switchroom 0.13.12 → 0.13.14

package/dist/cli/switchroom.js

@@ -26509,17 +26509,34 @@ var init_wait = __esm(() => {
 // src/cli/drive.ts
 var exports_drive = {};
 __export(exports_drive, {
+  workspaceScopesForTier: () => workspaceScopesForTier,
+  selectGoogleWorkspaceScopes: () => selectGoogleWorkspaceScopes,
   selectDriveAccountScopes: () => selectDriveAccountScopes,
   runDriveOAuthFlow: () => runDriveOAuthFlow,
   registerDriveCommand: () => registerDriveCommand,
   __test: () => __test,
+  GOOGLE_SLIDES_SCOPE: () => GOOGLE_SLIDES_SCOPE,
+  GOOGLE_SHEETS_SCOPE: () => GOOGLE_SHEETS_SCOPE,
+  GOOGLE_DOCS_SCOPE: () => GOOGLE_DOCS_SCOPE,
   DRIVE_WRITE_SCOPES: () => DRIVE_WRITE_SCOPES,
   DRIVE_READONLY_SCOPES: () => DRIVE_READONLY_SCOPES
 });
 import { createInterface as createInterface2 } from "node:readline";
+function workspaceScopesForTier(tier) {
+  const docScopes = [GOOGLE_DOCS_SCOPE, GOOGLE_SHEETS_SCOPE];
+  if (tier === "extended" || tier === "complete") {
+    return [...docScopes, GOOGLE_SLIDES_SCOPE];
+  }
+  return docScopes;
+}
 function selectDriveAccountScopes(write) {
   return write ? DRIVE_WRITE_SCOPES : DRIVE_READONLY_SCOPES;
 }
+function selectGoogleWorkspaceScopes(opts) {
+  const base = selectDriveAccountScopes(opts.write);
+  const workspace = workspaceScopesForTier(opts.tier ?? "core");
+  return [...new Set([...base, ...workspace])];
+}
 function getVaultPath(configPath) {
   try {
     const config = loadConfig(configPath);
@@ -26932,7 +26949,7 @@ function registerDriveCommand(program3, deps = {}) {
     await runDisconnect({ agentName: agent }, deps);
   });
 }
-var EXIT_OK = 0, EXIT_DENIED = 1, EXIT_TIMEOUT = 2, EXIT_RATE_LIMITED = 3, EXIT_ERROR = 4, EXIT_ABORTED = 130, DRIVE_READONLY_SCOPES, DRIVE_WRITE_SCOPES, DEFAULT_SCOPES, __test;
+var EXIT_OK = 0, EXIT_DENIED = 1, EXIT_TIMEOUT = 2, EXIT_RATE_LIMITED = 3, EXIT_ERROR = 4, EXIT_ABORTED = 130, DRIVE_READONLY_SCOPES, DRIVE_WRITE_SCOPES, DEFAULT_SCOPES, GOOGLE_DOCS_SCOPE = "https://www.googleapis.com/auth/documents", GOOGLE_SHEETS_SCOPE = "https://www.googleapis.com/auth/spreadsheets", GOOGLE_SLIDES_SCOPE = "https://www.googleapis.com/auth/presentations", __test;
 var init_drive = __esm(() => {
   init_source();
   init_loader();
@@ -47314,8 +47331,8 @@ var {
 } = import__.default;
 
 // src/build-info.ts
-var VERSION = "0.13.12";
-var COMMIT_SHA = "18363dfb";
+var VERSION = "0.13.14";
+var COMMIT_SHA = "0cf961a6";
 
