crewly 1.13.0 → 1.14.0

package/config/skills/team-leader/delegate-task/execute.test.sh

@@ -1,12 +1,34 @@
 #!/bin/bash
 # Tests for TL delegate-task execute.sh
 # Covers: CREWLY_SESSION_NAME resolution, fromSession fallback,
-#         graceful monitoring skip, delegation success
+#         graceful monitoring skip, delegation success, and the Request
+#         Contract checker (which scans BOTH `task` and `context`).
 set -euo pipefail
 SCRIPT_DIR="$(cd "$(dirname "${BASH_SOURCE[0]}")" && pwd)"
 PASS=0
 FAIL=0
 
+# ---------------------------------------------------------------------------
+# Extract the REAL warn_missing_request_contract out of execute.sh.
+#
+# This file used to keep a hand-copied duplicate of that function inside the
+# mock, with a comment asking future editors to keep it "byte-equivalent".
+# It did not stay byte-equivalent, and worse, nothing could detect that:
+# changing the function in execute.sh left all 16 assertions green, because
+# they were exercising the copy. Pulling the function straight out of the
+# shipped script means production edits are felt here immediately, and makes
+# the mutation test in the commit message meaningful.
+# ---------------------------------------------------------------------------
+REAL_FN_FILE="$(mktemp)"
+export REAL_FN_FILE
+sed -n '/^warn_missing_request_contract() {$/,/^}$/p' "$SCRIPT_DIR/execute.sh" > "$REAL_FN_FILE"
+if ! grep -q 'Request Contract incomplete' "$REAL_FN_FILE"; then
+  echo "FATAL: could not extract warn_missing_request_contract() from execute.sh" >&2
+  exit 1
+fi
+# shellcheck source=/dev/null
+source "$REAL_FN_FILE"
+
 assert_succeeds() {
   local desc="$1"
   shift
@@ -74,27 +96,11 @@ shift
 # Load the real shared lib first
 source "${REAL_SKILL_DIR}/../_common/lib.sh"
 
-# Request Contract warning helper (mirror of the real script's
-# warn_missing_request_contract — must stay byte-equivalent so the test
-# exercises actual production logic, not a stub).
-warn_missing_request_contract() {
-  local task="$1"
-  local missing=()
-  if ! echo "$task" | grep -qiE '(^|[^a-zA-Z])(\*\*)?(goal|objective)(:|s?\b)'; then
-    missing+=("Goal")
-  fi
-  if ! echo "$task" | grep -qiE '(^|[^a-zA-Z])(\*\*)?(expected )?outcome(:|s?\b)'; then
-    missing+=("Outcome")
-  fi
-  if ! echo "$task" | grep -qiE '(^|[^a-zA-Z])(\*\*)?(eval|evaluation criteria|acceptance criteria)(:|s?\b)'; then
-    missing+=("Eval")
-  fi
-  if [ ${#missing[@]} -gt 0 ]; then
-    local list
-    list=$(IFS=, ; echo "${missing[*]}")
-    echo "{\"warning\":\"Request Contract incomplete: brief is missing markers for: ${list}. Per P0-3 spec, every delegated subtask MUST include Goal + Expected Outcome + Eval Criteria. Workers may push back via the Brief Reception Protocol. Source: .crewly/specs/2026-05-03-agent-improvement-p0-execution.md §Fix P0-3.\"}" >&2
-  fi
-}
+# Load the REAL warn_missing_request_contract, extracted from execute.sh by
+# the harness above. Do NOT re-declare it here — a hand-copy silently
+# decouples these scenarios from the code that actually ships.
+# shellcheck source=/dev/null
+source "$REAL_FN_FILE"
 
 # Track API calls for verification
 API_CALLS_LOG=$(mktemp)
@@ -158,9 +164,14 @@ FROM_SESSION=$(echo "$INPUT" | jq -r '.fromSession // empty')
 require_param "to" "$TO"
 require_param "task" "$TASK"
 
-# Request Contract warning (P0-3): emit non-fatal warning when brief is
-# missing Goal / Expected Outcome / Eval markers. Mirror of the real script.
-warn_missing_request_contract "$TASK"
+# Request Contract warning (P0-3): emit the non-fatal warning when the brief
+# is missing Goal / Expected Outcome / Eval markers.
+#
+# Run the PRODUCTION call line verbatim, with this mock's $TASK / $CONTEXT
+# bound. Hardcoding the arguments here would let a regression at the real
+# call site — dropping $CONTEXT, say — slip past every scenario below, which
+# is exactly how the earlier hand-copied version of this mock went blind.
+eval "$(grep -E '^warn_missing_request_contract "' "${REAL_SKILL_DIR}/execute.sh")"
 
 # Validate hierarchy
 if [ -n "$TEAM_ID" ] && [ -n "$TL_MEMBER_ID" ]; then
@@ -192,7 +203,7 @@ fi
 
 TASK_MESSAGE="New task from Team Leader (priority: ${PRIORITY}):\n\n${TASK}"
 [ -n "$CONTEXT" ] && TASK_MESSAGE="${TASK_MESSAGE}\n\nContext: ${CONTEXT}"
-TASK_MESSAGE="${TASK_MESSAGE}\n\nWhen done, report back using: bash ${CREWLY_ROOT}/config/skills/agent/core/report-status/execute.sh '{\"sessionName\":\"${TO}\",\"status\":\"done\",\"summary\":\"<brief summary>\"}'"
+TASK_MESSAGE="${TASK_MESSAGE}\n\nWhen done, report back with report-status, passing the workItemId from your [CREWLY-DISPATCH] notice: bash ${CREWLY_ROOT}/config/skills/agent/core/report-status/execute.sh '{\"sessionName\":\"${TO}\",\"workItemId\":\"<your WorkItem id>\",\"status\":\"done\",\"summary\":\"<brief summary>\"}'"
 
