add oauth apps support

[jaxxstorm]

Signed-off-by: Lee Briggs lee@leebriggs.co.uk

[chatgpt-codex-connector]

💡 Codex Review

Here are some automated review suggestions for this pull request.

Reviewed commit: bf772996c1

ℹ️ About Codex in GitHub

Your team has set up Codex to review pull requests in this repo. Reviews are triggered when you

• Open a pull request for review
• Mark a draft as ready
• Comment "@codex review".

If Codex has suggestions, it will comment; otherwise it will react with 👍.

Codex can also answer questions or update the PR. Try commenting "@codex address that feedback".

[Copilot]

🟡 Not ready to approve

The Makefile/test harness changes introduce concrete workflow regressions (broken test-unit, misplaced diff output, and weakened example-output assertions) that should be fixed before merging.

Once you've addressed the issues Copilot identified, you can request another Copilot review.

This review doesn't count toward merge requirements. Sign up for the private preview to control whether Copilot approvals count.

Pull request overview

This PR adds first-class OAuth app command support to tscli, updates the pinned OpenAPI snapshot and coverage artifacts accordingly, and refactors the OpenAPI refresh / coverage-gap tooling into a dedicated tools Go module (wired into make and CI).

Changes:

• Add create/get/list/set/delete oauth-app(s) CLI commands, docs, and integration/example-output tests.
• Refresh pinned OpenAPI schema + metadata and extend coverage mapping/property coverage for the new endpoints and models.
• Introduce a tools/ Go module + go.work, refactoring openapirefresh and coveragegaps into importable packages with cmd/ entrypoints, and run tool tests in CI.

File summaries

File	Description
tools/internal/openapirefresh/openapirefresh.go	Refactor OpenAPI refresh tool into a reusable package with Options/Run.
tools/internal/openapirefresh/openapirefresh_test.go	Align tests with new openapirefresh package name.
tools/internal/coveragegaps/properties.go	Register OAuth app types for property coverage reflection.
tools/internal/coveragegaps/properties_test.go	Align tests with new coveragegaps package name.
tools/internal/coveragegaps/coveragegaps.go	Refactor coverage-gaps tool into a reusable package with Options/Run.
tools/internal/coveragegaps/coveragegaps_test.go	Align tests with new coveragegaps package name.
tools/go.sum	Add checksums for the new tools module dependencies.
tools/go.mod	Introduce tools Go module with workspace replace back to repo root.
tools/cmd/openapirefresh/main.go	New CLI entrypoint for OpenAPI refresh tool.
tools/cmd/coveragegaps/main.go	New CLI entrypoint for coverage-gaps tool.
test/cli/testdata/leaf_commands.txt	Add OAuth app commands to the leaf command manifest.
test/cli/group_integration_test.go	Add mocked-API integration coverage for OAuth app commands.
test/cli/example_output_test.go	Add OAuth app examples + adjust output-shape assertions.
pkg/contract/openapi/tailscale-v2-openapi.yaml	Add OAuth apps tag, paths, params, and schemas to pinned snapshot.
pkg/contract/openapi/snapshot-metadata.yaml	Update snapshot metadata for refreshed OpenAPI schema.
pkg/contract/openapi/command-operation-map.yaml	Map new oauth-app commands to OpenAPI operations.
pkg/apitype/models.go	Add OAuth app request/response models.
Makefile	Switch coverage tooling to tools/ module binaries; update paths and CI/test hooks.
go.work	Add workspace including root + tools module.
docs/commands/tscli_set.md	Link new tscli set oauth-app command doc.
docs/commands/tscli_set_oauth-app.md	Generated doc for tscli set oauth-app.
docs/commands/tscli_list.md	Link new tscli list oauth-apps command doc.
docs/commands/tscli_list_oauth-apps.md	Generated doc for tscli list oauth-apps.
docs/commands/tscli_get.md	Link new tscli get oauth-app command doc.
docs/commands/tscli_get_oauth-app.md	Generated doc for tscli get oauth-app.
docs/commands/tscli_delete.md	Link new tscli delete oauth-app command doc.
docs/commands/tscli_delete_oauth-app.md	Generated doc for tscli delete oauth-app.
docs/commands/tscli_create.md	Link new tscli create oauth-app command doc.
docs/commands/tscli_create_oauth-app.md	Generated doc for tscli create oauth-app.
docs/commands/README.md	Add OAuth app command docs to generated index.
docs/commands/_sidebar.md	Add OAuth app command docs to sidebar nav.
coverage/property-coverage.yaml	Declare property coverage evidence for OAuth app operations.
coverage/coverage-gaps.md	Updated coverage report including OAuth app properties/operations.
coverage/coverage-gaps.json	Updated machine-readable coverage report including OAuth app entries.
cmd/tscli/set/cli.go	Wire OAuth app “set” subcommand into tscli set.
cmd/tscli/oauthapp/cli.go	Implement OAuth app CRUD/list commands using tscli.Do.
cmd/tscli/list/cli.go	Wire OAuth app “list” subcommand into tscli list.
cmd/tscli/get/cli.go	Wire OAuth app “get” subcommand into tscli get.
cmd/tscli/delete/cli.go	Wire OAuth app “delete” subcommand into tscli delete.
cmd/tscli/create/cli.go	Wire OAuth app “create” subcommand into tscli create.
.opencode/skills/openapi-refresh/SKILL.md	Add workflow guidance for refreshing pinned OpenAPI snapshot.
.opencode/skills/coverage-gaps/SKILL.md	Add workflow guidance for running coverage-gap analysis.
.github/workflows/ci.yml	Run go test for both root module and tools/ module.
.codex/skills/openapi-refresh/SKILL.md	Duplicate skill doc under .codex for OpenAPI refresh workflow.
.codex/skills/coverage-gaps/SKILL.md	Duplicate skill doc under .codex for coverage-gaps workflow.

Review details

Suppressed comments (1)

Makefile:30

• make test-unit currently runs go test ./coverage/coveragegaps, but that directory no longer exists, so the target will fail. Update the target to run unit tests for the root module and the tools module packages instead.

test-unit:
	$(GO_TEST) ./coverage/coveragegaps ./pkg/...
	$(GO_TEST) ./test/cli -run 'Test(Leaf|Version|Config|Do|Load)'

• Files reviewed: 41/45 changed files
• Comments generated: 2
• Review effort level: Lite

We're testing this review assessment. Please use 👍 or 👎 to tell us if it's correct.