feat(extensions): add OAuth setup UI for WASM tools + display name labels (#437)

Add setup.required_secrets to tool capabilities.json files so users can
configure OAuth client credentials (Google, Slack, Okta, Telegram) through
the Extensions UI Setup modal instead of environment variables.

- Add ToolSetupSchema/ToolSecretSetupSchema types to capabilities_schema.rs
- Extend get_setup_schema(), save_setup_secrets(), list() to handle WasmTool
- Extract load_tool_capabilities() helper to reduce duplication
- Auto-activate tools after saving setup secrets
- Show display_name labels (Channel/Tool/MCP) in extension cards
- Update button labels: "Setup" when unconfigured, "Reconfigure" when set
- Replace "Set" badge with checkmark in configure modal
- Fix innerHTML XSS pattern in slash autocomplete (use textContent)
- Add tests for ToolSetupSchema parsing and resolve_nested promotion
- Update registry display names (e.g. "Telegram Channel" vs "Telegram Tool")

Co-authored-by: Claude Sonnet 4.6 <[email protected]>

tools-src/gmail/gmail-tool.capabilities.json

@@ -42,5 +42,17 @@
       }
     },
     "env_var": "GOOGLE_OAUTH_TOKEN"
+  },
+  "setup": {
+    "required_secrets": [
+      {
+        "name": "google_oauth_client_id",
+        "prompt": "Google OAuth Client ID (from console.cloud.google.com/apis/credentials)"
+      },
+      {
+        "name": "google_oauth_client_secret",
+        "prompt": "Google OAuth Client Secret"
+      }
+    ]
   }
 }

tools-src/google-calendar/google-calendar-tool.capabilities.json

@@ -41,5 +41,17 @@
       }
     },
     "env_var": "GOOGLE_OAUTH_TOKEN"
+  },
+  "setup": {
+    "required_secrets": [
+      {
+        "name": "google_oauth_client_id",
+        "prompt": "Google OAuth Client ID (from console.cloud.google.com/apis/credentials)"
+      },
+      {
+        "name": "google_oauth_client_secret",
+        "prompt": "Google OAuth Client Secret"
+      }
+    ]
   }
 }

tools-src/google-docs/google-docs-tool.capabilities.json

@@ -41,5 +41,17 @@
       }
     },
     "env_var": "GOOGLE_OAUTH_TOKEN"
+  },
+  "setup": {
+    "required_secrets": [
+      {
+        "name": "google_oauth_client_id",
+        "prompt": "Google OAuth Client ID (from console.cloud.google.com/apis/credentials)"
+      },
+      {
+        "name": "google_oauth_client_secret",
+        "prompt": "Google OAuth Client Secret"
+      }
+    ]
   }
 }

tools-src/google-drive/google-drive-tool.capabilities.json

@@ -46,5 +46,17 @@
       }
     },
     "env_var": "GOOGLE_OAUTH_TOKEN"
+  },
+  "setup": {
+    "required_secrets": [
+      {
+        "name": "google_oauth_client_id",
+        "prompt": "Google OAuth Client ID (from console.cloud.google.com/apis/credentials)"
+      },
+      {
+        "name": "google_oauth_client_secret",
+        "prompt": "Google OAuth Client Secret"
+      }
+    ]
   }
 }

tools-src/google-sheets/google-sheets-tool.capabilities.json

@@ -41,5 +41,17 @@
       }
     },
     "env_var": "GOOGLE_OAUTH_TOKEN"
+  },
+  "setup": {
+    "required_secrets": [
+      {
+        "name": "google_oauth_client_id",
+        "prompt": "Google OAuth Client ID (from console.cloud.google.com/apis/credentials)"
+      },
+      {
+        "name": "google_oauth_client_secret",
+        "prompt": "Google OAuth Client Secret"
+      }
+    ]
   }
 }

tools-src/google-slides/google-slides-tool.capabilities.json

@@ -41,5 +41,17 @@
       }
     },
     "env_var": "GOOGLE_OAUTH_TOKEN"
+  },
+  "setup": {
+    "required_secrets": [
+      {
+        "name": "google_oauth_client_id",
+        "prompt": "Google OAuth Client ID (from console.cloud.google.com/apis/credentials)"
+      },
+      {
+        "name": "google_oauth_client_secret",
+        "prompt": "Google OAuth Client Secret"
+      }
+    ]
   }
 }

tools-src/okta/okta-tool.capabilities.json

@@ -89,5 +89,17 @@
     "setup_url": "https://developer.okta.com/docs/guides/implement-oauth-for-okta/main/",
     "token_hint": "OAuth2 access token (JWT)",
     "env_var": "OKTA_OAUTH_TOKEN"
+  },
+  "setup": {
+    "required_secrets": [
+      {
+        "name": "okta_oauth_client_id",
+        "prompt": "Okta OAuth Client ID"
+      },
+      {
+        "name": "okta_oauth_client_secret",
+        "prompt": "Okta OAuth Client Secret"
+      }
+    ]
   }
 }

tools-src/slack/slack-tool.capabilities.json

@@ -46,5 +46,17 @@
     "setup_url": "https://api.slack.com/apps",
     "token_hint": "Starts with 'xoxb-'",
     "env_var": "SLACK_BOT_TOKEN"
+  },
+  "setup": {
+    "required_secrets": [
+      {
+        "name": "slack_oauth_client_id",
+        "prompt": "Slack OAuth Client ID (from api.slack.com/apps)"
+      },
+      {
+        "name": "slack_oauth_client_secret",
+        "prompt": "Slack OAuth Client Secret"
+      }
+    ]
   }
 }

tools-src/telegram/telegram-tool.capabilities.json

@@ -24,5 +24,17 @@
     "display_name": "Telegram",
     "instructions": "1. Go to https://my.telegram.org/apps and create an app\n2. Store your API ID and hash in the workspace:\n   - Write your numeric API ID to telegram/api_id\n   - Write your API hash string to telegram/api_hash\n3. Use the 'login' action with your phone number\n4. Use 'submit_auth_code' with the code you receive\n5. Use 'submit_2fa_password' if you have 2FA enabled\n6. Save the returned session JSON to telegram/session.json",
     "setup_url": "https://my.telegram.org/apps"
+  },
+  "setup": {
+    "required_secrets": [
+      {
+        "name": "telegram_api_id",
+        "prompt": "Telegram API ID (from my.telegram.org/apps)"
+      },
+      {
+        "name": "telegram_api_hash",
+        "prompt": "Telegram API Hash"
+      }
+    ]
   }
 }