Fix Google OAuth service policies

[RhysSullivan]

What changed

• add an audited per-service Google OAuth policy for all 22 Discovery integrations
• request the scopes each ordinary-user service actually needs and filter methods that require admin, app, partner, or domain-wide delegation credentials
• fix OAuth alternative-scope semantics, scope compaction, required action inputs, and health probes
• hide unsupported Google Keep user OAuth and remove retired Google Photos sharing actions
• update the public Google data-use disclosures for the expanded first-party bundle

Why

The earlier Gmail fix exposed one instance of a broader issue: Discovery documents list alternative scopes and mixed credential modes, but Executor treated them as cumulative or universally callable. This left some tools missing, some tools guaranteed to fail, and some generated OAuth metadata overprivileged.

Validation

• live conversion against the current Discovery documents for all 22 services
• OpenAPI package: 46 files, 283 tests passed
• provider service split: 2 files, 36 tests passed
• Cloud and e2e typechecks passed
• marketing typecheck and production build passed
• repository lint, changelog, formatting, and diff checks passed

[github-actions]

Cloudflare preview

Torn down — the PR is closed.

[pkg-pr-new]

Open in StackBlitz

@executor-js/codemode-core

npm i https://pkg.pr.new/@executor-js/codemode-core@1669

@executor-js/runtime-quickjs

npm i https://pkg.pr.new/@executor-js/runtime-quickjs@1669

@executor-js/cli

npm i https://pkg.pr.new/@executor-js/cli@1669

@executor-js/config

npm i https://pkg.pr.new/@executor-js/config@1669

@executor-js/execution

npm i https://pkg.pr.new/@executor-js/execution@1669

@executor-js/sdk

npm i https://pkg.pr.new/@executor-js/sdk@1669

@executor-js/plugin-file-secrets

npm i https://pkg.pr.new/@executor-js/plugin-file-secrets@1669

@executor-js/plugin-graphql

npm i https://pkg.pr.new/@executor-js/plugin-graphql@1669

@executor-js/plugin-keychain

npm i https://pkg.pr.new/@executor-js/plugin-keychain@1669

@executor-js/plugin-mcp

npm i https://pkg.pr.new/@executor-js/plugin-mcp@1669

@executor-js/plugin-onepassword

npm i https://pkg.pr.new/@executor-js/plugin-onepassword@1669

@executor-js/plugin-openapi

npm i https://pkg.pr.new/@executor-js/plugin-openapi@1669

executor

npm i https://pkg.pr.new/executor@1669

commit: e77e09c

[cloudflare-workers-and-pages]

Deploying with Cloudflare Workers

The latest updates on your project. Learn more about integrating Git with Workers.

Status	Name	Latest Commit	Updated (UTC)
✅ Deployment successful! View logs	executor-cloud	42d4e49	Aug 18 2026, 11:42 PM

[cloudflare-workers-and-pages]

Deploying with Cloudflare Workers

The latest updates on your project. Learn more about integrating Git with Workers.

Status	Name	Latest Commit	Preview URL	Updated (UTC)
✅ Deployment successful! View logs	executor-marketing	42d4e49	Commit Preview URL Branch Preview URL	Aug 18 2026, 11:42 PM