Adom Google

@@ -79,26 +79,56 @@ No Cloud-console wrestling, no secret management. ### 3. Self-host it → fully DIY (free, more setup) Fork this repo and stand up your own: - A Google Cloud project + OAuth client (Internal to your Workspace for long-lived tokens),-  with the Gmail/Drive/Sheets/Docs/Slides/Calendar/Tasks/Chat APIs enabled.+  with the Gmail/Drive/Sheets/Docs/Slides/Calendar/Tasks/People/Chat APIs enabled. - The open-source OAuth gateway ([`john/service-oauth`](https://wiki.adom.inc/pages/service-oauth))   on a small container, with your client's secret in `creds/<app>.json`. - Point `OAUTH_GATEWAY_URL` + `bin/credentials.json` (client_id) at yours. +**Enabling the APIs** — in the Cloud Console go to **APIs & Services → Library**, search each+one, and click **Enable**. You want all nine:++![Enable the Gmail, Drive, Sheets, Docs, Slides, Calendar, Tasks, People and Chat APIs in the Google Cloud Console](/blob/app/adom-google/docs/enable-apis.png)+ The Chat API also needs a one-time "Chat app" configuration (name/avatar/description) in the-Cloud console — see the SKILL.md for the exact steps.+Cloud console's **Chat API → Configuration** tab — otherwise `spaces.*` calls 404 with "Chat+app not found." See the [SKILL.md](/blob/app/adom-google/SKILL.md) for the exact steps.  --- -## Safe vs full mode+## What you can drive — the whole board++Every Google Workspace surface, with typed shortcuts for the common flows and the generic+`api` passthrough for everything else. `adom-google setup` asks each user to pick **safe**+(default — nothing scary on the consent screen) or **full** (broad, includes delete):++| App | What you can do | Safe mode | Full mode |+|---|---|---|---|+| **Gmail** | read messages, attachments & `.ics` invites, labels, trash, organize | ✅ read + organize | ✅ read + organize |+| **Contacts** (People) | create / list / search contacts, store service identities | ✅ full read/write | ✅ full read/write |+| **Calendar** | create / move / delete events, invite guests, list agenda | ✅ events | ✅ + manage calendars |+| **Tasks** | create / list / complete task lists & tasks | ✅ full | ✅ full |+| **Google Chat** | post to spaces, list spaces, read space messages | ✅ post + read | ✅ post + read |+| **Drive** | upload / download / search / share / organize files | ⚠️ only files this app creates | ✅ **all** files incl. delete |+| **Sheets** | create spreadsheets, read/write cells, formulas, formatting | ⚠️ only sheets it creates | ✅ **all** spreadsheets |+| **Docs** | create docs, insert/replace text, fill templates | ⚠️ only docs it creates | ✅ **all** documents |+| **Slides** | build decks, add slides, replace text/images | ⚠️ only decks it creates | ✅ **all** presentations |+| **Any other Google API** | YouTube, Forms, Apps Script, Admin SDK, Photos… | via `api` passthrough | via `api` passthrough |++**Safe mode** uses the narrow scopes (`gmail.modify`, `contacts`, `calendar.events`,+`tasks`, `chat.messages`, `chat.spaces.readonly`, `drive.file`) — the consent screen shows+**no "see & delete ALL your files."** **Full mode** swaps in the broad scopes (`drive`,+`spreadsheets`, `documents`, `presentations`, `calendar`) for whole-board+read/write/delete.++Either way, `api` reaches **any** Google endpoint — your real ceiling is just the scopes you+granted plus your own Google permissions (admin APIs only work for admins). -`adom-google setup` asks every user which scope set they want:+### See it in action -| **Safe** (default) | **Full** |-|---|---|-| Read/write Gmail, Contacts, Calendar events, Tasks + only the Drive/Sheets/Docs/Slides files **this app creates**. The consent screen shows **no "see & delete ALL your files."** | Broad read/write/**delete** across **all** your existing Drive/Sheets/Docs/Slides/Calendars. For users who want the whole board. |+Read from one app, write to another — in a single flow. Here your AI reads an invoice+attachment out of **Gmail** and posts the total straight into a **Google Chat** space: -Each person's reach is also capped by their own Google permissions — admin APIs only work-for admins.+![adom-google reading a Gmail attachment and posting the result into Google Chat](/blob/app/adom-google/docs/chat-reads-email.png)  --- 

