Accounts: each sign-in lands in its own gmail:account:<email> profile;
gmail:default shrinks to the default pointer + filters. A legacy token-bearing
default migrates lazily into one account (no user action). The three gmail
tools take an optional account argument (default fallback), name the mailbox
in results and approval args, and broker refresh targets account-keyed
profiles.
Filters: senders (addr or @domain) and label names, enforced in the DESKTOP
tool layer - matching messages silently omitted from search, a direct fetch
reads like a real 404, no tombstone an agent could probe. The hidden count
rides a _display sidecar on the tool-result message (mirroring source):
persisted for the GUI, stripped from every provider feed, audited as
rule+count, and shown on the tool card / step-group line.
GUI: GmailDetail page (Accounts with Default badge + per-account disconnect,
one-click add, filter chip rows, collapsed Tools); routes for account
disconnect/default and PATCH filters.
Any test that built a SessionManager without COWORKER_STATE_DIR read the
developer's machine-global SecretStore — including their real cloud
sign-in, so test session creation emitted REAL coworker_session_created
events to prod (discovered as burst noise in the telemetry table). Six
tests turned out to be riding the developer's connected Slack profile for
inbound-delivery gating; they now connect a fake Slack in their own store.
Side effect: the suite is ~45% faster (no live telemetry threads).
Connector inbound messages carry a display-only source sidecar so the GUI
renders a rich card (logo, channel/person names, ids-on-hover, time) while
the model still receives the framed text. The sidecar is persisted with the
message and stripped unconditionally before the provider feed. Frontend adds
ConnectorMessageCard wired through an extracted, testable itemsFromMessages.
Rohit C Prasad