Repository navigation
limit google actions to the granted scopes and revoke on disconnect - #82
Merged
Merged
Conversation
hkonsti
added this pull request to stack #88
October 13, 2026 21:06
hkonsti
force-pushed
the
hkonsti/google-3-scopes
branch
from
October 13, 2026 21:36
b228462 to
52965b2
Compare
hkonsti
force-pushed
the
hkonsti/google-3-scopes
branch
from
October 14, 2026 00:49
52965b2 to
0f239d0
Compare
hkonsti
force-pushed
the
hkonsti/google-3-scopes
branch
2 times, most recently
from
October 14, 2026 18:14
68c138f to
9ed1201
Compare
…ed use line, revoke at google on disconnect
…fuse plainly what the agent's own setting turns off, keep the make-default button off unavailable actions, and keep a google grant another connection uses
…account, or its address
hkonsti
force-pushed
the
hkonsti/google-3-scopes
branch
from
October 15, 2026 00:20
9ed1201 to
cf574dd
Compare
This file contains hidden or bidirectional Unicode text that may be interpreted or compiled differently than what appears below. To review, open the file in an editor that reveals hidden Unicode characters.
Learn more about bidirectional Unicode characters
Sign up for free
to join this conversation on GitHub.
Already have an account?
Sign in to comment
Add this suggestion to a batch that can be applied as a single commit.This suggestion is invalid because no changes were made to the code.Suggestions cannot be applied while the pull request is closed.Suggestions cannot be applied while viewing a subset of changes.Only one suggestion per line can be applied in a batch.Add this suggestion to a batch that can be applied as a single commit.Applying suggestions on deleted lines is not supported.You must change the existing code in this line in order to create a valid suggestion.Outdated suggestions cannot be applied.This suggestion has been applied or marked resolved.Suggestions cannot be applied from pending reviews.Suggestions cannot be applied on multi-line comments.Suggestions cannot be applied while the pull request is queued to merge.Suggestion cannot be applied right now. Please check back later.
Google's consent screen lets a person untick scopes, and older connections lack scopes added later, so an action whose scope the sign-in didn't grant is now unavailable: the connection response carries
unavailable(read from the decrypted credential per request throughconnections/unavailable.ts, no migration), defaults and agent settings refuse turning it on,runAgentToolrefuses it with "Sign in to Google again" and logs it as denied, and the web shows it disabled with a "Sign in again" link that opens Google on the account (login_hint). Integrations gain an optionaldisclosure, Google's Limited Use line, shown above a connection's permissions and on the welcome step. Disconnecting a Google connection revokes the grant at Google first (connections/disconnect.ts), deleting it anyway when Google can't be reached.Stack: 3 of 3 for the Google Workspace connector, on #81.
Open workspace in Conductor