fix(google): allow the userinfo endpoint so sends carry a display name

The composite Google connector reuses the Gmail send path, which resolves
the account's display name from Google's userinfo endpoint to build a
`"Name" <email>` From header. That endpoint was missing from this
connector's own Network allowlist, so the outbound proxy refused the
lookup and replies and forwards went out with a bare email address as the
sender — recipients saw an address instead of a name.

Connectors declare their allowlist in `build()`, and a composite does not
inherit the allowlists of the connectors whose code it reuses. Adding the
endpoint to the standalone Gmail connector therefore left the composite
still blocked, with passing tests either side of the gap. The new test
drives the composite's real `build()` and asserts the allowlist.

Also make the fallback observable. It is deliberately best-effort so a
failed lookup never blocks a send, but two paths degraded silently:

- A 403 — the endpoint missing from the allowlist, or a grant without the
  `profile` scope — logged only a generic warning. It now logs an error
  naming both causes; a 403 is a misconfiguration that degrades every
  send, not a transient blip.
- A 200 with no `name` claim, which is what a grant without the `profile`
  scope returns, threw nothing at all and silently produced a bare
  address. It now logs an error pointing at re-authorization.

`getUserInfo` throws a typed `UserInfoError` carrying the HTTP status so
callers can separate a misconfiguration from a transient failure.

Co-Authored-By: Claude Opus 4.8 <noreply@anthropic.com>

Author: KrisBraun

connectors/gmail/src/gmail-api.ts

@@ -78,6 +78,23 @@ export type SyncState = {
   historyFloor?: Date;
 };
 
+/**
+ * A non-OK response from Google's userinfo endpoint (used only to resolve the
+ * account's display name for outbound `From` headers). Carries `status` so
+ * callers can separate a misconfiguration — a 403 from the outbound proxy when
+ * the endpoint is absent from the connector's Network allowlist, or from
+ * Google when the grant lacks `profile` — from a transient failure.
+ */
+export class UserInfoError extends Error {
+  constructor(
+    public status: number,
+    public statusText: string,
+  ) {
+    super(`UserInfo error: ${status} ${statusText}`);
+    this.name = "UserInfoError";
+  }
+}
+
 export class GmailApiError extends Error {
   constructor(
     public status: number,
@@ -394,9 +411,7 @@ export class GmailApi {
       { headers: { Authorization: `Bearer ${this.accessToken}` } }
     );
     if (!response.ok) {
-      throw new Error(
-        `UserInfo error: ${response.status} ${response.statusText}`
-      );
+      throw new UserInfoError(response.status, response.statusText);
     }
     return response.json() as Promise<{ email: string; name?: string }>;
   }

connectors/gmail/src/sync.test.ts

@@ -5,6 +5,7 @@ import type { CreateLinkDraft, NewLinkWithNotes, Uuid } from "@plotday/twister";
 import {
   GmailApi,
   GmailApiError,
+  UserInfoError,
   type GmailHeader,
   type GmailMessage,
   type GmailMessagePart,
@@ -305,6 +306,59 @@ describe("onCreateLinkFn — draft.forward", () => {
     expect(raw).toContain("From: me@example.com");
     expect(raw).not.toContain('From: "');
   });
+
+  it("logs an error naming the allowlist when the userinfo lookup is blocked (403)", async () => {
+    vi.spyOn(GmailApi.prototype, "getMessage").mockResolvedValue(sourceMessage());
+    vi.spyOn(GmailApi.prototype, "getProfile").mockResolvedValue({
+      emailAddress: "me@example.com",
+    });
+    vi.spyOn(GmailApi.prototype, "getUserInfo").mockRejectedValue(
+      new UserInfoError(403, "Forbidden")
+    );
+    const sendNewMessage = vi
+      .spyOn(GmailApi.prototype, "sendNewMessage")
+      .mockResolvedValue({ id: "sent-5", threadId: "sent-thread-5" });
+    const onError = vi.spyOn(console, "error").mockImplementation(() => {});
+    const { host } = makeHost();
+
+    await onCreateLinkFn(host, forwardDraft());
+
+    // The send still goes out — the display name is best-effort.
+    const raw = decodeRawMessage(sendNewMessage.mock.calls[0][0]);
+    expect(raw).toContain("From: me@example.com");
+    expect(raw).not.toContain('From: "');
+    // A 403 is a misconfiguration, not a transient blip: say so loudly, and
+    // name the two things that actually cause it.
+    const logged = onError.mock.calls.map((c) => String(c[0])).join("\n");
+    expect(logged).toMatch(/allowlist/i);
+    expect(logged).toMatch(/profile/i);
+  });
+
+  it("logs an error and sends bare when userinfo returns no display name", async () => {
+    vi.spyOn(GmailApi.prototype, "getMessage").mockResolvedValue(sourceMessage());
+    vi.spyOn(GmailApi.prototype, "getProfile").mockResolvedValue({
+      emailAddress: "me@example.com",
+    });
+    // A grant without the `profile` scope still returns 200 here — just with
+    // no `name` claim. This degrades silently unless it's called out.
+    vi.spyOn(GmailApi.prototype, "getUserInfo").mockResolvedValue({
+      email: "me@example.com",
+    });
+    const sendNewMessage = vi
+      .spyOn(GmailApi.prototype, "sendNewMessage")
+      .mockResolvedValue({ id: "sent-6", threadId: "sent-thread-6" });
+    const onError = vi.spyOn(console, "error").mockImplementation(() => {});
+    const { host } = makeHost();
+
+    await onCreateLinkFn(host, forwardDraft());
+
+    const raw = decodeRawMessage(sendNewMessage.mock.calls[0][0]);
+    expect(raw).toContain("From: me@example.com");
+    expect(raw).not.toContain('From: "');
+    const logged = onError.mock.calls.map((c) => String(c[0])).join("\n");
+    expect(logged).toMatch(/profile/i);
+    expect(logged).toMatch(/re-auth/i);
+  });
 });
 
