@moretea-labs/forge 1.8.0 → 1.8.2

package/src/runtime/plugins/external-registration.ts

@@ -1,5 +1,5 @@
 import { createHash } from 'crypto';
-import { existsSync, mkdirSync, readdirSync, rmSync } from 'fs';
+import { existsSync, mkdirSync, readdirSync, rmSync, statSync } from 'fs';
 import { isAbsolute, join } from 'path';
 import { controllerSystemRoot, ensureControllerHome } from '../../cli/repositories/controller-home';
 import { readJsonFile, sanitizeFileComponent, writeJsonAtomic } from '../shared/json-files';
@@ -98,6 +98,26 @@ export function externalPluginRegistrationPath(controllerHome: string, pluginId:
   return join(registrationRoot(controllerHome), `${sanitizeFileComponent(pluginId)}.json`);
 }
 
+export function externalPluginRegistrationSetIdentity(controllerHome: string): string {
+  const root = registrationRoot(controllerHome);
+  if (!existsSync(root)) return 'absent';
+  const names = readdirSync(root, { withFileTypes: true })
+    .filter((entry) => entry.isFile() && entry.name.endsWith('.json'))
+    .map((entry) => entry.name)
+    .sort((left, right) => left.localeCompare(right));
+  return names.map((name) => {
+    const path = join(root, name);
+    try {
+      const stat = statSync(path, { bigint: true });
+      return `${name}:${stat.dev}:${stat.ino}:${stat.size}:${stat.mtimeNs}:${stat.ctimeNs}`;
+    } catch {
+      // A concurrent registration replacement/removal is itself an identity
+      // change. Do not reuse the prior adapter snapshot across that race.
+      return `${name}:changed`;
+    }
+  }).join('|');
+}
+
 function boundedInteger(value: number | undefined, fallback: number, min: number, max: number): number {
   if (typeof value !== 'number' || !Number.isFinite(value)) return fallback;
   return Math.min(Math.max(Math.trunc(value), min), max);

package/src/runtime/plugins/github-adapter.ts

@@ -11,6 +11,7 @@ import {
   listGitHubWorkflowRuns,
   listGitHubWorkflows,
 } from '../../cli/github/github';
+import { syncGitHubSemanticRelease } from '../../cli/github/semantic-projection';
 import type {
   AssistantPluginActionDescriptor,
   AssistantPluginActionExecutionInput,
@@ -72,7 +73,7 @@ function githubCapabilities(): AssistantPluginCapability[] {
       title: 'Issue Sync',
       description: 'Mirror controller issues and task metadata into GitHub issues.',
       scopes: ['github:issues:write', 'controller:issues:write'],
-      actions: ['configure', 'publish_issue', 'refresh_issue', 'close_issue'],
+      actions: ['configure', 'publish_issue', 'refresh_issue', 'close_issue', 'sync_semantic_release'],
     },
     {
       capabilityId: 'project-sync',
@@ -91,7 +92,7 @@ function githubCapabilities(): AssistantPluginCapability[] {
   ];
 }
 
