name: connect-google description: Connect + use the customer's real Google Workspace (Gmail, Calendar, Drive, Sheets, Docs). Trigger when the user asks to read mail, check calendar, find Drive files, summarize a Sheet, send mail, or "nối Google". Google only — other services get their own connect-* skill.

connect-google — connect + use Google Workspace (on the builtin engine)

Uses Hermes' builtin google-workspace skill as the engine. This layer adds Vietnamese voice + guardrails + connect orchestration (sovereign: everything stays on the customer's VPS).

When to offer connecting (avoid nagging / wrong context)

• ✅ Learning Bài 2 (explorer.connect_data), NOT connected + lesson not done → guide the connect (lesson beat 4). Only place to proactively offer.
• ⚠️ Work mode: only when a concrete task needs Google but it's not connected → ask ONCE, briefly: "Việc này cần nối Google — nối nhé?" then let the user decide. No lecturing, no repeating.
• 🚫 Already connected → never mention connecting; just do the task.
• 🚫 Bài 2 done or user declined → don't offer again.

⚡ WHEN CONNECTED — run ONE full command, don't explore

Creds are already in env. Each terminal call is a fresh shell → always use the FULL command below; never set a $GAPI var then reuse it; never read the builtin source/lib/; never run identity.py/whereami.py for Google tasks.

Other operations (create calendar event, edit/append a Sheet, share/upload a Drive file, reply/label mail, append a Doc, etc.): google_api.py is self-documenting — run python3 ~/.hermes/skills/productivity/google-workspace/scripts/google_api.py <service> --help (service = gmail|calendar|drive|sheets|docs) to see every command + args. Use that instead of guessing or reading the builtin source.

Run one command → read JSON → reply in natural Vietnamese + remind to verify (human-in-the-loop). Write actions (send mail, create event, edit Sheet) → summarize for the user and get confirmation BEFORE running.

🔌 CONNECT (when NOT connected) — driven by the orchestrator, you ONLY relay

🛑 Connecting is multi-turn and the Console UI specifics matter. Do NOT improvise steps, do NOT find/explore the filesystem, do NOT call setup.py directly, do NOT use the builtin google-workspace setup text. Just run the orchestrator lib/connect_next.py and relay its message to the user VERBATIM (it's already Vietnamese, with links). It tracks state and uses the right python internally.

You arrive here when a Google task returned NOT_AUTHENTICATED / No client secret stored, or the user asked to connect (admin/CEO only — connection is company-level).

1. Run: python3 lib/connect_next.py → JSON {stage, message}. Send the message field to the user EXACTLY / verbatim — keep every URL as full plain text (Telegram auto-links it). 🚫 Do NOT reword, summarize, shorten, renumber, or turn URLs into hyperlink labels like "[Link]". Copy it character-for-character.
2. React by stage after the user replies:
3. need_oauth_client → the user will send a JSON file or paste their Client ID + Secret. When they do → if it's an attached file, save it and run python3 lib/connect_next.py --secret <saved-path>; if they pasted JSON text, run python3 lib/connect_next.py --secret '<the json>'. Then relay the new message.
4. need_consent → the user opens the link, approves, and pastes back the localhost:1/... URL. When they paste it → run python3 lib/connect_next.py --code "<that URL>" → relay.
5. connected → done — relay the success message.
6. error → relay the message (it tells the user what to resend/retry).
7. Repeat: after every user reply, run the matching connect_next.py command and relay its message. You never improvise; the orchestrator owns the steps.

Principles

• When connected → run the full GAPI command directly, don't explore.
• Human-in-the-loop: always remind to verify; write actions need confirmation first.
• Connection is company-level → only admin/CEO connects.