菜单
Authenticate and manage credentials for the gws CLI — login, logout, status, scopes, service accounts, and credential storage.
用 Codex 或 Claude 帮你安装 复制这段 Prompt，粘贴到 Codex、Claude 或其他助手里，让它检查 Skill 页面并帮你完成安装。
基于 SOC 职业分类
This skill should be used AFTER code review and verification pass, when the user wants to "ship this", "ship the task", "open and merge the PR", "push, PR, wait for CI, and merge", or otherwise run the mechanical tail of a one-PR-per-task loop. It pushes the current branch, opens a PR, waits for CI to reach a terminal state, merges (squash + delete branch), syncs the base branch, and optionally runs a post-merge command (e.g. `anvil apply`). It makes NO review decisions — the human or agent gates that first.
Mine past coding-agent sessions (Claude Code, Codex, OpenClaw, Cursor CLI) into local-model eval suites executable via anvil-serving. Retro-first — consumes session-retro output dirs and cross-session findings themes, curates candidates into deterministic check-based evals sized for local models, emits anvil-serving-compatible eval-data suites, and runs them against any OpenAI-compatible endpoint. Use when the user asks to "create evals from my sessions", "build local-model evals", "turn this retro into evals", "which work classes can my local model handle", or wants evidence for anvil-serving routing decisions. Reads only local session logs; writes only to the eval-data root the user chooses.
Generate spec-INDEPENDENT breakage probes for a change — attack it along fail-closed, malformed-input, resource-exhaustion, and state-drift axes, not by re-reading its own tests. Use before opening a PR, as anvil execute's verify-left stage, when the user asks to "recall-mode verify", "red-team this change", "what breaks this", "find failure modes", or wants an independent breakage pass that doesn't reuse the implementer's assumptions. Reports findings; does not fix.
Scan source for Windows/cross-platform CLI hazards before shipping — non-ASCII in printed strings (the cp1252 console crash), hardcoded python3, heredoc backslash mangling, Node .cmd/.bat spawns, set -e in hooks. Use when the user asks to "check for encoding issues", "scan for Windows portability", "cli hygiene", is about to ship a CLI/script change, or wants the deterministic form of the ship-loop Windows discipline. Advisory (never blocks); wire it as a gate-router gate.
Route changed file paths to the verify commands this repo requires before shipping — docs changed means docs strict build, shell changed means bash -n, CLI changed means the encoding smoke test. Use before committing/opening a PR, when the user asks "what checks do I need to run", "run the gates", "gate check", or after substantive edits in a repo with a .claude/gate-router.local.md rules file. Deterministic local gates instead of session memory; also helps AUTHOR the rules file for a new repo.
Save or update this project's cross-session handoff note — the resume point for the next session, shared across checkouts of the same git remote and across linked worktrees. Use when the user types /handoff (optionally with a one-line summary), says "save a handoff", "note where we are for next time", "write a handoff before I clear context", or is wrapping up a session.
| name | gws-auth |
| description | Authenticate and manage credentials for the gws CLI — login, logout, status, scopes, service accounts, and credential storage. |
Note: See the gws-shared skill for global flags and security rules.
Manage authentication and credentials for the gws CLI.
gws auth login # Interactive OAuth2 login (opens browser)
gws auth logout # Remove stored credentials
gws auth setup # Guided first-run setup wizard
gws auth status # Show current auth state and active scopes
gws auth export # Export credentials for use in other tools
gws auth login
Default scopes: Drive, Sheets, Gmail, Calendar, Docs, Slides, Tasks.
gws auth login --full
Adds pubsub and cloud-platform scopes. Requires a verified OAuth app or Workspace domain admin approval.
gws auth login --scopes drive,gmail,sheets,pubsub
Unrecognized service names are resolved dynamically from Discovery docs.
gws auth login --readonly
Grants only .readonly scopes for all services.
GOOGLE_WORKSPACE_CLI_TOKEN — Pre-obtained OAuth2 access token (highest priority)GOOGLE_WORKSPACE_CLI_CREDENTIALS_FILE — Path to OAuth credentials JSON~/.config/gws/GOOGLE_APPLICATION_CREDENTIALS — Standard Google ADC (fallback)export GOOGLE_WORKSPACE_CLI_CREDENTIALS_FILE=/path/to/service-account.json
gws drive files list
~/.config/gws/ (override with GOOGLE_WORKSPACE_CLI_CONFIG_DIR)export GOOGLE_WORKSPACE_CLI_KEYRING_BACKEND=file| Variable | Description |
|---|---|
GOOGLE_WORKSPACE_CLI_TOKEN | Pre-obtained OAuth2 access token |
GOOGLE_WORKSPACE_CLI_CREDENTIALS_FILE | Path to OAuth credentials JSON |
GOOGLE_WORKSPACE_CLI_CLIENT_ID | OAuth client ID |
GOOGLE_WORKSPACE_CLI_CLIENT_SECRET | OAuth client secret |
GOOGLE_WORKSPACE_CLI_CONFIG_DIR | Override config directory |
GOOGLE_WORKSPACE_CLI_KEYRING_BACKEND | keyring (default) or file |
GOOGLE_APPLICATION_CREDENTIALS | Standard Google ADC path |
gws auth setup # Guided wizard
gws auth status # Verify it worked
gws gmail +triage # Test with a read operation
gws auth status
gws auth login --scopes drive,gmail,sheets,calendar,pubsub,cloud-platform
gws auth login (minimal scopes) — add more later with --scopesgws auth status to verify permissions before running commandsGOOGLE_WORKSPACE_CLI_KEYRING_BACKEND=file and provide credentials via env varsgws auth export