Configuration

Row config for the gmail row (full row replacement semantics — patches restate every field):

Field	Default	Meaning
`clientIdEnv`	`GMAIL_OAUTH_CLIENT_ID`	Credential-store ref / env name for the client id
`clientSecretEnv`	`GMAIL_OAUTH_CLIENT_SECRET`	Credential-store ref / env name for the client secret
`clientId`	`''`	Literal fallback when no ref is set (discouraged)
`clientSecret`	`''`	Literal fallback (discouraged)
`scopes`	`[openid, email, gmail.modify]`	OAuth scopes; `https://www.googleapis.com/auth/gmail.modify` covers read + send + labels. The `openid`/`email` scopes are required — the token exchange works without them, but Google's userinfo endpoint (where the account email is read) rejects tokens lacking `openid` with 401 "Invalid Credentials". Narrower scopes (`gmail.readonly`) work for the read tools; sending requires the `modify` scope. Source of truth is `DEFAULT_SCOPES` in `src/config.js` — the bundle's own patch layer deliberately omits this key (an explicit patch value overrides the defaults, and a stale restated list once silently defeated an openid fix on every restart); override it in your own profile patch layer if you need to
`callbackHost`	`127.0.0.1`	Loopback callback host (Desktop clients accept any local port)
`callbackPath`	`/gmail/callback`	Callback path
`defaultAccount`	`''`	Account used when a tool omits `account` (auto-resolved when exactly one account is authorized)
`authTimeoutMs`	`300000`	How long `/gmail auth` waits for the browser callback
`requireApproval.send`	`true`	Ask the user before `gmail_send`
`requireApproval.labels`	`true`	Ask the user before `gmail_labels`
`context.enabled`	`true`	Emit the model-context section once authorized
`context.order`	`117`	Section order in the system prompt (kept clear of stock bundles)

gmail-dsh

安装

说明文档

Configuration