tide-commander 1.165.1 → 1.166.0

package/dist/src/packages/server/integrations/google-drive/drive-client.js

@@ -6,6 +6,7 @@
  */
 import { google } from 'googleapis';
 import { loadConfig, updateConfig } from './drive-config.js';
+import { getTokenHealth, needsReauth, notifyTokenRotated, onTokenRotated, probeTokenHealth, reportGoogleApiError, reportGoogleApiSuccess, startTokenHealthMonitor, } from '../google-auth/token-health.js';
 import { Readable } from 'stream';
 // ─── State ───
 let ctx = null;
@@ -22,6 +23,30 @@ const SCOPES = [
 ];
 const REDIRECT_PATH = '/api/drive/auth/callback';
 let oauth2Client = null;
+/**
+ * Build an OAuth2 client whose every outbound call updates shared token health.
+ *
+ * Every Drive and Docs call made with `auth: oauth2Client` funnels through this one
+ * `request()` method, so wrapping it here means a revoked token is detected the moment
+ * an agent actually touches Drive — no waiting for the next background probe — without
+ * instrumenting each of the ~15 API call sites.
+ */
+function createOAuthClient(clientId, clientSecret, redirectUri) {
+    const client = new google.auth.OAuth2(clientId, clientSecret, redirectUri);
+    const originalRequest = client.request.bind(client);
+    client.request = (async (opts) => {
+        try {
+            const result = await originalRequest(opts);
+            reportGoogleApiSuccess();
+            return result;
+        }
+        catch (err) {
+            reportGoogleApiError(err);
+            throw err;
+        }
+    });
+    return client;
+}
 function getRedirectUri() {
     if (!ctx)
         throw new Error('Google Drive not initialized');
@@ -44,10 +69,16 @@ export async function init(integrationCtx) {
         ctx.log.info('Google Drive missing OAuth credentials, skipping init');
         return;
     }
-    oauth2Client = new google.auth.OAuth2(clientId, clientSecret, getRedirectUri());
+    oauth2Client = createOAuthClient(clientId, clientSecret, getRedirectUri());
     oauth2Client.setCredentials({ refresh_token: refreshToken });
     driveApi = google.drive({ version: 'v3', auth: oauth2Client });
     docsApi = google.docs({ version: 'v1', auth: oauth2Client });
+    // Constructing the client above proves nothing — it just wraps the token string.
+    // Probe Google (and keep probing) so an expired token is reflected in getStatus().
+    startTokenHealthMonitor(ctx);
+    // Re-read the shared refresh token if the user re-consents via Gmail or Calendar,
+    // otherwise this client keeps using the token it was seeded with here.
+    onTokenRotated('google-drive', () => init(integrationCtx));
     ctx.log.info('Google Drive initialized');
 }
 export async function shutdown() {
@@ -61,16 +92,36 @@ export function getStatus() {
     const hasCredentials = !!(ctx?.secrets.get('GOOGLE_CLIENT_ID') &&
         ctx?.secrets.get('GOOGLE_CLIENT_SECRET') &&
         ctx?.secrets.get('GOOGLE_REFRESH_TOKEN'));
+    const health = getTokenHealth();
+    const reauth = hasCredentials && needsReauth(health);
+    // Having credentials on disk is necessary but not sufficient — a revoked refresh
+    // token is still three non-empty strings. Only report connected when Google's last
+    // verdict wasn't a rejection. An 'unreachable' probe (offline host) is deliberately
+    // NOT treated as a rejection: it would push users into a pointless re-consent flow.
