Adom Google

@@ -81,13 +81,15 @@ The **code** is open source and ships with **no OAuth provider baked in**, it ha which gateway or Google client to use until you give it one. That "provider" (gateway URL + client_id) is the only account-specific piece. Four ways to get one: -### 1. You're at Adom → just use it+### 1. Your org already set it up (Adom has) → just use it ```bash-adom-wiki pkg install adom/adom-google-adom   # pulls the CLI + drops the Adom provider config-adom-google auth                   # full Workspace access, one Allow click (~10 min to approve)+adom-wiki pkg install adom/adom-google+adom-google auth                   # full Workspace access, one Allow click ```-(`adom-google-adom` is a tiny private, Adom-only package that writes the Adom provider; the-public `adom-google` package contains none of Adom's infrastructure.)+adom-google finds your org's provider on its members-only wiki settings page+(`adom-wiki settings get <org> google-oauth`), so there is nothing else to install. The public+package contains none of any org's infrastructure, and the settings file holds no secret.+(`adom-google-adom` still works for Adom staff as a fallback while this rolls out.)  ### 2. Any other org → self-serve onboarding (the AI sets up Google *for* you) This is the one most teams want. You don't touch the Google Cloud Console, **your AI drives@@ -380,7 +382,7 @@ improves it *together*: The **code** is 100% yours under MIT, forever. The one thing that isn't is **Adom's hosted OAuth gateway**, and that caveat applies **only if you use it**: -- **Adom-hosted path** (Adom employees via `adom-google-adom`, or any org on the managed+- **Adom-hosted path** (Adom employees via `adom/org-settings`, or any org on the managed   ~$5/mo plan): your sign-in and token refresh run through **Adom's cloud gateway**, and the   shared client's Google API calls count against **Adom's quota**. That gateway + quota is an   **Adom service, subject to change** (rate limits, availability, terms).

@@ -46,7 +46,7 @@ skill, which drives the user's real logged-in browser (the bridge's `nbrowser_*` console, auto-fills the fields (especially the redirect URI), captures the new client, and wires it in RELAY mode (their secret stays `0600` on their box; Adom only lends a shared callback URL). Kick it off with `adom-google onboard --org <slug>` (or `--json` for the exact values). Adom-employees skip all this, they install `adom-google-adom` and just run `auth`.+employees skip all this: adom-google finds Adom's provider in `adom/org-settings`, so they just run `auth`.  ## Install @@ -173,11 +173,28 @@ confidential-client **token broker**, so the client secret never reaches user co provider (`{gateway_url, client_id, app}`) is resolved at runtime, later wins: bundled `provider.json` → legacy `credentials.json` → `~/.config/adom-google/provider.json` → env (`OAUTH_GATEWAY_URL`, `ADOM_GOOGLE_CLIENT_ID/SECRET/APP`). With none configured, every command-prints the NO_PROVIDER hint. Adom employees install the private **`adom-google-adom`** package,-which writes the Adom provider (gateway + Internal client_id) to `~/.config/adom-google/provider.json`;-self-hosters run `adom-google provider set --gateway <url> --client-id <id>`. The client secret is+first tries the user's **wiki org settings** (below), then prints the NO_PROVIDER hint.+Self-hosters run `adom-google provider set --gateway <url> --client-id <id>`. The client secret is never in any package, in broker mode it lives only on the gateway's `creds/<app>.json` (0600). +**Org settings: the provider comes from your org, not from a package (0.8.25+).** Every wiki org+has a members-only `<org>/org-settings` page for shared, NON-secret integration config+(`adom-wiki settings`). An org that has set adom-google up stores `integrations/google-oauth.json`+there: `{client_id, gateway_url, app, mode:"broker", workspace_domains, ...}`, never a secret. When+nothing else configures a provider, adom-google reads it and caches it to+`~/.config/adom-google/provider.json` (0600, tagged `_source: org-settings:<org>`), and `auth`+re-reads it each time so a moved gateway is picked up. Rules: an explicit provider always wins and+is never looked up; a user in SEVERAL orgs that set it up is never guessed for+(`adom-google provider discover --org <org>`); a settings file containing a secret is refused;+`ADOM_GOOGLE_NO_DISCOVER=1` turns it off. Adom's own provider lives in `adom/org-settings`, which is+what retires the `adom-google-adom` package (kept briefly as a fallback-only forwarder).++```bash+adom-google provider discover [--org <org>] [--json]   # fetch + cache from org settings+adom-google provider show                              # shows "[from <org>/org-settings]"+adom-wiki settings get <org> google-oauth              # what the org has stored+```+ If the Gateway is down, `auth --manual` uses a desktop-client loopback paste flow (that one exchanges locally and does need a client secret via `init`). 

