From 02dba4e63c90b57196a98ab5cb0448035fe6b974 Mon Sep 17 00:00:00 2001
From: Claude <noreply@anthropic.com>
Date: Sat, 31 Oct 2026 22:27:47 +0000
Subject: [PATCH 1/2] Unify user-facing product name as "Thoughtful"

The product appeared as "Writing Tools", "Thoughtful AI Tools", and
"Thoughtful Writing Tools" depending on the surface. Use "Thoughtful"
on the OAuth login page, device approval page, Google Docs add-on
(menu, sidebar, store listing, setup README), Office store long
description, dev debug pages, and docs. The Mindmap OAuth client's
display name becomes "Mindmap" (re-provisioned on startup).

Left as-is: the lab name ("Thoughtful AI Lab"), LICENSE, package and
repo identifiers.

Co-Authored-By: Claude Opus 5.5 <noreply@anthropic.com>
Claude-Session: https://claude.ai/code/session_017KwGFihH21DMyLYsDhRSFp
---
 backend/src/__tests__/oauth-config.test.ts |  2 +-
 backend/src/config.ts                      |  2 +-
 backend/src/routes/debug.ts                |  2 +-
 backend/src/routes/device-approval.ts      |  6 +++---
 backend/src/routes/device-taskpane.ts      |  2 +-
 backend/src/routes/oauth-login.ts          |  6 +++---
 docs/oauth-provider.md                     |  4 ++--
 frontend/public/longDescription.html       |  4 ++--
 google-docs-addon/Code.gs                  | 12 ++++++------
 google-docs-addon/README.md                | 12 ++++++------
 google-docs-addon/appsscript.json          |  2 +-
 google-docs-addon/sidebar.html             | 10 +++++-----
 google-docs-addon/store-listing.md         |  6 +++---
 13 files changed, 35 insertions(+), 35 deletions(-)

diff --git a/backend/src/__tests__/oauth-config.test.ts b/backend/src/__tests__/oauth-config.test.ts
index 5281581c..5cef9840 100644
--- a/backend/src/__tests__/oauth-config.test.ts
+++ b/backend/src/__tests__/oauth-config.test.ts
@@ -40,7 +40,7 @@ describe('trusted OAuth client configuration', () => {
 		expect(trustedOAuthClients()).toEqual([
 			{
 				clientId: 'writing-tools-mindmap',
-				name: 'Writing Tools Mindmap',
+				name: 'Mindmap',
 				redirectUris: [PROD_REDIRECT],
 			},
 		]);
diff --git a/backend/src/config.ts b/backend/src/config.ts
index d7f27a26..60465066 100644
--- a/backend/src/config.ts
+++ b/backend/src/config.ts
@@ -101,7 +101,7 @@ export const trustedOAuthClients = (): TrustedOAuthClient[] =>
 	[
 		{
 			clientId: envString('MINDMAP_OAUTH_CLIENT_ID'),
-			name: 'Writing Tools Mindmap',
+			name: 'Mindmap',
 			redirectUris: envList('MINDMAP_OAUTH_REDIRECT_URIS'),
 		},
 	].filter((client) => client.clientId && client.redirectUris.length > 0);
diff --git a/backend/src/routes/debug.ts b/backend/src/routes/debug.ts
index cb751409..b4c656ab 100644
--- a/backend/src/routes/debug.ts
+++ b/backend/src/routes/debug.ts
@@ -8,7 +8,7 @@ const DEBUG_HTML = `<!DOCTYPE html>
 <head>
   <meta charset="UTF-8" />
   <meta name="viewport" content="width=device-width, initial-scale=1" />
-  <title>Auth Debug — Writing Tools Backend</title>
+  <title>Auth Debug — Thoughtful backend</title>
   <style>
     body { font-family: sans-serif; max-width: 560px; margin: 2.5rem auto; padding: 0 1.5rem; line-height: 1.5; }
     h1 { font-size: 1.3rem; }
diff --git a/backend/src/routes/device-approval.ts b/backend/src/routes/device-approval.ts
index dfb46925..36758a50 100644
--- a/backend/src/routes/device-approval.ts
+++ b/backend/src/routes/device-approval.ts
@@ -5,9 +5,9 @@ import type { Context } from 'hono';
 // Registered whenever auth is enabled (see index.ts).
 