-function githubActions(): AssistantPluginActionDescriptor[] {
+function githubActions(projectConfigured: boolean): AssistantPluginActionDescriptor[] {
   return [
     {
       actionId: 'configure',
@@ -145,6 +146,22 @@ function githubActions(): AssistantPluginActionDescriptor[] {
         additionalProperties: false,
       },
     },
+    {
+      actionId: 'sync_semantic_release',
+      title: 'Sync semantic release to GitHub',
+      description: 'Idempotently project one root semantic release Work and explicitly linked child Works from Forge into GitHub Issues without changing Forge semantics.',
+      readOnly: false,
+      risk: 'remote_write',
+      confirmation: 'authorization',
+      defaultTimeoutMs: 120_000,
+      cancellable: true,
+      idempotent: true,
+      scopes: projectConfigured ? ['github:issues:write', 'github:projects:write'] : ['github:issues:write'],
+      resourceClaims: [{ resource: 'remote', mode: 'exclusive' }],
+      argumentsSchema: { type: 'object', required: ['release_work_id'], properties: {
+        release_work_id: { type: 'string', minLength: 1, maxLength: 200 },
+      }, additionalProperties: false },
+    },
     {
       actionId: 'refresh_issue',
       title: 'Refresh linked GitHub issue',
@@ -321,7 +338,7 @@ export function buildGitHubPluginManifest(previousRevision = 0, previousUpdatedA
     },
     permissions: githubPermissions(status.ready, projectConfigured),
     capabilities: githubCapabilities(),
-    actions: githubActions(),
+    actions: githubActions(projectConfigured),
     updatedAt: previousUpdatedAt ?? now(),
   };
 }
@@ -343,6 +360,16 @@ export async function executeGitHubPluginAction(input: AssistantPluginActionExec
     }
     case 'publish_issue':
       return { issue: publishIssueWithGitHubPlugin(input.repoRoot, String(input.args.issue_id ?? '').trim()) };
+    case 'sync_semantic_release': {
+      const config = loadGitHubPluginConfig(input.repoRoot);
+      if (!config.enabled || !getGitHubPluginStatus(input.repoRoot).ready) throw new Error('GITHUB_SEMANTIC_PLUGIN_NOT_READY');
+      return { ...syncGitHubSemanticRelease(input.repoRoot, {
+        releaseWorkId: String(input.args.release_work_id ?? '').trim(),
+        repository: config.repository,
+        projectOwner: config.projectOwner,
+        projectNumber: config.projectNumber,
+      }) };
+    }
     case 'refresh_issue':
       return refreshIssueWithGitHubPlugin(input.repoRoot, String(input.args.issue_id ?? '').trim()) as Record<string, unknown>;
     case 'list_workflows': {

package/src/runtime/plugins/gmail-adapter.ts

@@ -7,6 +7,7 @@ import type {
   AssistantPluginPermissionScope,
 } from './types';
 import { AssistantPluginError } from './errors';
+import { importStoredGoogleClientSecretFromClipboard } from '../safe-tooling/google-credential-store';
 import {
   type GmailPluginConfig,
   encodeBase64Url,
@@ -19,7 +20,18 @@ import {
   stableMockId,
 } from './google-shared';
 
-const GMAIL_PLUGIN_ID = 'gmail';
+export const GMAIL_PLUGIN_ID = 'gmail';
+export const GMAIL_AUTOMATION_CAPABILITY_ID = 'scheduled-gmail-automation';
+export const GMAIL_OWNER_NOTIFICATION_CAPABILITY_ID = 'owner-notification';
+const GMAIL_AUTOMATION_GRANT_MINUTES = 90 * 24 * 60;
+
+function gmailAutomationMailbox(config: GmailPluginConfig): string {
+  const mailbox = stringValue(config.accountEmail)?.toLowerCase();
+  if (!mailbox) {
+    throw new AssistantPluginError('GMAIL_AUTOMATION_MAILBOX_NOT_CONFIGURED', 'Set the Gmail plugin accountEmail to the connected mailbox before using scheduled Gmail automation.', { retryable: false });
+  }
+  return mailbox;
+}
 
