@agent-native/core 0.176.1 → 0.176.2-nightly-20260831184159

package/corpus/templates/mail/server/lib/automation-engine.ts

@@ -12,10 +12,19 @@ import {
 } from "@agent-native/core/oauth-tokens";
 import { runWithRequestContext } from "@agent-native/core/server";
 import { getUserSetting, putUserSetting } from "@agent-native/core/settings";
+import {
+  AI_FILTER_ACTIONS,
+  AI_FILTER_MIN_LEARNED_EXAMPLES,
+  AI_FILTER_RULE_NAME,
+  type AiFilterDecision,
+  type AiFilterState,
+} from "@shared/ai-filter.js";
 import type { AutomationAction } from "@shared/types.js";
 import { eq, and } from "drizzle-orm";
+import { nanoid } from "nanoid";
 
 import { db, schema } from "../db/index.js";
+import { getAiFilterState, recordAiFilterDecisions } from "./ai-filter.js";
 import {
   buildLabelCache,
   executeActions,
@@ -59,6 +68,7 @@ interface RuleRecord {
   id: string;
   ownerEmail: string;
   domain: string;
+  kind?: string;
   name: string;
   condition: string;
   actions: string;
@@ -99,11 +109,7 @@ async function getAccessToken(accountEmail: string): Promise<string | null> {
     try {
       const { clientId, clientSecret } =
         await getOAuth2Credentials(accountEmail);
-      const oauth = createOAuth2Client(
-        clientId,
-        clientSecret,
-        "http://localhost:8080/_agent-native/google/callback",
-      );
+      const oauth = createOAuth2Client(clientId, clientSecret, "");
       const refreshed = await oauth.refreshToken(tokens.refresh_token);
       const updated = {
         ...tokens,
@@ -340,6 +346,8 @@ async function fetchNewInboxMessages(
 interface RuleMatch {
   ruleId: string;
   match: boolean;
+  confidence: number;
+  reason?: string;
 }
 
 const MODEL_AVAILABILITY_CACHE_TTL_MS = 5 * 60 * 1000;
@@ -501,9 +509,10 @@ async function evaluateRules(
   rules: RuleRecord[],
   ownerEmail: string,
   modelSettings: AutomationModelSettings,
-): Promise<Map<string, string[]>> {
-  // Returns: messageId → array of matched ruleIds
-  const results = new Map<string, string[]>();
+  aiFilterState?: AiFilterState,
+): Promise<Map<string, RuleMatch[]>> {
+  // Returns: messageId → array of matched rules with model confidence/reason.
+  const results = new Map<string, RuleMatch[]>();
   if (emails.length === 0 || rules.length === 0) return results;
 
   // Process in batches of 10 emails per call
@@ -528,6 +537,16 @@ Date: ${e.date}`,
       )
       .join("\n\n");
 
+    const feedbackText = aiFilterState?.feedback.length
+      ? aiFilterState.feedback
+          .slice(-20)
+          .map(
+            (feedback) =>
+              `- ${feedback.disposition === "spam" ? "Unwanted" : "Keep"}: From ${feedback.sender}; Subject "${feedback.subject}"${feedback.comment ? `; Note: "${feedback.comment}"` : ""}`,
+          )
+          .join("\n")
+      : "None yet.";
+
     const prompt = `You are an email classification engine. Given emails and a set of rules, determine which rules match each email.
 
 Rules:
@@ -536,10 +555,13 @@ ${rulesText}
 Emails:
 ${emailsText}
 
+User-confirmed examples (use these as feedback, not as absolute rules):
+${feedbackText}
+
 For each email, evaluate ALL rules. Respond with ONLY a JSON array, no other text. Format:
-[{"emailId": "<id>", "matches": [{"ruleId": "<id>", "match": true/false}]}]
+[{"emailId": "<id>", "matches": [{"ruleId": "<id>", "match": true/false, "confidence": 0.0, "reason": "short explanation"}]}]
 