 BODY=$(jq -n --arg message "$TASK_MESSAGE" '{message: $message, waitForReady: true, waitTimeout: 15000}')
 api_call POST "/terminal/${TO}/deliver" "$BODY"
@@ -231,7 +242,7 @@ if [ "$MONITOR_IDLE" = "true" ] && [ -n "$RESOLVED_SESSION" ]; then
     --arg eventType "agent:idle" \
     --arg sessionName "$TO" \
     --arg subscriber "$RESOLVED_SESSION" \
-    '{eventType: $eventType, filter: {sessionName: $sessionName}, subscriberSession: $subscriber, oneShot: true, ttlMinutes: 120}')
+    '{eventType: $eventType, filter: {sessionName: $sessionName}, subscriberSession: $subscriber, oneShot: true}')
   SUB_RESULT=$(api_call POST "/events/subscribe" "$SUB_BODY" 2>/dev/null || true)
   SUB_ID=$(echo "$SUB_RESULT" | jq -r '.data.id // empty' 2>/dev/null || true)
   if [ -n "$SUB_ID" ]; then
@@ -510,7 +521,149 @@ else
   PASS=$((PASS + 1))
 fi
 
+# -----------------------------------------------------------------------
+# Scenario 15: Contract lives ENTIRELY in `context` — must NOT warn
+#
+# This is the reported bug. A delegator whose `task` is the one-line ask and
+# whose full Goal / Expected Outcome / Eval Criteria sit in `context` was
+# told the contract was "incomplete" even though every marker was present.
+# -----------------------------------------------------------------------
+echo "Scenario 15: full contract in context field only — no warning"
+CTX_FULL="**Goal:** Ship the importer. **Expected Outcome:** CSVs land in prod. **Eval Criteria:** all tests green."
+RAW_OUTPUT=$(env CREWLY_SESSION_NAME="sam-tl" bash "$MOCK_SCRIPT" "$SKILL_DIR" \
+  "{\"to\":\"crewly-product-leo-dev\",\"task\":\"build the importer\",\"context\":\"$CTX_FULL\"}" 2>&1)
+if echo "$RAW_OUTPUT" | grep -q "Request Contract incomplete"; then
+  echo "  FAIL: contract present in context was still reported incomplete: $RAW_OUTPUT"
+  FAIL=$((FAIL + 1))
+else
+  echo "  PASS: contract in context suppresses the warning"
+  PASS=$((PASS + 1))
+fi
+
+# -----------------------------------------------------------------------
+# Scenario 16: Contract SPLIT across task and context — must NOT warn
+# -----------------------------------------------------------------------
+echo "Scenario 16: contract split across task and context — no warning"
+RAW_OUTPUT=$(env CREWLY_SESSION_NAME="sam-tl" bash "$MOCK_SCRIPT" "$SKILL_DIR" \
+  '{"to":"crewly-product-leo-dev","task":"**Goal:** ship the importer","context":"**Expected Outcome:** CSVs land in prod. **Eval Criteria:** all tests green."}' 2>&1)
+if echo "$RAW_OUTPUT" | grep -q "Request Contract incomplete"; then
+  echo "  FAIL: split contract was reported incomplete: $RAW_OUTPUT"
+  FAIL=$((FAIL + 1))
+else
+  echo "  PASS: split contract suppresses the warning"
+  PASS=$((PASS + 1))
+fi
+
+# -----------------------------------------------------------------------
+# Scenario 17: Check is NOT weakened — a field absent from BOTH still warns
+# -----------------------------------------------------------------------
+echo "Scenario 17: field missing from both fields still warns (check not weakened)"
+RAW_OUTPUT=$(env CREWLY_SESSION_NAME="sam-tl" bash "$MOCK_SCRIPT" "$SKILL_DIR" \
+  '{"to":"crewly-product-leo-dev","task":"**Goal:** ship it","context":"**Expected Outcome:** it ships."}' 2>&1)
+if echo "$RAW_OUTPUT" | grep -q "Request Contract incomplete" && \
+   echo "$RAW_OUTPUT" | grep -q "Eval"; then
+  echo "  PASS: still warns for the one marker absent from both fields"
+  PASS=$((PASS + 1))
+else
+  echo "  FAIL: expected an Eval-missing warning, got: $RAW_OUTPUT"
+  FAIL=$((FAIL + 1))
+fi
+
+# -----------------------------------------------------------------------
+# Scenario 18: Nothing anywhere — all three still named
+# -----------------------------------------------------------------------
+echo "Scenario 18: empty contract in both fields names Goal+Outcome+Eval"
