docs: document oauth auth login

docs/current_roadmap.md

@@ -103,10 +103,11 @@ auth admin are implemented. The next work is polish, not new broad surfaces.
   remains in `wf_transport_rpc_http`:
   [`server CLI and transport boundary`](superpowers/specs/2026-06-10-server-cli-transport-boundary.md).
 - Next auth work: typed/discriminated auth records and source-owned auth binders
-  (`McpAuthBinder` first) are now completed. Remaining: OAuth refresh-token
+  (`McpAuthBinder` first) are now completed. Remaining: Google Drive MCP smoke
-  support and Google Drive MCP smoke through
+  through `https://drivemcp.googleapis.com/mcp/v1` (manual/local-only, requires
-  `https://drivemcp.googleapis.com/mcp/v1`. Production secret manager
+  Google OAuth client credentials). OAuth refresh-token support and provider
-  integration and encrypted-at-rest file format remain deferred.
+  profiles are now implemented. Production secret manager integration and
+  encrypted-at-rest file format remain deferred.
 - Active specs:
   - [`workflow config targets and sources`](superpowers/specs/2026-06-03-workflow-config-targets-and-sources.md)
   - [`store-backed source registry`](superpowers/specs/2026-06-03-store-backed-source-registry-design.md)

docs/superpowers/specs/2026-06-06-auth-source-secrets-boundary.md

@@ -363,17 +363,21 @@ Do not inline secret payloads into:
    - Move MCP header/env interpretation behind `McpAuthBinder`.
    - Keep source providers responsible for declaring supported auth variants.
 
-7. **OAuth refresh-token support**
+7. **OAuth refresh-token support** (implemented)
    - Add `oauth_refresh_token` variant and injected token refresher protocol.
    - Apply OAuth records as bearer headers for HTTP-capable MCP sources.
    - Unit-test with a fake refresher; do not require Google or browser login.
+   - Provider profiles in workflow config describe OAuth login parameters.
+   - CLI command `wf admin auth oauth-login` exchanges authorization codes
+     and saves refresh tokens as typed auth records.
 
-8. **Google Drive MCP smoke**
+8. **Google Drive MCP smoke** (manual/local-only)
    - Configure a normal HTTP MCP source:
      `https://drivemcp.googleapis.com/mcp/v1`.
    - Bind it to an OAuth refresh-token auth record.
    - Verify `list_tools` or a harmless read-only tool through the durable server
      path when local credentials are available.
+   - Requires local Google OAuth client credentials; not automated in CI.
 
 ## Open Decisions
 

docs/wf_cli.md

@@ -407,6 +407,51 @@ wf admin auth delete drive.work --confirm
 Use source `auth_ref` values to point sources at these records. Do not commit
 payload files containing real secrets.
 
+### Google Drive MCP OAuth Setup
+
+Google Drive MCP is a remote HTTP MCP source:
+
+```json
+{
+  "sources": [
+    {
+      "id": "google.drive",
+      "kind": "mcp",
+      "transport": {
+        "kind": "http",
+        "url": "https://drivemcp.googleapis.com/mcp/v1"
+      },
+      "auth_ref": "google.drive.personal"
+    }
+  ],
+  "auth": {
+    "providers": {
+      "google": {
+        "kind": "oauth_authorization_code_pkce",
+        "auth_url": "https://accounts.google.com/o/oauth2/v2/auth",
+        "token_url": "https://oauth2.googleapis.com/token",
+        "client_id_env": "GOOGLE_OAUTH_CLIENT_ID",
+        "client_secret_env": "GOOGLE_OAUTH_CLIENT_SECRET",
+        "scopes": [
+          "https://www.googleapis.com/auth/drive.readonly"
+        ]
+      }
+    }
+  }
+}
+```
+
+Run OAuth login:
+
+```bash
+wf --config wf.config.json admin auth oauth-login google \
+  --id google.drive.personal \
+  --authorization-response "<redirected URL>"
+```
+
+Refresh tokens are sensitive. The local file auth store is plaintext and
+intended for local/dev use only.
+
 ### `source_missing`
 
 A required logical source is not available or not bound.