gog workspace

Use gog as the Google Workspace gateway. Prefer gog over raw Google APIs.

Default Flow

For normal Gmail/Drive/Calendar reads, do not run setup/status/auth diagnostics first.

1. Run the requested read command directly with safe gog --no-input and --enable-commands flags.
2. If that read succeeds, answer the user from the result.
3. If that read fails with installation, auth, account, credentials, or keyring errors, then run the diagnostic check below or tell the user the exact auth action from the command error.

Never call skill.run_script for check-gog.sh as a preflight step just because this is the first Workspace task in a session.

For unread Gmail, use this exact command shape. Do not invent flags:

[{ "tool": "os.shell.run", "args": { "cmd": "gog", "args": ["--json", "--no-input", "--account", "<email>", "--wrap-untrusted", "--gmail-no-send", "--enable-commands", "gmail.search,gmail.get", "gmail", "search", "is:unread newer_than:7d", "--max", "10"] } }]