params = {
+    grant_type: 'authorization_code',
+    code: opts.code,
+    client_id: opts.client_id || '',
+    redirect_uri: opts.redirect_uri || '',
+  };
+  if (opts.client_secret) params.client_secret = opts.client_secret;
+  if (opts.code_verifier) params.code_verifier = opts.code_verifier;
+
+  const { res, data } = await postForm(provider.token_url, params, fetchFn);
+  if (!res.ok) {
+    return { ok: false, error: 'token_exchange_failed', http_status: res.status, detail: data?.error || null };
+  }
+  const tokens = parseTokenResponse(data);
+  if (!tokens) return { ok: false, error: 'no_access_token' };
+  return { ok: true, ...tokens };
+}
+
+/**
+ * Re-mint an access token from a refresh token. Used by http_api_call on a 401.
+ *
+ * @param {object} provider  resolved provider config (needs token_url)
+ * @param {object} opts      { refresh_token, client_id, client_secret }
+ * @param {Function} fetchFn injectable fetch
+ */
+export async function refreshAccessToken(provider, opts = {}, fetchFn = fetch) {
+  if (!provider?.token_url) throw new Error('provider.token_url required');
+  if (!opts.refresh_token) throw new Error('refresh_token required');
+  const params = {
+    grant_type: 'refresh_token',
+    refresh_token: opts.refresh_token,
+    client_id: opts.client_id || '',
+  };
+  if (opts.client_secret) params.client_secret = opts.client_secret;
+
+  const { res, data } = await postForm(provider.token_url, params, fetchFn);
+  if (!res.ok) {
+    return { ok: false, error: 'refresh_failed', http_status: res.status, detail: data?.error || null };
+  }
+  const tokens = parseTokenResponse(data);
+  if (!tokens) return { ok: false, error: 'no_access_token' };
+  // Providers often omit a new refresh_token on refresh — keep the old one.
+  return { ok: true, ...tokens, refresh_token: tokens.refresh_token || opts.refresh_token };
+}

package/lib/oauth/provider-registry.js

@@ -0,0 +1,102 @@
+// lib/oauth/provider-registry.js — declarative OAuth2 provider catalog.
+//
+// Each provider is INERT DATA: authorize/token endpoints, default scopes, and
+// whether PKCE is used. NO secrets live here — client id/secret are supplied by
+// the operator once (per connection) and referenced from the vault by name.
+//
+// This registry is the single source of truth for "how do I talk to provider X's
+// OAuth endpoints". A connection manifest's `oauth.provider` keys into it; the
+// manifest may also override authorize_url/token_url/scopes inline so Tool-Smith
+// connectors for not-yet-catalogued providers still work without editing code.
+//
+// Pure ESM — no DB, fs, or network imports.
+
+const PROVIDERS = {
+  google: {
+    label: 'Google',
+    authorize_url: 'https://accounts.google.com/o/oauth2/v2/auth',
+    token_url: 'https://oauth2.googleapis.com/token',
+    pkce: true,
+    // Default to read-only mail+calendar scopes; connections add what they need.
+    default_scopes: ['openid', 'email'],
+    // Google requires these to mint a refresh token.
+    extra_auth_params: { access_type: 'offline', prompt: 'consent' },
+  },
+  meta: {
+    label: 'Meta (Facebook/Instagram)',
+    authorize_url: 'https://www.facebook.com/v19.0/dialog/oauth',
+    token_url: 'https://graph.facebook.com/v19.0/oauth/access_token',
+    pkce: false,
+    default_scopes: ['public_profile'],
+    extra_auth_params: {},
+  },
+  linkedin: {
+    label: 'LinkedIn',
+    authorize_url: 'https://www.linkedin.com/oauth/v2/authorization',
+    token_url: 'https://www.linkedin.com/oauth/v2/accessToken',
+    pkce: false,
+    default_scopes: ['r_liteprofile'],
+    extra_auth_params: {},
+  },
+  tiktok: {
+    label: 'TikTok',
+    authorize_url: 'https://www.tiktok.com/v2/auth/authorize/',
+    token_url: 'https://open.tiktokapis.com/v2/oauth/token/',
+    pkce: true,
+    default_scopes: ['user.info.basic'],
+    extra_auth_params: {},
+  },
+  hubspot: {
+    label: 'HubSpot',
+    authorize_url: 'https://app.hubspot.com/oauth/authorize',
+    token_url: 'https://api.hubapi.com/oauth/v1/token',
+    pkce: false,
+    default_scopes: ['oauth'],
+    extra_auth_params: {},
+  },
+};
+
+/**
+ * Resolve a provider config, layering manifest-supplied overrides on top of the
+ * built-in catalog. Either source may be absent: a fully-inline connection
+ * manifest needs no catalog entry; a catalogued provider needs no inline URLs.
+ *
+ * @param {string} providerKey         e.g. 'google'
+ * @param {object} [overrides]         connection.oauth block (authorize_url, token_url, scopes, pkce, extra_auth_params)
+ * @returns {object|null}              normalized provider config, or null if unresolvable
+ */
+export function resolveProvider(providerKey, overrides = {}) {
+  const base = providerKey && PROVIDERS[providerKey] ? PROVIDERS[providerKey] : null;
+  const authorize_url = overrides.authorize_url || base?.authorize_url || null;
+  const token_url = overrides.token_url || base?.token_url || null;
+  if (!authorize_url || !token_url) return null;
+
+  const scopes = Array.isArray(overrides.scopes) && overrides.scopes.length
+    ? overrides.scopes.slice()
+    : (base?.default_scopes || []).slice();
+
+  const pkce = typeof overrides.pkce === 'boolean' ? overrides.pkce : Boolean(base?.pkce);
+
+  const extra_auth_params = {
+    ...(base?.extra_auth_params || {}),
+    ...(overrides.extra_auth_params && typeof overrides.extra_auth_params === 'object'
+      ? overrides.extra_auth_params
+      : {}),
+  };
+
+  return {
+    provider: providerKey || 'custom',
+    label: base?.label || providerKey || 'Custom provider',
+    authorize_url,
+    token_url,
+    scopes,
+    pkce,
+    extra_auth_params,
+  };
+}
+
+export function listProviders() {
+  return Object.entries(PROVIDERS).map(([key, p]) => ({ provider: key, label: p.label, pkce: p.pkce }));
+}
+
+export { PROVIDERS };

