Adom Google

@@ -171,10 +171,19 @@ adom-google chat send --to <space-id|email> "<text>"      # post; email auto-res #   "<text>" may be '-' (stdin) or '@file'; add --thread <key> to reply in a thread adom-google chat read --from <space-id|email> [--limit N] [--json]   # recent messages -adom-google status     # access (full/safe) + what's authorized (never prints secrets)+adom-google status     # access (full/safe) + what was REQUESTED at auth (never prints secrets)+adom-google scopes     # authoritative GRANTED scopes (live tokeninfo) + drift vs requested+adom-google scopes --require chat.spaces [--auto-widen]   # gate: exit 2 + exact fix when short adom-google accounts   # list all configured accounts (work + personal, isolated) ``` +**Requested ≠ granted.** `status` prints what auth ASKED for; `scopes` asks Google's tokeninfo+what was actually GRANTED — always gate on `scopes --require <scope>` before building against an+API. And tokeninfo can't tell you whether the API is *enabled* in the OAuth client's GCP project:+to probe real capability **without creating anything**, send a deliberately invalid body to the+target method — a missing scope fails 403 `ACCESS_TOKEN_SCOPE_INSUFFICIENT` *before* body+validation, while a granted scope fails 400 `INVALID_ARGUMENT` (proof the call would work).+ ## Multiple accounts (v0.8.0+) — e.g. work + personal, fully isolated  `adom-google --account <name> <cmd>` (or `ADOM_GOOGLE_ACCOUNT=<name>`) runs ANY command against a@@ -190,8 +199,10 @@ each account authorizes independently: `adom-google --account personal auth`. (clean, no prefix). For an **attributed bot post** to a team space (deploys/alerts as "Kel (on behalf of john)"), use **[adom-gchat](/adom/adom-gchat)**, the post-only webhook bot. Rule of thumb: posting *as yourself* ⇒ `adom-google chat`; an *attributed bot announcement* ⇒-`adom-gchat`. The `chat.messages` + `chat.spaces.readonly` scopes are in both safe and full-mode, so this works out of the box once authorized.+`adom-gchat`. Chat scopes ship in both modes (safe: `chat.messages` + `chat.spaces.readonly` ++`chat.spaces.create`; full: `chat.messages` + `chat.spaces`, which adds space creation and+metadata updates), so this works out of the box once authorized — tokens issued before v0.8.5+need a re-auth to pick up space creation (`adom-google scopes --require chat.spaces --auto-widen`).  We use Google Contacts to store **service identities** (portal/account metadata for an API vendor), e.g. the JPMorgan Payments developer portal. Keep secrets (client secrets, portal

@@ -1 +1 @@-0.8.4+0.8.5

@@ -1,6 +1,6 @@ {   "slug": "adom-google",-  "version": "0.8.4",+  "version": "0.8.5",   "type": "app",   "license": "MIT",   "description": "Drive your whole Google Workspace from the terminal \u2014 Gmail, Contacts, Drive, Sheets, Docs, Slides, Calendar, Tasks, Google Chat, plus a generic `api` passthrough to hit ANY Google API. Connect a personal @gmail (or another org's Google account) with ZERO setup via Adom's hosted Connector (`adom-google connect-personal`), or bring your own token-broker gateway (`provider set`) \u2014 Adom staff use the private adom-google-adom provider. One-click OAuth, no client secret on your machine.",

@@ -4,7 +4,7 @@   "slug": "adom-google",   "title": "Adom Google",   "brief": "Drive your whole Google Workspace from the terminal — Gmail, Drive, Sheets, Docs, Slides, Calendar, Tasks, Chat + any Google API.",-  "version": "0.8.4",+  "version": "0.8.5",   "visibility": "public",   "install": {     "binary_name": "adom-google"