tide-commander 1.165.1 → 1.167.0

package/dist/src/packages/server/data/builtin-skills/mermaid-diagrams.js

@@ -0,0 +1,76 @@
+export const mermaidDiagrams = {
+    slug: 'mermaid-diagrams',
+    name: 'Mermaid Diagrams',
+    description: 'Use whenever a picture communicates faster than prose — architecture, control/data flow, sequence of calls, state machine, data model, or timeline. Output a ```mermaid fenced block and Tide Commander renders it as a diagram inline in the chat.',
+    // Output-only skill: no tools needed, it changes HOW you present, not what you can do.
+    allowedTools: [],
+    // Available to every agent by default.
+    assignedAgentClasses: ['*'],
+    content: `# Mermaid Diagrams
+
+Tide Commander renders **Mermaid** diagrams inline in the chat UI. When a visual would
+land faster than a paragraph, emit a fenced \`mermaid\` code block — it shows up as a
+rendered diagram, no tool call required.
+
+## When to reach for a diagram
+- Multi-step flow / control flow / algorithm → **flowchart**
+- Interactions or calls between services, agents, or components over time → **sequenceDiagram**
+- Entities and their relationships (DB schema, domain model) → **erDiagram**
+- States and transitions → **stateDiagram-v2**
+- Project phases / schedule → **gantt**
+- Class or module structure → **classDiagram**
+
+Skip it when a single sentence already does the job — don't diagram the trivial.
+
+## How
+Put valid Mermaid inside a fenced block tagged \`mermaid\`:
+
+\`\`\`mermaid
+flowchart TD
+  A[User request] --> B{Cached?}
+  B -- yes --> C[Serve from cache]
+  B -- no --> D[Query DB] --> E[Cache result] --> C
+\`\`\`
+
+If the syntax is invalid (or still streaming), the UI safely falls back to showing the
+raw source instead of breaking — so only ship diagrams whose syntax you're confident is valid.
+
+## More examples
+
+Sequence of calls:
+\`\`\`mermaid
+sequenceDiagram
+  participant U as User
+  participant API
+  participant DB
+  U->>API: POST /order
+  API->>DB: INSERT order
+  DB-->>API: ok (id=42)
+  API-->>U: 201 Created
+\`\`\`
+
+Data model:
+\`\`\`mermaid
+erDiagram
+  CUSTOMER ||--o{ ORDER : places
+  ORDER ||--|{ LINE_ITEM : contains
+  PRODUCT ||--o{ LINE_ITEM : "referenced by"
+\`\`\`
+
+State machine:
+\`\`\`mermaid
+stateDiagram-v2
+  [*] --> Idle
+  Idle --> Working: assign task
+  Working --> Idle: done
+  Working --> Error: fail
+  Error --> Idle: retry
+\`\`\`
+
+## Tips
+- Keep node/participant labels short; long text overflows — wrap or abbreviate.
+- One diagram per fenced block.
+- Special characters in labels (\`(\`, \`:\`, \`#\`, \`"\`) often need quoting — Mermaid is picky.
+- Prefer the modern \`flowchart\` keyword over the legacy \`graph\`.
+- Mentally validate the syntax before sending; a broken diagram just renders as code.`,
+};

