@cubis/foundry 0.3.83 → 0.3.84

package/workflows/workflows/agent-environment-setup/platforms/claude/skills/go-fiber/references/testing.md

@@ -1,285 +0,0 @@
-# Fiber v3 Testing
-
-## Handler Testing with app.Test()
-
-Fiber provides `app.Test()` which accepts a standard `*http.Request` and returns an `*http.Response`. This avoids starting a real server and keeps tests fast.
-
-```go
-func TestGetUser(t *testing.T) {
-    app := fiber.New(fiber.Config{
-        ErrorHandler: customErrorHandler,
-    })
-    app.Get("/users/:id", getUser)
-
-    req := httptest.NewRequest("GET", "/users/42", nil)
-    req.Header.Set("Content-Type", "application/json")
-
-    resp, err := app.Test(req)
-    require.NoError(t, err)
-    assert.Equal(t, 200, resp.StatusCode)
-
-    var user User
-    err = json.NewDecoder(resp.Body).Decode(&user)
-    require.NoError(t, err)
-    assert.Equal(t, "42", user.ID)
-}
-```
-
-## Table-Driven Handler Tests
-
-Use table-driven tests to cover multiple scenarios with shared setup.
-
-```go
-func TestCreateBookmark(t *testing.T) {
-    app := setupTestApp()
-
-    tests := []struct {
-        name       string
-        body       interface{}
-        authToken  string
-        wantStatus int
-        wantCode   string
-        checkBody  func(t *testing.T, body []byte)
-    }{
-        {
-            name: "valid bookmark",
-            body: map[string]interface{}{
-                "url":   "https://example.com",
-                "title": "Example Site",
-                "tags":  []string{"web", "reference"},
-            },
-            authToken:  validToken,
-            wantStatus: 201,
-            checkBody: func(t *testing.T, body []byte) {
-                var bm Bookmark
-                require.NoError(t, json.Unmarshal(body, &bm))
-                assert.NotEmpty(t, bm.ID)
-                assert.Equal(t, "https://example.com", bm.URL)
-            },
-        },
-        {
-            name:       "missing required URL",
-            body:       map[string]interface{}{"title": "No URL"},
-            authToken:  validToken,
-            wantStatus: 400,
-            wantCode:   "VALIDATION_ERROR",
-        },
-        {
-            name:       "invalid URL format",
-            body:       map[string]interface{}{"url": "not-a-url", "title": "Bad"},
-            authToken:  validToken,
-            wantStatus: 400,
-            wantCode:   "VALIDATION_ERROR",
-        },
-        {
-            name:       "no auth token",
-            body:       map[string]interface{}{"url": "https://example.com", "title": "Test"},
-            authToken:  "",
-            wantStatus: 401,
-            wantCode:   "UNAUTHORIZED",
-        },
-        {
-            name:       "expired token",
-            body:       map[string]interface{}{"url": "https://example.com", "title": "Test"},
-            authToken:  expiredToken,
-            wantStatus: 401,
-            wantCode:   "TOKEN_EXPIRED",
-        },
-    }
-
-    for _, tt := range tests {
-        t.Run(tt.name, func(t *testing.T) {
-            bodyBytes, _ := json.Marshal(tt.body)
-            req := httptest.NewRequest("POST", "/api/v1/bookmarks",
-                bytes.NewReader(bodyBytes))
-            req.Header.Set("Content-Type", "application/json")
-            if tt.authToken != "" {
-                req.Header.Set("Authorization", "Bearer "+tt.authToken)
-            }
-
-            resp, err := app.Test(req)
-            require.NoError(t, err)
-            assert.Equal(t, tt.wantStatus, resp.StatusCode)
-
-            body, _ := io.ReadAll(resp.Body)
-            if tt.wantCode != "" {
-                var errResp ErrorResponse
-                require.NoError(t, json.Unmarshal(body, &errResp))
-                assert.Equal(t, tt.wantCode, errResp.Code)
-            }
-            if tt.checkBody != nil {
-                tt.checkBody(t, body)
-            }
-        })
-    }
-}
-```
-
-## Testing Middleware
-
-Test middleware in isolation by registering it on a minimal app.
-
-```go
-func TestRequestIDMiddleware(t *testing.T) {
-    app := fiber.New()
-    app.Use(requestIDMiddleware)
-    app.Get("/test", func(c fiber.Ctx) error {
-        return c.JSON(fiber.Map{
-            "request_id": c.Locals("requestid"),
-        })
-    })
-
