lukasandClaude Opus 4.8
e5a87b37b1
Implements SPEC v1.5 §6.2.1–6.2.3 so Gmail (and Yahoo/iCloud/Outlook-personal) onboard via a provider app password on the existing plain-password sync path — no OAuth, no new sync code. Gmail was oauth2-only with OAuth unimplemented, so it was previously un-addable. Backend: - presets.yaml: each preset declares an ordered `auth_strategy`; Gmail becomes `auth: password` + `[app_password, oauth2]`. App-password providers ship a data-driven `help:` block (deep_link, app_name_hint, i18n step keys, docs_url). - discovery/types: CandidateConfig carries `auth_strategy` + `HelpBlock`; presets load them and autoconfig candidates derive a default from the detected auth. - schemas/api: CandidateOut exposes auth_strategy + help; DiscoverResponse adds `google_oauth_enabled`. - config: GOOGLE_OAUTH_ENABLED flag (default false) gates the OAuth fallback. Frontend: - ProviderCredentialPanel (wizard step 1.5): deep-link popup (user gesture), rendered steps, single paste field that strips whitespace, instant verify (auto POST /accounts/test at 16 chars → Connected ✓ / mapped error), and the auth_failed recovery branch with a gated "Sign in with Google instead" button. - AccountWizard routes app-password providers to the panel, then a details step. - i18n keys (en) for the panel + provider steps. Honors the §6.2.2 prohibitions: no page automation, no real-password capture, no scraping — deep-link + guide + paste + test only. Adds the v1.5 spec. Co-Authored-By: Claude Opus 4.8 <noreply@anthropic.com> Claude-Session: https://claude.ai/code/session_01U72FZiF1W1pb8XxyWBTREA