Judge access

Command Inbox OAuth is published to Production (2026-06-18). Any Google account can sign in at command-inbox.sayantanbal.in.

Open command-inbox.sayantanbal.in → Sign in with Google.
If Google shows an unverified app warning, click Advanced → Go to Command Inbox (unsafe) — expected until Google completes OAuth verification (submitted; pending approval).
Connect Gmail + Calendar on onboarding (or click Skip to inbox on the working-days step).
Follow the Evaluator guide — 5-minute walkthrough on your own inbox.

We do not publish shared demo passwords. Every judge uses their own Gmail.

Plan B — Testing mode + test users

If Production sign-in fails unexpectedly:

Open a GitHub issue with your Gmail address.
Wait for confirmation your email was added to OAuth Test users in Google Cloud Console.
Retry sign-in.

Until your email is on the test-user list (Testing mode only), Google shows Access blocked.

Agent demo without real contacts

The agent demo uses a synthetic contact — no email required:

During onboarding, click Load demo contacts (or import in Settings → Contacts).
This adds friend@corsair.dev for calendar invite demos.
In the Agent panel, try: "Send a calendar invite to friend@corsair.dev at 9 AM next Thursday and email them to confirm."
Approve create_calendar_invite and send_email when prompted — nothing sends without your click.

See also: Evaluator guide § Agent · Agent chat.

Before the demo

Use a desktop browser (Chrome or Edge recommended).
Prefer a fully indexed inbox for semantic search (/) — fresh accounts still get the last 50 threads classified immediately; background indexing continues with a progress banner.
Optional: send yourself a scheduling email from another account to populate the Schedule lane before trying M.

Scopes requested

Scope	Purpose
Gmail read/send/modify	Inbox, compose, archive, search
Calendar read/write	Events, invites, focus blocks

If a judge sees "Access blocked"

OAuth app reverted to Testing and their email is not on Test users — open a judge-access issue.
They signed in with a different Google account than the one added.
Production GOOGLE_CLIENT_ID / GOOGLE_CLIENT_SECRET do not match the OAuth app in GCP.

If a judge sees "unverified app"

Expected while Google verification is pending. Click Advanced → continue. The app is published; verification removes the warning (2–12+ weeks for Gmail scopes).

Demo account tips

Use a real inbox with a few scheduling threads in the Schedule lane for the M hero flow.
Send yourself a test email 30s before a live demo to show webhook → lane update.
Keep at least one AI provider key funded on the server (GOOGLE_GENERATIVE_AI_API_KEY or OPENAI_API_KEY) or add your own key under Settings → AI.

Pre-indexed inbox (recommended)

For the best semantic search (/) experience:

Sign in and connect Google.
Wait until the activity bar shows indexing complete (no “Indexing N more threads…” banner).
Confirm / returns results for phrases in your mail.

Fresh connects still work: the last 50 threads get lanes immediately; older mail indexes in the background.

Calendar webhook security

Calendar push notifications require a stored channel token and an HTTPS APP_URL.

Local dev: Google rejects http://localhost. Use ngrok:

ngrok http 3000
# Set APP_URL=https://YOUR-SUBDOMAIN.ngrok-free.app in .env.local
bun scripts/renew-watches.ts

Production: set APP_URL to your Vercel domain, then reload /inbox once or run bun scripts/renew-watches.ts.

Until renewal succeeds on HTTPS, calendar webhooks return 503 Calendar watch not configured.