 interface GmailProvider {
   listMessages(args: Record<string, unknown>, config: GmailPluginConfig): Promise<Record<string, unknown>>;
@@ -96,6 +108,20 @@ function gmailCapabilities(): AssistantPluginCapability[] {
       scopes: ['gmail.modify'],
       actions: ['modify_message_labels', 'archive_message', 'mark_message_read', 'mark_message_unread', 'trash_message'],
     },
+    {
+      capabilityId: GMAIL_AUTOMATION_CAPABILITY_ID,
+      title: 'Scheduled Gmail Automation',
+      description: 'After an explicit reusable grant, archive selected messages in the profile-verified mailbox. This does not authorize sending mail, replies or trash.',
+      scopes: ['gmail.modify'],
+      actions: ['authorize_scheduled_gmail_automation', 'archive_scheduled_message'],
+    },
+    {
+      capabilityId: GMAIL_OWNER_NOTIFICATION_CAPABILITY_ID,
+      title: 'Owner Authorization Email',
+      description: 'Send Forge authorization/approval notices exclusively to the configured, Google-profile-verified owner mailbox. Does not authorize archive, replies, trash or arbitrary recipients.',
+      scopes: ['gmail.send'],
+      actions: ['authorize_owner_notifications', 'send_owner_notification'],
+    },
   ];
 }
 