+    const wired = config.enabled && hasCredentials && driveApi !== null;
+    let error;
+    if (!hasCredentials && config.enabled)
+        error = 'Missing OAuth credentials';
+    else if (reauth)
+        error = health.error;
     return {
-        authenticated: Boolean(driveApi && hasCredentials),
-        connected: config.enabled && hasCredentials && driveApi !== null,
-        lastChecked: Date.now(),
-        error: !hasCredentials && config.enabled ? 'Missing OAuth credentials' : undefined,
+        authenticated: Boolean(driveApi && hasCredentials) && !reauth,
+        connected: wired && !reauth,
+        lastChecked: health.checkedAt || Date.now(),
+        error,
+        needsReauth: reauth,
+        tokenState: hasCredentials ? health.state : undefined,
     };
 }
 export function isConfigured() {
     return driveApi !== null;
 }
+/** Force a live refresh_token exchange against Google and return the updated status. */
+export async function probeToken() {
+    if (ctx)
+        await probeTokenHealth(ctx, { force: true });
+    return getStatus();
+}
 // ─── OAuth ───
 export function getAuthUrl() {
     if (!oauth2Client) {
@@ -79,7 +130,7 @@ export function getAuthUrl() {
         if (!clientId || !clientSecret || !ctx) {
             throw new Error('Google Drive OAuth not configured');
         }
-        oauth2Client = new google.auth.OAuth2(clientId, clientSecret, getRedirectUri());
+        oauth2Client = createOAuthClient(clientId, clientSecret, getRedirectUri());
     }
     return oauth2Client.generateAuthUrl({
         access_type: 'offline',
@@ -99,6 +150,10 @@ export async function handleAuthCallback(code) {
     docsApi = google.docs({ version: 'v1', auth: oauth2Client });
     // Auto-enable the integration after successful OAuth
     updateConfig({ enabled: true });
+    // Fresh consent just produced this token. Clears the 'expired' verdict AND re-arms
+    // Gmail and Calendar, whose clients still hold the old refresh token — all three
+    // share this one secret, so one consent must repair all three.
+    await notifyTokenRotated();
     ctx.log.info('Google Drive OAuth complete. Drive initialized.');
 }
 // ─── Files CRUD ───

package/dist/src/packages/server/integrations/google-drive/drive-routes.js

@@ -283,10 +283,15 @@ router.get('/search', async (req, res) => {
     }
 });
 // ─── Status & Auth ───
-// GET /api/drive/status — Get Google Drive auth status
-router.get('/status', (_req, res) => {
-    const status = driveClient.getStatus();
-    res.json(status);
+// GET /api/drive/status — Get Google Drive auth status.
+// `?probe=1` forces a live refresh_token exchange against Google instead of reusing
+// the cached verdict — the settings UI uses it to verify the token on open, so a
+// revoked token can't keep rendering as "Connected".
+router.get('/status', async (req, res) => {
+    if (req.query.probe === '1' || req.query.probe === 'true') {
+        await driveClient.probeToken();
+    }
+    res.json(driveClient.getStatus());
 });
 // GET /api/drive/auth/url — Get OAuth authorization URL
 router.get('/auth/url', (_req, res) => {

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "tide-commander",
-  "version": "1.165.1",
+  "version": "1.166.0",
   "description": "Visual multi-agent orchestrator and manager for Claude Code with 3D/2D interface",
   "repository": {
     "type": "git",

package/dist/assets/GoogleOAuthSetup-Bh-Cy-dE.js

@@ -1,236 +0,0 @@