 function calThread(over: Record<string, unknown> = {}) {

connectors/gmail/src/sync.ts

@@ -39,6 +39,7 @@ import { enrichLinkContactsFromGoogle } from "@plotday/connector-google-contacts
 import {
   GmailApi,
   GmailApiError,
+  UserInfoError,
   type GmailMessage,
   type GmailThread,
   type AttachmentData,
@@ -1521,8 +1522,35 @@ async function saveTransformedThread(
 async function getFromHeaderFn(api: GmailApi, email: string): Promise<string> {
   try {
     const userInfo = await api.getUserInfo();
+    if (!userInfo.name) {
+      // A grant without the `profile` scope still answers 200 here — just
+      // with no `name` claim. Nothing throws, so without this the send
+      // degrades to a bare address with no trace of why.
+      console.error(
+        "[gmail] userinfo returned no display name; this connection's grant " +
+          "is likely missing the 'profile' scope. Sending with a bare From " +
+          "address until the connection is re-authorized."
+      );
+      return email;
+    }
     return formatFromHeader(email, userInfo.name);
   } catch (error) {
+    if (error instanceof UserInfoError && error.status === 403) {
+      // A 403 is a misconfiguration, not a blip, and it degrades *every*
+      // send for the connection until fixed. Either the outbound proxy
+      // rejected the URL (missing from this connector's Network allowlist —
+      // note composite connectors declare their own) or Google refused the
+      // grant. Both are silent from the recipient's side, so log loudly.
+      console.error(
+        "[gmail] userinfo lookup refused (403): the endpoint may be missing " +
+          "from this connector's Network allowlist, or the grant may lack " +
+          "the 'profile' scope. Sending with a bare From address.",
+        error
+      );
+      return email;
+    }
+    // Anything else (transient network failure, 5xx, expired token) is
+    // genuinely best-effort: the send should still go out.
     console.warn(
       "[gmail] failed to fetch display name for From header:",
       error

connectors/google/src/google.ts

@@ -125,6 +125,11 @@ export class Google extends Connector<Google> {
           "https://gmail.googleapis.com/gmail/v1/*",
           "https://people.googleapis.com/v1/*",
           "https://tasks.googleapis.com/*",
+          // The mail send path resolves the account's display name here to
+          // build a `"Name" <email>` From header. Without this entry the
+          // outbound proxy 403s the lookup and sends fall back to a bare
+          // address.
+          "https://www.googleapis.com/oauth2/v3/userinfo",
         ],
       }),
       googleContacts: build(GoogleContacts),

connectors/google/test/network-allowlist.test.ts

@@ -0,0 +1,38 @@
+import { describe, it, expect } from "vitest";
+import type { ToolBuilder } from "@plotday/twister";
+import { Google } from "../src/google";
+
+/**
+ * The composite connector reuses the mail send path from
+ * `@plotday/connector-gmail`, which resolves the account's display name from
+ * Google's userinfo endpoint to build a `"Name" <email>` From header. That
+ * lookup is a plain `fetch`, so the endpoint must be in this connector's own
+ * Network allowlist — the outbound proxy 403s anything that isn't, and the
+ * send path then silently falls back to a bare address.
+ */
+function captureNetworkUrls(): string[] | undefined {
+  let urls: string[] | undefined;
+  const builder = ((_tool: unknown, options?: { urls?: string[] }) => {
+    if (options?.urls) urls = options.urls;
+    return {} as never;
+  }) as unknown as ToolBuilder;
+
+  Google.prototype.build.call({} as Google, builder);
+  return urls;
+}
+
+describe("Google composite — network allowlist", () => {
+  it("permits the userinfo endpoint used to build the outbound From display name", () => {
+    expect(captureNetworkUrls()).toContain(
+      "https://www.googleapis.com/oauth2/v3/userinfo"
+    );
+  });
+
+  it("still permits the per-product API hosts", () => {
+    const urls = captureNetworkUrls();
+    expect(urls).toContain("https://gmail.googleapis.com/gmail/v1/*");
+    expect(urls).toContain("https://www.googleapis.com/calendar/*");
+    expect(urls).toContain("https://people.googleapis.com/v1/*");
+    expect(urls).toContain("https://tasks.googleapis.com/*");
+  });
+});