connect-google

Give the user's agents their Google account through gog (Gmail, Calendar, Drive, Docs, Sheets, Slides, Contacts, Tasks). Do every step yourself in Chrome AI with the dev-browser skill; the user only chooses their account and clicks "Allow" in Google's pages. Talk to the user in their language, short messages, no jargon (never say "OAuth", "client secret", "scope" or "token" to them; say "Google access" and "the key").

If you got this skill from a link instead of a local folder, install nothing else from the repo: download scripts/gog-oauth.sh with curl -fsSL https://raw.githubusercontent.com/Melvynx/ai-maxxing-skills/main/skills/connect-google/scripts/gog-oauth.sh -o <scratch>/gog-oauth.sh, and read another skill it names only when you reach it, from https://raw.githubusercontent.com/Melvynx/ai-maxxing-skills/main/skills/<skill-name>/SKILL.md.

Never print, log or repeat the key's secret, a sign-in code or anything gog keeps in the Keychain. Browser scripts that read the secret write it straight to a file with writeFile and log only { saved: true }. Ask the user before you tick a Google terms box or publish the app (steps 3 and 6), once for both.

1. Check the tools. chrome-ai start and dev-browser --help must answer (otherwise run setup-dev-browser). gog auth setup --help must answer: if gog is missing or too old to know auth setup, install it. On macOS: brew trust --formula openclaw/tap/gogcli && brew install openclaw/tap/gogcli (if an older gog from steipete/tap is there, brew uninstall gogcli first; the accounts it saved stay). On Linux: the linux_<arch> archive from https://github.com/openclaw/gogcli/releases, checked against its checksums.txt, then gog in ~/.local/bin. Then jq --version.

2. Pick the account: the argument, or the Google account signed in to Chrome AI (open https://myaccount.google.com in a page named connect-google and read the email). If Chrome AI is not signed in to Google, ask the user to sign in there and say "done". If gog auth list --check --json --no-input already lists that email, skip to step 9.

3. If gog auth credentials list --json --no-input already lists a client, skip to step 8. Otherwise find or create the Google Cloud project, in the page connect-google. Open https://console.cloud.google.com/cloud-resource-manager and look for a project named gog CLI: reuse its ID. If there is none, open https://console.cloud.google.com/projectcreate, name it gog CLI, create it, wait for the notification, and read its ID (the project= part of the address once it opens). On a first visit, Google Cloud asks for a country and its terms: ask the user before you accept. Read each page with snapshotForAI() before clicking: the console speaks the user's language and moves its buttons.

4. Turn on the Google services: open https://console.cloud.google.com/flows/enableapi?apiid=gmail.googleapis.com,calendar-json.googleapis.com,drive.googleapis.com,docs.googleapis.com,sheets.googleapis.com,slides.googleapis.com,people.googleapis.com,tasks.googleapis.com&project=<id> and confirm. Wait until the page says they are on.

5. Set up the sign-in screen: open https://console.cloud.google.com/auth/overview?project=<id>. If it offers to get started, fill: app name gog CLI, support email = the account, audience External, contact email = the account, tick the Google API Services User Data Policy box, then create. If it is already set up, keep it as it is.

6. Keep the access for good: open https://console.cloud.google.com/auth/audience?project=<id>. If the status is "Testing", click "Publish app" and confirm. A Testing app loses Google access every 7 days; published, it keeps it (Google does not review a personal app, it only shows a warning when signing in).

7. Create the key: open https://console.cloud.google.com/auth/clients/create?project=<id>, type Desktop app, name gog CLI, create. In the same browser script, read the client ID and the secret from the dialog that opens and save them without logging them:

   await writeFile("gog-client.json", JSON.stringify({ installed: { client_id, client_secret, auth_uri: "https://accounts.google.com/o/oauth2/auth", token_uri: "https://oauth2.googleapis.com/token", redirect_uris: ["http://localhost"] } }));
   console.log(JSON.stringify({ saved: true, client_id_end: client_id.slice(-30) }));
   

Then gog auth credentials set ~/.dev-browser/tmp/gog-client.json --no-input && rm -f ~/.dev-browser/tmp/gog-client.json, and gog auth credentials list lists default. The secret is shown only once: if the dialog closed before you read it, create a new key the same way (an existing gog CLI key cannot be read again). 8. Connect the account: bash scripts/gog-oauth.sh <email> (add a second argument like gmail,calendar to ask for less). Run it in the background: it opens Google's sign-in page in Chrome AI and waits up to 10 minutes. Tell the user right away, in 3 short lines: in the Chrome AI window, pick <email>; on "Google hasn't verified this app", click Continue (it is their own app); tick every access asked and click Continue. It ends with connected=<email> services=.... Exit code 4 means they did not allow access in time: ask, then run it again. On macOS, the first time, a Keychain window asks to let gog save its access: tell them to click "Always Allow". 9. Prove it works with real reads: gog --account <email> gmail search 'newer_than:7d' --max 3 --json --wrap-untrusted and gog --account <email> calendar events --today --json. Both must answer without an error. If Google says a service is off, redo step 4 for it. 10. Teach every agent: npx skills add openclaw/gogcli -g -a claude-code -s gog -y installs gog's own skill. Then add export GOG_ACCOUNT=<email> once (never twice) to ~/.zshrc and ~/.zprofile (or ~/.bashrc and ~/.bash_profile), so gog uses this account without --account. If the user has a brain folder with an AGENTS.md, add one line there: Google (Gmail, Calendar, Drive, Docs, Sheets) goes through gog, account <email>, read before writing, ask before sending an email or changing a calendar. 11. Another account: run step 8 again with the other email (same key, nothing to redo in Google Cloud), then use --account <email> to pick it.

End with a short check list, a check or a cross on each line: gog installed, Google Cloud project, services on, app published, key saved in gog, account connected, Gmail and Calendar answer, agents taught. Then tell the user in 3 lines: their Google is connected, a new session can read their mail, calendar and files, and one thing to try now, for example "What is on my calendar tomorrow?".