-Be precise: only mark a rule as matching if the email clearly fits the condition. When a condition mentions a specific sender, check the From field. When it mentions a topic or category, use the subject and snippet.`;
+Be precise: only mark a rule as matching if the email clearly fits the condition. When a condition mentions a specific sender, check the From field. When it mentions a topic or category, use the subject and snippet. Confidence must be between 0 and 1. Give a short reason for every match.`;
 
     try {
       const text = await callModel(prompt, ownerEmail, modelSettings);
@@ -551,13 +573,40 @@ Be precise: only mark a rule as matching if the email clearly fits the condition
         .trim();
       const parsed = JSON.parse(jsonStr) as Array<{
         emailId: string;
-        matches: RuleMatch[];
+        matches: Array<{
+          ruleId: string;
+          match: boolean;
+          confidence?: number;
+          reason?: string;
+        }>;
       }>;
+      if (!Array.isArray(parsed)) {
+        throw new Error("Model returned a non-array result");
+      }
 
       for (const emailResult of parsed) {
+        if (
+          typeof emailResult?.emailId !== "string" ||
+          !Array.isArray(emailResult.matches)
+        ) {
+          throw new Error("Model returned an invalid email classification");
+        }
         const matchedRules = emailResult.matches
           .filter((m) => m.match)
-          .map((m) => m.ruleId);
+          .map((m) => ({
+            ruleId: m.ruleId,
+            match: true,
+            confidence:
+              typeof m.confidence === "number" &&
+              Number.isFinite(m.confidence) &&
+              m.confidence >= 0 &&
+              m.confidence <= 1
+                ? m.confidence
+                : 0,
+            ...(typeof m.reason === "string"
+              ? { reason: m.reason.slice(0, 500) }
+              : {}),
+          }));
         if (matchedRules.length > 0) {
           results.set(emailResult.emailId, matchedRules);
         }
@@ -585,6 +634,7 @@ export interface ProcessResult {
   messagesProcessed: number;
   actionsExecuted: number;
   errors: number;
+  suggestionsCreated: number;
 }
 
 export async function processAutomationsForAccount(
@@ -597,10 +647,19 @@ export async function processAutomationsForAccount(
     messagesProcessed: 0,
     actionsExecuted: 0,
     errors: 0,
+    suggestionsCreated: 0,
   };
 
-  // 1. Load active rules
-  const rules = await loadActiveRules(ownerEmail, "mail");
+  // 1. Load active rules and keep the AI filter's learned baseline
+  // conservative until it has several confirmed examples.
+  const aiFilterState = await getAiFilterState(ownerEmail);
+  const rules = (await loadActiveRules(ownerEmail, "mail")).filter(
+    (rule) =>
+      rule.kind !== "ai-filter" ||
+      (aiFilterState.enabled &&
+        (rule.name !== AI_FILTER_RULE_NAME ||
+          aiFilterState.feedback.length >= AI_FILTER_MIN_LEARNED_EXAMPLES)),
+  );
   if (rules.length === 0) return result;
 
   // 2. Resolve model settings. Credentials are resolved by the selected engine
@@ -662,17 +721,75 @@ export async function processAutomationsForAccount(
     rules,
     ownerEmail,
     modelSettings,
+    aiFilterState,
   );
 
   // 6. Execute matched actions
   if (matches.size > 0) {
     const labelCache = await buildLabelCache(accessToken);
     const rulesById = new Map(rules.map((r) => [r.id, r]));
+    const aiDecisions: AiFilterDecision[] = [];
+
+    for (const [messageId, matchedRules] of matches) {
+      const message = messages.find((candidate) => candidate.id === messageId);
+      if (!message) continue;
+
+      const aiMatch = matchedRules
+        .filter((match) => rulesById.get(match.ruleId)?.kind === "ai-filter")
+        .sort((a, b) => b.confidence - a.confidence)[0];
+
+      if (aiMatch) {
+        const shouldAutoFilter =
+          aiFilterState.autoFilter &&
+          aiMatch.confidence >= aiFilterState.autoFilterThreshold;
+        const shouldSuggest =
+          aiMatch.confidence >= aiFilterState.suggestionThreshold;
+        const decisionBase = {
+          id: nanoid(12),
+          messageId,
+          threadId: message.threadId,
+          accountEmail,
+          sender: message.from.slice(0, 320),
+          subject: message.subject.slice(0, 500),
+          confidence: aiMatch.confidence,
+          ...(aiMatch.reason ? { reason: aiMatch.reason } : {}),
+          source: "automatic" as const,
+          createdAt: Date.now(),
+        };
 
