fix(google-docs): managed picker downloads with its own drive.file token

The managed Google connect doesn't grant drive.file, so the picked file can't
be read with the user's main token. The picker runs a standalone drive.file
authorization, so claim-picked now returns { fileIds, tokens } and the desktop
downloads with that fresh token via importGoogleDocWithToken — matching the
backend contract and keeping the picker self-contained (no forced reconnect).

Author: Gagancreates

apps/x/apps/main/src/google-picker-managed.ts

@@ -1,7 +1,7 @@
 import { shell, BrowserWindow } from 'electron';
 import { getWebappUrl } from '@x/core/dist/config/remote-config.js';
 import { claimPickedFilesViaBackend } from '@x/core/dist/auth/google-backend-oauth.js';
-import { importGoogleDoc } from '@x/core/dist/knowledge/google_docs.js';
+import { importGoogleDocWithToken } from '@x/core/dist/knowledge/google_docs.js';
 import type { GoogleDocListItem } from '@x/core/dist/knowledge/google_docs.js';
 
 // Managed (rowboat-mode) OAuth-redirect Picker. Unlike BYOK, the OAuth runs on
@@ -27,7 +27,9 @@ import type { GoogleDocListItem } from '@x/core/dist/knowledge/google_docs.js';
 //        client, so the desktop's existing managed token can read it.)
 //
 //   POST ${API_URL}/v1/google-oauth/claim-picked   body { session }
-//        Authenticated with the user's Rowboat bearer. Returns { fileIds: string[] }.
+//        Authenticated with the user's Rowboat bearer. Returns
+//        { fileIds: string[], tokens: { access_token, ... } } — a fresh
+//        drive.file token minted during the picker's own authorization.
 
 export interface ManagedPickResult {
   path: string;
@@ -103,14 +105,14 @@ export async function completeManagedGooglePick(session: string): Promise<void>
   focusApp();
 
   try {
-    const fileIds = await claimPickedFilesViaBackend(session);
-    if (fileIds.length === 0) {
+    const { fileIds, accessToken } = await claimPickedFilesViaBackend(session);
+    if (fileIds.length === 0 || !accessToken) {
       current.resolve(null);
       return;
     }
-    // drive.file is granted to the company client, so the user's existing
-    // managed token reads the picked file — the normal import path applies.
-    const result = await importGoogleDoc(fileIds[0], current.targetFolder);
+    // Download with the picker's own fresh drive.file token (the main
+    // connection doesn't carry drive.file).
+    const result = await importGoogleDocWithToken(fileIds[0], current.targetFolder, accessToken);
     current.resolve(result);
   } catch (error) {
     current.reject(error instanceof Error ? error : new Error(String(error)));

apps/x/packages/core/src/auth/google-backend-oauth.ts

@@ -108,21 +108,26 @@ export async function claimTokensViaBackend(state: string): Promise<OAuthTokens>
 }
 
 /**
- * Claim the Drive file ids the user selected in the managed OAuth-redirect
- * Picker, parked under `session` by the webapp picker callback. Mirrors
- * claimTokensViaBackend — the picker hands back file ids, not tokens, because
- * the desktop already holds a managed token that can read the picked files.
+ * Claim what the user selected in the managed OAuth-redirect Picker, parked
+ * under `session` by the webapp picker callback. Returns the picked file ids
+ * plus a fresh drive.file access token — the picker runs a standalone
+ * drive.file authorization (the main connection doesn't carry drive.file), so
+ * the desktop downloads the picked files with this token, not the main one.
  */
-export async function claimPickedFilesViaBackend(session: string): Promise<string[]> {
+export async function claimPickedFilesViaBackend(
+    session: string,
+): Promise<{ fileIds: string[]; accessToken: string }> {
     const res = await postWithBearer("/v1/google-oauth/claim-picked", { session });
     if (!res.ok) {
         const err = await readError(res);
         throw new Error(`claim picked files failed: ${res.status} ${err.error ?? ""}`.trim());
     }
-    const body = (await res.json()) as { fileIds?: unknown };
-    return Array.isArray(body.fileIds)
+    const body = (await res.json()) as { fileIds?: unknown; tokens?: { access_token?: unknown } };
+    const fileIds = Array.isArray(body.fileIds)
         ? body.fileIds.filter((id): id is string => typeof id === "string" && id.length > 0)
         : [];
+    const accessToken = typeof body.tokens?.access_token === "string" ? body.tokens.access_token : "";
+    return { fileIds, accessToken };
 }
 
 /**