Connected Agent Platform: Google Workspace + GitHub full actions

[smshagor-dev]

Goal

Make OpenMindAI a full Google Workspace + GitHub connected workstation while preserving the existing local/offline-first chat and AI behavior. This milestone does not add or depend on any Codex feature.

Google Workspace

• Desktop OAuth 2.0 authorization code + PKCE + loopback callback
• Secure access/refresh token storage in the OS credential store
• Token refresh, disconnect/revoke state, and connection health
• Gmail search/read/thread/reply/send/modify/archive/trash actions
• Google Drive list/search/read/upload/create/update/delete actions
• Calendar list/search/create/update/delete events
• Contacts search/list/read
• Least-privilege scope documentation and clear consent UI

GitHub

• Validate token capabilities and account
• Repository/branch/file/commit read
• Create/update/delete files and multi-file commits
• Create branches
• Issues/comments write
• Pull request create/read/update/merge
• Actions runs/jobs/logs read, workflow dispatch, rerun/cancel
• Workflow file modifications through normal repository writes
• Tags/releases where token permissions allow
• Explicit confirmation for destructive/admin-impacting writes

OpenMindAI integration

• Connected actions are exposed through typed Tauri/backend commands
• Connected Work UI can discover and execute Google/GitHub actions from inside OpenMindAI
• Read actions may execute directly; destructive/write actions require explicit user confirmation
• Remote results are bounded before display/processing
• Offline mode leaves local chat/local AI functional and clearly reports remote connector unavailability

Security / quality gates

• Never persist OAuth refresh/access tokens or GitHub tokens in SQLite/plain files
• PKCE/state validation for Google OAuth
• Repository/path/input validation for GitHub writes
• API response size/time bounds
• Unit/regression tests
• Frontend lint/build green
• Rust fmt/Clippy/tests green on Windows/macOS/Linux
• Dependency audit and CodeQL green

Current validation snapshot

• Current main: 5c12b466f2ff7cbaeca16714bea2552e6adca8c5
• Main CI: run 33239117279
  • Frontend validation: green
  • macOS Rust fmt/Clippy/tests: green
  • Windows Rust fmt/Clippy/tests: green
  • Ubuntu Rust: fmt + Clippy green; tests still running
  • Windows integrated Tauri application build: still running
• Main Security: run 33239117277
  • npm + Cargo dependency audit: green
  • CodeQL autobuild: green; analysis still running
• Verified test suite on current main: 145 passed, 0 failed, 2 intentionally ignored external/model tests.

Manual trust gates — do not fake

• Configure/verify a real Google Cloud Desktop OAuth client and required APIs
• Complete real Google account consent and live Gmail/Drive/Calendar/Contacts execution
• Connect a real GitHub token with intended repository permissions and execute live read/write/PR/Actions/release operations

The repository implementation is complete. The issue remains open until the current-main CI/Security gates finish green. Real-account credential and permission exercises remain explicit manual trust gates and are not represented as completed by CI.