-    for (const [messageId, matchedRuleIds] of matches) {
-      for (const ruleId of matchedRuleIds) {
+        if (shouldAutoFilter) {
+          const ctx: ActionContext = {
+            accessToken,
+            messageId,
+            ownerEmail,
+            accountEmail,
+            labelCache,
+          };
+          const { successes, failures } = await executeActions(
+            AI_FILTER_ACTIONS,
+            ctx,
+          );
+          result.actionsExecuted += successes;
+          result.errors += failures;
+          if (successes > 0) {
+            aiDecisions.push({
+              ...decisionBase,
+              disposition: "filtered",
+            });
+          }
+        } else if (shouldSuggest) {
+          aiDecisions.push({
+            ...decisionBase,
+            disposition: "suggested",
+          });
+          result.suggestionsCreated += 1;
+        }
+      }
+
+      for (const matchedRule of matchedRules) {
+        const ruleId = matchedRule.ruleId;
         const rule = rulesById.get(ruleId);
-        if (!rule) continue;
+        if (!rule || rule.kind === "ai-filter") continue;
 
         const actions = JSON.parse(rule.actions) as AutomationAction[];
         const ctx: ActionContext = {
@@ -688,6 +805,8 @@ export async function processAutomationsForAccount(
         result.errors += failures;
       }
     }
+
+    await recordAiFilterDecisions(ownerEmail, aiDecisions);
   }
 
   // 7. Update watermark
@@ -739,6 +858,7 @@ export async function processAutomations(ownerEmail?: string): Promise<{
         messagesProcessed: 0,
         actionsExecuted: 0,
         errors: 1,
+        suggestionsCreated: 0,
       });
     }
   }
@@ -748,9 +868,13 @@ export async function processAutomations(ownerEmail?: string): Promise<{
     0,
   );
   const totalActions = details.reduce((sum, d) => sum + d.actionsExecuted, 0);
+  const totalSuggestions = details.reduce(
+    (sum, d) => sum + d.suggestionsCreated,
+    0,
+  );
 
   return {
-    result: `Processed ${totalProcessed} messages, executed ${totalActions} actions`,
+    result: `Processed ${totalProcessed} messages, executed ${totalActions} actions, created ${totalSuggestions} suggestions`,
     details,
   };
 }

package/corpus/templates/mail/server/lib/automations.ts

@@ -5,10 +5,15 @@ import type { AutomationAction, AutomationRule } from "../../shared/types.js";
 import { db, schema } from "../db/index.js";
 
 export function toApiRule(row: any): AutomationRule {
+  const kind = row.kind ?? "automation";
+  if (kind !== "automation" && kind !== "ai-filter") {
+    throw new Error(`Unknown automation rule kind: ${kind}`);
+  }
   return {
     id: row.id,
     ownerEmail: row.ownerEmail,
     domain: row.domain,
+    kind,
     name: row.name,
     condition: row.condition,
     actions: JSON.parse(row.actions),
@@ -42,6 +47,7 @@ export async function createAutomationRule(
     condition: string;
     actions: AutomationAction[];
     domain?: string;
+    kind?: "automation" | "ai-filter";
     enabled?: boolean;
   },
 ): Promise<AutomationRule> {
@@ -50,6 +56,7 @@ export async function createAutomationRule(
     id: nanoid(12),
     ownerEmail,
     domain: input.domain ?? "mail",
+    kind: input.kind ?? "automation",
     name: input.name,
     condition: input.condition,
     actions: JSON.stringify(input.actions),
@@ -71,6 +78,7 @@ export async function updateAutomationRule(
     actions?: AutomationAction[];
     enabled?: boolean;
     domain?: string;
+    kind?: "automation" | "ai-filter";
   },
 ): Promise<AutomationRule> {
   const updates: Record<string, any> = { updatedAt: Date.now() };
@@ -81,6 +89,7 @@ export async function updateAutomationRule(
   }
   if (patch.enabled !== undefined) updates.enabled = patch.enabled ? 1 : 0;
   if (patch.domain !== undefined) updates.domain = patch.domain;
+  if (patch.kind !== undefined) updates.kind = patch.kind;
 