-import{r as t,i as w,k as v,j as e}from"./main-DIf9R6Jx.js";import"./vendor-react--Eh9ivFN.js";import"./vendor-three-Chj50gSY.js";function B({integration:o,onSave:j,onCancel:h}){const[l,C]=t.useState(o.values.GOOGLE_CLIENT_ID||""),[p,E]=t.useState(""),[b,S]=t.useState(o.values.GOOGLE_REDIRECT_BASE_URL||""),[y,G]=t.useState(null),[g,O]=t.useState(null),[c,u]=t.useState(!1),[N,s]=t.useState(null),[A,z]=t.useState(!1),I=o.values.GOOGLE_CLIENT_ID==="********"&&o.values.GOOGLE_CLIENT_SECRET==="********",[x,f]=t.useState(o.status.connected?"connected":"credentials"),r=t.useRef(null),m=t.useCallback(async()=>{try{const n={gmail:"/api/email/status","google-calendar":"/api/calendar/status","google-drive":"/api/drive/status"}[o.id]||"/api/calendar/status",i=await w(v(n));if(i.ok){const d=await i.json();O(d),d.authenticated&&(f("connected"),r.current&&(clearInterval(r.current),r.current=null))}}catch(a){console.error("Failed to fetch Google auth status:",a)}},[o.id]);t.useEffect(()=>(m(),()=>{r.current&&clearInterval(r.current)}),[m]);const k=async()=>{const n={gmail:"/api/email/auth/url","google-calendar":"/api/calendar/auth/url","google-drive":"/api/drive/auth/url"}[o.id]||"/api/calendar/auth/url",i=await w(v(n));if(!i.ok){const _=await i.json().catch(()=>({}));throw new Error(_.error||`HTTP ${i.status}`)}const d=await i.json();if(!d.url)throw new Error("OAuth URL is empty");G(d.url),s(null),f("authorize"),r.current&&clearInterval(r.current),r.current=setInterval(m,3e3)},L=async()=>{u(!0),s(null);try{await k()}catch(a){s(a instanceof Error?a.message:"Failed to get OAuth URL")}finally{u(!1)}},R=async()=>{if(!l.trim()){s("Client ID is required");return}u(!0),s(null);try{const a={GOOGLE_REDIRECT_BASE_URL:b.trim()};l.trim()&&l.trim()!=="********"&&(a.GOOGLE_CLIENT_ID=l.trim()),p.trim()&&(a.GOOGLE_CLIENT_SECRET=p.trim()),console.log("Saving Google OAuth config...",a),await j(a),console.log("Config saved successfully"),await k()}catch(a){const n=a instanceof Error?a.message:"Failed to get OAuth URL";console.error("Error in handleSaveCredentials:",n,a),s(n)}finally{u(!1)}};return e.jsxs("div",{className:"google-oauth-setup",children:[N&&e.jsx("div",{className:"google-oauth-error",children:N}),x==="credentials"&&e.jsxs("div",{className:"google-oauth-section",children:[e.jsx("h4",{className:"google-oauth-section-title",children:"Google OAuth Credentials"}),I&&!A?e.jsxs(e.Fragment,{children:[e.jsxs("div",{className:"google-oauth-shared-banner",children:[e.jsxs("div",{className:"google-oauth-shared-title",children:[e.jsx("span",{children:"✓"}),e.jsx("span",{children:"Credentials already configured"})]}),e.jsx("div",{className:"google-oauth-shared-body",children:"Existing Google OAuth credentials (Client ID and Secret) are saved in your secrets store — they're shared between Gmail, Calendar, and Drive. You may still need to re-authorize once so the refresh token grants access to this service."})]}),e.jsxs("div",{className:"integration-form-actions",children:[e.jsx("button",{type:"button",className:"integration-btn cancel",onClick:h,children:"Cancel"}),e.jsx("button",{type:"button",className:"integration-btn secondary",onClick:()=>z(!0),disabled:c,children:"Edit credentials"}),e.jsx("button",{type:"button",className:"integration-btn save",onClick:L,disabled:c,children:c?"Loading...":"Authorize with existing credentials"})]})]}):e.jsxs(e.Fragment,{children:[e.jsxs("p",{className:"google-oauth-help",children:["Create OAuth2 credentials in the"," ",e.jsx("a",{href:"https://console.cloud.google.com/apis/credentials",target:"_blank",rel:"noopener noreferrer",className:"google-oauth-link",children:"Google Cloud Console"}),". Enable the relevant API (Gmail, Calendar, or Drive). Set the redirect URI to:"," ",e.jsx("code",{className:"google-oauth-code",children:(()=>{const a=o.id==="gmail"?"/api/email/auth/callback":o.id==="google-drive"?"/api/drive/auth/callback":"/api/calendar/auth/callback",n=b.trim();return n?