@@ -127,6 +153,24 @@ function gmailActions(): AssistantPluginActionDescriptor[] {
         additionalProperties: false,
       },
     },
+    {
+      actionId: 'import_oauth_client_secret_from_clipboard',
+      title: 'Import Gmail OAuth client secret',
+      description: 'Consume the current macOS clipboard once, store the OAuth client secret in Keychain, clear the clipboard, and never return credential material.',
+      readOnly: false,
+      risk: 'workspace_write',
+      confirmation: 'authorization',
+      defaultTimeoutMs: 10_000,
+      cancellable: false,
+      idempotent: false,
+      scopes: ['gmail.readonly'],
+      resourceClaims: [{ resource: 'provider-state', mode: 'write' }],
+      argumentsSchema: {
+        type: 'object',
+        properties: {},
+        additionalProperties: false,
+      },
+    },
     {
       actionId: 'list_messages',
       title: 'List Gmail messages',
@@ -276,6 +320,79 @@ function gmailActions(): AssistantPluginActionDescriptor[] {
         additionalProperties: false,
       },
     },
+    {
+      actionId: 'authorize_scheduled_gmail_automation',
+      title: 'Authorize scheduled Gmail automation',
+      description: 'Explicitly grant Forge up to 90 days to archive selected messages in the configured, profile-verified Gmail mailbox. It does not authorize sending messages or trash.',
+      readOnly: false,
+      risk: 'remote_write',
+      confirmation: 'authorization',
+      requiredConfirmationText: 'authorize-scheduled-gmail-automation',
+      defaultTimeoutMs: 30_000,
+      cancellable: false,
+      idempotent: true,
+      scopes: ['gmail.modify'],
+      resourceClaims: [{ resource: 'repo-state', mode: 'write' }],
+      argumentsSchema: { type: 'object', properties: {}, additionalProperties: false },
+    },
+    {
+      actionId: 'archive_scheduled_message',
+      title: 'Archive selected Gmail message for scheduled automation',
+      description: 'Archive one explicitly selected message in the fixed owner mailbox. Requires the dedicated scheduled Gmail automation grant.',
+      readOnly: false,
+      risk: 'remote_write',
+      confirmation: 'authorization',
+      requiresExplicitCapabilityGrant: true,
+      defaultTimeoutMs: 30_000,
+      cancellable: false,
+      idempotent: true,
+      scopes: ['gmail.modify'],
+      resourceClaims: [{ resource: 'remote', mode: 'exclusive' }],
+      argumentsSchema: {
+        type: 'object',
+        properties: { message_id: { type: 'string', minLength: 1, maxLength: 512 } },
+        required: ['message_id'],
+        additionalProperties: false,
+      },
+    },
+    {
+      actionId: 'authorize_owner_notifications',
+      title: 'Authorize owner notification emails',
+      description: 'Explicitly allow Forge to send future authorization requests to this verified Gmail account, with links to affected ChatGPT conversations. Does not grant archiving, replies or arbitrary recipients.',
+      readOnly: false,
+      risk: 'remote_write',
+      confirmation: 'authorization',
+      requiredConfirmationText: 'authorize-owner-notifications',
+      defaultTimeoutMs: 30_000,
+      cancellable: false,
+      idempotent: true,
+      scopes: ['gmail.send'],
+      resourceClaims: [{ resource: 'repo-state', mode: 'write' }],
+      argumentsSchema: { type: 'object', properties: {}, additionalProperties: false },
+    },
+    {
+      actionId: 'send_owner_notification',
+      title: 'Send Forge notification to owner mailbox',
+      description: 'Send a plain-text Forge/Gmail automation notification only to the configured, profile-verified Gmail mailbox. No recipient, CC, BCC, or attachments can be supplied. Requires the dedicated scheduled Gmail automation grant.',
+      readOnly: false,
+      risk: 'remote_write',
+      confirmation: 'authorization',
+      requiresExplicitCapabilityGrant: true,
+      defaultTimeoutMs: 45_000,
+      cancellable: false,
+      idempotent: false,
+      scopes: ['gmail.send'],
+      resourceClaims: [{ resource: 'remote', mode: 'exclusive' }],
+      argumentsSchema: {
+        type: 'object',
+        properties: {
+          subject: { type: 'string', minLength: 1, maxLength: 180 },
+          body_text: { type: 'string', minLength: 1, maxLength: 12000 },
+        },
+        required: ['subject', 'body_text'],
+        additionalProperties: false,
+      },
+    },
     {
       actionId: 'modify_message_labels',
       title: 'Modify Gmail message labels',
@@ -668,7 +785,7 @@ function gmailProvider(config: GmailPluginConfig, repoRoot?: string): GmailProvi
 export function buildGmailPluginManifest(previousRevision = 0, previousUpdatedAt?: string, repoRoot?: string, context?: AssistantPluginBuildContext): AssistantPluginManifest {
   const root = repoRoot ?? process.cwd();
   const config = loadGmailPluginConfig(root, context);
-  const auth = resolveGoogleAuth('gmail', config, { repoRoot: root });
+  const auth = resolveGoogleAuth('gmail', config, { repoRoot: root, controllerHome: context?.controllerHome });
   const state = pluginStateFromGoogleAuth(config, auth);
   return {
     schemaVersion: 1,
@@ -714,9 +831,11 @@ export async function executeGmailPluginAction(input: AssistantPluginActionExecu
       });
       return {
         config,
-        auth: resolveGoogleAuth('gmail', config, { repoRoot: input.repoRoot }),
+        auth: resolveGoogleAuth('gmail', config, { repoRoot: input.repoRoot, controllerHome: input.controllerHome }),
       };
     }
+    case 'import_oauth_client_secret_from_clipboard':
+      return importStoredGoogleClientSecretFromClipboard('gmail');
     case 'list_messages':
       return gmailProvider(current, input.repoRoot).listMessages(input.args, current);
     case 'get_message':
@@ -731,6 +850,40 @@ export async function executeGmailPluginAction(input: AssistantPluginActionExecu
       return gmailProvider(current, input.repoRoot).createDraft(input.args, current);
     case 'send_message':
       return gmailProvider(current, input.repoRoot).sendMessage(input.args, current);
+    case 'authorize_owner_notifications':
+      return {
+        authorizedMailbox: gmailAutomationMailbox(current),
+        capabilityId: GMAIL_OWNER_NOTIFICATION_CAPABILITY_ID,
+        scopes: ['gmail.send'],
+        grantLifetimeDays: 90,
+        sent: false,
+      };
+    case 'authorize_scheduled_gmail_automation':
+      return {
+        authorizedMailbox: gmailAutomationMailbox(current),
+        capabilityId: GMAIL_AUTOMATION_CAPABILITY_ID,
+        scopes: ['gmail.modify'],
+        grantLifetimeDays: 90,
+        sent: false,
+        note: 'The plugin action store records the reusable grant after this explicit authorization action succeeds.',
+      };
+    case 'archive_scheduled_message':
+      return gmailProvider(current, input.repoRoot).archiveMessage(input.args, current);
+    case 'send_owner_notification': {
+      const subject = stringValue(input.args.subject);
+      const bodyText = stringValue(input.args.body_text);
+      if (!subject || !/^\[(Forge|Gmail)\]/.test(subject)) {
+        throw new AssistantPluginError('GMAIL_OWNER_NOTIFICATION_SUBJECT_INVALID', 'Owner notifications must start with [Forge] or [Gmail].', { retryable: false });
+      }
+      if (!bodyText) {
+        throw new AssistantPluginError('GMAIL_OWNER_NOTIFICATION_BODY_REQUIRED', 'Owner notifications require plain-text body_text.', { retryable: false });
+      }
+      return gmailProvider(current, input.repoRoot).sendMessage({
+        to: [gmailAutomationMailbox(current)],
+        subject,
+        body_text: bodyText,
+      }, current);
+    }
     case 'modify_message_labels':
       return gmailProvider(current, input.repoRoot).modifyMessageLabels(input.args, current);
     case 'archive_message':
@@ -748,8 +901,41 @@ export async function executeGmailPluginAction(input: AssistantPluginActionExecu
   }
 }
 
+async function resolveGmailAutomationAuthorizationContext(input: AssistantPluginActionExecutionInput) {
+  if (![
+    'authorize_scheduled_gmail_automation',
+    'archive_scheduled_message',
+    'authorize_owner_notifications',
+    'send_owner_notification',
+  ].includes(input.actionId)) return undefined;
+
+  const current = loadGmailPluginConfig(input.repoRoot, input);
+  if (!current.enabled) {
+    throw new AssistantPluginError('GMAIL_AUTOMATION_DISABLED', 'Enable the Gmail plugin before authorizing scheduled Gmail automation.', { retryable: false });
+  }
+  const configuredEmail = gmailAutomationMailbox(current);
+  const profile = await gmailProvider(current, input.repoRoot).getProfile({}, current);
+  const actualEmail = stringValue(profile.emailAddress)?.toLowerCase();
+  if (actualEmail !== configuredEmail) {
+    throw new AssistantPluginError(
+      'GMAIL_AUTOMATION_MAILBOX_MISMATCH',
+      'The connected Gmail profile does not match the configured Gmail accountEmail.',
+      { retryable: false },
+    );
+  }
+  return {
+    target: {
+      kind: 'gmail-mailbox' as const,
+      id: configuredEmail,
+      identityFingerprint: `gmail-profile:${configuredEmail}`,
+    },
+    expiresInMinutes: GMAIL_AUTOMATION_GRANT_MINUTES,
+  };
+}
+
 export const gmailPluginAdapter = {
   pluginId: GMAIL_PLUGIN_ID,
   buildManifest: buildGmailPluginManifest,
   executeAction: executeGmailPluginAction,
+  resolveAuthorizationContext: resolveGmailAutomationAuthorizationContext,
 };

package/src/runtime/plugins/google-calendar-adapter.ts

@@ -394,7 +394,7 @@ function calendarProvider(config: GoogleCalendarPluginConfig, repoRoot?: string)
 export function buildGoogleCalendarPluginManifest(previousRevision = 0, previousUpdatedAt?: string, repoRoot?: string, context?: AssistantPluginBuildContext): AssistantPluginManifest {
   const root = repoRoot ?? process.cwd();
   const config = loadGoogleCalendarPluginConfig(root, context);
-  const auth = resolveGoogleAuth('calendar', config, { repoRoot: root });
+  const auth = resolveGoogleAuth('calendar', config, { repoRoot: root, controllerHome: context?.controllerHome });
   const state = pluginStateFromGoogleAuth(config, auth);
   return {
     schemaVersion: 1,
@@ -441,7 +441,7 @@ export async function executeGoogleCalendarPluginAction(input: AssistantPluginAc
       });
       return {
         config,
-        auth: resolveGoogleAuth('calendar', config, { repoRoot: input.repoRoot }),
+        auth: resolveGoogleAuth('calendar', config, { repoRoot: input.repoRoot, controllerHome: input.controllerHome }),
       };
     }
     case 'list_events':

package/src/runtime/plugins/google-shared.ts

@@ -6,7 +6,7 @@ import type {
 } from './types';
 import { AssistantPluginError, toAssistantPluginError } from './errors';
 import { bootstrapManagedRuntimeEnv } from '../shared/managed-env';
-import { readStoredGoogleRefreshToken } from '../safe-tooling/google-credential-store';
+import { readStoredGoogleClientSecret, readStoredGoogleRefreshToken } from '../safe-tooling/google-credential-store';
 import { readRepositoryPluginConfig, writeRepositoryPluginConfig, type RepositoryPluginConfigContext } from './config-store';
 
 export type GoogleProviderKind = 'mock' | 'google-workspace';
@@ -128,8 +128,15 @@ function refreshCredential(service: GoogleService): { name: string; value: strin
   return stored ? { name: stored.source, value: stored.token } : undefined;
 }
 
+function clientSecretCredential(service: GoogleService): { name: string; value: string } | undefined {
+  const fromEnv = firstEnv(clientSecretEnvNames(service));
+  if (fromEnv) return fromEnv;
+  const stored = readStoredGoogleClientSecret(service);
+  return stored ? { name: stored.source, value: stored.secret } : undefined;
+}
+
 function refreshCredentialsReady(service: GoogleService): boolean {
-  return Boolean(refreshCredential(service) && firstEnv(clientIdEnvNames(service)) && firstEnv(clientSecretEnvNames(service)));
+  return Boolean(refreshCredential(service) && firstEnv(clientIdEnvNames(service)));
 }
 