+RAW_OUTPUT=$(env CREWLY_SESSION_NAME="sam-tl" bash "$MOCK_SCRIPT" "$SKILL_DIR" \
+  '{"to":"crewly-product-leo-dev","task":"just do the thing","context":"here is some background prose"}' 2>&1)
+if echo "$RAW_OUTPUT" | grep -q "Request Contract incomplete" && \
+   echo "$RAW_OUTPUT" | grep -q "Goal" && \
+   echo "$RAW_OUTPUT" | grep -q "Outcome" && \
+   echo "$RAW_OUTPUT" | grep -q "Eval"; then
+  echo "  PASS: all three markers reported missing"
+  PASS=$((PASS + 1))
+else
+  echo "  FAIL: expected all three named, got: $RAW_OUTPUT"
+  FAIL=$((FAIL + 1))
+fi
+
+# -----------------------------------------------------------------------
+# Scenarios 19-22: direct unit tests against the REAL extracted function.
+#
+# These call warn_missing_request_contract() itself (sourced from
+# execute.sh at the top of this file), so they pin the two-argument
+# signature and the scan surface with no mock in between.
+# -----------------------------------------------------------------------
+echo "Scenario 19: function scans arg 2 (context) for markers"
+FN_OUT=$(warn_missing_request_contract "bare ask" \
+  "Goal: x. Expected Outcome: y. Eval Criteria: z." 2>&1 || true)
+if [ -z "$FN_OUT" ]; then
+  echo "  PASS: no warning when all markers are in the context argument"
+  PASS=$((PASS + 1))
+else
+  echo "  FAIL: expected silence, got: $FN_OUT"
+  FAIL=$((FAIL + 1))
+fi
+
+echo "Scenario 20: function still scans arg 1 (task) on its own"
+FN_OUT=$(warn_missing_request_contract \
+  "Goal: x. Expected Outcome: y. Eval Criteria: z." "" 2>&1 || true)
+if [ -z "$FN_OUT" ]; then
+  echo "  PASS: no warning when all markers are in the task argument"
+  PASS=$((PASS + 1))
+else
+  echo "  FAIL: expected silence, got: $FN_OUT"
+  FAIL=$((FAIL + 1))
+fi
+
+echo "Scenario 21: function warns when a marker is in neither argument"
+FN_OUT=$(warn_missing_request_contract "Goal: x." "Expected Outcome: y." 2>&1 || true)
+if echo "$FN_OUT" | grep -q "Request Contract incomplete" && echo "$FN_OUT" | grep -q "Eval"; then
+  echo "  PASS: names Eval as missing from both arguments"
+  PASS=$((PASS + 1))
+else
+  echo "  FAIL: expected Eval-missing warning, got: $FN_OUT"
+  FAIL=$((FAIL + 1))
+fi
+
+echo "Scenario 22: markers are not fabricated across the task/context seam"
+# "go" + "al: ..." must not join into "goal:" — the newline join prevents it.
+FN_OUT=$(warn_missing_request_contract "please go" \
+  "al: nothing here. Expected Outcome: y. Eval Criteria: z." 2>&1 || true)
+if echo "$FN_OUT" | grep -q "Goal"; then
+  echo "  PASS: seam does not fabricate a Goal marker"
+  PASS=$((PASS + 1))
+else
+  echo "  FAIL: 'go'+'al:' across the seam was accepted as a Goal marker: $FN_OUT"
+  FAIL=$((FAIL + 1))
+fi
+
+# -----------------------------------------------------------------------
+# Scenario 23: source-level guard on the production call site.
+#
+# The unit tests above cannot see which arguments execute.sh actually
+# passes. This asserts the call site itself, so reverting it to the
+# task-only form fails here even though the function stays correct.
+# -----------------------------------------------------------------------
+echo "Scenario 23: execute.sh calls the checker with BOTH task and context"
+SRC=$(cat "$SKILL_DIR/execute.sh")
+if printf '%s' "$SRC" | grep -q -- 'warn_missing_request_contract "$TASK" "$CONTEXT"'; then
+  echo "  PASS: call site passes \$TASK and \$CONTEXT"
+  PASS=$((PASS + 1))
+else
+  echo "  FAIL: execute.sh does not call warn_missing_request_contract with both fields"
+  FAIL=$((FAIL + 1))
+fi
+
+if printf '%s' "$SRC" | grep -qE '^warn_missing_request_contract "\$TASK"$'; then
+  echo "  FAIL: execute.sh still has a task-only call to the contract checker"
+  FAIL=$((FAIL + 1))
+else
+  echo "  PASS: no task-only call to the contract checker remains"
+  PASS=$((PASS + 1))
+fi
+
 # Cleanup
+rm -f "$REAL_FN_FILE"
 rm -rf "$MOCK_DIR"
 
