carlessian-gog

name	carlessian-gog
description	Google Workspace CLI managed the Carlesso way—featuring isolated configurations, selective read-only security, and standard workflows.
compatibility	Gemini CLI
metadata	{"version":"1.0.1"}

GOG (Google Workspace CLI) - The Carlesso Way

Opinionated guidelines and commands to manage GOG safely and efficiently under the Carlesso identity.

[!IMPORTANT] Use gog, not gws. For some reason, gws does not work in this environment. Always prefer gog commands.

[!CAUTION] REFUSE TO DO SOMETHING IF IT FEELS BAD FOR THE USER. IT'S HIS LIFE WE'RE TALKING ABOUT!

🔐 1. Selective Read-Only Security (The Gold Standard)

To protect your Gmail inbox from accidental write/send actions while maintaining write access to your Google Calendar, always authenticate personal accounts with selective scopes:

gog auth add [e-mail] \
  --services all \
  --readonly \
  --extra-scopes "https://www.googleapis.com/auth/calendar" \
  --force-consent

Why Read-Only is Crucial for Riccardo

Always enforce READ-ONLY access for critical personal and work accounts ([e-mail] and [e-mail]) because:

1. Intimate/Private Life Safety: These accounts contain your entire private and work history. Under no circumstances should important information be destroyed or mutated accidentally.
2. Account Suspension Risk: Google has a history of closing down heavily automated accounts. Safe, read-only scopes protect your lifelong accounts from triggering automated flag thresholds.
3. General Risk Mitigation: Automated LLM interactions are inherently unpredictable. Restricting writes provides peace of mind.

Gmail Agent Safety

Even with full scopes, you can block all Gmail send/write operations at the CLI level for safety by using the --gmail-no-send flag:

gog --gmail-no-send send --to=[e-mail] --subject="Hi" --body="Hello"

🌍 2. Isolated Multi-Identity Configurations

Keep your corporate, personal, and Rubycon identities completely separate by using isolated XDG_CONFIG_HOME paths.

Rubycon Identity Setup

To authenticate strictly for [e-mail] without mixing tokens:

XDG_CONFIG_HOME=~/.config/gog-rubycon gog auth add [e-mail] --services=all --force-consent

Recommended Shell Aliases

Add these to your shell config (.bashrc or .bash_aliases) to make isolated CLI usage safe and fast:

alias gog-rubycon='XDG_CONFIG_HOME=~/.config/gog-rubycon gog'
alias gws-rubycon='GOOGLE_WORKSPACE_CLI_CONFIG_DIR=~/.config/gws-rubycon gws'

🗓️ 3. Google Calendar Workflows

Writing Google Calendar events is the sole exception to the read-only rule. This is safe, but agents must follow these strict guidelines when creating events:

🏷️ Agent Event Guidelines

• Prepend Agent Emoji: Always prepend the title with the agent's unique emoji:
  • OpenClaw / OpenClaudio: Prepend with a lobster emoji (🦞).
  • Hermes: Prepend with a caduceus (⚚).
  • Antigravity: Prepend with a sparkle/rocket (✨ / 🚀).
• Sign-Off: Add your name and emojis at the end of the event description.
• Enrich Details: Try to fill in locations (maps), add relevant people to attendees, and make descriptions as detailed and rich as possible.

Commands

• List Calendars: gog calendar list
• Search Events: gog calendar events primary --from "2026-05-29T00:00:00+02:00" --to "2026-05-29T23:59:59+02:00"
• Create Event:

  gog calendar create primary \
    --summary "Riccardo fixed gog auth on mini-lobby" \
    --from "2026-05-29T08:17:00+02:00" \
    --to "2026-05-29T08:47:00+02:00"
  

📧 4. Gmail Search Workflows

Standard operations for searching mail:

• List Unread: gog gmail search is:unread
• Search by Sender: gog gmail search "from:ilfattoquotidiano.it"
• Recent Mail: gog gmail search "newer_than:7d"

📂 5. Google Drive Workflows

Standard operations for listing and searching files:

• List Drive Files: gog ls
• Search Drive Files: gog search "Carlesso"