 export function installGoogleAccessToken(service: GoogleService, accessToken: string, expiresInSeconds = 3600, source = 'oauth'): void {
@@ -289,9 +296,9 @@ function tokenEnvNames(service: GoogleService): string[] {
 export function resolveGoogleAuth(
   service: GoogleService,
   config: GooglePluginConfig,
-  options: { repoRoot?: string } = {},
+  options: { repoRoot?: string; controllerHome?: string } = {},
 ): GoogleAuthState {
-  bootstrapManagedRuntimeEnv({ repoRoot: options.repoRoot });
+  bootstrapManagedRuntimeEnv({ repoRoot: options.repoRoot, controllerHome: options.controllerHome });
   if (config.provider === 'mock') {
     return {
       provider: 'mock', ready: true, authenticated: true, probed: true,
@@ -324,7 +331,7 @@ export function resolveGoogleAuth(
       credentialSource: refresh?.name,
       accessToken: REFRESH_REQUIRED_ACCESS_TOKEN,
       errors: [],
-      warnings: ['A stored refresh credential is available; the next provider request will refresh and verify an access token.'],
+      warnings: ['A refresh token is stored, but Google has not verified it. A matching OAuth client secret may also be required by the provider.'],
     };
   }
   return {
@@ -344,7 +351,7 @@ export type GoogleReadinessMode =
 export function resolveGoogleReadinessMode(config: GooglePluginConfig, auth: GoogleAuthState): GoogleReadinessMode {
   if (!config.enabled) return 'disabled';
   if (config.provider === 'mock' && auth.ready) return 'mock_provider_ready';
-  if (config.provider === 'google-workspace' && auth.ready) return 'live_provider_ready';
+  if (config.provider === 'google-workspace' && auth.ready && auth.probed) return 'live_provider_ready';
   if (config.provider === 'google-workspace' && auth.authenticated) return 'live_token_unverified';
   return 'missing_token';
 }
@@ -372,10 +379,10 @@ export function pluginStateFromGoogleAuth(config: GooglePluginConfig, auth: Goog
       checkedAt: new Date().toISOString(),
       ready: config.enabled && ready,
       probed: config.enabled ? auth.probed : false,
-      errors: [],
+      errors: !config.enabled || auth.authenticated ? [] : auth.errors,
       warnings: !config.enabled
         ? ['Plugin is disabled. Enable it before using Google provider actions.']
-        : [...auth.warnings, ...(!auth.authenticated ? auth.errors : [])],
+        : auth.warnings,
       details: {
         provider: config.provider,
         accountEmail: config.accountEmail,
@@ -428,8 +435,8 @@ function serviceBaseUrl(service: GoogleService): string {
 async function refreshGoogleAccessToken(service: GoogleService, timeoutMs: number): Promise<string | undefined> {
   const refreshToken = refreshCredential(service);
   const clientId = firstEnv(clientIdEnvNames(service));
-  const clientSecret = firstEnv(clientSecretEnvNames(service));
-  if (!refreshToken || !clientId || !clientSecret) return undefined;
+  const clientSecret = clientSecretCredential(service);
+  if (!refreshToken || !clientId) return undefined;
   const controller = new AbortController();
   const timeout = setTimeout(() => controller.abort(), timeoutMs);
   try {
@@ -437,8 +444,8 @@ async function refreshGoogleAccessToken(service: GoogleService, timeoutMs: numbe
       grant_type: 'refresh_token',
       refresh_token: refreshToken.value,
       client_id: clientId.value,
-      client_secret: clientSecret.value,
     });
+    if (clientSecret) body.set('client_secret', clientSecret.value);
     const response = await fetch('https://oauth2.googleapis.com/token', {
       method: 'POST',
       headers: { 'content-type': 'application/x-www-form-urlencoded', accept: 'application/json' },
@@ -450,7 +457,12 @@ async function refreshGoogleAccessToken(service: GoogleService, timeoutMs: numbe
     try { parsed = raw ? JSON.parse(raw) as Record<string, unknown> : {}; } catch { parsed = { raw }; }
     const accessToken = typeof parsed.access_token === 'string' ? parsed.access_token.trim() : '';
     if (!response.ok || !accessToken) {
-      throw new AssistantPluginError('PLUGIN_AUTH_FAILED', 'Google refresh token exchange failed.', {
+      const missingSecret = parsed.error === 'invalid_request'
+        && typeof parsed.error_description === 'string'
+        && /client_secret is missing/i.test(parsed.error_description);
+      throw new AssistantPluginError('PLUGIN_AUTH_FAILED', missingSecret
+        ? 'Google OAuth client secret is missing for the configured client. Restore its matching secret in macOS Keychain, or reauthorize with a new OAuth client.'
+        : 'Google refresh token exchange failed.', {
         retryable: false,
         details: { service, status: response.status, providerError: parsed },
       });

package/src/runtime/plugins/google-tasks-adapter.ts

@@ -457,7 +457,7 @@ function tasksProvider(config: GoogleTasksPluginConfig, repoRoot?: string): Task
 export function buildGoogleTasksPluginManifest(previousRevision = 0, previousUpdatedAt?: string, repoRoot?: string, context?: AssistantPluginBuildContext): AssistantPluginManifest {
   const root = repoRoot ?? process.cwd();
   const config = loadGoogleTasksPluginConfig(root, context);
-  const auth = resolveGoogleAuth('tasks', config, { repoRoot: root });
+  const auth = resolveGoogleAuth('tasks', config, { repoRoot: root, controllerHome: context?.controllerHome });
   const state = pluginStateFromGoogleAuth(config, auth);
   return {
     schemaVersion: 1,
@@ -504,7 +504,7 @@ export async function executeGoogleTasksPluginAction(input: AssistantPluginActio
       });
       return {
         config,
-        auth: resolveGoogleAuth('tasks', config, { repoRoot: input.repoRoot }),
+        auth: resolveGoogleAuth('tasks', config, { repoRoot: input.repoRoot, controllerHome: input.controllerHome }),
       };
     }
     case 'list_tasklists':