package/dist/src/packages/server/integrations/gmail/gmail-client.js

@@ -4,6 +4,7 @@
  */
 import { google } from 'googleapis';
 import * as fs from 'fs';
+import { getTokenHealth, needsReauth, notifyTokenRotated, onTokenRotated, probeTokenHealth, reportGoogleApiError, reportGoogleApiSuccess, startTokenHealthMonitor, } from '../google-auth/token-health.js';
 // Gmail API scopes
 const SCOPES = [
     'https://www.googleapis.com/auth/gmail.send',
@@ -28,6 +29,40 @@ let lastPollAt;
 let lastError;
 let messageCallbacks = [];
 let lastHistoryId;
+// ─── OAuth client ───
+/**
+ * True when Gmail authenticates with the shared `GOOGLE_REFRESH_TOKEN` rather than a
+ * service account. Token health is a fact about that refresh token only — in
+ * service-account mode Gmail rides a JWT that a dead refresh token says nothing about,
+ * so every token-health branch below is gated on this.
+ */
+function usingOAuth() {
+    return (config.authMethod || 'oauth2') !== 'service_account';
+}
+/**
+ * Build an OAuth2 client whose every outbound call updates shared token health.
+ *
+ * Every Gmail call made with `auth: oauth2Client` funnels through this one `request()`
+ * method, so wrapping it here means a revoked token is detected the moment polling or
+ * an agent actually touches Gmail — no waiting for the next background probe — without
+ * instrumenting each API call site.
+ */
+function createOAuthClient(clientId, clientSecret, redirectUri) {
+    const client = new google.auth.OAuth2(clientId, clientSecret, redirectUri);
+    const originalRequest = client.request.bind(client);
+    client.request = (async (opts) => {
+        try {
+            const result = await originalRequest(opts);
+            reportGoogleApiSuccess();
+            return result;
+        }
+        catch (err) {
+            reportGoogleApiError(err);
+            throw err;
+        }
+    });
+    return client;
+}
 // ─── Lifecycle ───
 export async function init(context) {
     ctx = context;
@@ -71,12 +106,19 @@ export async function init(context) {
             ctx.log.info('Gmail not configured (missing OAuth credentials)');
             return;
         }
-        oauth2Client = new google.auth.OAuth2(config.clientId, config.clientSecret, getRedirectUri());
+        oauth2Client = createOAuthClient(config.clientId, config.clientSecret, getRedirectUri());
         // Load refresh token from secrets
         const refreshToken = ctx.secrets.get('GOOGLE_REFRESH_TOKEN') || config.refreshToken;
         if (refreshToken) {
             oauth2Client.setCredentials({ refresh_token: refreshToken });
             gmail = google.gmail({ version: 'v1', auth: oauth2Client });
+            // Holding the token string proves nothing — it may be revoked. Probe Google (and
+            // keep probing) so an expired token is reflected in getStatus(). The monitor is
+            // shared with Drive/Calendar: one timer, one verdict for the one refresh token.
+            startTokenHealthMonitor(ctx);
+            // Re-read the shared refresh token if the user re-consents via Drive or Calendar,
+            // otherwise this client keeps using the token it was seeded with here.
+            onTokenRotated('gmail', () => init(context));
             try {
                 const profile = await gmail.users.getProfile({ userId: 'me' });
                 authenticatedEmail = profile.data.emailAddress ?? undefined;
@@ -160,16 +202,35 @@ export function shutdown() {
 export function getStatus() {
     const oauthConfigured = Boolean(config.clientId && config.clientSecret);
