Code Review Summary

This PR makes a single targeted change to templates/mail/server/handlers/google-auth.ts: in dev mode (when session.email === "local@localhost"), getGoogleStatus now calls getAuthStatus(undefined) instead of getAuthStatus("local@localhost"), making all production-connected OAuth accounts visible locally when sharing a Neon Postgres DB.

Risk: Standard — touches auth/session ownership logic.

Security: The local@localhost sentinel is structurally impossible in production (the Google auth plugin resolves real emails from session cookies), so there is no cross-environment leak risk.

Key Finding:

The fix is incomplete — getGoogleStatus now exposes all accounts in dev, but the rest of the mail backend still filters by the local@localhost owner. disconnectGoogle still calls getAuthStatus(session.email) for its ownership check, so any account owned by a production email will show in the UI but return 403 when you try to disconnect it. Similarly, the email-fetching handlers (listEmails, getThreads, sendEmail, etc.) continue to call isConnected("local@localhost") and getAccountTokens("local@localhost"), so those production-owned accounts won't actually serve mail data. The newly visible accounts are visible but not usable.

Confirmed by: 2 out of 2 code-review agents.

Found using 2 parallel code-review agent calls with randomized file ordering.

Incremental Review — PR #97 (3rd pass)

This incremental review covers the latest two commits: getAccountTokens() bypass in emails.ts and Postgres onnotice suppression in packages/core/src/db/client.ts.

Previous finding resolved ✅ — The disconnect (403) issue is fixed via the getAuthStatus() lib-level bypass. The getAccountTokens() bypass now correctly resolves tokens for all accounts in dev mode, fixing label loading.

One gap remains: getClients() in google-auth.ts was not updated with the local@localhost bypass. This creates an internal inconsistency: isConnected("local@localhost") now returns true (any account), but getClients("local@localhost") still calls listOAuthAccountsByOwner("google", "local@localhost") — which returns [] for accounts created in production. listGmailMessages gets zero clients and silently returns { messages: [], errors: [] }, so the inbox appears empty with no error. This is the primary user-visible failure in the shared-Neon scenario the PR targets.

onnotice suppression is safe — postgres.js only routes server NOTICE messages through this callback; query errors are still thrown normally.

Risk: Standard — auth/session ownership logic in mail template backend.

Found using 2 parallel code-review agent calls with randomized file ordering.