   await db
     .update(schema.automationRules)

package/corpus/templates/mail/server/lib/email-state.ts

@@ -4,6 +4,8 @@ import {
   saveOAuthTokens,
 } from "@agent-native/core/oauth-tokens";
 import { getUserSetting, putUserSetting } from "@agent-native/core/settings";
+import { isInboxScopedAppLabel } from "@shared/gmail-labels.js";
+import type { EmailMessage, Label } from "@shared/types.js";
 /**
  * Shared server functions for email state-change operations.
  *
@@ -12,7 +14,6 @@ import { getUserSetting, putUserSetting } from "@agent-native/core/settings";
  * superset of behaviour from the two prior implementations — see reconciliation
  * notes inline.
  */
-import type { EmailMessage, Label } from "@shared/types.js";
 
 import type { BulkMarkReadResult } from "./bulk-mark-read.js";
 import {
@@ -132,8 +133,12 @@ function recomputeUnreadCounts(
   labels: Label[],
 ): Label[] {
   return labels.map((label) => {
+    const inboxScoped = label.id === "inbox" || isInboxScopedAppLabel(label.id);
     const active = emails.filter(
-      (e) => !e.isArchived && !e.isTrashed && e.labelIds.includes(label.id),
+      (e) =>
+        !e.isTrashed &&
+        (!inboxScoped || !e.isArchived) &&
+        e.labelIds.includes(label.id),
     );
     return {
       ...label,

package/corpus/templates/mail/server/lib/gmail-query.ts

@@ -86,6 +86,16 @@ export function buildGmailEmailSearchQuery({
   return [viewQuery, searchClause].filter(Boolean).join(" ");
 }
 
+export function filterLabelMessages(
+  emails: EmailMessage[],
+  label: string,
+): EmailMessage[] {
+  return emails.filter(
+    (message) =>
+      !message.isTrashed && mailLabelsInclude(message.labelIds, label),
+  );
+}
+
 function threadKey(message: EmailMessage): string {
   return `${message.accountEmail ?? ""}:${message.threadId || message.id}`;
 }

package/corpus/templates/mail/server/lib/google-auth.ts

@@ -182,8 +182,7 @@ async function getValidAccessToken(
   }
 
   const { clientId, clientSecret } = await getOAuth2Credentials(owner);
-  const redirectUri = "http://localhost:8080/_agent-native/google/callback";
-  const oauth2 = createOAuth2Client(clientId, clientSecret, redirectUri);
+  const oauth2 = createOAuth2Client(clientId, clientSecret, "");
   let refreshed;
   try {
     refreshed = await oauth2.refreshToken(tokens.refresh_token);
@@ -235,9 +234,8 @@ export async function getAuthUrl(
   const { clientId, clientSecret } = await getOAuth2Credentials(owner);
   const uri =
     redirectUri ||
-    (origin
-      ? `${origin}/_agent-native/google/callback`
-      : "http://localhost:8080/_agent-native/google/callback");
+    (origin ? `${origin}/_agent-native/google/callback` : undefined);
+  if (!uri) throw new Error("Google OAuth redirect URI is required.");
   const oauth2 = createOAuth2Client(clientId, clientSecret, uri);
   return oauth2.generateAuthUrl({
     access_type: "offline",
@@ -288,9 +286,8 @@ export async function exchangeCode(
   const { clientId, clientSecret } = await getOAuth2Credentials(owner);
   const uri =
     redirectUri ||
-    (origin
-      ? `${origin}/_agent-native/google/callback`
-      : "http://localhost:8080/_agent-native/google/callback");
+    (origin ? `${origin}/_agent-native/google/callback` : undefined);
+  if (!uri) throw new Error("Google OAuth redirect URI is required.");
   const oauth2 = createOAuth2Client(clientId, clientSecret, uri);
   const tokenResponse = await oauth2.getToken(code);
 

