@michael-joseph-miller/ant-bot 0.4.4 → 0.4.5

package/CHANGELOG.md

@@ -4,6 +4,25 @@ All notable changes to ant-bot are recorded here. The format follows
 [Keep a Changelog](https://keepachangelog.com/en/1.1.0/), and versions follow
 [semantic versioning](https://semver.org/spec/v2.0.0.html).
 
+## [0.4.5] — 2026-08-24
+
+### Changed
+
+- **The built-in Gmail connector asks for the whole mailbox.** It requested `gmail.modify`; it now
+  requests `https://mail.google.com/` plus `gmail.settings.basic` and `gmail.settings.sharing` —
+  read, compose, send, permanent deletion, filters, forwarding and vacation settings. What keeps a
+  Bot in check is not the size of the token: `send_message` and `create_draft` carry seeded
+  `require` rules, so a human is asked every time regardless. Existing sign-ins keep the narrower
+  token until you sign in again.
+
+### Fixed
+
+- **A sign-in older than the scopes now asked for says so.** Widening what a connector requests
+  does nothing until the human re-consents, and until then everything reads as healthy while any
+  call needing the new permission is refused. `check` now compares the stored token's scopes
+  against what the connector asks for and reports `needs sign-in — signed in, but without N newer
+  permission(s)`.
+
 ## [0.4.4] — 2026-08-24
 
 ### Changed

package/README.md

@@ -281,10 +281,10 @@ Current totals, as run against this checkout:
 | Package | Test files | Tests |
 |---|---|---|
 | `@antbot/contract` | 1 | 34 |
-| `@antbot/daemon` | 29 | 619 |
+| `@antbot/daemon` | 29 | 624 |
 | `@antbot/ui` | 10 | 114 |
 | `@antbot/cli` | 8 | 142 |
-| **Total** | **48** | **909** |
+| **Total** | **48** | **914** |
 
 ## Status / not built
 

package/dist/server.js

@@ -2455,6 +2455,25 @@ var ConnectorAuthService = class {
   async write(connectorName, tokens) {
     await this.secrets.set(tokenSecretName(connectorName), JSON.stringify(tokens));
   }
+  /**
+   * The scopes a stored sign-in actually carries, or null when there is no sign-in.
+   *
+   * A token grants what was consented to when it was minted, not what the client is configured
+   * to be allowed to ask for. Widening the requested list does nothing until the human signs in
+   * again — and without checking, that shows up as a tool that keeps returning "insufficient
+   * permission" with everything looking correctly connected.
+   */
+  async grantedScopes(connectorName) {
+    const key = tokenSecretName(connectorName);
+    const raw = (await this.secrets.resolve([key])).get(key);
+    if (!raw) return null;
+    try {
+      const parsed = JSON.parse(raw);
+      return typeof parsed.scope === "string" ? parsed.scope.split(/\s+/).filter(Boolean) : [];
+    } catch {
+      return null;
+    }
+  }
   async signOut(connectorName) {
     await this.secrets.remove(tokenSecretName(connectorName));
   }
@@ -2844,8 +2863,18 @@ var BUILTIN_CATALOG = {
     displayName: "Gmail",
     description: "Read, search and draft email in the signed-in Gmail account.",
     provider: GOOGLE,
-    // modify covers read + draft + send; asking for less means a second consent screen later.
-    scopes: ["https://www.googleapis.com/auth/gmail.modify"],
+    // The full mailbox, plus settings. `mail.google.com` subsumes read/compose/send/modify and
+    // adds permanent deletion; the two settings scopes are separate and cover filters, forwarding
+    // and vacation. Listing narrower scopes as well would only lengthen the consent screen.
+    //
+    // Breadth here is not what keeps a bot in check — `mcp__gmail__send_message` and
+    // `mcp__gmail__create_draft` carry seeded `require` rules, so a human is asked every time
+    // whatever the token allows.
+    scopes: [
+      "https://mail.google.com/",
+      "https://www.googleapis.com/auth/gmail.settings.basic",
+      "https://www.googleapis.com/auth/gmail.settings.sharing"
+    ],
     tools: gmailTools
   }
 };
@@ -2889,6 +2918,18 @@ var BuiltinService = class {
   authorized(name) {
     return this.auth?.isAuthorized(name) ?? false;
   }
+  /**
+   * Scopes this connector asks for that the stored sign-in does not carry. Empty when the token
+   * covers everything — including when the provider granted a broader scope that subsumes one
+   * asked for, which is why the comparison is by exact string and errs toward "sign in again".
+   */
+  async missingScopes(name) {
+    const def = this.get(name);
+    if (!def || !this.auth) return [];
+    const granted = await this.auth.grantedScopes(name);
+    if (granted === null) return [];
+    return def.scopes.filter((s) => !granted.includes(s));
+  }
   /** Constant-time compare so the bearer cannot be guessed a byte at a time. */
   checkBearer(header) {
     const given = (header ?? "").replace(/^Bearer\s+/i, "");
@@ -3097,6 +3138,15 @@ async function probeConnector(config, opts = {}) {
 // daemon/src/connectors/check.ts
 function decideCheck(signals) {
   if (signals.builtinProvider) {
+    if (signals.builtinSignedIn && signals.builtinMissingScopes?.length) {
+      return {
+        status: "needs-sign-in",
+        selfRegistration: signals.builtinProvider.dynamicRegistration,
+        provider: signals.builtinProvider.name,
+        tools: signals.probe?.tools ?? [],
+        detail: `signed in, but without ${signals.builtinMissingScopes.length} newer permission(s) \u2014 sign in again to grant them`
+      };
+    }
     return signals.builtinSignedIn ? { status: "ready", tools: signals.probe?.tools ?? [], provider: signals.builtinProvider.name } : {
       status: "needs-sign-in",
       selfRegistration: signals.builtinProvider.dynamicRegistration,
@@ -3559,6 +3609,7 @@ async function createApp(opts = {}) {
         challenge: "none",
         missingSecrets: [],
         builtinSignedIn: app.builtin?.authorized(connector.name) ?? false,
+        builtinMissingScopes: await app.builtin?.missingScopes(connector.name) ?? [],
         builtinProvider: def ? { name: def.provider.displayName, dynamicRegistration: def.provider.dynamicRegistration } : void 0
       });
     } else {