     const serviceAccountConfigured = Boolean(config.serviceAccountJson && config.impersonateEmail);
+    // Token health only speaks for the OAuth path. Having a live `gmail` handle is
+    // necessary but not sufficient there: a revoked refresh token still builds a handle
+    // just fine. Only trust it when Google's last verdict wasn't a rejection —
+    // 'unreachable' (offline host) is deliberately NOT a rejection, so needsReauth()
+    // leaves us connected rather than pushing a pointless re-consent.
+    const oauthActive = usingOAuth() && oauthConfigured;
+    const health = getTokenHealth();
+    const reauth = oauthActive && needsReauth(health);
+    const live = Boolean(gmail && authenticatedEmail);
     return {
         configured: oauthConfigured || serviceAccountConfigured,
-        authenticated: Boolean(gmail && authenticatedEmail),
+        authenticated: live && !reauth,
         emailAddress: authenticatedEmail,
         pollingActive: pollingTimer !== null,
-        connected: Boolean(gmail && authenticatedEmail),
+        connected: live && !reauth,
         lastChecked: lastPollAt || Date.now(),
-        error: lastError,
+        error: (oauthActive ? health.error : undefined) ?? lastError,
+        needsReauth: reauth,
+        tokenState: oauthActive ? health.state : undefined,
     };
 }
+/** Force a live refresh_token exchange against Google and return the updated status. */
+export async function probeToken() {
+    // Service-account mode doesn't use GOOGLE_REFRESH_TOKEN — probing would report on a
+    // token Gmail never touches, so skip straight to the (unaffected) status.
+    if (ctx && usingOAuth())
+        await probeTokenHealth(ctx, { force: true });
+    return getStatus();
+}
 export function isConfigured() {
     const oauthConfigured = Boolean(config.clientId && config.clientSecret);
     const serviceAccountConfigured = Boolean(config.serviceAccountJson && config.impersonateEmail);
@@ -181,7 +242,7 @@ export function getAuthUrl() {
         if (!config.clientId || !config.clientSecret || !ctx) {
             throw new Error('Gmail OAuth not configured');
         }
-        oauth2Client = new google.auth.OAuth2(config.clientId, config.clientSecret, getRedirectUri());
+        oauth2Client = createOAuthClient(config.clientId, config.clientSecret, getRedirectUri());
     }
     return oauth2Client.generateAuthUrl({
         access_type: 'offline',
@@ -194,15 +255,22 @@ export async function handleAuthCallback(code) {
         throw new Error('Gmail OAuth not initialized');
     const { tokens } = await oauth2Client.getToken(code);
     oauth2Client.setCredentials(tokens);
+    let rotated = false;
     if (tokens.refresh_token) {
         ctx.secrets.set('GOOGLE_REFRESH_TOKEN', tokens.refresh_token);
         config.refreshToken = tokens.refresh_token;
+        rotated = true;
     }
     gmail = google.gmail({ version: 'v1', auth: oauth2Client });
     const profile = await gmail.users.getProfile({ userId: 'me' });
     authenticatedEmail = profile.data.emailAddress ?? undefined;
     lastHistoryId = profile.data.historyId ?? undefined;
     lastError = undefined;
+    // Fresh consent just produced this token. Clears the 'expired' verdict AND re-arms
+    // Drive and Calendar, whose clients still hold the old refresh token — all three
+    // share this one secret, so one consent must repair all three.
+    if (rotated)
+        await notifyTokenRotated();
     ctx.log.info(`Gmail OAuth complete. Authenticated as ${authenticatedEmail}`);
 }
 // ─── Sending ───