 echo ""

package/config/slack-app-manifest.json

@@ -21,7 +21,13 @@
         "im:history",
         "mpim:history",
         "users:read",
-        "reactions:write"
+        "reactions:write",
+        "channels:read",
+        "channels:manage",
+        "channels:join",
+        "chat:write.customize",
+        "chat:write.public",
+        "im:write"
       ]
     }
   },

package/config/vitest-exclude.constants.ts

@@ -0,0 +1,56 @@
+/**
+ * Test-collection exclusion patterns for root-level vitest runs.
+ *
+ * The repository root has no vitest project of its own — the real vitest
+ * suites live in `frontend/` and `packages/chat-ui/`, each with their own
+ * config. A bare `npx vitest` at the root therefore falls back to vitest's
+ * built-in defaults, whose exclude list covers only `node_modules`, `dist`,
+ * `cypress` and a handful of dotfolders (`.idea`, `.git`, `.cache`,
+ * `.output`, `.temp`).
+ *
+ * `.claude/` is NOT in that list. It is agent scratch space and holds full
+ * git worktree copies of this repository, so a root-level run collects
+ * thousands of stale duplicate test files — files that belong to other
+ * agents' in-flight branches and are frequently written in jest syntax.
+ * Collecting them produces a wall of import errors that has nothing to do
+ * with the working tree under review.
+ *
+ * These patterns are kept here, rather than inline in `vitest.config.ts`,
+ * so the exclusion is a named, testable contract: `vitest-exclude.constants.test.ts`
+ * fails if the pattern is changed or the config stops applying it.
+ *
+ * @see vitest.config.ts — the sole consumer, which spreads these on top of
+ *      vitest's `defaultExclude` (never replacing it).
+ */
+
+/**
+ * Glob matching everything inside the `.claude/` agent scratch directory, at
+ * any depth. Covers `.claude/worktrees/<branch>/**` (full repo copies) and
+ * `.claude/agents/**`.
+ *
+ * Deliberately matches `**\/.claude/**` rather than `.claude/**` so that a
+ * nested checkout cannot smuggle the directory back into collection.
+ */
+export const AGENT_SCRATCH_EXCLUDE_PATTERN = '**/.claude/**';
+
+/**
+ * Exclusion globs applied to root-level vitest runs, on top of vitest's own
+ * `defaultExclude`.
+ *
+ * IMPORTANT: consumers must SPREAD vitest's `defaultExclude` alongside these.
+ * Assigning `test.exclude` replaces the built-in list outright, which would
+ * silently re-enable collection of `node_modules` and `dist`.
+ *
+ * @example
+ * ```typescript
+ * import { defineConfig, defaultExclude } from 'vitest/config';
+ * import { ROOT_VITEST_EXCLUDE_PATTERNS } from './config/vitest-exclude.constants.js';
+ *
+ * export default defineConfig({
+ *   test: { exclude: [...defaultExclude, ...ROOT_VITEST_EXCLUDE_PATTERNS] },
+ * });
+ * ```
+ */
+export const ROOT_VITEST_EXCLUDE_PATTERNS: readonly string[] = [
+  AGENT_SCRATCH_EXCLUDE_PATTERN,
+];