`${n.replace(/\/$/,"")}${a}`:v(a)})()})]}),e.jsxs("div",{className:"google-oauth-field",children:[e.jsxs("label",{className:"integration-field-label",children:["OAuth Client ID ",e.jsx("span",{className:"integration-field-required",children:"*"})]}),e.jsx("input",{type:"text",className:"integration-field-input",value:l,placeholder:"xxxx.apps.googleusercontent.com",onChange:a=>C(a.target.value)})]}),e.jsxs("div",{className:"google-oauth-field",children:[e.jsxs("label",{className:"integration-field-label",children:["OAuth Client Secret ",e.jsx("span",{className:"integration-field-required",children:"*"})]}),e.jsx("input",{type:"password",className:"integration-field-input",value:p,placeholder:o.values.GOOGLE_CLIENT_SECRET?"(saved)":"Enter client secret",onChange:a=>E(a.target.value),autoComplete:"off"})]}),e.jsxs("div",{className:"google-oauth-field",children:[e.jsx("label",{className:"integration-field-label",children:"OAuth Redirect Base URL"}),e.jsx("input",{type:"text",className:"integration-field-input",value:b,placeholder:"http://localhost:6200",onChange:a=>S(a.target.value),autoComplete:"off"}),e.jsxs("span",{className:"integration-field-description",style:{display:"block",marginTop:7,color:"#7f849c",fontSize:12},children:["Override the base URL used to build the OAuth redirect (e.g. ",e.jsx("code",{children:"http://commander.local:10003"}),"). Shared across Gmail, Calendar, and Drive. Leave empty to use the server's local address. Google does not accept raw IPs — use a domain (you can map one in ",e.jsx("code",{children:"/etc/hosts"}),")."]})]}),e.jsxs("div",{className:"integration-form-actions",children:[e.jsx("button",{type:"button",className:"integration-btn cancel",onClick:h,children:"Cancel"}),e.jsx("button",{type:"button",className:"integration-btn save",onClick:R,disabled:c||!l.trim(),children:c?"Saving...":"Save & Authorize"})]})]})]}),x==="authorize"&&e.jsxs("div",{className:"google-oauth-section",children:[e.jsx("h4",{className:"google-oauth-section-title",children:"Authorize Google Access"}),e.jsx("p",{className:"google-oauth-help",children:"Click the link below to authorize Tide Commander to access your Google account. After granting access, you will be redirected back and the connection will be established automatically."}),y&&e.jsx("a",{href:y,target:"_blank",rel:"noopener noreferrer",className:"google-oauth-authorize-btn",children:"Authorize with Google"}),e.jsxs("div",{className:"google-oauth-waiting",children:[e.jsx("span",{className:"google-oauth-spinner"}),e.jsx("span",{children:"Waiting for authorization to complete..."})]}),e.jsx("div",{className:"integration-form-actions",children:e.jsx("button",{type:"button",className:"integration-btn cancel",onClick:()=>{r.current&&(clearInterval(r.current),r.current=null),f("credentials")},children:"Back"})})]}),x==="connected"&&e.jsxs("div",{className:"google-oauth-section",children:[e.jsx("h4",{className:"google-oauth-section-title",children:"Google Connected"}),e.jsxs("div",{className:"google-oauth-connected-info",children:[e.jsx("span",{className:"google-oauth-connected-badge",children:"Connected"}),(g==null?void 0:g.emailAddress)&&e.jsx("span",{className:"google-oauth-email",children:g.emailAddress})]}),e.jsx("p",{className:"google-oauth-help",children:"Your Google account has been successfully connected."}),e.jsx("div",{className:"integration-form-actions",children:e.jsx("button",{type:"button",className:"integration-btn cancel",onClick:async()=>{await j({}),h()},children:"Close"})})]}),e.jsx("style",{children:`
-        .google-oauth-setup {
-          padding: 0;
-        }
-        .google-oauth-error {
-          background: linear-gradient(135deg, rgba(243, 139, 168, 0.2) 0%, rgba(243, 139, 168, 0.08) 100%);
-          border-left: 3px solid #f38ba8;
-          color: #f38ba8;
-          padding: 12px 16px;