package/corpus/templates/mail/server/lib/jobs.ts

@@ -90,11 +90,7 @@ async function getAccessToken(accountEmail: string): Promise<string | null> {
     try {
       const { clientId, clientSecret } =
         await getOAuth2Credentials(accountEmail);
-      const oauth = createOAuth2Client(
-        clientId,
-        clientSecret,
-        "http://localhost:8080/_agent-native/google/callback",
-      );
+      const oauth = createOAuth2Client(clientId, clientSecret, "");
       const refreshed = await oauth.refreshToken(tokens.refresh_token);
       const updated = {
         ...tokens,

package/corpus/templates/mail/server/onboarding.ts

@@ -46,7 +46,7 @@ registerOnboardingStep({
       description:
         "One-click Google sign-in using the workspace's managed OAuth connection. Only you can use this connection.",
       payload: {
-        url: "/_agent-native/connections/oauth/gmail/start?scope=user&appId=mail&return=/",
+        url: "/_agent-native/connections/oauth/gmail/start?scope=user&appId=mail&return=/home",
         external: false,
       },
     },
@@ -57,7 +57,7 @@ registerOnboardingStep({
       description:
         "Workspace admins can connect once and make this Gmail connection available to selected apps or everyone in the workspace.",
       payload: {
-        url: "/_agent-native/connections/oauth/gmail/start?scope=organization&appId=mail&return=/",
+        url: "/_agent-native/connections/oauth/gmail/start?scope=organization&appId=mail&return=/home",
         external: false,
       },
     },

package/corpus/templates/mail/server/plugins/agent-chat.ts

@@ -24,6 +24,8 @@ const INITIAL_TOOL_NAMES = [
   "navigate",
   "get-mail-settings",
   "update-mail-settings",
+  "manage-automations",
+  "manage-email-rules",
   "find-contact",
   "provider-api-catalog",
   "provider-api-docs",
@@ -149,8 +151,9 @@ Be concise and helpful. When summarizing emails, include sender, subject, and a
 
 ## Automations
 
-You can create and manage email automation rules that process new inbox emails automatically using AI.
-Use manage-automations to create rules like "auto-label newsletters", "star emails from my boss", etc.
+Use manage-automations for recurring or event-triggered automations shown in Settings > Automations. For a new schedule, confirm the summary with the user, then define it with the schedule, timezone, and email actions it should run. Use an event trigger when it should run only when something changes.
+
+Use manage-email-rules for natural-language rules that process each new inbox email, such as auto-labeling newsletters or starring messages from a manager. These are separate from recurring or event-triggered automations.
 
 Sending email from an automation is opt-in. Mail keeps "Allow automations to send emails automatically" off by default. When it is off, an automation may draft or queue an email, but a real send remains approval-gated. Turning it on lets event-triggered automations send without asking for approval each time; it does not remove approval from normal interactive sends.
 

package/corpus/templates/mail/server/plugins/auth.ts

@@ -14,6 +14,7 @@ import { createAuthPlugin } from "@agent-native/core/server";
 export default createAuthPlugin({
   googleOnly: true,
   mountGoogleOAuthRoutes: false,
+  workspaceAppPublicPaths: ["/"],
   googleScopes: [
     "https://www.googleapis.com/auth/gmail.readonly",
     "https://www.googleapis.com/auth/gmail.send",

package/corpus/templates/mail/server/plugins/core-routes.ts

@@ -2,4 +2,7 @@ import { createCoreRoutesPlugin } from "@agent-native/core/server";
 
 import { envKeys } from "../lib/env-config.js";
 
-export default createCoreRoutesPlugin({ envKeys });
+export default createCoreRoutesPlugin({
+  googleOAuthManagedConnection: "required",
+  envKeys,
+});

package/corpus/templates/mail/server/plugins/db.ts

@@ -208,6 +208,12 @@ CREATE INDEX IF NOT EXISTS idx_mail_inventory_cursors_owner_expiry ON mail_inven
       sql: `ALTER TABLE mail_inventory_cursors ADD COLUMN IF NOT EXISTS claim_id TEXT;
 ALTER TABLE mail_inventory_cursors ADD COLUMN IF NOT EXISTS claimed_at ${intType()}`,
     },
+    {
+      version: 20,
+      name: "automation-rules-kind",
+      sql: `ALTER TABLE automation_rules ADD COLUMN IF NOT EXISTS kind TEXT NOT NULL DEFAULT 'automation';
+CREATE INDEX IF NOT EXISTS idx_automation_rules_owner_kind ON automation_rules(owner_email, kind)`,
+    },
   ],
   { table: "mail_migrations" },
 );