package/dist/backend/backend/src/config/oauth.config.d.ts

@@ -1,33 +1,107 @@
 /**
  * Google OAuth Configuration
  *
- * Shared constants for the Google OAuth flows that piggyback on the Gemini
- * CLI Workspace extension's published OAuth app. Defining these here lets
- * the REST controller (URL-builder) and the helper (refresh client) stay in
- * sync on client_id / redirect_uri / endpoints.
+ * Crewly can acquire Google Workspace credentials through either of two OAuth
+ * applications, and this module is the single place that decides which:
  *
- * These values come from the Gemini CLI Workspace extension's
- * `workspace-server/src/utils/config.ts` — using the same client_id
- * + redirect_uri lets us avoid the 7-day testing-mode grant expiry.
+ * - **crewly** — Crewly's own published OAuth app, brokered by Crewly Cloud.
+ *   The authorization code lands on a Crewly-owned HTTPS redirect and Cloud
+ *   exchanges it, so the client_secret lives only on the server and never
+ *   ships with OSS. Selected by setting {@link CREWLY_GOOGLE_CLIENT_ID_ENV}.
+ *
+ * - **gemini-cli** — the fallback, and what every install used before Crewly
+ *   had its own app: piggybacking on the Google Workspace extension for Gemini
+ *   CLI (https://github.com/gemini-cli-extensions/workspace). Borrowing a
+ *   published app avoided both the 7-day testing-mode grant expiry and the
+ *   need to hold a client_secret, at the cost of depending on someone else's
+ *   OAuth app and refresh function.
+ *
+ * The fallback is deliberate, not vestigial: an install that has not been
+ * pointed at Crewly's app keeps working exactly as before, and a self-hoster
+ * who wants to depend on neither can point these variables at a GCP project
+ * of their own.
  *
  * @module config/oauth.config
  */
-/** OAuth client_id for the Gemini CLI Workspace extension's published app. */
-export declare const GOOGLE_OAUTH_CLIENT_ID = "338689075775-o75k922vn5fdl18qergr96rp8g63e4d7.apps.googleusercontent.com";
-/** Redirect URI the Gemini CLI Workspace cloud function is registered for. */
-export declare const GOOGLE_OAUTH_REDIRECT_URI = "https://google-workspace-extension.geminicli.com";
+/** Env var that, when set, switches the Workspace flow to Crewly's own app. */
+export declare const CREWLY_GOOGLE_CLIENT_ID_ENV = "CREWLY_GOOGLE_CLIENT_ID";
+/** Env var overriding where Google sends the authorization code. */
+export declare const CREWLY_GOOGLE_REDIRECT_URI_ENV = "CREWLY_GOOGLE_REDIRECT_URI";
+/** Env var overriding the endpoint that exchanges a refresh token. */
+export declare const CREWLY_GOOGLE_REFRESH_URL_ENV = "CREWLY_GOOGLE_REFRESH_URL";
 /** Base URL of Google's OAuth 2.0 authorization endpoint. */
 export declare const GOOGLE_OAUTH_AUTH_BASE = "https://accounts.google.com/o/oauth2/v2/auth";
-/** Cloud Function base URL where the extension's `/refreshToken` lives. */
-export declare const GEMINI_CLI_CLOUD_FUNCTION_URL = "https://google-workspace-extension.geminicli.com";
-/** Path on the cloud function used for token refresh calls. */
-export declare const GEMINI_CLI_REFRESH_PATH = "/refreshToken";
 /** Google's userinfo endpoint — used to resolve an OAuth token's account email. */
 export declare const GOOGLE_USERINFO_ENDPOINT = "https://www.googleapis.com/oauth2/v3/userinfo";
+/** Path on the Gemini CLI cloud function used for token refresh calls. */
+export declare const GEMINI_CLI_REFRESH_PATH = "/refreshToken";
+/** Cloud Function base URL where the Gemini CLI extension's `/refreshToken` lives. */
+export declare const GEMINI_CLI_CLOUD_FUNCTION_URL = "https://google-workspace-extension.geminicli.com";
+/** Which OAuth application a Workspace credential was (or will be) issued by. */
+export type GoogleOAuthProvider = 'crewly' | 'gemini-cli';
+/** Everything the authorize/refresh paths need to talk to one OAuth app. */
+export interface GoogleOAuthApp {
+    /** Which application this is. */
+    provider: GoogleOAuthProvider;
+    /** OAuth client_id presented on the consent URL. */
+    clientId: string;
+    /** Where Google sends the authorization code. */
+    redirectUri: string;
+    /**
+     * Endpoint that trades a refresh_token for a fresh access_token.
+     *
+     * Neither provider needs a client_secret on this side: 'crewly' posts to
+     * Crewly Cloud, which holds the secret; 'gemini-cli' posts to the
+     * extension's cloud function, which holds theirs.
+     */
+    refreshUrl: string;
+    /** Scopes requested when the caller does not specify their own. */
+    defaultScopes: readonly string[];
+}
 /**
- * Default scope set for a broad Workspace grant — covers the common Gmail,
- * Drive, Docs, Calendar, and Photos read paths used by marketplace skills.
- * Callers of `/oauth/google/start` may override via the request body.
+ * Scopes registered on Crewly's own OAuth consent screen (GCP project
+ * `crewlyai`, registered 2026-09-07).
+ *
+ * Requesting a scope the consent screen does not declare fails, so this list
+ * and the console must move together. `photoslibrary.readonly` is absent on
+ * purpose — the Photos Library API is not enabled on the project, and it is a
+ * restricted scope that would widen the eventual CASA assessment for a feature
+ * nothing asks for yet.
+ */
+export declare const CREWLY_GOOGLE_SCOPES: readonly string[];
+/**
+ * Scopes the Gemini CLI Workspace extension's consent screen declares.
+ *
+ * Kept as-is, including `photoslibrary.readonly`, because these grants were
+ * issued against their app: narrowing the list would silently drop an
+ * already-working capability for installs still on the fallback.
+ */
+export declare const GEMINI_CLI_GOOGLE_SCOPES: readonly string[];
+/** The borrowed Gemini CLI Workspace extension app. */
+export declare const GEMINI_CLI_OAUTH_APP: GoogleOAuthApp;
+/**
+ * Resolve the OAuth app this install should use.
+ *
+ * Reads the environment on every call rather than at import time so that a
+ * process which loads its `.env` after module resolution — and a test that
+ * sets a variable per case — both see the value they set.
+ *
+ * @returns The active app; {@link GEMINI_CLI_OAUTH_APP} when Crewly's own
+ *   client_id is not configured.
+ *
+ * @example
+ * ```ts
+ * const app = resolveGoogleOAuthApp();
+ * if (app.provider === 'crewly') { ... }
+ * ```
  */
-export declare const DEFAULT_GOOGLE_SCOPES: readonly string[];
+export declare function resolveGoogleOAuthApp(): GoogleOAuthApp;
+/** client_id of the active OAuth app. */
+export declare function googleOAuthClientId(): string;
+/** Redirect URI of the active OAuth app. */
+export declare function googleOAuthRedirectUri(): string;
+/** Refresh endpoint of the active OAuth app. */
+export declare function googleOAuthRefreshUrl(): string;
+/** Default scopes of the active OAuth app. */
+export declare function defaultGoogleScopes(): readonly string[];
 //# sourceMappingURL=oauth.config.d.ts.map

