---
name: connect-google
description: Connect the user's Google account (Gmail, Calendar, Drive, Docs, Sheets, Slides, Contacts, Tasks) to every agent with the gog CLI, fully on its own. It creates the Google Cloud project and the access key in Chrome AI with dev-browser, then shows Google's sign-in pages there so the user only picks the account and allows access. Use for "connect Google", "connect my Gmail", "give the agent my calendar". Run on the user's computer.
argument-hint: "[email, default the account signed in to Chrome AI]"
user-invocable: true
---

Give the user's agents their Google account through `gog` (Gmail, Calendar, Drive, Docs, Sheets, Slides, Contacts, Tasks). Do every step yourself in Chrome AI with the `dev-browser` skill; the user only chooses their account and clicks "Allow" in Google's pages. Talk to the user in their language, short messages, no jargon (never say "OAuth", "client secret", "scope" or "token" to them; say "Google access" and "the key").

If you got this skill from a link instead of a local folder, install nothing else from the repo: download [scripts/gog-oauth.sh](scripts/gog-oauth.sh) with `curl -fsSL https://raw.githubusercontent.com/Melvynx/ai-maxxing-skills/main/skills/connect-google/scripts/gog-oauth.sh -o <scratch>/gog-oauth.sh`, and read another skill it names only when you reach it, from `https://raw.githubusercontent.com/Melvynx/ai-maxxing-skills/main/skills/<skill-name>/SKILL.md`.

Never print, log or repeat the key's secret, a sign-in code or anything gog keeps in the Keychain. Browser scripts that read the secret write it straight to a file with `writeFile` and log only `{ saved: true }`. Ask the user before you tick a Google terms box or publish the app (steps 3 and 6), once for both.

1. Check the tools. `chrome-ai start` and `dev-browser --help` must answer (otherwise run `setup-dev-browser`). `gog auth setup --help` must answer: if `gog` is missing or too old to know `auth setup`, install it. On macOS: `brew trust --formula openclaw/tap/gogcli && brew install openclaw/tap/gogcli` (if an older gog from `steipete/tap` is there, `brew uninstall gogcli` first; the accounts it saved stay). On Linux: the `linux_<arch>` archive from https://github.com/openclaw/gogcli/releases, checked against its `checksums.txt`, then `gog` in `~/.local/bin`. Then `jq --version`.
2. Pick the account: the argument, or the Google account signed in to Chrome AI (open `https://myaccount.google.com` in a page named `connect-google` and read the email). If Chrome AI is not signed in to Google, ask the user to sign in there and say "done". If `gog auth list --check --json --no-input` already lists that email, skip to step 9.
3. If `gog auth credentials list --json --no-input` already lists a client, skip to step 8. Otherwise find or create the Google Cloud project, in the page `connect-google`. Open `https://console.cloud.google.com/cloud-resource-manager` and look for a project named `gog CLI`: reuse its ID. If there is none, open `https://console.cloud.google.com/projectcreate`, name it `gog CLI`, create it, wait for the notification, and read its ID (the `project=` part of the address once it opens). On a first visit, Google Cloud asks for a country and its terms: ask the user before you accept. Read each page with `snapshotForAI()` before clicking: the console speaks the user's language and moves its buttons.
4. Turn on the Google services: open `https://console.cloud.google.com/flows/enableapi?apiid=gmail.googleapis.com,calendar-json.googleapis.com,drive.googleapis.com,docs.googleapis.com,sheets.googleapis.com,slides.googleapis.com,people.googleapis.com,tasks.googleapis.com&project=<id>` and confirm. Wait until the page says they are on.
5. Set up the sign-in screen: open `https://console.cloud.google.com/auth/overview?project=<id>`. If it offers to get started, fill: app name `gog CLI`, support email = the account, audience **External**, contact email = the account, tick the Google API Services User Data Policy box, then create. If it is already set up, keep it as it is.
6. Keep the access for good: open `https://console.cloud.google.com/auth/audience?project=<id>`. If the status is "Testing", click "Publish app" and confirm. A Testing app loses Google access every 7 days; published, it keeps it (Google does not review a personal app, it only shows a warning when signing in).
7. Create the key: open `https://console.cloud.google.com/auth/clients/create?project=<id>`, type **Desktop app**, name `gog CLI`, create. In the same browser script, read the client ID and the secret from the dialog that opens and save them without logging them:

   ```js
   await writeFile("gog-client.json", JSON.stringify({ installed: { client_id, client_secret, auth_uri: "https://accounts.google.com/o/oauth2/auth", token_uri: "https://oauth2.googleapis.com/token", redirect_uris: ["http://localhost"] } }));
   console.log(JSON.stringify({ saved: true, client_id_end: client_id.slice(-30) }));
   ```

   Then `gog auth credentials set ~/.dev-browser/tmp/gog-client.json --no-input && rm -f ~/.dev-browser/tmp/gog-client.json`, and `gog auth credentials list` lists `default`. The secret is shown only once: if the dialog closed before you read it, create a new key the same way (an existing `gog CLI` key cannot be read again).
8. Connect the account: `bash scripts/gog-oauth.sh <email>` (add a second argument like `gmail,calendar` to ask for less). Run it in the background: it opens Google's sign-in page in Chrome AI and waits up to 10 minutes. Tell the user right away, in 3 short lines: in the Chrome AI window, pick `<email>`; on "Google hasn't verified this app", click Continue (it is their own app); tick every access asked and click Continue. It ends with `connected=<email> services=...`. Exit code 4 means they did not allow access in time: ask, then run it again. On macOS, the first time, a Keychain window asks to let `gog` save its access: tell them to click "Always Allow".
9. Prove it works with real reads: `gog --account <email> gmail search 'newer_than:7d' --max 3 --json --wrap-untrusted` and `gog --account <email> calendar events --today --json`. Both must answer without an error. If Google says a service is off, redo step 4 for it.
10. Teach every agent: `npx skills add openclaw/gogcli -g -a claude-code -s gog -y` installs gog's own skill. Then add `export GOG_ACCOUNT=<email>` once (never twice) to `~/.zshrc` and `~/.zprofile` (or `~/.bashrc` and `~/.bash_profile`), so `gog` uses this account without `--account`. If the user has a brain folder with an `AGENTS.md`, add one line there: Google (Gmail, Calendar, Drive, Docs, Sheets) goes through `gog`, account `<email>`, read before writing, ask before sending an email or changing a calendar.
11. Another account: run step 8 again with the other email (same key, nothing to redo in Google Cloud), then use `--account <email>` to pick it.

End with a short check list, a check or a cross on each line: gog installed, Google Cloud project, services on, app published, key saved in gog, account connected, Gmail and Calendar answer, agents taught. Then tell the user in 3 lines: their Google is connected, a new session can read their mail, calendar and files, and one thing to try now, for example "What is on my calendar tomorrow?".