package/corpus/templates/mail/server/routes/api/attachments.get.ts

@@ -37,11 +37,7 @@ async function getAccessToken(accountEmail: string): Promise<string | null> {
     try {
       const { clientId, clientSecret } =
         await getOAuth2Credentials(accountEmail);
-      const oauth = createOAuth2Client(
-        clientId,
-        clientSecret,
-        "http://localhost:8080/_agent-native/google/callback",
-      );
+      const oauth = createOAuth2Client(clientId, clientSecret, "");
       const refreshed = await oauth.refreshToken(tokens.refresh_token);
       const updated = {
         ...tokens,

package/corpus/templates/mail/shared/ai-filter.ts

@@ -0,0 +1,74 @@
+import { z } from "zod";
+
+import type { AutomationAction } from "./types.js";
+
+export const AI_FILTER_LABEL = "agent-native-filtered";
+export const AI_FILTER_RULE_NAME = "AI filter learned examples";
+export const AI_FILTER_MIN_LEARNED_EXAMPLES = 3;
+export const AI_FILTER_DEFAULT_THRESHOLD = 0.92;
+export const AI_FILTER_DEFAULT_SUGGESTION_THRESHOLD = 0.72;
+
+export const AI_FILTER_ACTIONS: AutomationAction[] = [
+  { type: "label", labelName: AI_FILTER_LABEL },
+  { type: "archive" },
+];
+
+export const aiFilterTargetSchema = z.object({
+  id: z.string().min(1).max(256),
+  threadId: z.string().max(256).optional(),
+  accountEmail: z.string().email().optional(),
+  sender: z.string().max(320).optional(),
+  subject: z.string().max(500).optional(),
+});
+
+export type AiFilterTarget = z.infer<typeof aiFilterTargetSchema>;
+
+const aiFilterFeedbackSchema = z.object({
+  id: z.string().min(1).max(32),
+  disposition: z.enum(["spam", "not_spam"]),
+  sender: z.string().max(320),
+  subject: z.string().max(500),
+  comment: z.string().max(500).optional(),
+  createdAt: z.number().int().nonnegative(),
+});
+
+const aiFilterDecisionSchema = z.object({
+  id: z.string().min(1).max(32),
+  messageId: z.string().min(1).max(256),
+  threadId: z.string().max(256).optional(),
+  accountEmail: z.string().email().optional(),
+  sender: z.string().max(320),
+  subject: z.string().max(500),
+  disposition: z.enum(["suggested", "filtered", "kept"]),
+  source: z.enum(["manual", "automatic"]),
+  confidence: z.number().min(0).max(1).optional(),
+  reason: z.string().max(500).optional(),
+  createdAt: z.number().int().nonnegative(),
+});
+
+export type AiFilterFeedback = z.infer<typeof aiFilterFeedbackSchema>;
+export type AiFilterDecision = z.infer<typeof aiFilterDecisionSchema>;
+
+export const aiFilterStateSchema = z.object({
+  enabled: z.boolean(),
+  autoFilter: z.boolean(),
+  autoFilterThreshold: z.number().min(0.5).max(1),
+  suggestionThreshold: z.number().min(0.5).max(1),
+  labelName: z.literal(AI_FILTER_LABEL),
+  feedback: z.array(aiFilterFeedbackSchema).max(100),
+  decisions: z.array(aiFilterDecisionSchema).max(200),
+});
+
+export type AiFilterState = z.infer<typeof aiFilterStateSchema>;
+
+export function createDefaultAiFilterState(): AiFilterState {
+  return {
+    enabled: true,
+    autoFilter: true,
+    autoFilterThreshold: AI_FILTER_DEFAULT_THRESHOLD,
+    suggestionThreshold: AI_FILTER_DEFAULT_SUGGESTION_THRESHOLD,
+    labelName: AI_FILTER_LABEL,
+    feedback: [],
+    decisions: [],
+  };
+}