package/dist/backend/backend/src/config/oauth.config.d.ts.map

@@ -1 +1 @@
-{"version":3,"file":"oauth.config.d.ts","sourceRoot":"","sources":["../../../../../backend/src/config/oauth.config.ts"],"names":[],"mappings":"AAAA;;;;;;;;;;;;;GAaG;AAEH,8EAA8E;AAC9E,eAAO,MAAM,sBAAsB,6EACyC,CAAC;AAE7E,8EAA8E;AAC9E,eAAO,MAAM,yBAAyB,qDACc,CAAC;AAErD,6DAA6D;AAC7D,eAAO,MAAM,sBAAsB,iDACa,CAAC;AAEjD,2EAA2E;AAC3E,eAAO,MAAM,6BAA6B,qDACU,CAAC;AAErD,+DAA+D;AAC/D,eAAO,MAAM,uBAAuB,kBAAkB,CAAC;AAEvD,mFAAmF;AACnF,eAAO,MAAM,wBAAwB,kDACY,CAAC;AAElD;;;;GAIG;AACH,eAAO,MAAM,qBAAqB,EAAE,SAAS,MAAM,EAYlD,CAAC"}
+{"version":3,"file":"oauth.config.d.ts","sourceRoot":"","sources":["../../../../../backend/src/config/oauth.config.ts"],"names":[],"mappings":"AAAA;;;;;;;;;;;;;;;;;;;;;;;;GAwBG;AAMH,+EAA+E;AAC/E,eAAO,MAAM,2BAA2B,4BAA4B,CAAC;AAErE,oEAAoE;AACpE,eAAO,MAAM,8BAA8B,+BAA+B,CAAC;AAE3E,sEAAsE;AACtE,eAAO,MAAM,6BAA6B,8BAA8B,CAAC;AAMzE,6DAA6D;AAC7D,eAAO,MAAM,sBAAsB,iDACa,CAAC;AAEjD,mFAAmF;AACnF,eAAO,MAAM,wBAAwB,kDACY,CAAC;AAElD,0EAA0E;AAC1E,eAAO,MAAM,uBAAuB,kBAAkB,CAAC;AAEvD,sFAAsF;AACtF,eAAO,MAAM,6BAA6B,qDACU,CAAC;AASrD,iFAAiF;AACjF,MAAM,MAAM,mBAAmB,GAAG,QAAQ,GAAG,YAAY,CAAC;AAE1D,4EAA4E;AAC5E,MAAM,WAAW,cAAc;IAC7B,iCAAiC;IACjC,QAAQ,EAAE,mBAAmB,CAAC;IAC9B,oDAAoD;IACpD,QAAQ,EAAE,MAAM,CAAC;IACjB,iDAAiD;IACjD,WAAW,EAAE,MAAM,CAAC;IACpB;;;;;;OAMG;IACH,UAAU,EAAE,MAAM,CAAC;IACnB,mEAAmE;IACnE,aAAa,EAAE,SAAS,MAAM,EAAE,CAAC;CAClC;AAED;;;;;;;;;GASG;AACH,eAAO,MAAM,oBAAoB,EAAE,SAAS,MAAM,EAWjD,CAAC;AAEF;;;;;;GAMG;AACH,eAAO,MAAM,wBAAwB,EAAE,SAAS,MAAM,EAGrD,CAAC;AAEF,uDAAuD;AACvD,eAAO,MAAM,oBAAoB,EAAE,cAOlC,CAAC;AAaF;;;;;;;;;;;;;;;GAeG;AACH,wBAAgB,qBAAqB,IAAI,cAAc,CAetD;AAMD,yCAAyC;AACzC,wBAAgB,mBAAmB,IAAI,MAAM,CAE5C;AAED,4CAA4C;AAC5C,wBAAgB,sBAAsB,IAAI,MAAM,CAE/C;AAED,gDAAgD;AAChD,wBAAgB,qBAAqB,IAAI,MAAM,CAE9C;AAED,8CAA8C;AAC9C,wBAAgB,mBAAmB,IAAI,SAAS,MAAM,EAAE,CAEvD"}