-    // Test auto-generated ID
-    req := httptest.NewRequest("GET", "/test", nil)
-    resp, err := app.Test(req)
-    require.NoError(t, err)
-
-    id := resp.Header.Get("X-Request-Id")
-    assert.NotEmpty(t, id)
-
-    // Test client-provided ID is preserved
-    req = httptest.NewRequest("GET", "/test", nil)
-    req.Header.Set("X-Request-Id", "client-id-123")
-    resp, err = app.Test(req)
-    require.NoError(t, err)
-    assert.Equal(t, "client-id-123", resp.Header.Get("X-Request-Id"))
-}
-
-func TestAuthMiddleware(t *testing.T) {
-    app := fiber.New(fiber.Config{ErrorHandler: customErrorHandler})
-    app.Use(jwtAuthMiddleware)
-    app.Get("/protected", func(c fiber.Ctx) error {
-        user := c.Locals("user").(*UserClaims)
-        return c.JSON(fiber.Map{"user_id": user.ID})
-    })
-
-    tests := []struct {
-        name       string
-        auth       string
-        wantStatus int
-    }{
-        {"valid token", "Bearer " + validToken, 200},
-        {"missing header", "", 401},
-        {"invalid format", "Token xyz", 401},
-        {"expired token", "Bearer " + expiredToken, 401},
-    }
-
-    for _, tt := range tests {
-        t.Run(tt.name, func(t *testing.T) {
-            req := httptest.NewRequest("GET", "/protected", nil)
-            if tt.auth != "" {
-                req.Header.Set("Authorization", tt.auth)
-            }
-            resp, err := app.Test(req)
-            require.NoError(t, err)
-            assert.Equal(t, tt.wantStatus, resp.StatusCode)
-        })
-    }
-}
-```
-
-## Integration Tests with Database
-
-```go
-func setupTestApp(t *testing.T) *fiber.App {
-    t.Helper()
-
-    db := setupTestDB(t) // Create test database
-    t.Cleanup(func() {
-        db.Close()
-    })
-
-    svc := NewBookmarkService(db)
-    app := fiber.New(fiber.Config{ErrorHandler: customErrorHandler})
-    RegisterRoutes(app, svc)
-    return app
-}
-
-func TestCreateAndListBookmarks(t *testing.T) {
-    app := setupTestApp(t)
-
-    // Create
-    createBody, _ := json.Marshal(CreateBookmarkRequest{
-        URL:   "https://example.com",
-        Title: "Test",
-    })
-    req := httptest.NewRequest("POST", "/api/v1/bookmarks",
-        bytes.NewReader(createBody))
-    req.Header.Set("Content-Type", "application/json")
-    req.Header.Set("Authorization", "Bearer "+testToken)
-
-    resp, err := app.Test(req)
-    require.NoError(t, err)
-    assert.Equal(t, 201, resp.StatusCode)
-
-    // List and verify
-    req = httptest.NewRequest("GET", "/api/v1/bookmarks", nil)
-    req.Header.Set("Authorization", "Bearer "+testToken)
-
-    resp, err = app.Test(req)
-    require.NoError(t, err)
-    assert.Equal(t, 200, resp.StatusCode)
-
-    var list []Bookmark
-    json.NewDecoder(resp.Body).Decode(&list)
-    assert.Len(t, list, 1)
-    assert.Equal(t, "https://example.com", list[0].URL)
-}
-```
-
-## Benchmark Tests
-
-```go
-func BenchmarkGetBookmarks(b *testing.B) {
-    app := setupBenchApp()
-    req := httptest.NewRequest("GET", "/api/v1/bookmarks", nil)
-    req.Header.Set("Authorization", "Bearer "+testToken)
-
-    b.ReportAllocs()
-    b.ResetTimer()
-
-    for i := 0; i < b.N; i++ {
-        resp, err := app.Test(req, fiber.TestConfig{
-            Timeout: 0, // Disable timeout for benchmarks
-        })
-        if err != nil {
-            b.Fatal(err)
-        }
-        resp.Body.Close()
-    }
-}
-```
-
-## Test Helpers
-
-```go
-// makeRequest builds and executes a test request
-func makeRequest(t *testing.T, app *fiber.App, method, path string, body interface{}, token string) *http.Response {
-    t.Helper()
-
-    var bodyReader io.Reader
-    if body != nil {
-        b, _ := json.Marshal(body)
-        bodyReader = bytes.NewReader(b)
-    }
-
-    req := httptest.NewRequest(method, path, bodyReader)
-    req.Header.Set("Content-Type", "application/json")
-    if token != "" {
-        req.Header.Set("Authorization", "Bearer "+token)
-    }
-
-    resp, err := app.Test(req)
-    require.NoError(t, err)
-    return resp
-}
-
-// decodeBody reads and decodes the response body
-func decodeBody[T any](t *testing.T, resp *http.Response) T {
-    t.Helper()
-    var result T
-    body, _ := io.ReadAll(resp.Body)
-    require.NoError(t, json.Unmarshal(body, &result))
-    return result
-}
-```

