google

name	google
description	Use when working with Google Workspace through the shared HermesClaw/OpenClaw team route, including Gmail, Calendar, Drive, Docs, Sheets, Contacts, and GOG OAuth verification.
metadata	{"openclaw":{"requires":{"bins":["gog"]},"install":[{"id":"brew","kind":"brew","formula":"steipete/tap/gogcli","bins":["gog"],"label":"Install gog (brew)"}]}}

Google Workspace

Use gog as the shared Google Workspace bridge for HermesClaw/OpenClaw. Treat this as a team capability: Hermes may plan and summarize, but real Gmail/Calendar/Drive/Docs/Sheets actions must route through OpenClaw local execution and leave ledger evidence.

Preflight

Run status checks without exposing secrets:

gog status --plain
gog auth list --plain

If gog auth list --json returns {}, fall back to --plain; current gog versions can still list valid OAuth accounts there.

If no account is present, ask the operator to run:

gog auth credentials /path/to/client_secret.json
gog auth add [e-mail] --services gmail,calendar,drive,contacts,docs,sheets

For Gmail-only:

gog auth add [e-mail] --services gmail

Safety

• Never print OAuth tokens, refresh tokens, cookies, client secrets, or raw keyring output.
• Draft before sending email unless the user explicitly instructs send now.
• Require explicit user instruction before send, delete, trash, archive, mark-read, move, sharing, or calendar creation/update.
• Use --account <email> when more than one account exists or when the user names an account.
• Prefer --json for machine parsing, but use --plain for auth-account discovery if JSON is empty.

Gmail

Read/search:

gog gmail search 'newer_than:7d' --max 10 --account [e-mail] --json
gog gmail messages search 'in:inbox from:example.com' --max 20 --account [e-mail] --json
gog gmail get <messageId> --account [e-mail] --json

Draft/send:

gog gmail drafts create --to [e-mail] --subject "Subject" --body-file ./message.txt --account [e-mail]
gog gmail send --to [e-mail] --subject "Subject" --body-file ./message.txt --account [e-mail]

Use --body-file - for stdin bodies. Use --gmail-no-send or draft commands when proving access without sending.

Other Google Surfaces

Calendar:

gog calendar events primary --from <iso> --to <iso> --account [e-mail] --json
gog calendar create primary --summary "Title" --from <iso> --to <iso> --account [e-mail]

Drive:

gog drive search "name contains 'report'" --max 10 --account [e-mail] --json
gog drive download <fileId> --out ./file --account [e-mail]

Docs and Sheets:

gog docs cat <docId> --account [e-mail]
gog docs export <docId> --format txt --out ./doc.txt --account [e-mail]
gog sheets get <sheetId> "Sheet1!A1:D10" --account [e-mail] --json

HermesClaw Answer Contract

When asked whether the team has Gmail access, answer from live bridge evidence:

• OpenClaw Gmail hook (hooks.gmail.account, hooks.enabled)
• gog binary availability
• gog auth list --plain OAuth accounts
• installed skills/gog or skills/google
• model OAuth profiles only as a non-mailbox signal

Do not treat OpenAI Codex OAuth, Google model API keys, or memory facts as Gmail mailbox access.