package/dist/src/packages/server/integrations/gmail/gmail-routes.js

@@ -126,10 +126,15 @@ router.post('/check-approvals', async (req, res) => {
         res.status(500).json({ error: `Failed to check approvals: ${err instanceof Error ? err.message : err}` });
     }
 });
-// GET /api/email/status — Get Gmail status
-router.get('/status', (req, res) => {
-    const status = gmailClient.getStatus();
-    res.json(status);
+// GET /api/email/status — Get Gmail status.
+// `?probe=1` forces a live refresh_token exchange against Google instead of reusing
+// the cached verdict — the settings UI uses it to verify the token on open, so a
+// revoked token can't keep rendering as "Connected". No-op in service-account mode.
+router.get('/status', async (req, res) => {
+    if (req.query.probe === '1' || req.query.probe === 'true') {
+        await gmailClient.probeToken();
+    }
+    res.json(gmailClient.getStatus());
 });
 // GET /api/email/auth/url — Get OAuth authorization URL
 router.get('/auth/url', (req, res) => {

package/dist/src/packages/server/integrations/google-auth/token-health.js

@@ -0,0 +1,196 @@
+/**
+ * Google OAuth token health.
+ *
+ * Gmail, Calendar, and Drive all authenticate with the SAME `GOOGLE_REFRESH_TOKEN`
+ * secret, so token liveness is a single shared fact — this module owns it.
+ *
+ * Why this exists: each client used to report `connected` from the mere presence of
+ * three non-empty secret strings plus a non-null API handle. Nothing ever validated
+ * the refresh token against Google and nothing invalidated the handle when Google
+ * rejected it, so a revoked or expired token still rendered as "Connected" — and a
+ * server restart didn't help, because init() only constructs an OAuth2 client from
+ * the token string without exchanging it.
+ *
+ * The probe below performs a real refresh_token -> access_token exchange, which is
+ * the only way to learn that a refresh token is dead.
+ */
+import { google } from 'googleapis';
+/** The token is definitively dead and only a fresh OAuth consent will fix it. */
+export function needsReauth(health) {
+    return health.state === 'expired' || health.state === 'invalid_client';
+}
+// ─── State ───
+let health = { state: 'unknown', checkedAt: 0 };
+/** In-flight probe, so N concurrent status calls trigger at most one token exchange. */
+let inFlight = null;
+let monitorTimer = null;
+/** Status endpoints are polled every ~3s by the settings UI; only re-probe this often. */
+const PROBE_TTL_MS = 5 * 60_000;
+/** Background re-probe, so a token that dies mid-session surfaces without user action. */
+const MONITOR_INTERVAL_MS = 15 * 60_000;
+export function getTokenHealth() {
+    return health;
+}
+// ─── Error classification ───
+/**
+ * Map an error from a token exchange or Google API call onto a token state.
+ *
+ * Returns null when the error says nothing about token validity (a 404 on a file,
+ * a missing scope, a rate limit) — callers must leave the health state untouched
+ * rather than flapping the UI to "expired" on unrelated failures.
+ */
+function classify(err) {
+    const e = err;
+    const oauthError = e?.response?.data?.error ?? '';
+    const description = e?.response?.data?.error_description ?? '';
+    const message = e?.message ?? String(err);
+    const haystack = `${oauthError} ${message}`.toLowerCase();
+    // The definitive signal: Google rejected the refresh token itself. Emitted when the
+    // token is revoked, expired (a "Testing"-mode OAuth consent screen expires refresh
+    // tokens after 7 days), or the user changed their password.
+    if (haystack.includes('invalid_grant')) {
+        return {
+            state: 'expired',
+            error: description || 'Google rejected the refresh token (invalid_grant). Re-authorize to reconnect.',
+        };
+    }
+    // Client ID/secret are wrong or the OAuth client was deleted. Re-consent won't help
+    // until the credentials are fixed, but it's still a hard auth failure worth surfacing.
+    if (haystack.includes('invalid_client') || haystack.includes('unauthorized_client')) {
+        return {
+            state: 'invalid_client',
+            error: description || 'Google rejected the OAuth client credentials (invalid_client).',
+        };
+    }
+    // Couldn't reach Google at all. Explicitly NOT an auth verdict: reporting "expired"
+    // because the host is offline would send users through a pointless re-consent flow.
+    const code = String(e?.code ?? '');
+    const status = e?.response?.status;
+    const networkish = ['ENOTFOUND', 'ECONNREFUSED', 'ECONNRESET', 'ETIMEDOUT', 'EAI_AGAIN'].includes(code) ||
+        (typeof status === 'number' && status >= 500);
+    if (networkish) {
+        return { state: 'unreachable', error: `Could not reach Google to verify the token (${code || status}).` };
+    }
+    return null;
+}
+/**