package/workflows/workflows/agent-environment-setup/platforms/claude/skills/golang-best-practices/evals/assertions.md

@@ -1,33 +0,0 @@
-# Golang Best Practices — Eval Assertions
-
-## Eval 1: Concurrent Service Design (golang-concurrent-service)
-
-This eval tests whether the skill produces a correctly structured concurrent service with proper cancellation and error propagation.
-
-### Assertions
-
-1. **errgroup with derived context** — The response must use `errgroup.WithContext(ctx)` to get both a group and a derived context. This is critical because when any goroutine in the group returns an error, the derived context is cancelled, which signals the remaining goroutines to stop.
-
-2. **Per-request and overall timeouts** — The response must demonstrate both a per-API-call timeout (e.g., `context.WithTimeout(ctx, 3*time.Second)`) and an overall deadline on the parent context (10 seconds). Layered timeouts prevent both individual stalls and aggregate slowness.
-
-3. **Error wrapping with %w** — Errors returned from goroutines must be wrapped with `fmt.Errorf("fetch %s: %w", apiName, err)` so the caller can use `errors.Is` and `errors.As` to inspect the chain. Unwrapped errors lose origin context.
-
-4. **Structured logging** — The response must use `slog` or an equivalent structured logger with contextual attributes (API name, duration, request ID). String-formatted log messages are not acceptable because they cannot be parsed by log aggregation systems.
-
-5. **Concurrency safety** — The service must be safe to call from multiple goroutines. This means either the struct has no mutable state, or shared state is protected with sync primitives. The response must not have data races.
-
-## Eval 2: Error Handling Patterns (golang-error-handling)
-
-This eval tests whether the skill produces a comprehensive error handling strategy for a REST API.
-
-### Assertions
-
-1. **Custom error type** — The response must define a struct that implements the `error` interface and carries an HTTP status code, a user-safe message, and an internal error. This enables the middleware to produce appropriate HTTP responses while preserving internal debugging context.
-
-2. **Sentinel errors** — The response must define package-level sentinel errors (e.g., `var ErrNotFound = errors.New("not found")`) for common failure modes. Sentinel errors enable callers to match on specific conditions with `errors.Is` without inspecting error strings.
-
-3. **Error middleware with errors.As** — The response must implement middleware (or a wrapper handler) that uses `errors.As` to extract the custom error type and map it to the correct HTTP status code and JSON response. This centralizes error-to-response mapping.
-
-4. **Error-returning handlers** — Handler functions must return `error` values rather than calling `http.Error()` or `w.Write()` directly. This pattern separates business logic from HTTP response formatting and makes handlers testable.
-
-5. **errors.Is for sentinels and %w for wrapping** — The handler logic must demonstrate using `errors.Is` to match sentinel errors and `fmt.Errorf` with `%w` to add context when propagating errors upward. These are the two fundamental operations in Go's error handling model.

package/workflows/workflows/agent-environment-setup/platforms/claude/skills/golang-best-practices/evals/evals.json