 // src/cli/agent.ts
 init_source();
@@ -54578,7 +54595,7 @@ function registerAccountAdd(accountParent) {
   accountParent.command("add <account>").description("Mint a Google OAuth refresh token for <account> and register it with the auth-broker. For Drive scopes the effective flow is desktop-loopback (device-code returns invalid_scope for Drive; OOB is retired) \u2014 use a Desktop OAuth client; on a headless host complete the browser step over an SSH port-forward. Add --write for create/edit (drive.file); default is read-only.").option("--replace", "Overwrite existing credentials for <account> (default refuses if account already registered)", false).option("--write", "Request Drive WRITE scope (drive.file: create + edit app-created files) in addition to read. Default is read-only \u2014 a read grant never silently becomes a write grant. Re-consent an existing account with `--replace --write`.", false).action(withConfigError(async (account, opts) => {
     const normalizedAccount = validateAndNormalizeAccountEmail(account);
     const [
-      { runDriveOAuthFlow: runDriveOAuthFlow2, selectDriveAccountScopes: selectDriveAccountScopes2 },
+      { runDriveOAuthFlow: runDriveOAuthFlow2, selectGoogleWorkspaceScopes: selectGoogleWorkspaceScopes2 },
       { selectInitialTier: selectInitialTier2 },
       { brokerCall: brokerCall2 },
       { loadConfig: loadConfig2, resolvePath: resolvePath2 },
@@ -54647,7 +54664,11 @@ function registerAccountAdd(accountParent) {
       clientIdRaw = await resolveRef(clientIdRaw, "google_client_id");
       clientSecretRaw = await resolveRef(clientSecretRaw, "google_client_secret");
     }
-    const accountScopes = selectDriveAccountScopes2(opts.write ?? false);
+    const tier = gw.tier ?? "core";
+    const accountScopes = selectGoogleWorkspaceScopes2({
+      write: opts.write ?? false,
+      tier
+    });
     const oauthCfg = {
       client_id: clientIdRaw,
       client_secret: clientSecretRaw,
@@ -54656,6 +54677,9 @@ function registerAccountAdd(accountParent) {
     if (opts.write) {
       console.log(source_default.yellow("  Requesting Drive WRITE scope (drive.file \u2014 create/edit app-created files)."));
     }
+    console.log(source_default.gray(`  Workspace tier: ${tier} \u2014 requesting Docs + Sheets` + (tier === "extended" || tier === "complete" ? " + Slides" : "") + " API scopes so the tier's tools can authenticate."));
+    console.log(source_default.gray(`  Changing the tier later requires re-running this command
+` + "  (`--replace`) \u2014 OAuth scopes are fixed at consent time."));
     const oauthEnv = {
       DISPLAY: process.env.DISPLAY,
       WAYLAND_DISPLAY: process.env.WAYLAND_DISPLAY,
@@ -73048,6 +73072,29 @@ function buildSeedCredentials(input) {
 }
 var AIOFILE_PIN = "aiofile==3.10.2";
 var AIOFILE_PKG = AIOFILE_PIN.split("==")[0];
+function requiredWorkspaceScopesForTier(tier) {
+  const docs = [
+    "https://www.googleapis.com/auth/documents",
+    "https://www.googleapis.com/auth/spreadsheets"
+  ];
+  if (tier === "extended" || tier === "complete") {
+    return [...docs, "https://www.googleapis.com/auth/presentations"];
+  }
+  return docs;
+}
+function findMissingWorkspaceScopes(seedScope, tier) {
+  const have = new Set(seedScope.split(/\s+/).map((s) => s.trim()).filter((s) => s.length > 0));
+  return requiredWorkspaceScopesForTier(tier).filter((s) => !have.has(s));
+}
+var DRIVE_FILE_SCOPE = "https://www.googleapis.com/auth/drive.file";
+function buildMissingScopeWarning(missing, tier, accountEmail, hasWriteScope) {
+  const short = missing.map((s) => s.replace(/^https:\/\/www\.googleapis\.com\/auth\//, "")).join(", ");
+  return `drive-mcp-launcher: WARNING \u2014 the Google account '${accountEmail}' was ` + `consented WITHOUT the scope(s) needed for tier '${tier ?? "core"}': ` + `${short}.
+` + `  The matching MCP tools (Docs / Sheets / Slides create+edit) will FAIL ` + `to authenticate. OAuth scopes are fixed at consent time \u2014 re-run on the ` + `host to re-mint the token with the correct scopes:
+` + `    switchroom auth google account add ${accountEmail} --replace` + `${hasWriteScope ? " --write" : ""}
+` + `  (scopes are derived from \`google_workspace.tier\` \u2014 set the tier ` + `before re-running${hasWriteScope ? "; --write preserves the existing " + "Drive write capability" : ""}). Drive read/file tools are unaffected.
+`;
+}
 function buildUvxArgs(tier) {
   const args = [
     "--from",
@@ -73072,6 +73119,9 @@ function buildChildEnv(baseEnv, credentialsDir, accountEmail) {
   delete env2.WORKSPACE_MCP_STATELESS_MODE;
   delete env2.GOOGLE_APPLICATION_CREDENTIALS;
   delete env2.WORKSPACE_MCP_SERVICE_ACCOUNT_FILE;
+  if (!env2.WORKSPACE_MCP_PORT) {
+    env2.WORKSPACE_MCP_PORT = env2.SWITCHROOM_GDRIVE_MCP_PORT ?? "8631";
+  }
   return env2;
 }
 function classifyRootSchema(schema) {
@@ -73288,6 +73338,11 @@ async function runDriveMcpLauncher(opts) {
     process.exit(1);
   }
   const tier = opts.tier ?? configSecrets.tier;
+  const missingScopes = findMissingWorkspaceScopes(brokerCreds.scope, tier);
+  if (missingScopes.length > 0) {
+    const hasWriteScope = brokerCreds.scope.split(/\s+/).map((s) => s.trim()).includes(DRIVE_FILE_SCOPE);
+    process.stderr.write(buildMissingScopeWarning(missingScopes, tier, brokerCreds.accountEmail, hasWriteScope));
+  }
   const args = buildUvxArgs(tier);
   const env2 = buildChildEnv(process.env, credentialsDir, brokerCreds.accountEmail);
   const { spawn: spawn5 } = await import("node:child_process");

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "switchroom",
-  "version": "0.13.12",
+  "version": "0.13.14",
   "description": "Run Claude Code 24/7 on your Claude Pro/Max subscription over Telegram. Open-source alternative to OpenClaw and NanoClaw — no API keys.",
   "type": "module",
   "bin": {