+ * Report an error thrown by a live Google API call (Drive list, Gmail send, ...).
+ *
+ * Lets a dead token surface immediately at the point of real use instead of waiting
+ * for the next background probe. Unrelated errors are ignored.
+ */
+export function reportGoogleApiError(err) {
+    const verdict = classify(err);
+    if (!verdict)
+        return;
+    // Don't let a transient network blip overwrite a known-good/known-dead verdict.
+    if (verdict.state === 'unreachable' && health.state !== 'unknown')
+        return;
+    health = { ...verdict, checkedAt: Date.now() };
+}
+/** Record that a Google API call succeeded — the token is provably alive. */
+export function reportGoogleApiSuccess() {
+    if (health.state === 'valid')
+        return;
+    health = { state: 'valid', checkedAt: Date.now() };
+}
+// ─── Probe ───
+/**
+ * Exchange the stored refresh token for an access token to prove it still works.
+ *
+ * Uses a throwaway OAuth2 client seeded with ONLY the refresh token: with no cached
+ * access token, `getAccessToken()` is forced to hit Google's token endpoint rather
+ * than returning a still-valid cached access token, which is what makes this a real
+ * validation instead of a no-op.
+ */
+export async function probeTokenHealth(ctx, opts = {}) {
+    const clientId = ctx.secrets.get('GOOGLE_CLIENT_ID');
+    const clientSecret = ctx.secrets.get('GOOGLE_CLIENT_SECRET');
+    const refreshToken = ctx.secrets.get('GOOGLE_REFRESH_TOKEN');
+    if (!clientId || !clientSecret || !refreshToken) {
+        health = { state: 'unknown', checkedAt: Date.now(), error: 'Missing OAuth credentials' };
+        return health;
+    }
+    const fresh = Date.now() - health.checkedAt < PROBE_TTL_MS;
+    if (!opts.force && fresh && health.state !== 'unknown')
+        return health;
+    if (inFlight)
+        return inFlight;
+    inFlight = (async () => {
+        try {
+            const client = new google.auth.OAuth2(clientId, clientSecret);
+            client.setCredentials({ refresh_token: refreshToken });
+            const { token } = await client.getAccessToken();
+            health = token
+                ? { state: 'valid', checkedAt: Date.now() }
+                : {
+                    state: 'expired',
+                    checkedAt: Date.now(),
+                    error: 'Google returned no access token for the stored refresh token.',
+                };
+        }
+        catch (err) {
+            const verdict = classify(err) ?? {
+                state: 'unreachable',
+                error: err instanceof Error ? err.message : 'Token probe failed',
+            };
+            health = { ...verdict, checkedAt: Date.now() };
+            ctx.log.warn(`[GoogleAuth] token probe: ${health.state}${health.error ? ` — ${health.error}` : ''}`);
+        }
+        return health;
+    })().finally(() => {
+        inFlight = null;
+    });
+    return inFlight;
+}
+/**
+ * Probe now, then re-probe periodically. Idempotent — the three Google plugins each
+ * call this during init() and share the single resulting timer.
+ */
+export function startTokenHealthMonitor(ctx) {
+    void probeTokenHealth(ctx, { force: true });
+    if (monitorTimer)
+        return;
+    monitorTimer = setInterval(() => {
+        void probeTokenHealth(ctx, { force: true });
+    }, MONITOR_INTERVAL_MS);
+    // Don't hold the event loop open on shutdown.
+    monitorTimer.unref?.();
+}
+export function stopTokenHealthMonitor() {
+    if (monitorTimer) {
+        clearInterval(monitorTimer);
+        monitorTimer = null;
+    }
+}
+/** Called after a successful OAuth consent — the brand-new refresh token is good. */
+export function markTokenFresh() {
+    health = { state: 'valid', checkedAt: Date.now() };
+}
+// ─── Token rotation ───
+/**
+ * Re-init hooks, keyed by integration id so repeated init() calls just replace them.
+ *
+ * Consent granted through ONE integration writes a new `GOOGLE_REFRESH_TOKEN` that the
+ * other two never see: their OAuth2 clients keep the refresh token they were seeded
+ * with at init. When the reason for re-consenting was a revoked token, those clients
+ * are holding a dead string — so re-authorizing via Calendar would leave Drive broken
+ * while shared health reported 'valid'. Every client re-reads the secret on rotation.
+ */
+const reinitHandlers = new Map();
+export function onTokenRotated(integrationId, reinit) {
+    reinitHandlers.set(integrationId, reinit);
+}
+/** Announce a freshly minted refresh token: mark health good and re-arm every client. */
+export async function notifyTokenRotated() {
+    markTokenFresh();
+    for (const reinit of reinitHandlers.values()) {
+        try {
+            await reinit();
+        }
+        catch {
+            // A sibling integration failing to re-init must not abort the OAuth callback
+            // for the one the user actually just authorized.
+        }
+    }
+}