-          border-radius: 8px;
-          margin-bottom: 18px;
-          font-size: 13px;
-          font-weight: 500;
-        }
-        .google-oauth-section {
-          background: linear-gradient(180deg, rgba(45, 49, 69, 0.4) 0%, rgba(30, 30, 46, 0.2) 100%);
-          border: 1px solid rgba(137, 180, 250, 0.15);
-          border-radius: 12px;
-          padding: 28px;
-          backdrop-filter: blur(10px);
-        }
-        .google-oauth-section-title {
-          margin: 0 0 16px 0;
-          color: #cdd6f4;
-          font-size: 18px;
-          font-weight: 700;
-          letter-spacing: -0.5px;
-        }
-        .google-oauth-help {
-          color: #a6adc8;
-          font-size: 13px;
-          line-height: 1.6;
-          margin: 0 0 20px 0;
-          font-weight: 400;
-        }
-        .google-oauth-link {
-          color: #89b4fa;
-          text-decoration: none;
-          border-bottom: 1.5px solid rgba(137, 180, 250, 0.4);
-          transition: all 0.2s ease;
-          font-weight: 500;
-        }
-        .google-oauth-link:hover {
-          color: #a8c5ff;
-          border-bottom-color: #89b4fa;
-        }
-        .google-oauth-code {
-          background: rgba(137, 180, 250, 0.15);
-          color: #89b4fa;
-          padding: 4px 10px;
-          border-radius: 6px;
-          font-size: 12px;
-          word-break: break-all;
-          font-weight: 500;
-          font-family: 'Monaco', 'Menlo', monospace;
-        }
-        .google-oauth-field {
-          margin-bottom: 18px;
-        }
-        .integration-field-label {
-          display: block;
-          margin-bottom: 8px;
-          color: #cdd6f4;
-          font-size: 14px;
-          font-weight: 600;
-          letter-spacing: 0.3px;
-        }
-        .integration-field-required {
-          color: #f38ba8;
-        }
-        .integration-field-input {
-          width: 100%;
-          background: rgba(30, 30, 46, 0.6);
-          border: 1.5px solid rgba(137, 180, 250, 0.2);
-          color: #cdd6f4;
-          padding: 11px 14px;
-          border-radius: 8px;
-          font-size: 13px;
-          transition: all 0.2s ease;
-          font-weight: 500;
-        }
-        .integration-field-input:focus {
-          outline: none;
-          border-color: #89b4fa;
-          background: rgba(30, 30, 46, 0.8);
-          box-shadow: 0 0 0 3px rgba(137, 180, 250, 0.15);
-        }
-        .google-oauth-authorize-btn {
-          display: inline-block;
-          background: linear-gradient(135deg, #89b4fa 0%, #7aa3f0 100%);
-          color: #1e1e2e;
-          padding: 12px 32px;
-          border-radius: 8px;
-          text-decoration: none;
-          font-weight: 700;
-          font-size: 14px;
-          margin-bottom: 20px;
-          transition: all 0.25s ease;
-          border: none;
-          cursor: pointer;
-          box-shadow: 0 4px 12px rgba(137, 180, 250, 0.25);
-          letter-spacing: 0.3px;
-        }
-        .google-oauth-authorize-btn:hover {
-          transform: translateY(-2px);
-          box-shadow: 0 6px 16px rgba(137, 180, 250, 0.35);
-          background: linear-gradient(135deg, #a8c5ff 0%, #8eb8ff 100%);
-        }
-        .google-oauth-waiting {
-          display: flex;
-          align-items: center;
-          gap: 12px;
-          color: #a6adc8;
-          font-size: 13px;
-          margin-bottom: 20px;
-          background: rgba(137, 180, 250, 0.08);
-          padding: 14px 16px;
-          border-radius: 8px;
-          border-left: 3px solid #89b4fa;
-          font-weight: 500;
-        }
-        .google-oauth-spinner {
-          display: inline-block;
-          width: 16px;
-          height: 16px;