package/lib/runtime.js

@@ -12,7 +12,7 @@ import { listApprovalRequests } from './approvals.js';
 import { defaultModelForEngine, normalizeAgentEngine } from './agent-engines.js';
 import { DEFAULT_PROJECT_ID, appendProjectChangelog, getProject } from './projects.js';
 import { listActivity, listTasks, reportingSnapshot } from './delegation.js';
-import { getMainAgentTrustMode } from './tools/registry.js';
+import { getMainAgentTrustMode, listMarketplaceTools } from './tools/registry.js';
 import { defaultSkillsMarkdown } from './marketplace-seeds.js';
 import { getConfig } from './config.js';
 import { publishLiveEvent, publishStateChanged } from './live-events.js';
@@ -154,6 +154,79 @@ export function setAgentToolPermission(agentId, toolName, mode = 'approval_requi
   return rowToAgentToolPermission(db.prepare('SELECT * FROM agent_tool_permissions WHERE agent_id = ? AND tool_name = ?').get(agentId, toolName));
 }
 
+/**
+ * Set an agent's declared toolset from the simple agent page.
+ *
+ * Two sources of truth are kept in sync:
+ *  - `agents.tools` (JSON list) drives the runner prompt and the /agents card
+ *    icons — it is the agent's *declared* toolset.
+ *  - `agent_tool_permissions` is the *enforcement* layer the runtime actually
+ *    gates on. Newly added tools get a safe default mode (read-only → auto,
+ *    anything that can write/send → approval_required), matching the Caretaker
+ *    seeding convention. Existing non-disabled rows are left untouched so the
+ *    deep per-tool modes set in Configuration survive a simple-page edit.
+ *
+ * Unknown tool names are dropped (a stale form can't poison the toolset).
+ * Workspace files are intentionally NOT rewritten here — writeAgentFiles would
+ * regenerate skills.md from defaults and clobber an owner's edits.
+ */
+export function updateAgentToolset(agentId, toolNames = []) {
+  if (!agentId) return { ok: false, error: 'agent_id is required' };
+  const db = getDb();
+  const agentRow = db.prepare('SELECT id, tools FROM agents WHERE id = ?').get(agentId);
+  if (!agentRow) return { ok: false, error: 'agent not found' };
+
+  const known = new Map(listMarketplaceTools().map(tool => [tool.name, tool]));
+  const next = [...new Set(
+    (Array.isArray(toolNames) ? toolNames : [])
+      .map(name => String(name || '').trim())
+      .filter(name => name && known.has(name))
+  )];
+  const desired = new Set(next);
+
+  // Reconcile against the enforcement layer (permission rows), NOT just the
+  // declared `agents.tools` column — agents created via createAgent carry a
+  // tools list but no permission rows, so a pure column diff would leave newly
+  // "kept" tools non-functional.
+  const existing = listAgentToolPermissions(agentId);
+  const existingMode = new Map(existing.map(p => [p.tool_name, p.mode]));
+  const prevEnabled = new Set(existing.filter(p => p.mode !== 'disabled').map(p => p.tool_name));
+
+  // 1) Declared toolset (drives the runner prompt + the /agents card icons).
+  db.prepare('UPDATE agents SET tools = ? WHERE id = ?').run(JSON.stringify(next), agentId);
+
+  // 2) Enable every desired tool. Existing non-disabled rows are left untouched
+  //    so deep per-tool modes set in Configuration survive a simple-page edit;
+  //    new or previously-disabled tools get a safe default (read-only → auto,
+  //    anything that can write/send → approval_required).
+  for (const name of next) {
+    const cur = existingMode.get(name);
+    if (cur && cur !== 'disabled') continue;
+    const tool = known.get(name);
+    const mode = (tool?.risk_level === 'low' || tool?.approval_mode === 'auto')
+      ? 'auto'
+      : 'approval_required';
+    setAgentToolPermission(agentId, name, mode);
+  }
+  // 3) Disable previously-enabled tools the owner removed.
+  for (const p of existing) {
+    if (p.mode !== 'disabled' && !desired.has(p.tool_name)) {
+      setAgentToolPermission(agentId, p.tool_name, 'disabled');
+    }
+  }
+
+  const added = next.filter(name => !prevEnabled.has(name));
+  const removed = [...prevEnabled].filter(name => !desired.has(name));
+
+  appendAudit({
+    type: 'agent.tools.update',
+    summary: `Updated toolset for ${agentId}`,
+    status: 'complete',
+    meta: { agent_id: agentId, added, removed, count: next.length, surface: 'agent-detail-simple' },
+  });
+  return { ok: true, tools: next, added, removed };
+}
+
 export function ensureOpsAgent({ silent = false } = {}) {
   const tools = ['directory_list', 'file_read', 'file_search', 'terminal_run', 'web_search', 'web_fetch'];
   const created = createAgent({