 // User-facing product name, in one place so it's tunable. Interpolated into the
-// template below (static HTML and the inline script alike). Cross-app naming
-// (manifest DisplayName, frontend) is a broader cleanup tracked separately.
-const PRODUCT_NAME = 'Thoughtful AI Tools';
+// template below (static HTML and the inline script alike). Keep it in step with
+// the OAuth login page (oauth-login.ts) and the add-in's own branding.
+const PRODUCT_NAME = 'Thoughtful';
 
 const DEVICE_HTML = `<!DOCTYPE html>
 <html lang="en">
diff --git a/backend/src/routes/device-taskpane.ts b/backend/src/routes/device-taskpane.ts
index c1ff1895..b47a7c3e 100644
--- a/backend/src/routes/device-taskpane.ts
+++ b/backend/src/routes/device-taskpane.ts
@@ -13,7 +13,7 @@ function buildDebugDeviceHtml(serializedClientId: string) {
 <head>
   <meta charset="UTF-8" />
   <meta name="viewport" content="width=device-width, initial-scale=1" />
-  <title>Device Flow Debug — Writing Tools Backend</title>
+  <title>Device Flow Debug — Thoughtful backend</title>
   <style>
     body { font-family: sans-serif; max-width: 560px; margin: 2.5rem auto; padding: 0 1.5rem; line-height: 1.5; }
     h1 { font-size: 1.3rem; }
diff --git a/backend/src/routes/oauth-login.ts b/backend/src/routes/oauth-login.ts
index b4d055d9..99d84b43 100644
--- a/backend/src/routes/oauth-login.ts
+++ b/backend/src/routes/oauth-login.ts
@@ -14,7 +14,7 @@ const LOGIN_HTML = `<!doctype html>
 <head>
   <meta charset="utf-8">
   <meta name="viewport" content="width=device-width,initial-scale=1">
-  <title>Sign in to Writing Tools</title>
+  <title>Sign in to Thoughtful</title>
   <style>
     body{font:16px/1.5 system-ui,sans-serif;max-width:620px;margin:3rem auto;padding:0 1.5rem;color:#172033}
     h1{font-size:1.5rem}button{font:inherit;padding:.65rem 1rem;border:1px solid #3157d5;border-radius:7px;cursor:pointer;background:#3157d5;color:white}
@@ -22,9 +22,9 @@ const LOGIN_HTML = `<!doctype html>
   </style>
 </head>
 <body>
-  <h1>Sign in to Writing Tools</h1>
+  <h1>Sign in to Thoughtful</h1>
   <main id="app">
-    <p>Sign in to let the app you came from use Writing Tools AI on your behalf.</p>
+    <p>Sign in to let the app you came from use Thoughtful on your behalf.</p>
     <button id="sign-in">Sign in with Google</button>
   </main>
   <script>
diff --git a/docs/oauth-provider.md b/docs/oauth-provider.md
index a0e6d09b..1887b72d 100644
--- a/docs/oauth-provider.md
+++ b/docs/oauth-provider.md
@@ -3,7 +3,7 @@
 The backend is an OAuth 2.1 authorization server (Better Auth's `oauthProvider`
 plugin under `/api/auth/oauth2/*`), and its OpenAI proxy is the resource server
 that accepts the resulting access tokens. This lets separately hosted
-first-party apps call the proxy as a signed-in Writing Tools user.
+first-party apps call the proxy as a signed-in Thoughtful user.
 
 The first and only client is the standalone Mindmap. It may call the two
 text-generation proxies; it receives no document or room access, and the user
@@ -71,7 +71,7 @@ introspection is configured, so opaque access tokens are never accepted.
 