-          border: 2.5px solid rgba(137, 180, 250, 0.25);
-          border-top-color: #89b4fa;
-          border-radius: 50%;
-          animation: google-spin 0.8s linear infinite;
-          flex-shrink: 0;
-        }
-        @keyframes google-spin {
-          to { transform: rotate(360deg); }
-        }
-        .google-oauth-connected-info {
-          display: flex;
-          align-items: center;
-          gap: 14px;
-          margin-bottom: 20px;
-          background: rgba(166, 227, 161, 0.08);
-          padding: 16px;
-          border-radius: 10px;
-          border-left: 3px solid #a6e3a1;
-        }
-        .google-oauth-connected-badge {
-          background: linear-gradient(135deg, rgba(166, 227, 161, 0.3) 0%, rgba(166, 227, 161, 0.15) 100%);
-          color: #a6e3a1;
-          padding: 6px 14px;
-          border-radius: 6px;
-          font-size: 12px;
-          font-weight: 700;
-          letter-spacing: 0.4px;
-          text-transform: uppercase;
-          border: 1px solid rgba(166, 227, 161, 0.3);
-          flex-shrink: 0;
-        }
-        .google-oauth-email {
-          color: #cdd6f4;
-          font-size: 14px;
-          font-weight: 600;
-          letter-spacing: 0.2px;
-        }
-        .integration-form-actions {
-          display: flex;
-          gap: 12px;
-          justify-content: flex-end;
-          margin-top: 24px;
-          padding-top: 20px;
-          border-top: 1px solid rgba(137, 180, 250, 0.1);
-        }
-        .integration-btn {
-          padding: 10px 24px;
-          border-radius: 8px;
-          font-weight: 600;
-          font-size: 13px;
-          border: none;
-          cursor: pointer;
-          transition: all 0.2s ease;
-          letter-spacing: 0.3px;
-        }
-        .integration-btn.save {
-          background: linear-gradient(135deg, #89b4fa 0%, #7aa3f0 100%);
-          color: #1e1e2e;
-          box-shadow: 0 4px 12px rgba(137, 180, 250, 0.25);
-        }
-        .integration-btn.save:hover:not(:disabled) {
-          transform: translateY(-2px);
-          box-shadow: 0 6px 16px rgba(137, 180, 250, 0.35);
-        }
-        .integration-btn.cancel {
-          background: rgba(137, 180, 250, 0.1);
-          color: #89b4fa;
-          border: 1.5px solid rgba(137, 180, 250, 0.2);
-        }
-        .integration-btn.cancel:hover:not(:disabled) {
-          background: rgba(137, 180, 250, 0.15);
-          border-color: #89b4fa;
-        }
-        .integration-btn.secondary {
-          background: rgba(249, 226, 175, 0.1);
-          color: #f9e2af;
-          border: 1.5px solid rgba(249, 226, 175, 0.25);
-        }
-        .integration-btn.secondary:hover:not(:disabled) {
-          background: rgba(249, 226, 175, 0.18);
-          border-color: #f9e2af;
-        }
-        .integration-btn:disabled {
-          opacity: 0.5;
-          cursor: not-allowed;
-        }
-        .google-oauth-shared-banner {
-          background: linear-gradient(135deg, rgba(166, 227, 161, 0.15) 0%, rgba(166, 227, 161, 0.05) 100%);
-          border: 1px solid rgba(166, 227, 161, 0.3);
-          border-left: 3px solid #a6e3a1;
-          border-radius: 10px;
-          padding: 16px 18px;
-          margin-bottom: 8px;
-        }
-        .google-oauth-shared-title {
-          display: flex;
-          align-items: center;
-          gap: 10px;
-          color: #a6e3a1;
-          font-size: 14px;
-          font-weight: 700;
-          letter-spacing: 0.2px;
-          margin-bottom: 8px;
-        }
-        .google-oauth-shared-body {
-          color: #a6adc8;
-          font-size: 13px;
-          line-height: 1.6;
-          font-weight: 400;
-        }
-      `})]})}export{B as GoogleOAuthSetup};