Google Workspace via gws

gws (install: npm install -g @googleworkspace/cli; this skill targets 0.22.x) speaks every Workspace API the user is likely to ask about, Drive, Docs, Sheets, Gmail, Calendar, Chat, Tasks, Slides, Keep, Forms, Apps Script, Meet. It is a community CLI ("not an officially supported Google product"). It wraps the REST APIs so you don't hand-roll curl, but it does not bundle credentials: you must configure an OAuth client or service account first, then authenticate.

When to use this skill

Any user request that names a Google Workspace surface:

• "read this Drive file", "list my Drive folder", "share this doc"
• "create a Google Doc with…", "update this sheet", "append a row"
• "send an email", "draft a Gmail reply", "check my inbox for…"
• "what's on my calendar", "schedule a meeting"
• "post to this Chat space"

Do NOT shell out to curl against the raw Workspace REST APIs, gws already wraps them and handles pagination, retries, and JSON parsing.

Auth

First, always: try the pre-injected token

Before any OAuth client, service account, or login dance, check for a pre-injected access token. When the user has used "Connect Workspace" in the web UI, the GOOGLE_WORKSPACE_CLI_TOKEN secret is auto-injected into every bash command and is gws's highest-priority auth source, no OAuth client, no login, no loopback bridge. Don't ask, don't inspect the environment, just probe with a cheap read against the surface you need:

bash(command="export GOOGLE_WORKSPACE_CLI_CONFIG_DIR=/workspace/lha/config/gws GOOGLE_WORKSPACE_CLI_KEYRING_BACKEND=file && gws gmail messages list --params '{\"maxResults\": 1}'")