 Revocation rides on the authorizing sign-in: the token's `sid` claim names the
 Better Auth session that approved it, and the proxy requires that session to
-still exist, be unexpired, and belong to `sub`. Signing out of Writing Tools (or
+still exist, be unexpired, and belong to `sub`. Signing out of Thoughtful (or
 the session expiring) therefore revokes Mindmap's token immediately. Disabling
 the client, by contrast, only stops new grants.
 
diff --git a/frontend/public/longDescription.html b/frontend/public/longDescription.html
index 6eaa963a..b6df76b9 100644
--- a/frontend/public/longDescription.html
+++ b/frontend/public/longDescription.html
@@ -9,7 +9,7 @@
   <link
     href="https://fonts.googleapis.com/css2?family=Albert+Sans:ital,wght@0,100..900;1,100..900&family=Fredoka:wght@300..700&family=Montserrat:ital,wght@0,100..900;1,100..900&family=Nunito+Sans:ital,opsz,wght@0,6..12,200..1000;1,6..12,200..1000&family=Plus+Jakarta+Sans:ital,wght@0,200..800;1,200..800&family=Urbanist:ital,wght@0,100..900;1,100..900&display=swap"
     rel="stylesheet">
-  <title>AI Writing Tools Add-in</title>
+  <title>Thoughtful Add-in</title>
   <style>
     body {
       font-family: "Plus Jakarta Sans", sans-serif;
@@ -45,7 +45,7 @@
 </head>
 <body>
   <article id="main-article">
-    <h1>Thoughtful Writing Tools Add-in</h1>
+    <h1>Thoughtful</h1>
     <p>Thoughtful helps you write more thoughtfully. Its AI encourages your own thinking.</p>
     <section class="article-section">
       <h2>Key Features</h2>
diff --git a/google-docs-addon/Code.gs b/google-docs-addon/Code.gs
index 2cf433b9..71755c7b 100644
--- a/google-docs-addon/Code.gs
+++ b/google-docs-addon/Code.gs
@@ -9,7 +9,7 @@
  */
  
 /**
- * Thoughtful AI Tools - Google Docs Add-on
+ * Thoughtful - Google Docs Add-on
  *
  * This Apps Script bridges the sidebar UI (HTML/JS/React) and the Google Docs
  * document (via DocumentApp), providing document operations only. The React app
@@ -26,7 +26,7 @@
 function onOpen(e) {
   DocumentApp.getUi()
     .createAddonMenu()
-    .addItem('Open Thoughtful AI Tools', 'showSidebar')
+    .addItem('Open Thoughtful', 'showSidebar')
     .addToUi();
 }
 
@@ -56,12 +56,12 @@ function onFileScopeGranted(e) {
  */
 function createHomepageCard() {
   const card = CardService.newCardBuilder()
-    .setHeader(CardService.newCardHeader().setTitle('Thoughtful AI Tools'))
+    .setHeader(CardService.newCardHeader().setTitle('Thoughtful'))
     .addSection(
       CardService.newCardSection()
         .addWidget(
           CardService.newTextParagraph()
-            .setText('Click the button below to open Thoughtful AI Tools in a sidebar for the full experience.')
+            .setText('Click the button below to open Thoughtful in a sidebar for the full experience.')
         )
         .addWidget(
           CardService.newTextButton()
@@ -97,11 +97,11 @@ function createHomepageCard() {
 }
 
 /**
- * Shows the sidebar with the Thoughtful AI Tools UI.
+ * Shows the sidebar with the Thoughtful UI.
  */
 function showSidebar() {
   const html = HtmlService.createHtmlOutputFromFile('sidebar')
-    .setTitle('Thoughtful AI Tools')
+    .setTitle('Thoughtful')
     .setWidth(400);
   DocumentApp.getUi().showSidebar(html);
 }
diff --git a/google-docs-addon/README.md b/google-docs-addon/README.md
index 7cf7227d..81b31313 100644
--- a/google-docs-addon/README.md
+++ b/google-docs-addon/README.md
@@ -1,6 +1,6 @@
 # Google Docs Add-on
 
-This folder contains the Google Apps Script code for the Writing Tools Google Docs add-on.
+This folder contains the Google Apps Script code for the Thoughtful Google Docs add-on.
 
 ## Architecture
 
@@ -76,14 +76,14 @@ operations. All backend traffic (chat, revise, logging) goes from the React app
    ```bash
    cd google-docs-addon
    rm .clasp.json
-   clasp create --type docs --title "Writing Tools"
+   clasp create --type docs --title "Thoughtful"
    ```
    Google may show another authorization screen — click **Allow**.
    This creates a new `.clasp.json` with your own `scriptId`.
 
