From a5e5796d1892cd3f305f31b12c35c2c28e01acd3 Mon Sep 17 00:00:00 2001 From: EugeneTes Date: Thu, 24 Sep 2026 20:10:03 +0000 Subject: [PATCH] Drop GOOGLE_REFRESH_TOKEN env seeding; link Calendar only via /connect_calendar --- .env.example | 3 --- README.md | 1 - docker-compose.yml | 1 - src/config.test.ts | 23 ++--------------------- src/config.ts | 8 +++----- src/main.ts | 7 ------- 6 files changed, 5 insertions(+), 38 deletions(-) diff --git a/.env.example b/.env.example index 0e5e93e..97c9941 100644 --- a/.env.example +++ b/.env.example @@ -21,9 +21,6 @@ LOG_LEVEL=info # /connect_calendar and follow the two-step flow — no refresh token needed here. GOOGLE_CLIENT_ID= GOOGLE_CLIENT_SECRET= -# Deprecated. If set at startup, seeded once into workspace/.secretary/google-token.json -# and then ignored. Use /connect_calendar in the bot for new setups. -GOOGLE_REFRESH_TOKEN= # Playwright browser tools (MCP bridge). When PLAYWRIGHT_ENABLED=true the agent # gets ~60 browser_* tools (navigate, click, type, screenshot, run arbitrary diff --git a/README.md b/README.md index 4d14092..3fac891 100644 --- a/README.md +++ b/README.md @@ -98,7 +98,6 @@ The agent's edits to `MEMORY.md` are local runtime data. Leave them uncommitted, | `CAPTCHA_API_KEY` | no | | Captcha solver key; enables `fortress_solve_captcha` and auto-solve during fetch | | `GOOGLE_CLIENT_ID` | no | | OAuth client id (TVs and Limited Input devices) — enables the calendar tool | | `GOOGLE_CLIENT_SECRET` | no | | OAuth client secret — required alongside `GOOGLE_CLIENT_ID` | -| `GOOGLE_REFRESH_TOKEN` | no | | Deprecated. If set, seeded once into `workspace/.secretary/google-token.json`, then ignored. | ## Keeping it running on Windows diff --git a/docker-compose.yml b/docker-compose.yml index df59ead..ddd8fb8 100644 --- a/docker-compose.yml +++ b/docker-compose.yml @@ -17,7 +17,6 @@ services: - LOG_LEVEL=${LOG_LEVEL:-info} - GOOGLE_CLIENT_ID=${GOOGLE_CLIENT_ID:-} - GOOGLE_CLIENT_SECRET=${GOOGLE_CLIENT_SECRET:-} - - GOOGLE_REFRESH_TOKEN=${GOOGLE_REFRESH_TOKEN:-} - FORTRESS_ENABLED=${FORTRESS_ENABLED:-false} - FORTRESS_HEADLESS=${FORTRESS_HEADLESS:-true} - FORTRESS_CHANNEL=${FORTRESS_CHANNEL:-} diff --git a/src/config.test.ts b/src/config.test.ts index ce865a2..9f32d91 100644 --- a/src/config.test.ts +++ b/src/config.test.ts @@ -72,25 +72,12 @@ describe("loadConfig", () => { }); }); - it("accepts Google client_id + client_secret without a refresh token", () => { + it("accepts Google client_id + client_secret", () => { const cfg = loadConfig( { ...base, GOOGLE_CLIENT_ID: "cid", GOOGLE_CLIENT_SECRET: "csecret" }, "/p", ); - expect(cfg.google).toEqual({ clientId: "cid", clientSecret: "csecret", refreshToken: undefined }); - }); - - it("accepts Google client_id + client_secret + refresh_token together", () => { - const cfg = loadConfig( - { - ...base, - GOOGLE_CLIENT_ID: "cid", - GOOGLE_CLIENT_SECRET: "csecret", - GOOGLE_REFRESH_TOKEN: "rt", - }, - "/p", - ); - expect(cfg.google).toEqual({ clientId: "cid", clientSecret: "csecret", refreshToken: "rt" }); + expect(cfg.google).toEqual({ clientId: "cid", clientSecret: "csecret" }); }); it("rejects Google config that has client_id without client_secret", () => { @@ -105,12 +92,6 @@ describe("loadConfig", () => { ).toThrow(/GOOGLE_CLIENT_ID.*GOOGLE_CLIENT_SECRET/); }); - it("rejects a lone GOOGLE_REFRESH_TOKEN without client_id/secret", () => { - expect(() => - loadConfig({ ...base, GOOGLE_REFRESH_TOKEN: "rt" }, "/p"), - ).toThrow(/GOOGLE_CLIENT_ID.*GOOGLE_CLIENT_SECRET/); - }); - it("leaves google undefined when no GOOGLE_* vars are set", () => { expect(loadConfig(base, "/p").google).toBeUndefined(); }); diff --git a/src/config.ts b/src/config.ts index 6079a10..55e56e8 100644 --- a/src/config.ts +++ b/src/config.ts @@ -19,7 +19,6 @@ export interface Config { export interface GoogleConfig { clientId: string; clientSecret: string; - refreshToken?: string; } export interface PlaywrightConfig { @@ -65,17 +64,16 @@ export function loadConfig(env: NodeJS.ProcessEnv = process.env, cwd: string = p const googleClientId = blankToUndefined(env.GOOGLE_CLIENT_ID); const googleClientSecret = blankToUndefined(env.GOOGLE_CLIENT_SECRET); - const googleRefreshToken = blankToUndefined(env.GOOGLE_REFRESH_TOKEN); const hasClientId = Boolean(googleClientId); const hasClientSecret = Boolean(googleClientSecret); - if (hasClientId !== hasClientSecret || (!hasClientId && googleRefreshToken)) { + if (hasClientId !== hasClientSecret) { throw new ConfigError( - "Google Calendar needs both GOOGLE_CLIENT_ID and GOOGLE_CLIENT_SECRET (refresh token is optional; if set at startup it will be migrated into the workspace store).", + "Google Calendar needs both GOOGLE_CLIENT_ID and GOOGLE_CLIENT_SECRET.", ); } const google: GoogleConfig | undefined = googleClientId && googleClientSecret - ? { clientId: googleClientId, clientSecret: googleClientSecret, refreshToken: googleRefreshToken } + ? { clientId: googleClientId, clientSecret: googleClientSecret } : undefined; const playwright: PlaywrightConfig | undefined = parseBool(env.PLAYWRIGHT_ENABLED) diff --git a/src/main.ts b/src/main.ts index 2f46524..ef6ba35 100644 --- a/src/main.ts +++ b/src/main.ts @@ -91,13 +91,6 @@ async function main(): Promise { let tokenStore: GoogleTokenStore | null = null; if (config.google) { tokenStore = createGoogleTokenStore(config.workspaceDir); - if (config.google.refreshToken && tokenStore.read() === null) { - tokenStore.write(config.google.refreshToken); - logger.warn( - "GOOGLE_REFRESH_TOKEN env var seeded into workspace/.secretary/google-token.json. " + - "You can remove GOOGLE_REFRESH_TOKEN from .env now — future updates come through /connect_calendar.", - ); - } customTools.push(createCalendarTool({ clientId: config.google.clientId, clientSecret: config.google.clientSecret,