package/corpus/templates/mail/shared/types.ts

@@ -155,6 +155,7 @@ export type EmailTrackingStats = {
 /** Identifiers for actions available in the mobile bottom bar */
 export type MobileActionId =
   | "archive"
+  | "aiFilter"
   | "trash"
   | "star"
   | "reply"
@@ -185,6 +186,7 @@ export type AutomationRule = {
   id: string;
   ownerEmail: string;
   domain: "mail" | "calendar";
+  kind?: "automation" | "ai-filter";
   name: string;
   condition: string;
   actions: AutomationAction[];

package/corpus/templates/plan/.agents/skills/frontend-design/SKILL.md

@@ -68,6 +68,10 @@ is the target: a surface full of information and nearly empty of narration. So
 "make it minimal" is never satisfied by removing data or by burying it behind
 extra clicks, and never blocked by deleting a sentence.
 
+Keep on-screen text and badging minimal: show the shortest label needed for the
+next action, remove decorative or duplicate status chips, and put context in a
+tooltip or progressive disclosure when it is not needed to decide.
+
 Do not add, unless asked:
 
 - A page title that repeats the nav item or route the user just clicked, or a

package/corpus/templates/plan/.agents/skills/secrets/SKILL.md

@@ -31,6 +31,53 @@ standard workspace connections and org/workspace vault scopes; never put them
 in `.env` or deployment environment variables, and never add a provider-specific
 action or startup bootstrap just to write a credential for one organization.
 
+## Google OAuth triage
+
+| Observation | Meaning | Next action |
+| --- | --- | --- |
+| `invalid_grant` from a deliberately fake code | Google accepted the client pair and rejected only the code | Do not rotate credentials; check flow state and callback registration |
+| `invalid_client` | Google rejected the client id/secret pair | Verify the exact pair and deployment source before rotating |
+| `redirect_uri_mismatch` | The client, host, callback path, and Google registration disagree | Compare that exact tuple in Google Cloud Console; publish a new deploy if site-scoped or build-time configuration changes |
+
+Do not reason about this from memory. The probe checks both contracts: the
+unqualified `/health/google` endpoint reports the sign-in contract, while
+`/health/google?client=managed` reports deployment-level managed OAuth. It asks
+Google directly whether each live `(client_id, redirect_uri)` pair is
+registered:
+
+```bash
+pnpm check:google-redirect-uris -- --env all
+```
+
+The sign-in health path calls `checkGoogleSignInCredential()`, which prefers
+the active Better Auth pair and otherwise uses `resolveGoogleSignInCredentials()`
+from `packages/core/src/server/google-oauth-credentials.ts`. Managed health
+calls `checkGoogleManagedCredential()`, which resolves
+`["GOOGLE_CLIENT_ID", "GOOGLE_CLIENT_SECRET"]` through `resolveSecretPair()` in
+`packages/core/src/server/credential-provider.ts`. App provider handlers use
+`resolveGoogleProviderCredentialCandidatesWithReader()` with `resolveSecret`
+under request context. These are separate flows and can intentionally land on
+different Google clients, so a clean result for one says nothing about the
+other. Read both contracts before changing anything:
+
+```bash
+curl -s https://HOST/_agent-native/health/google | jq '{clientId,mismatchedPairs,credentialSource}'
+curl -s "https://HOST/_agent-native/health/google?client=managed" | jq '{clientId,mismatchedPairs,credentialSource}'
+```
+
+Different `clientId` values across those two, or `mismatchedPairs: true`, is a
+divergence to understand, not damage to undo. Never repair it by rotating a
+secret: writing a fresh value into whichever namespace the failing flow does
+not read verifies clean and changes nothing. Do not collapse the namespaces
+without first confirming which flow uses which client; separate sign-in and
+managed clients on one host can be deliberate. For prebuilt Netlify deploys,
+uploaded Functions read site-scoped secrets at runtime, and the health route
+resolves them per request. The build may receive masked placeholder values.
+After changing a site-scoped env var, publish a new deploy before verifying
+live behavior. Call it a rebuild when the changed value is baked into build
+output or static assets; a runtime-only secret does not need to be baked into
+the bundle.
+
 ## Credential Modeling Preflight
 
 Before registering a provider's fields, inspect the workspace/provider connection