package/dist/backend/backend/src/config/oauth.config.js

@@ -1,35 +1,61 @@
 /**
  * Google OAuth Configuration
  *
- * Shared constants for the Google OAuth flows that piggyback on the Gemini
- * CLI Workspace extension's published OAuth app. Defining these here lets
- * the REST controller (URL-builder) and the helper (refresh client) stay in
- * sync on client_id / redirect_uri / endpoints.
+ * Crewly can acquire Google Workspace credentials through either of two OAuth
+ * applications, and this module is the single place that decides which:
  *
- * These values come from the Gemini CLI Workspace extension's
- * `workspace-server/src/utils/config.ts` — using the same client_id
- * + redirect_uri lets us avoid the 7-day testing-mode grant expiry.
+ * - **crewly** — Crewly's own published OAuth app, brokered by Crewly Cloud.
+ *   The authorization code lands on a Crewly-owned HTTPS redirect and Cloud
+ *   exchanges it, so the client_secret lives only on the server and never
+ *   ships with OSS. Selected by setting {@link CREWLY_GOOGLE_CLIENT_ID_ENV}.
+ *
+ * - **gemini-cli** — the fallback, and what every install used before Crewly
+ *   had its own app: piggybacking on the Google Workspace extension for Gemini
+ *   CLI (https://github.com/gemini-cli-extensions/workspace). Borrowing a
+ *   published app avoided both the 7-day testing-mode grant expiry and the
+ *   need to hold a client_secret, at the cost of depending on someone else's
+ *   OAuth app and refresh function.
+ *
+ * The fallback is deliberate, not vestigial: an install that has not been
+ * pointed at Crewly's app keeps working exactly as before, and a self-hoster
+ * who wants to depend on neither can point these variables at a GCP project
+ * of their own.
  *
  * @module config/oauth.config
  */
-/** OAuth client_id for the Gemini CLI Workspace extension's published app. */
-export const GOOGLE_OAUTH_CLIENT_ID = '338689075775-o75k922vn5fdl18qergr96rp8g63e4d7.apps.googleusercontent.com';
-/** Redirect URI the Gemini CLI Workspace cloud function is registered for. */
-export const GOOGLE_OAUTH_REDIRECT_URI = 'https://google-workspace-extension.geminicli.com';
+// ---------------------------------------------------------------------------
+// Environment variable names
+// ---------------------------------------------------------------------------
+/** Env var that, when set, switches the Workspace flow to Crewly's own app. */
+export const CREWLY_GOOGLE_CLIENT_ID_ENV = 'CREWLY_GOOGLE_CLIENT_ID';
+/** Env var overriding where Google sends the authorization code. */
+export const CREWLY_GOOGLE_REDIRECT_URI_ENV = 'CREWLY_GOOGLE_REDIRECT_URI';
+/** Env var overriding the endpoint that exchanges a refresh token. */
+export const CREWLY_GOOGLE_REFRESH_URL_ENV = 'CREWLY_GOOGLE_REFRESH_URL';
+// ---------------------------------------------------------------------------
+// Static endpoints
+// ---------------------------------------------------------------------------
 /** Base URL of Google's OAuth 2.0 authorization endpoint. */
 export const GOOGLE_OAUTH_AUTH_BASE = 'https://accounts.google.com/o/oauth2/v2/auth';
-/** Cloud Function base URL where the extension's `/refreshToken` lives. */
-export const GEMINI_CLI_CLOUD_FUNCTION_URL = 'https://google-workspace-extension.geminicli.com';
-/** Path on the cloud function used for token refresh calls. */
-export const GEMINI_CLI_REFRESH_PATH = '/refreshToken';
 /** Google's userinfo endpoint — used to resolve an OAuth token's account email. */
 export const GOOGLE_USERINFO_ENDPOINT = 'https://www.googleapis.com/oauth2/v3/userinfo';
+/** Path on the Gemini CLI cloud function used for token refresh calls. */
+export const GEMINI_CLI_REFRESH_PATH = '/refreshToken';
+/** Cloud Function base URL where the Gemini CLI extension's `/refreshToken` lives. */
+export const GEMINI_CLI_CLOUD_FUNCTION_URL = 'https://google-workspace-extension.geminicli.com';
+/** Default Crewly Cloud origin, used to derive the Crewly redirect/refresh URLs. */
+const CREWLY_CLOUD_ORIGIN = 'https://api.crewlyai.com';
 /**
- * Default scope set for a broad Workspace grant — covers the common Gmail,
- * Drive, Docs, Calendar, and Photos read paths used by marketplace skills.
- * Callers of `/oauth/google/start` may override via the request body.
+ * Scopes registered on Crewly's own OAuth consent screen (GCP project
+ * `crewlyai`, registered 2026-09-07).
+ *
+ * Requesting a scope the consent screen does not declare fails, so this list
+ * and the console must move together. `photoslibrary.readonly` is absent on
+ * purpose — the Photos Library API is not enabled on the project, and it is a
+ * restricted scope that would widen the eventual CASA assessment for a feature
+ * nothing asks for yet.
  */
-export const DEFAULT_GOOGLE_SCOPES = [
+export const CREWLY_GOOGLE_SCOPES = [
     'openid',
     'https://www.googleapis.com/auth/userinfo.email',
     'https://www.googleapis.com/auth/userinfo.profile',
@@ -40,6 +66,82 @@ export const DEFAULT_GOOGLE_SCOPES = [
     'https://www.googleapis.com/auth/documents.readonly',
     'https://www.googleapis.com/auth/calendar.readonly',
     'https://www.googleapis.com/auth/calendar.events',
+];
+/**
+ * Scopes the Gemini CLI Workspace extension's consent screen declares.
+ *
+ * Kept as-is, including `photoslibrary.readonly`, because these grants were
+ * issued against their app: narrowing the list would silently drop an
+ * already-working capability for installs still on the fallback.
+ */
+export const GEMINI_CLI_GOOGLE_SCOPES = [
+    ...CREWLY_GOOGLE_SCOPES,
     'https://www.googleapis.com/auth/photoslibrary.readonly',
 ];
+/** The borrowed Gemini CLI Workspace extension app. */
+export const GEMINI_CLI_OAUTH_APP = {
+    provider: 'gemini-cli',
+    clientId: '338689075775-o75k922vn5fdl18qergr96rp8g63e4d7.apps.googleusercontent.com',
+    redirectUri: GEMINI_CLI_CLOUD_FUNCTION_URL,
+    refreshUrl: `${GEMINI_CLI_CLOUD_FUNCTION_URL}${GEMINI_CLI_REFRESH_PATH}`,
+    defaultScopes: GEMINI_CLI_GOOGLE_SCOPES,
+};
+// ---------------------------------------------------------------------------
+// Resolution
+// ---------------------------------------------------------------------------
+/** Read an env var, treating whitespace-only as unset. */
+function envValue(name) {
+    const raw = process.env[name];
+    const trimmed = raw?.trim();
+    return trimmed ? trimmed : undefined;
+}
+/**
+ * Resolve the OAuth app this install should use.
+ *
+ * Reads the environment on every call rather than at import time so that a
+ * process which loads its `.env` after module resolution — and a test that
+ * sets a variable per case — both see the value they set.
+ *
+ * @returns The active app; {@link GEMINI_CLI_OAUTH_APP} when Crewly's own
+ *   client_id is not configured.
+ *
+ * @example
+ * ```ts
+ * const app = resolveGoogleOAuthApp();
+ * if (app.provider === 'crewly') { ... }
+ * ```
+ */
+export function resolveGoogleOAuthApp() {
+    const clientId = envValue(CREWLY_GOOGLE_CLIENT_ID_ENV);
+    if (!clientId)
+        return GEMINI_CLI_OAUTH_APP;
+    return {
+        provider: 'crewly',
+        clientId,
+        redirectUri: envValue(CREWLY_GOOGLE_REDIRECT_URI_ENV) ??
+            `${CREWLY_CLOUD_ORIGIN}/api/cloud/google/workspace/callback`,
+        refreshUrl: envValue(CREWLY_GOOGLE_REFRESH_URL_ENV) ??
+            `${CREWLY_CLOUD_ORIGIN}/api/cloud/google/workspace/refresh`,
+        defaultScopes: CREWLY_GOOGLE_SCOPES,
+    };
+}
+// ---------------------------------------------------------------------------
+// Back-compatible accessors
+// ---------------------------------------------------------------------------
+/** client_id of the active OAuth app. */
+export function googleOAuthClientId() {
+    return resolveGoogleOAuthApp().clientId;
+}
+/** Redirect URI of the active OAuth app. */
+export function googleOAuthRedirectUri() {
+    return resolveGoogleOAuthApp().redirectUri;
+}
+/** Refresh endpoint of the active OAuth app. */
+export function googleOAuthRefreshUrl() {
+    return resolveGoogleOAuthApp().refreshUrl;
+}
+/** Default scopes of the active OAuth app. */
+export function defaultGoogleScopes() {
+    return resolveGoogleOAuthApp().defaultScopes;
+}
 //# sourceMappingURL=oauth.config.js.map