@@ -1 +1 @@-0.8.24+0.8.25

@@ -80,8 +80,13 @@ case ":$PATH:" in   *) echo "[adom-google] NOTE: $HOME/.local/bin is not on PATH, add it to your shell rc." ;; esac +# No provider yet? Look in the user's wiki org settings: an org that has set adom-google up+# keeps its (non-secret) provider there, so every member is configured with no extra package.+if [ ! -s "$HOME/.config/adom-google/provider.json" ] && [ -z "${ADOM_GOOGLE_NO_DISCOVER:-}" ]; then+  "$BIN_DIR/adom-google" provider discover >/dev/null 2>&1 || true+fi if [ -s "$HOME/.config/adom-google/provider.json" ]; then-  echo "✅ adom-google installed (main skill + onboarding sub-skill). OAuth provider already configured. Next: 'adom-google auth' (one Allow click)."+  echo "✅ adom-google installed (main skill + onboarding sub-skill). OAuth provider configured$(python3 -c "import json,os;t=json.load(open(os.path.expanduser('~/.config/adom-google/provider.json'))).get('_source','');print(' (from '+t.split(':',1)[1]+'/org-settings)' if t.startswith('org-settings:') else '')" 2>/dev/null). Next: 'adom-google auth' (one Allow click)." else   # Not an error. This package deliberately ships no provider; on an Adom staff install,   # adom-google-adom writes one right after this step. Worded so an AI does not read a

@@ -1,6 +1,6 @@ {   "slug": "adom-google",-  "version": "0.8.24",+  "version": "0.8.25",   "type": "app",   "license": "MIT",   "description": "Drive your whole Google Workspace from the terminal: Gmail, Contacts, Drive, Sheets, Docs, Slides, Calendar, Tasks, Google Chat, plus a generic `api` passthrough to hit ANY Google API. Connect a personal @gmail (or another org's Google account) with ZERO setup via Adom's hosted Connector (`adom-google connect-personal`), or bring your own token-broker gateway (`provider set`): Adom staff use the private adom-google-adom provider. One-click OAuth, no client secret on your machine.",

@@ -4,7 +4,7 @@   "slug": "adom-google",   "title": "Adom Google",   "brief": "Drive your whole Google Workspace from the terminal, run by your AI. Read Gmail, write Google Docs, build Google Sheets and Google Slides, search Google Drive, manage Google Calendar and Google Tasks, and post to Google Chat, plus any Google API and a zero-setup personal Gmail.",-  "version": "0.8.24",+  "version": "0.8.25",   "visibility": "public",   "install": {     "binary_name": "adom-google"@@ -94,7 +94,7 @@   "skills": [],   "hero_path": "screenshots/hero-google-v5.png",   "hero_type": "image",-  "description": "Drive your whole Google Workspace from the terminal: Gmail, Contacts, Drive, Sheets, Docs, Slides, Calendar, Tasks, Google Chat, plus a generic `api` passthrough to hit ANY Google API. Open source, ships with NO OAuth provider baked in: point it at your own token-broker gateway (`provider set`), buy a managed one, or: Adom staff: install the private adom-google-adom provider. One-click OAuth, no client secret on your machine. First run asks safe mode (no delete) vs full mode (incl. delete).",+  "description": "Drive your whole Google Workspace from the terminal: Gmail, Contacts, Drive, Sheets, Docs, Slides, Calendar, Tasks, Google Chat, plus a generic `api` passthrough to hit ANY Google API. Connect a personal @gmail (or another org's Google account) with ZERO setup via Adom's hosted Connector (`adom-google connect-personal`), or bring your own token-broker gateway (`provider set`): Adom staff use the private adom-google-adom provider. One-click OAuth, no client secret on your machine.",   "keywords": [     "adom-google",     "google-workspace",@@ -118,8 +118,6 @@     "uninstall": "./uninstall.sh"   },   "files": [-    "bin/adom-google",-    "bin/adom-gmail",     "SKILL.md",     "skills/adom-google-onboarding/SKILL.md",     "README.md",@@ -128,7 +126,8 @@     "provider.example.json",     "install.sh",     "uninstall.sh",-    "package.json"+    "package.json",+    "VERSION"   ],   "org": "adom" }\ No newline at end of file