xaq-cli 0.1.0-nightly.86 → 0.1.0-nightly.87

package/dist/cli.js

@@ -59,7 +59,7 @@ const SERVER_GROUP = "Run xaq:";
 const AGENT_GROUP = "On an agent's machine:";
 withServerOptions(program.command("start", { isDefault: true }).description("run xaq in this terminal and print the setup link (the default command)").summary("run it in this terminal (the default command)").helpGroup(SERVER_GROUP)).option("--no-open", "don't open a browser on first run").option("--dev", "development: API only, the console runs on Vite (:5173)").allowExcessArguments().action(async (o, cmd) => {
 	if (cmd.args.length) throw new Error(unknownCommand(cmd.args[0]));
-	const { runForeground } = await import("./server-DzT6WlPa.js");
+	const { runForeground } = await import("./server-DrcmvN-U.js");
 	await runForeground({
 		...configInput(o),
 		dev: !!o.dev,

package/dist/{server-DzT6WlPa.js → server-DrcmvN-U.js}

@@ -8384,7 +8384,7 @@ var GoogleRuntime = class {
 		let uncertain = null;
 		for (let attempt = 0;; attempt++) {
 			if (opts.cost) await this.bucket(accountId).take(opts.cost);
-			const token = await this.tokens.accessToken(accountId, { force: forced });
+			const token = opts.token ? await opts.token(forced) : await this.tokens.accessToken(accountId, { force: forced });
 			let err;
 			try {
 				const res = await fetch(url, {
@@ -8417,7 +8417,7 @@ var GoogleRuntime = class {
 			}
 			if (err.status === 401 && !forced) {
 				forced = true;
-				this.tokens.invalidate(accountId);
+				if (!opts.token) this.tokens.invalidate(accountId);
 				continue;
 			}
 			if (!(idempotent ? isRetryable(err) : rejectedBeforeProcessing(err)) || attempt >= 4) {
@@ -8596,11 +8596,27 @@ function classifyCalendarError(err) {
 /** The enable link Google put in a SERVICE_DISABLED error, if any. */
 const activationUrl = (err) => err.details.metadata?.activationUrl ?? null;
 //#endregion
+//#region server/google/scoped.ts
+/** Whether the account has granted xaq every one of `scopes` (as last recorded). False for an unknown account. */
+function accountHasScopes(ctx, accountId, scopes) {
+	const row = getRow(ctx, accountId);
+	return !!row && hasScopes(accountScopes(row), scopes);
+}
+/**
+* An access token for the account limited to `scopes` (a subset of what it granted), with its expiry in epoch ms and
+* the scopes Google says it has. Cached per account and scope set until it nearly expires; one refresh in flight.
+* Throws ScopesNotGrantedError (not granted: ask for consent), AccountNeedsReauthError (the sign-in is gone) or
+* DownscopeError (Google's answer didn't prove the limit; never returned).
+*/
+function googleAccessToken(ctx, accountId, scopes, opts = {}) {
+	return googleRuntime(ctx).tokens.scopedAccessToken(accountId, scopes, opts);
+}
+//#endregion
 //#region server/google/drive.ts
-/** Full Drive access also covers reading. */
-const DRIVE_FULL_SCOPE = "https://www.googleapis.com/auth/drive";
-/** Whether these granted scopes let xaq read the user's Drive files. */
-const canReadDrive = (granted) => !!granted && (granted.includes("https://www.googleapis.com/auth/drive.readonly") || granted.includes(DRIVE_FULL_SCOPE));
+/** The scopes a Drive attachment's token carries: read-only Drive, nothing else. */
+const DRIVE_ATTACH_SCOPES = [DRIVE_READONLY_SCOPE];
+/** Whether the account has granted xaq the Drive read access attachments need (as last recorded). */
+const canReadDrive = (ctx, accountId) => accountHasScopes(ctx, accountId, DRIVE_ATTACH_SCOPES);
 const FIELDS$1 = "id,name,mimeType,size,webViewLink,trashed,shortcutDetails";
 /** Downloads take longer: 30 s plus 1 s per 256 KB they may carry, at most 10 minutes. */
 const downloadTimeout = (maxBytes) => Math.min(6e5, 3e4 + Math.ceil(maxBytes / 262144) * 1e3);
@@ -8608,12 +8624,17 @@ function createDriveClient(ctx, accountId) {
 	const rt = googleRuntime(ctx);
 	const base = ctx.config.google.apisBase ?? "https://www.googleapis.com";
 	const path = (fileId, suffix = "") => `/drive/v3/files/${encodeURIComponent(fileId)}${suffix}`;
+	const token = async (force) => (await googleAccessToken(ctx, accountId, DRIVE_ATTACH_SCOPES, { force })).accessToken;
 	return {
-		getFile: (fileId) => rt.request(accountId, base, path(fileId), { query: {
