google-workspace

Google Workspace

Use this skill for Google Workspace tasks (Gmail, Drive, Calendar, Docs, Sheets, etc.).

Files

• scripts/auth.js — OAuth login/status/clear + account enumeration
• scripts/workspace.js — JavaScript execution based API runner

Account model (multi-account)

This skill is profile-based by email address.

• There is no default account.
• Every API call must specify --email <[email protected]>.
• Tokens are stored per-email under ~/.pi/google-workspace/tokens/.

Before running API calls, discover available signed-in accounts:

node scripts/auth.js accounts

Usage

Always use exec and always provide --email.

node scripts/workspace.js exec --email [email protected] <<'JS'
const me = await workspace.whoAmI();
const files = await workspace.call('drive', 'files.list', {
  pageSize: 5,
  fields: 'files(id,name,mimeType)',
});
return { me, files: files.files };
JS

Available inside exec scripts:

• auth (authorized OAuth client)
• google (googleapis root)
• workspace.accountEmail (selected profile email)
• workspace.call(service, methodPath, params, {version})
• workspace.service(service, {version})
• workspace.whoAmI()

Optional flags:

• --timeout <ms> (default 30000, max 300000)
• --scopes s1,s2
• --script 'return 42'

Agent guidance

1. Prefer one exec script per user request.
2. Keep payloads small (fields, maxResults, minimal props).
3. Use Promise.all for independent requests.
4. Never print token contents.
5. If the user did not specify an account, run node scripts/auth.js accounts and choose/confirm an explicit email.
6. If auth fails, first run node scripts/auth.js accounts to see known profiles.
7. If account mismatch is possible, run workspace.whoAmI() in the selected profile.
8. On 401/403/unauthorized errors, switch account (--email ...) or re-login that specific profile.

Unauthorized/account-switch playbook

If a request fails with unauthorized/forbidden/insufficient permissions: