Without this the file was missing on first run, load_builtin_permissions()
returned {}, and the agent fell through to _DEFAULTS={Bash:'ask'} even
though the Settings UI showed green 'always_allow' checkmarks (because the
UI defaulted missing entries to always_allow for DISPLAY but the agent
defaults to ask for SAFETY). The mismatch meant users got prompted on
every ls/cd/pwd despite having flipped Bash to always_allow in the UI.
Lifespan now seeds the file with Bash=ask and everything else=always_allow,
matching agent_manager._DEFAULTS. Idempotent: only writes if a tool is
missing; never clobbers a policy the user already set.
google-workspace-mcp's gauth.py hardcodes token_uri to oauth2.googleapis.com
and uses local CLIENT_ID/SECRET on every refresh. OAuth runs through a
rotation pool on the cloud side, so the refresh_token is bound to the
pool slot that minted it, not the single client baked into the DMG, and
direct refreshes return unauthorized_client. Redirect spawn through a
shim that monkey-patches get_credentials to point token_uri at a local
proxy (/api/tools/google-oauth-token), which forwards the refresh to
api.openswarm.com/api/oauth/google/refresh (pool-aware). Unblocks every
Gmail/Drive/Calendar query for users on the cloud OAuth pool.
that dir and retry once — fixes Discord/YouTube failing with "MCP stdio process exited unexpectedly" after partial npx installs,
per-browser auto-close: spawned browser cards now disappear on their own sub-agent's completion instead of lingering until the parent agent
finishes, WebSocketManager agent:status matches by session.browser_id (spawned_by is the parent, so it never matched the finishing
sub-agent), user-created/pre-selected browsers untouched
- Bundle uv/uvx universal binaries in backend/uv-bin/ (downloaded during build)
- tools_lib: _extra_bin_dirs and _resolve_command check uv-bin/ for uvx
- build-app.sh: auto-download uv for both architectures, create universal binary
- run.sh: auto-download uv for dev mode on first run
- Removed google-workspace-mcp from requirements.txt (dependency conflict with langchain
- browser_agent.py: use get_anthropic_client instead of raw api_key, fix model map for 9Router
- credentials.py + agent_manager.py: subscription (9Router) checked before API key everywhere
- main.py: clean browser-agent endpoint, no credential params
- tools_lib.py: when uvx not found, fall back to pip-installed binary from venv
- requirements.txt: add google-workspace-mcp so it works without uvx
ciregenz