-			fields: FIELDS$1,
-			supportsAllDrives: true
-		} }),
+		getFile: (fileId) => rt.request(accountId, base, path(fileId), {
+			query: {
+				fields: FIELDS$1,
+				supportsAllDrives: true
+			},
+			token
+		}),
 		download: (fileId, maxBytes) => rt.request(accountId, base, path(fileId), {
+			token,
 			query: {
 				alt: "media",
 				supportsAllDrives: true
@@ -8623,6 +8644,7 @@ function createDriveClient(ctx, accountId) {
 			timeoutMs: downloadTimeout(maxBytes)
 		}),
 		exportFile: (fileId, mimeType, maxBytes) => rt.request(accountId, base, path(fileId, "/export"), {
+			token,
 			query: { mimeType },
 			binary: true,
 			maxResponseBytes: maxBytes,
@@ -8636,15 +8658,10 @@ function createDriveClient(ctx, accountId) {
 const GOOGLE_WORKSPACE_EXTENSION = "google-workspace";
 /**
 * The xaq Google account id (acc_…) the google-workspace connection `connectionId` is bound to, or null when it
-* isn't bound (or the binding can't be read).
-*
-* TODO(C, feat/google-extension-auth): read C's binding here. C stores the account id on the connection or on its
-* credential; that shape wasn't visible when this was written, so until C's branch merges no connection counts as
-* bound and agentCanReadDrive is always false (attaching by drive_file_id is refused for every agent: fail closed).
-* Replace the body with the lookup, e.g. `SELECT google_account_id FROM connections WHERE id = ? AND preset = ?`.
+* isn't a google-workspace connection or isn't bound (no account picked yet, or the account was removed).
 */
 function workspaceConnectionAccount(db, connectionId) {
-	return null;
+	return db.get("SELECT google_account_id FROM connections WHERE id = ? AND preset = ?", connectionId, "google-workspace")?.google_account_id ?? null;
 }
 //#endregion
 //#region server/google/drive-access.ts
@@ -9471,6 +9488,9 @@ function planDriveFile(label, file, exportAs) {
 }
 /** Drive's error for a file id, in words the agent can act on. Anything unrecognised is returned unchanged. */
 function driveError(err, label, fileId, accountEmail, file) {
+	if (err instanceof ScopesNotGrantedError) return driveNotEnabled(accountEmail);
+	if (err instanceof AccountNeedsReauthError) return new AttachmentError("needs_reauth", `The Google account ${accountEmail} needs to be reconnected in the xaq console before its Drive files can be attached.`);
+	if (err instanceof DownscopeError) return new AttachmentError("drive_error", `${label}: Google didn't give xaq a Drive-only token for ${accountEmail}, so nothing was downloaded. Try again later.`);
 	if (!(err instanceof GoogleApiError)) return err;
 	const name = file?.name ?? fileId;
 	const link = file?.webViewLink ? ` Put its link in the body instead: ${file.webViewLink}` : "";
@@ -10663,7 +10683,7 @@ var AgentMail = class {
 	*/
 	driveFor(a) {
 		if (!agentCanReadDrive(this.ctx, this.principal.agentId, a.account.id)) return new AttachmentError("drive_not_granted", driveNotGrantedMessage(a.account.email));
-		if (!canReadDrive(a.account.grantedScopes)) return driveNotEnabled(a.account.email);
+		if (!canReadDrive(this.ctx, a.account.id)) return driveNotEnabled(a.account.email);
 		return createDriveClient(this.ctx, a.account.id);
 	}
 	/**
@@ -14158,17 +14178,6 @@ function createCalendarSetup(ctx) {
 	};
 }
 //#endregion
-//#region server/google/scoped.ts
-/**
-* An access token for the account limited to `scopes` (a subset of what it granted), with its expiry in epoch ms and
-* the scopes Google says it has. Cached per account and scope set until it nearly expires; one refresh in flight.
-* Throws ScopesNotGrantedError (not granted: ask for consent), AccountNeedsReauthError (the sign-in is gone) or
-* DownscopeError (Google's answer didn't prove the limit; never returned).
-*/
-function googleAccessToken(ctx, accountId, scopes, opts = {}) {
-	return googleRuntime(ctx).tokens.scopedAccessToken(accountId, scopes, opts);
-}
-//#endregion
 //#region server/google/apis.ts
 /** The project ID from the Google step of the setup wizard, when it is one. */
 function googleProjectId(ctx) {
@@ -24642,4 +24651,4 @@ function openBrowser(url) {
 //#endregion
 export { runForeground };
 
-//# sourceMappingURL=server-DzT6WlPa.js.map
+//# sourceMappingURL=server-DrcmvN-U.js.map