package/lib/schema.js

@@ -922,6 +922,32 @@ CREATE TABLE IF NOT EXISTS shared_space_publications (
 CREATE INDEX IF NOT EXISTS idx_shared_space_pub_status ON shared_space_publications(status);
 CREATE INDEX IF NOT EXISTS idx_shared_space_pub_org ON shared_space_publications(org_id);
 
+-- ── Shared brand-profile publication ledger (local-only) ───────────────────────
+-- Sibling of shared_publications, but for the org BRAND. The brand profile is a
+-- singleton per install (config.brand_profile). This ledger records whether the
+-- local brand has been *published* to the org (status='published'), *adopted*
+-- from the org (source='org'), or stopped sharing (status='unpublished'). Like
+-- its siblings it performs no network writes itself — lib/shared-cloud.js owns
+-- the cloud writes on an explicit publish/adopt/unpublish action. A row is keyed
+-- by org_id (one brand per org). No row (the default) means the brand is purely
+-- local and has never left the machine.
+CREATE TABLE IF NOT EXISTS brand_publications (
+  id TEXT PRIMARY KEY,
+  org_id TEXT NOT NULL,
+  source TEXT NOT NULL DEFAULT 'local',
+  content_hash TEXT,
+  status TEXT NOT NULL DEFAULT 'published',
+  last_error TEXT,
+  published_by TEXT,
+  published_at TEXT,
+  adopted_at TEXT,
+  last_synced_at TEXT,
+  unpublished_at TEXT,
+  UNIQUE(org_id)
+);
+CREATE INDEX IF NOT EXISTS idx_brand_pub_status ON brand_publications(status);
+CREATE INDEX IF NOT EXISTS idx_brand_pub_org ON brand_publications(org_id);
+
 -- ── Dashboard spaces ─────────────────────────────────────────────────────────
 -- Server-side persistence for the dashboard's space sidebar. Replaces the prior
 -- localStorage-only store (use-spaces.js) which lost user state across browser
@@ -1555,6 +1581,23 @@ CREATE TABLE IF NOT EXISTS tool_proposals (
 );
 CREATE INDEX IF NOT EXISTS idx_tool_proposals_status ON tool_proposals(status);
 
+-- OAuth2 authorization-code state ledger. Single-use CSRF state values for the
+-- connection OAuth flow. A row is created at /oauth/start and consumed exactly
+-- once at /oauth/callback (consumed_at set). Replay of a consumed/expired state
+-- is rejected. code_verifier holds the PKCE verifier (never the access token).
+CREATE TABLE IF NOT EXISTS oauth_states (
+  state          TEXT PRIMARY KEY,
+  service_key    TEXT NOT NULL,
+  provider       TEXT NOT NULL,
+  scope_json     TEXT,
+  code_verifier  TEXT,
+  redirect_uri   TEXT,
+  created_at     TEXT NOT NULL,
+  expires_at     TEXT NOT NULL,
+  consumed_at    TEXT
+);
+CREATE INDEX IF NOT EXISTS idx_oauth_states_service ON oauth_states(service_key);
+
 
 `;