    > **Alternative (if `clasp create` still gives errors):**
    > 1. Go to https://script.google.com and click **New project**
-   > 2. Rename it to "Writing Tools"
+   > 2. Rename it to "Thoughtful"
    > 3. Copy the script ID from the URL: `https://script.google.com/home/projects/<SCRIPT_ID>/edit`
    > 4. Create `.clasp.json` manually:
    >    ```json
@@ -102,12 +102,12 @@ operations. All backend traffic (chat, revise, logging) goes from the React app
    > **If `clasp open` is not recognized:**
    > - Make sure clasp is installed globally: `npm install -g @google/clasp`
    > - On Windows, ensure the global npm bin folder (`%APPDATA%\npm`) is in your PATH
-   > - **Alternative:** Open https://script.google.com directly and find your "Writing Tools" project, or hover over it in the project list and click **Open Document**
+   > - **Alternative:** Open https://script.google.com directly and find your "Thoughtful" project, or hover over it in the project list and click **Open Document**
 
    In the Apps Script editor: **Deploy → Test deployments → + Add test** → select a Google Doc → **Save**
 
 7. **First time opening the sidebar in Google Docs:**
-   Go to **Extensions → Writing Tools → Open Writing Tools**.
+   Go to **Extensions → Thoughtful → Open Thoughtful**.
    Google will show an authorization screen — click **Review Permissions** → select your Google account → click **Allow**.
    This only happens once.
 
