docs(gmail-native): correct the Desktop OAuth client claim#1455
Merged
Conversation
Google issues a client secret to Desktop-type clients and requires it at the token endpoint (it is merely not treated as confidential) — a secret-less exchange fails with invalid_request. The validated path is Web application + secret; Desktop works only with both env vars set.
thepagent
approved these changes
Jul 25, 2026
brettchien
added a commit
to brettchien/openab
that referenced
this pull request
Jul 26, 2026
brettchien
added a commit
to brettchien/openab
that referenced
this pull request
Jul 26, 2026
…vers divergence Follows the merge of main (adapter ADR openabdev#1446, gmail doc openabdev#1455) into this branch: - Link the OAB MCP Adapter ADR directly now that it is present, and note the whole facade series (openabdev#1446/openabdev#1448/openabdev#1449/openabdev#1450/openabdev#1453/openabdev#1454) is merged with no facade PR left open — §6 builds on a settled foundation. - Cite adapter ADR §6.2 / Alternative C ("no second generic inbound MCP server", browser and external capabilities share one delivery mechanism), which makes retiring the bespoke per-session proxy (F5) an upstream design requirement rather than optional cleanup. - Record an unresolved divergence: the adapter ADR says the facade is delivered via ACP `mcpServers` and explicitly not by editing CLI config files, while the as-built `write_facade_mcp_config` does write a static entry — deliberately, since browser D2 found Cursor ignores ACP-passed mcpServers. Flagged for the facade contract owner instead of unilaterally reconciling. Co-Authored-By: Claude Opus 4.8 <noreply@anthropic.com>
This file contains hidden or bidirectional Unicode text that may be interpreted or compiled differently than what appears below. To review, open the file in an editor that reveals hidden Unicode characters.
Learn more about bidirectional Unicode characters
Sign up for free
to join this conversation on GitHub.
Already have an account?
Sign in to comment
2 participants
Add this suggestion to a batch that can be applied as a single commit.This suggestion is invalid because no changes were made to the code.Suggestions cannot be applied while the pull request is closed.Suggestions cannot be applied while viewing a subset of changes.Only one suggestion per line can be applied in a batch.Add this suggestion to a batch that can be applied as a single commit.Applying suggestions on deleted lines is not supported.You must change the existing code in this line in order to create a valid suggestion.Outdated suggestions cannot be applied.This suggestion has been applied or marked resolved.Suggestions cannot be applied from pending reviews.Suggestions cannot be applied on multi-line comments.Suggestions cannot be applied while the pull request is queued to merge.Suggestion cannot be applied right now. Please check back later.
Doc audit follow-up: the setup guide claimed a secret-less Desktop client works with the secret env var omitted. Google's Desktop (installed-app) client type still receives a client secret and requires it at the token endpoint — omitting it fails the exchange with
invalid_request. Truly secret-less Google client types (iOS/Android/TV) don't apply to this loopback flow. Every other claim in the doc was cross-checked against the shipped code and the live b2/laptop validation runs and is accurate.Review Contract
Goal
Remove the one unvalidated, likely-wrong claim from
docs/gmail-native.md(Desktop client without a secret).Non-goals
No other doc or code changes.
Accepted Residual Risks
None — strictly tightens the doc toward validated behavior.
Acceptance Criteria
The doc no longer suggests omitting
GMAIL_OAUTH_CLIENT_SECRET; the Desktop note reflects Google's actual token-endpoint requirement.Follow-ups
Optionally document the gmail.* restricted-scope verification requirement (>100 test users) if the adapter is ever positioned for public multi-user distribution — deferred until that's a real plan.