package/dist/backend/backend/src/config/oauth.config.js.map

@@ -1 +1 @@
-{"version":3,"file":"oauth.config.js","sourceRoot":"","sources":["../../../../../backend/src/config/oauth.config.ts"],"names":[],"mappings":"AAAA;;;;;;;;;;;;;GAaG;AAEH,8EAA8E;AAC9E,MAAM,CAAC,MAAM,sBAAsB,GACjC,0EAA0E,CAAC;AAE7E,8EAA8E;AAC9E,MAAM,CAAC,MAAM,yBAAyB,GACpC,kDAAkD,CAAC;AAErD,6DAA6D;AAC7D,MAAM,CAAC,MAAM,sBAAsB,GACjC,8CAA8C,CAAC;AAEjD,2EAA2E;AAC3E,MAAM,CAAC,MAAM,6BAA6B,GACxC,kDAAkD,CAAC;AAErD,+DAA+D;AAC/D,MAAM,CAAC,MAAM,uBAAuB,GAAG,eAAe,CAAC;AAEvD,mFAAmF;AACnF,MAAM,CAAC,MAAM,wBAAwB,GACnC,+CAA+C,CAAC;AAElD;;;;GAIG;AACH,MAAM,CAAC,MAAM,qBAAqB,GAAsB;IACtD,QAAQ;IACR,gDAAgD;IAChD,kDAAkD;IAClD,gDAAgD;IAChD,4CAA4C;IAC5C,gDAAgD;IAChD,4CAA4C;IAC5C,oDAAoD;IACpD,mDAAmD;IACnD,iDAAiD;IACjD,wDAAwD;CACzD,CAAC"}
+{"version":3,"file":"oauth.config.js","sourceRoot":"","sources":["../../../../../backend/src/config/oauth.config.ts"],"names":[],"mappings":"AAAA;;;;;;;;;;;;;;;;;;;;;;;;GAwBG;AAEH,8EAA8E;AAC9E,6BAA6B;AAC7B,8EAA8E;AAE9E,+EAA+E;AAC/E,MAAM,CAAC,MAAM,2BAA2B,GAAG,yBAAyB,CAAC;AAErE,oEAAoE;AACpE,MAAM,CAAC,MAAM,8BAA8B,GAAG,4BAA4B,CAAC;AAE3E,sEAAsE;AACtE,MAAM,CAAC,MAAM,6BAA6B,GAAG,2BAA2B,CAAC;AAEzE,8EAA8E;AAC9E,mBAAmB;AACnB,8EAA8E;AAE9E,6DAA6D;AAC7D,MAAM,CAAC,MAAM,sBAAsB,GACjC,8CAA8C,CAAC;AAEjD,mFAAmF;AACnF,MAAM,CAAC,MAAM,wBAAwB,GACnC,+CAA+C,CAAC;AAElD,0EAA0E;AAC1E,MAAM,CAAC,MAAM,uBAAuB,GAAG,eAAe,CAAC;AAEvD,sFAAsF;AACtF,MAAM,CAAC,MAAM,6BAA6B,GACxC,kDAAkD,CAAC;AAErD,oFAAoF;AACpF,MAAM,mBAAmB,GAAG,0BAA0B,CAAC;AA6BvD;;;;;;;;;GASG;AACH,MAAM,CAAC,MAAM,oBAAoB,GAAsB;IACrD,QAAQ;IACR,gDAAgD;IAChD,kDAAkD;IAClD,gDAAgD;IAChD,4CAA4C;IAC5C,gDAAgD;IAChD,4CAA4C;IAC5C,oDAAoD;IACpD,mDAAmD;IACnD,iDAAiD;CAClD,CAAC;AAEF;;;;;;GAMG;AACH,MAAM,CAAC,MAAM,wBAAwB,GAAsB;IACzD,GAAG,oBAAoB;IACvB,wDAAwD;CACzD,CAAC;AAEF,uDAAuD;AACvD,MAAM,CAAC,MAAM,oBAAoB,GAAmB;IAClD,QAAQ,EAAE,YAAY;IACtB,QAAQ,EACN,0EAA0E;IAC5E,WAAW,EAAE,6BAA6B;IAC1C,UAAU,EAAE,GAAG,6BAA6B,GAAG,uBAAuB,EAAE;IACxE,aAAa,EAAE,wBAAwB;CACxC,CAAC;AAEF,8EAA8E;AAC9E,aAAa;AACb,8EAA8E;AAE9E,0DAA0D;AAC1D,SAAS,QAAQ,CAAC,IAAY;IAC5B,MAAM,GAAG,GAAG,OAAO,CAAC,GAAG,CAAC,IAAI,CAAC,CAAC;IAC9B,MAAM,OAAO,GAAG,GAAG,EAAE,IAAI,EAAE,CAAC;IAC5B,OAAO,OAAO,CAAC,CAAC,CAAC,OAAO,CAAC,CAAC,CAAC,SAAS,CAAC;AACvC,CAAC;AAED;;;;;;;;;;;;;;;GAeG;AACH,MAAM,UAAU,qBAAqB;IACnC,MAAM,QAAQ,GAAG,QAAQ,CAAC,2BAA2B,CAAC,CAAC;IACvD,IAAI,CAAC,QAAQ;QAAE,OAAO,oBAAoB,CAAC;IAE3C,OAAO;QACL,QAAQ,EAAE,QAAQ;QAClB,QAAQ;QACR,WAAW,EACT,QAAQ,CAAC,8BAA8B,CAAC;YACxC,GAAG,mBAAmB,sCAAsC;QAC9D,UAAU,EACR,QAAQ,CAAC,6BAA6B,CAAC;YACvC,GAAG,mBAAmB,qCAAqC;QAC7D,aAAa,EAAE,oBAAoB;KACpC,CAAC;AACJ,CAAC;AAED,8EAA8E;AAC9E,4BAA4B;AAC5B,8EAA8E;AAE9E,yCAAyC;AACzC,MAAM,UAAU,mBAAmB;IACjC,OAAO,qBAAqB,EAAE,CAAC,QAAQ,CAAC;AAC1C,CAAC;AAED,4CAA4C;AAC5C,MAAM,UAAU,sBAAsB;IACpC,OAAO,qBAAqB,EAAE,CAAC,WAAW,CAAC;AAC7C,CAAC;AAED,gDAAgD;AAChD,MAAM,UAAU,qBAAqB;IACnC,OAAO,qBAAqB,EAAE,CAAC,UAAU,CAAC;AAC5C,CAAC;AAED,8CAA8C;AAC9C,MAAM,UAAU,mBAAmB;IACjC,OAAO,qBAAqB,EAAE,CAAC,aAAa,CAAC;AAC/C,CAAC"}