@@ -120,7 +120,7 @@ npm run dev-server
 ```
 
 Wait for Vite to print its local URL, then open your Google Doc and go to:
-**Extensions → Writing Tools → Open Writing Tools**
+**Extensions → Thoughtful → Open Thoughtful**
 
 No tunneling/ngrok is needed — the sidebar loads straight from localhost, and
 the dev server proxies `/api` to the local backend.
diff --git a/google-docs-addon/appsscript.json b/google-docs-addon/appsscript.json
index b76a9424..23ef4f38 100644
--- a/google-docs-addon/appsscript.json
+++ b/google-docs-addon/appsscript.json
@@ -9,7 +9,7 @@
   ],
   "addOns": {
     "common": {
-      "name": "Writing Tools",
+      "name": "Thoughtful",
       "logoUrl": "https://app.thoughtful-ai.com/assets/logo_black.png",
       "homepageTrigger": { "runFunction": "onHomepage" }
     },
diff --git a/google-docs-addon/sidebar.html b/google-docs-addon/sidebar.html
index 51a6e70b..6885dd51 100644
--- a/google-docs-addon/sidebar.html
+++ b/google-docs-addon/sidebar.html
@@ -4,7 +4,7 @@
   <base target="_top">
   <meta charset="UTF-8">
   <meta name="viewport" content="width=device-width, initial-scale=1.0">
-  <title>Writing Tools</title>
+  <title>Thoughtful</title>
   
   <style>
     /* Base styles while loading */
@@ -56,7 +56,7 @@
   <div id="root">
     <div class="loading-container">
       <div class="loading-spinner"></div>
-      <div class="loading-text">Loading Writing Tools...</div>
+      <div class="loading-text">Loading Thoughtful...</div>
     </div>
   </div>
   
@@ -211,7 +211,7 @@
       function loadFrom(base) {
         document.getElementById('root').innerHTML =
           '<div class="loading-container"><div class="loading-spinner"></div>' +
-          '<div class="loading-text">Loading Writing Tools…</div></div>';
+          '<div class="loading-text">Loading Thoughtful…</div></div>';
 
         var link = document.createElement('link');
         link.rel = 'stylesheet';
@@ -222,7 +222,7 @@
         s.src = base + '/google-docs.bundle.js';
         s.onerror = function () {
           document.getElementById('root').innerHTML =
-            '<div class="error-container"><h3>Could not load Writing Tools</h3>' +
+            '<div class="error-container"><h3>Could not load Thoughtful</h3>' +
             '<p>Failed to load the app from <code>' + base + '</code>.</p></div>';
         };
         document.body.appendChild(s);
@@ -232,7 +232,7 @@
         var root = document.getElementById('root');
         root.innerHTML =
           '<div style="padding:20px;color:#202124;">' +
-          '<p style="margin:0 0 12px;font-weight:600;">Dev mode — load Writing Tools from:</p>' +
+          '<p style="margin:0 0 12px;font-weight:600;">Dev mode — load Thoughtful from:</p>' +
           '<div id="srcButtons"></div></div>';
         var box = document.getElementById('srcButtons');
         Object.keys(SOURCES).forEach(function (key) {
diff --git a/google-docs-addon/store-listing.md b/google-docs-addon/store-listing.md
index 52be1ce7..798a4398 100644
--- a/google-docs-addon/store-listing.md
+++ b/google-docs-addon/store-listing.md
@@ -1,6 +1,6 @@
 # Application Name
 
-Thoughtful AI Tools
+Thoughtful
 
 # Short Description
 
@@ -8,7 +8,7 @@ AI helps you think and reflect while writing, not write for you.
 
 # Detailed Description
 
-Thoughtful AI Tools helps you write thoughtfully by keeping you fully engaged with your own ideas. Instead of generating text for you, it helps you see your document — its structure, main points, concepts, and gaps — so you can decide what to work on next.
+Thoughtful helps you write thoughtfully by keeping you fully engaged with your own ideas. Instead of generating text for you, it helps you see your document — its structure, main points, concepts, and gaps — so you can decide what to work on next.
 
 Open the sidebar in any document and use it to:
 
@@ -16,4 +16,4 @@ Visualize your document — generate hierarchical outlines, possible structures,
 Analyze your content — surface main points, key concepts, claims and arguments, potential counterarguments, and the questions a reader might ask.
 Find where to work next — get a prioritized list of places in your draft that could use attention, each linked directly to the relevant text.
 Jump across tabs — select a word or phrase and instantly find and navigate to where it appears in your document's other tabs.
-Every suggestion links back to specific parts of your document, so you stay grounded in your own writing. Thoughtful AI Tools is designed to support thinking and reflection — you remain the author.
\ No newline at end of file
+Every suggestion links back to specific parts of your document, so you stay grounded in your own writing. Thoughtful is designed to support thinking and reflection — you remain the author.
\ No newline at end of file

From 150b9801d10a5cc2525d45a5438e6ce67ec15c8c Mon Sep 17 00:00:00 2001
From: Claude <noreply@anthropic.com>
Date: Sat, 31 Oct 2026 22:28:27 +0000
Subject: [PATCH 2/2] Name the requesting app on the OAuth login page

The login page said "the app you came from" for every client. Look up
the authorization query's client_id in the trusted-client list and say
"<Name> wants to use Thoughtful's AI on your behalf", which matches
what the openai:chat scope grants. Only configured names can render
(and they're escaped); unknown ids keep the generic prompt.

