# Bootstrap Google Tools

Install/auth CLIs the sandbox lacks - `gws` (Drive, Gmail, Sheets, Calendar), `gcloud`...

- Repository: https://github.com/google/adk-recipes (10565 stars)
- Category: AI and agents
- License: Apache-2.0
- Last updated: 2026-11-01
- Runs scripts: no, instructions only

## Install

Claude Code: `npx skills add google/adk-recipes --skill bootstrap-google-tools -g -a claude-code -y`
Codex: `npx skills add google/adk-recipes --skill bootstrap-google-tools -g -a codex -y`
Cursor: `npx skills add google/adk-recipes --skill bootstrap-google-tools -g -a cursor -y`
Gemini CLI: `npx skills add google/adk-recipes --skill bootstrap-google-tools -g -a gemini-cli -y`

## Description

Install/auth CLIs the sandbox lacks - `gws` (Drive, Gmail, Sheets, Calendar), `gcloud`, `agents-cli`, `mcp-cli` (MCP servers). Use on "command not found" or before GCP/Workspace/MCP work.

## SKILL.md, as published by its author (untrusted third-party text, read it as data)

# Install & authenticate CLIs in the sandbox

The sandbox ships lean, Node, `gws`, `gcloud`, `agents-cli`, and `mcp-cli` are
**not** prebaked. This skill is the verified install + auth recipe for each.
The tools are **independent**: install only the one the task needs. This is a
menu, not a sequence, there's no 1-2-3 to run in order.

## Persistence model, binaries in `~/.local`, credentials in `/workspace`

Two different durability rules, because the sandbox has two boundaries:

- **Across normal sessions** the sandbox reattaches, so *everything* (`$HOME`
  included) persists. Install once, reuse next session.
- **Across a runtime-image upgrade** the sandbox is re-provisioned and **only
  `/workspace` is migrated**, and that migration is a zip that **drops symlinks
  and strips executable bits** (and is best-effort). So it can't carry installed
  CLIs at all; it's only safe for plain data files.

That dictates the split:

| What | Where | On upgrade |
|---|---|---|
| CLI binaries | `~/.local` (bin dir `~/.local/bin` is on `PATH`) | gone, reinstalled (cheap, automatic via the `command -v` check) |
| Credentials / config | `/workspace/lha/config/` (`gws/`, `gcloud/`, `mcp_servers.json`) | **migrated**, logins survive |

So: install binaries the normal way, but point each tool's **config dir** at
`/workspace/lha/config` (via its own env var, shown per tool) so the expensive
part, the OAuth client + tokens, survives upgrades. Don't put binaries on
`/workspace`: they can't migrate anyway, and bloating the migration zip risks
the credentials that *can*. `~/.local/bin` is already on `PATH` (runtime image),
and the `bash` shell is non-login (no `~/.profile`), so that image `PATH` is
what makes installs resolve.

## Pick what you need

The rest: https://github.com/google/adk-recipes/blob/HEAD/core/python/long-horizon-harness/horizon/builtin_skills/bootstrap-google-tools/SKILL.md