Repository navigation

Feat/desktop oauth pkce - #250

Merged

robdmac merged 21 commits into

mainfrom

feat/desktop-oauth-pkce

Jul 8, 2026

Merged

Feat/desktop oauth pkce#250
robdmac merged 21 commits into
mainfrom
feat/desktop-oauth-pkce

Commits on Jul 6, 2026
- feat(oauth): desktop public-client PKCE flow for Google integrations
  
  robdmac
  and
  claude
  committed
  fb5975c
- build(desktop): bake OAuth client creds into the bundled capnp at build time
  
  robdmac
  and
  claude
  committed
  4c5193a
Commits on Jul 7, 2026
- feat(oauth): GitHub device flow for the desktop public client
  
  robdmac
  and
  claude
  committed
  6a18b4a
- fix(desktop): enable control-plane outbound HTTPS; tighten SSRF surface
  
  robdmac
  and
  claude
  committed
  5febe2e
- feat(desktop): gate dev-auth behind a per-boot surface token
  
  robdmac
  and
  claude
  committed
  c3596f6
- feat(desktop): equip the orcabot CLI with the surface token; document boundary
  
  robdmac
  and
  claude
  committed
  3a8fb03
- test(desktop): security smoke for the dev-auth surface-token gate
  
  robdmac
  and
  claude
  committed
  1144725
- build(desktop): sync resources into target/release/resources after a rebuild
  
  robdmac
  and
  claude
  committed
  4ce444a
- feat(frontend): GitHub device-code modal for desktop connect
  
  robdmac
  and
  claude
  committed
  ee9d40e
- fix(frontend): send surface token on the desktop auth bootstrap
  
  robdmac
  and
  claude
  committed
  8950384
- fix(desktop): allow X-Orcabot-Surface through CORS; robust auth bootstrap
  
  robdmac
  and
  claude
  committed
  2293c20
- feat(desktop): OS-browser OAuth connect (open_url + connectViaBrowser) + Gmail
  
  robdmac
  and
  claude
  committed
  7959cf9
- feat(desktop): OS-browser OAuth connect for all popup-based providers
  
  robdmac
  and
  claude
  committed
  c0cc108
- fix(desktop): pass dev-auth + surface token as query params for OS-browser OAuth
  
  robdmac
  and
  claude
  committed
  08d9879
- fix(desktop): detect OAuth connect on app focus; graceful close-tab
  
  robdmac
  and
  claude
  committed
  e1e59bf
- fix(desktop): detect OAuth connect via native Tauri focus event; bake more providers
  
  robdmac
  and
  claude
  committed
  88f236c
- feat(desktop): hide Slack, Discord, and X from the canvas palette
  
  robdmac
  and
  claude
  committed
  09d146f
- feat(oauth): Microsoft PKCE public-client flow (Outlook/Calendar/Teams/OneDrive)
  
  robdmac
  and
  claude
  committed
  a943a87
- feat(oauth): Microsoft token refresh works on the public-client path
  
  robdmac
  and
  claude
  committed
  ac1479e
- feat(desktop): hide WhatsApp on desktop + hide empty messaging section
  
  robdmac
  and
  claude
  committed
  b00d01e
- fix(desktop): address review — bake only non-confidential creds; device dialog; hide Box
  
  robdmac
  and
  claude
  committed
  349186c

Commits

Commits on Jul 6, 2026

Commits on Jul 7, 2026