Co-Authored-By: Claude Opus 5.5 <noreply@anthropic.com>
Claude-Session: https://claude.ai/code/session_017KwGFihH21DMyLYsDhRSFp
---
 .../oauth-provider.integration.test.ts        | 10 ++++++++
 backend/src/routes/oauth-login.ts             | 24 ++++++++++++++-----
 docs/oauth-provider.md                        |  7 ++++--
 3 files changed, 33 insertions(+), 8 deletions(-)

diff --git a/backend/src/__tests__/oauth-provider.integration.test.ts b/backend/src/__tests__/oauth-provider.integration.test.ts
index c667c245..13b40a6c 100644
--- a/backend/src/__tests__/oauth-provider.integration.test.ts
+++ b/backend/src/__tests__/oauth-provider.integration.test.ts
@@ -157,11 +157,21 @@ describe.sequential('OAuth provider (Mindmap client)', () => {
 		const html = await login.text();
 		expect(html).toContain('Sign in with Google');
 		expect(html).toContain('oauth_query');
+		// Names the requesting trusted client, so the user knows what they're connecting.
+		expect(loginUrl.searchParams.get('client_id')).toBe(CLIENT_ID);
+		expect(html).toContain('<strong>Mindmap</strong> wants to use Thoughtful');
 		// The resource is part of the signed continuation, not re-added by the page.
 		expect(loginUrl.searchParams.get('resource')).toBe(ORIGIN);
 		expect(loginUrl.searchParams.getAll('ba_param')).toContain('resource');
 	});
 
+	it('falls back to a generic login prompt for an unknown client_id', async () => {
+		const login = await app.request(`${ORIGIN}/api/oauth/login?client_id=not-a-client`);
+		const html = await login.text();
+		expect(html).toContain('the app you came from');
+		expect(html).not.toContain('<strong>');
+	});
+
 	it('resumes authorization from the login page once sign-in sets a session', async () => {
 		// The provider's continuation fires on any sign-in that sets a session cookie,
 		// so anonymous sign-in stands in for the Google callback here.
diff --git a/backend/src/routes/oauth-login.ts b/backend/src/routes/oauth-login.ts
index 99d84b43..30e0fac1 100644
--- a/backend/src/routes/oauth-login.ts
+++ b/backend/src/routes/oauth-login.ts
@@ -1,6 +1,8 @@
-// The OAuth provider's login page, shared by every trusted client: nothing on it
-// depends on which client sent the user here. The provider only redirects here
-// when there's no session, so the page is one button.
+// The OAuth provider's login page, shared by every trusted client. The only thing
+// that depends on which client sent the user here is its display name, looked up
+// from the trusted-client list by the query's client_id so an unknown id can't put
+// arbitrary text on the page. The provider only redirects here when there's no
+// session, so the page is one button.
 //
 // It hands the provider's signed authorization query back as `oauth_query` on
 // sign-in. The provider keeps it in the Google OAuth state, and once the callback
@@ -9,7 +11,9 @@
 // Only the signed parameters are sent (the subset ba_param names, plus the
 // signature), matching what the provider's own client plugin does.
 
-const LOGIN_HTML = `<!doctype html>
+import { trustedOAuthClients } from '../config.js';
+
+const loginHtml = (lede: string) => `<!doctype html>
 <html lang="en">
 <head>
   <meta charset="utf-8">
@@ -24,7 +28,7 @@ const LOGIN_HTML = `<!doctype html>
 <body>
   <h1>Sign in to Thoughtful</h1>
   <main id="app">
-    <p>Sign in to let the app you came from use Thoughtful on your behalf.</p>
+    <p>${lede}</p>
     <button id="sign-in">Sign in with Google</button>
   </main>
   <script>
@@ -45,6 +49,14 @@ const LOGIN_HTML = `<!doctype html>
 </body>
 </html>`;
 
+const escapeHtml = (text: string): string =>
+	text.replace(/[&<>"']/g, (ch) => `&#${ch.charCodeAt(0)};`);
+
 export function oauthLoginHandler(c: import('hono').Context): Response {
-	return c.html(LOGIN_HTML);
+	const clientId = c.req.query('client_id');
+	const client = trustedOAuthClients().find((entry) => entry.clientId === clientId);
+	const lede = client
+		? `<strong>${escapeHtml(client.name)}</strong> wants to use Thoughtful's AI on your behalf. Sign in to connect it.`
+		: 'Sign in to let the app you came from use Thoughtful on your behalf.';
+	return c.html(loginHtml(lede));
 }
diff --git a/docs/oauth-provider.md b/docs/oauth-provider.md
index 1887b72d..d6a4a076 100644
--- a/docs/oauth-provider.md
+++ b/docs/oauth-provider.md
@@ -41,8 +41,11 @@ not register localhost.
 ## Login
 
 When authorize finds no session, the provider redirects to `/api/oauth/login`
-with a signed copy of the authorization query. That page is one "Sign in with
-Google" button: it posts the signed query as `oauth_query` with the social
+with a signed copy of the authorization query. That page names the requesting
+client ("**Mindmap** wants to use Thoughtful's AI on your behalf"), looking up
+`client_id` in the trusted-client list so only configured names can appear; an
+unknown id gets a generic prompt. Since trusted clients skip consent, a user who
+is already signed in never sees this page. It is one "Sign in with Google" button: it posts the signed query as `oauth_query` with the social
 sign-in, the provider carries it through the Google OAuth state, and after the
 callback sets the session it re-runs authorize and redirects to the client with
 a code. A query edited after signing is refused (`invalid_signature`).