@@ -56,11 +56,18 @@ When setting up adom-google on a user's container for the first time (it's uncon `adom-google setup` or any command prints a `Hint:` block saying so), **do NOT pick a mode for them. Ask.** Use `AskUserQuestion` with these two options: -- **Safe mode (recommended default)** — read/write Gmail, Contacts, Calendar events, Tasks,-  and only the Drive/Sheets/Docs/Slides files *this app creates*. The Google consent screen-  shows **no "see & delete ALL your files"** — nothing scary.-- **Full mode** — broad read/write/**delete** across **all** the user's existing-  Drive/Sheets/Docs/Slides/Calendars. Only if they explicitly want full control.+- **Safe mode (recommended default)** — read/organize Gmail, full Contacts, Calendar events,+  Tasks, post+read Google Chat, and only the Drive/Sheets/Docs/Slides files *this app+  creates*. Scopes: `gmail.modify, contacts, calendar.events, tasks, chat.messages,+  chat.spaces.readonly, drive.file`. The Google consent screen shows **no "see & delete ALL+  your files"** — nothing scary.+- **Full mode** — everything safe mode has, but the narrow Drive/Sheets/Docs/Slides/Calendar+  scopes are swapped for broad read/write/**delete** across **all** the user's existing+  files and calendars. Scopes add `drive, spreadsheets, documents, presentations, calendar`.+  Only if they explicitly want full control.++Both modes also expose the generic `adom-google api <url>` passthrough, which can hit **any**+Google API the granted scopes allow (Sheets/Docs/Slides/Drive/Calendar/Chat/Tasks/YouTube/…).  Then run exactly one: ```bash@@ -123,7 +130,14 @@ non-adom.inc accounts at consent. Two options to surface to them: ## Commands  ```bash-# Gmail (read-only; behaviour-compatible with old adom-gmail)+# Generic passthrough — ANY Google API, signed with the user's token. This is the workhorse:+# Sheets/Docs/Slides/Drive/Calendar/Chat/Tasks/YouTube all go through here, zero per-API code.+adom-google api <url> [-X METHOD] [-d '<json>'|@file] [-q key=val ...] [--raw]+#   e.g. create a sheet:   adom-google api -X POST https://sheets.googleapis.com/v4/spreadsheets -d '{"properties":{"title":"BOM"}}'+#        post to Chat:      adom-google api -X POST https://chat.googleapis.com/v1/spaces/<id>/messages -d '{"text":"shipped"}'+#        calendar event:    adom-google api -X POST https://www.googleapis.com/calendar/v3/calendars/primary/events?sendUpdates=all -d '{...}'++# Gmail (read; behaviour-compatible with old adom-gmail) adom-google gmail attachments <messageId> adom-google gmail read <messageId> <attachmentId> [-o file] adom-google gmail ics  <messageId>@@ -133,6 +147,8 @@ adom-google contacts create --name "First Last" [--org O] [--title T] \     [--email [email protected] ...] [--phone +1... ...] [--notes "..."] [--json] adom-google contacts list [--limit N] [--json] adom-google contacts search <query> [-v] [--json]++adom-google status     # mode (safe/full) + what's authorized (never prints secrets) ```  We use Google Contacts to store **service identities** (portal/account metadata for an API

@@ -44,6 +44,8 @@ SCOPES_SAFE = [     "https://www.googleapis.com/auth/drive.file",          # only files THIS app creates/opens (not "all your files")     "https://www.googleapis.com/auth/calendar.events",     # calendar EVENTS (not "delete all your calendars")     "https://www.googleapis.com/auth/tasks",               # Tasks+    "https://www.googleapis.com/auth/chat.messages",       # Google Chat — read + post (not a "delete all" risk)+    "https://www.googleapis.com/auth/chat.spaces.readonly", # Google Chat — list your spaces ] SCOPES_FULL = [     "https://www.googleapis.com/auth/gmail.modify",        # Gmail read/compose/send/labels

⋯ 1 unchanged line ⋯

⋯ 1 unchanged line ⋯

@@ -1,8 +1,8 @@ {   "slug": "adom-google",-  "version": "0.1.0",+  "version": "0.2.0",   "type": "app",-  "description": "Whole-of-Google-Workspace CLI for Adom containers \u2014 Gmail, Contacts, Drive, Sheets, Docs, Slides, Calendar, Tasks, plus a generic `api` passthrough to hit ANY Google API. One-click OAuth via the Adom gateway. Employee-only. On first run it asks each user to choose safe mode (no delete) or full mode (incl. delete).",+  "description": "Drive your whole Google Workspace from the terminal \u2014 Gmail, Contacts, Drive, Sheets, Docs, Slides, Calendar, Tasks, Google Chat, plus a generic `api` passthrough to hit ANY Google API. One-click OAuth via the Adom token-broker gateway (no client secret on your machine). On first run it asks each user to choose safe mode (no delete) or full mode (incl. delete).",   "install": {     "binary_name": "adom-google"   },