package/dist/src/packages/server/integrations/google-calendar/calendar-client.js

@@ -6,6 +6,7 @@
  */
 import { google } from 'googleapis';
 import { loadConfig, updateConfig } from './calendar-config.js';
+import { getTokenHealth, needsReauth, notifyTokenRotated, onTokenRotated, probeTokenHealth, reportGoogleApiError, reportGoogleApiSuccess, startTokenHealthMonitor, } from '../google-auth/token-health.js';
 // ─── State ───
 let ctx = null;
 let calendarApi = null;
@@ -24,9 +25,15 @@ export async function init(integrationCtx) {
         ctx.log.info('Google Calendar missing OAuth credentials, skipping init');
         return;
     }
-    oauth2Client = new google.auth.OAuth2(clientId, clientSecret, getRedirectUri());
+    oauth2Client = createOAuthClient(clientId, clientSecret, getRedirectUri());
     oauth2Client.setCredentials({ refresh_token: refreshToken });
     calendarApi = google.calendar({ version: 'v3', auth: oauth2Client });
+    // Constructing the client above proves nothing — it just wraps the token string.
+    // Probe Google (and keep probing) so an expired token is reflected in getStatus().
+    startTokenHealthMonitor(ctx);
+    // Re-read the shared refresh token if the user re-consents via Gmail or Drive,
+    // otherwise this client keeps using the token it was seeded with here.
+    onTokenRotated('google-calendar', () => init(integrationCtx));
     ctx.log.info('Google Calendar initialized');
 }
 export async function shutdown() {
@@ -39,16 +46,36 @@ export function getStatus() {
     const hasCredentials = !!(ctx?.secrets.get('GOOGLE_CLIENT_ID') &&
         ctx?.secrets.get('GOOGLE_CLIENT_SECRET') &&
         ctx?.secrets.get('GOOGLE_REFRESH_TOKEN'));
+    const health = getTokenHealth();
+    const reauth = hasCredentials && needsReauth(health);
+    // Having credentials on disk is necessary but not sufficient — a revoked refresh
+    // token is still three non-empty strings. Only report connected when Google's last
+    // verdict wasn't a rejection. An 'unreachable' probe (offline host) is deliberately
+    // NOT treated as a rejection: it would push users into a pointless re-consent flow.
+    const wired = config.enabled && hasCredentials && calendarApi !== null;
+    let error;
+    if (!hasCredentials && config.enabled)
+        error = 'Missing OAuth credentials';
+    else if (reauth)
+        error = health.error;
     return {
-        authenticated: Boolean(calendarApi && hasCredentials),
-        connected: config.enabled && hasCredentials && calendarApi !== null,
-        lastChecked: Date.now(),
-        error: !hasCredentials && config.enabled ? 'Missing OAuth credentials' : undefined,
+        authenticated: Boolean(calendarApi && hasCredentials) && !reauth,
+        connected: wired && !reauth,
+        lastChecked: health.checkedAt || Date.now(),
+        error,
+        needsReauth: reauth,
+        tokenState: hasCredentials ? health.state : undefined,
     };
 }
 export function isConfigured() {
     return calendarApi !== null;
 }
+/** Force a live refresh_token exchange against Google and return the updated status. */
+export async function probeToken() {
+    if (ctx)
+        await probeTokenHealth(ctx, { force: true });
+    return getStatus();
+}
 // ─── Events CRUD ───
 export async function createEvent(params) {
     if (!calendarApi)
@@ -265,6 +292,30 @@ const SCOPES = [
 ];
 const REDIRECT_PATH = '/api/calendar/auth/callback'; // Calendar's own callback
 let oauth2Client = null;
+/**
+ * Build an OAuth2 client whose every outbound call updates shared token health.
+ *
+ * Every Calendar call made with `auth: oauth2Client` funnels through this one
+ * `request()` method, so wrapping it here means a revoked token is detected the moment
+ * an agent actually touches Calendar — no waiting for the next background probe —
+ * without instrumenting each API call site.
+ */
+function createOAuthClient(clientId, clientSecret, redirectUri) {
+    const client = new google.auth.OAuth2(clientId, clientSecret, redirectUri);
+    const originalRequest = client.request.bind(client);
+    client.request = (async (opts) => {
+        try {
+            const result = await originalRequest(opts);
+            reportGoogleApiSuccess();
+            return result;
+        }
+        catch (err) {
+            reportGoogleApiError(err);
+            throw err;
+        }
+    });
+    return client;
+}
 function getRedirectUri() {
     if (!ctx)
         throw new Error('Google Calendar not initialized');
@@ -279,7 +330,7 @@ export function getAuthUrl() {
         if (!clientId || !clientSecret || !ctx) {
             throw new Error('Google Calendar OAuth not configured');
         }
-        oauth2Client = new google.auth.OAuth2(clientId, clientSecret, getRedirectUri());
+        oauth2Client = createOAuthClient(clientId, clientSecret, getRedirectUri());
     }
     return oauth2Client.generateAuthUrl({
         access_type: 'offline',
@@ -298,6 +349,10 @@ export async function handleAuthCallback(code) {
     calendarApi = google.calendar({ version: 'v3', auth: oauth2Client });
     // Auto-enable the integration after successful OAuth
     updateConfig({ enabled: true });
+    // Fresh consent just produced this token. Clears the 'expired' verdict AND re-arms
+    // Gmail and Drive, whose clients still hold the old refresh token — all three share
+    // this one secret, so one consent must repair all three.
+    await notifyTokenRotated();
     ctx.log.info(`Google Calendar OAuth complete. Calendar initialized.`);
 }
 function mapGoogleEvent(data, source) {

package/dist/src/packages/server/integrations/google-calendar/calendar-routes.js

@@ -138,10 +138,15 @@ router.post('/working-days', (req, res) => {
         res.status(500).json({ error: `Failed to calculate working days: ${err instanceof Error ? err.message : err}` });
     }
 });
-// GET /api/calendar/status — Get Google Calendar auth status
-router.get('/status', (req, res) => {
-    const status = calendarClient.getStatus();
-    res.json(status);
+// GET /api/calendar/status — Get Google Calendar auth status.
+// `?probe=1` forces a live refresh_token exchange against Google instead of reusing
+// the cached verdict — the settings UI uses it to verify the token on open, so a
+// revoked token can't keep rendering as "Connected".
+router.get('/status', async (req, res) => {
+    if (req.query.probe === '1' || req.query.probe === 'true') {
+        await calendarClient.probeToken();
+    }
+    res.json(calendarClient.getStatus());
 });
 // GET /api/calendar/auth/url — Get OAuth authorization URL
 router.get('/auth/url', (req, res) => {