@@ -1,54 +0,0 @@
-[
-  {
-    "id": "golang-concurrent-service",
-    "prompt": "Design a Go service that fetches data from 5 upstream APIs concurrently with a 3-second timeout per request and a 10-second overall deadline. If any single API fails, the service should cancel remaining requests and return an error. Requirements: use errgroup for coordination, context for cancellation, and structured logging with slog. The service should be safe to call from multiple goroutines simultaneously.",
-    "assertions": [
-      {
-        "type": "content",
-        "value": "uses errgroup.Group with a derived context from errgroup.WithContext for coordinated cancellation across goroutines"
-      },
-      {
-        "type": "content",
-        "value": "applies per-request timeout using context.WithTimeout and an overall deadline on the parent context"
-      },
-      {
-        "type": "content",
-        "value": "wraps errors with fmt.Errorf and %w to create error chains that preserve the original error for errors.Is/errors.As"
-      },
-      {
-        "type": "content",
-        "value": "uses slog or structured logging with contextual attributes like API name, duration, or request ID"
-      },
-      {
-        "type": "content",
-        "value": "the service struct and its methods are safe for concurrent use without external synchronization (no shared mutable state or properly synchronized)"
-      }
-    ]
-  },
-  {
-    "id": "golang-error-handling",
-    "prompt": "I have a Go REST API and I need a comprehensive error handling strategy. Design the error types, middleware, and handler patterns. Requirements:\n1. Custom error type with HTTP status, user-safe message, and internal detail\n2. Sentinel errors for common cases (NotFound, Unauthorized, Conflict)\n3. Middleware that converts errors to JSON responses with appropriate status codes\n4. Handler functions that return errors instead of writing responses directly\n\nTarget Go 1.24+.",
-    "assertions": [
-      {
-        "type": "content",
-        "value": "defines a custom error type (struct implementing the error interface) with fields for HTTP status code, user-facing message, and internal error"
-      },
-      {
-        "type": "content",
-        "value": "defines sentinel errors using errors.New or var declarations for NotFound, Unauthorized, and Conflict"
-      },
-      {
-        "type": "content",
-        "value": "implements error middleware that uses errors.As to extract the custom error type and map it to the correct HTTP status code"
-      },
-      {
-        "type": "content",
-        "value": "handler functions return error values rather than calling http.Error or w.Write directly, delegating response writing to the middleware"
-      },
-      {
-        "type": "content",
-        "value": "uses errors.Is for sentinel matching and fmt.Errorf with %w for error wrapping in handler logic"
-      }
-    ]
-  }
-]

package/workflows/workflows/agent-environment-setup/platforms/claude/skills/google-workspace/SKILL.md

@@ -1,102 +0,0 @@
----
-name: google-workspace
-description: "Use when integrating Google Workspace APIs: Gmail sending and search, Drive file management and sharing, Calendar event operations, Sheets data reading and writing, OAuth2 and service account authentication, and batch request optimization."
-allowed-tools: Read Grep Glob Bash Edit Write
-user-invocable: true
-argument-hint: "Google API integration or Workspace service to work on"
----
-
-# Google Workspace API Integration
-
-## Purpose
-
-Guide the design and implementation of production-grade Google Workspace API integrations covering Gmail (sending, searching, label management), Drive (file CRUD, sharing, permissions), Calendar (event creation, availability queries, recurring events), Sheets (reading, writing, formula preservation), OAuth2 user authentication, service account delegation, and batch request patterns for throughput optimization.
-
-## When to Use
-
-- Authenticating users with OAuth2 for Google Workspace API access.
-- Setting up service accounts with domain-wide delegation for server-to-server operations.
-- Sending, searching, or processing Gmail messages programmatically.
-- Managing Google Drive files, folders, permissions, and shared drives.
-- Creating, updating, or querying Google Calendar events and free/busy data.
-- Reading from and writing to Google Sheets with formula and formatting preservation.
-- Optimizing API throughput with batch requests and quota management.
-
-## Instructions
-
-1. **Configure OAuth2 consent screen and scopes before writing integration code** because Google requires scope approval for sensitive APIs, and requesting overly broad scopes triggers extended review that blocks production deployment for weeks.
-
-2. **Request the narrowest possible OAuth2 scopes for each integration** because narrow scopes (e.g., `gmail.send` instead of `gmail.modify`) reduce the security surface, simplify consent screen review, and increase user trust during the authorization flow.
-
-3. **Implement OAuth2 with PKCE for web and mobile clients** because the authorization code flow with PKCE prevents authorization code interception attacks without requiring a client secret, which cannot be kept confidential in public clients.
-
-4. **Use service accounts with domain-wide delegation for automated server-side operations** because service accounts do not require user interaction for authorization, and domain-wide delegation lets them act on behalf of any user in the Google Workspace domain.
-
-5. **Store OAuth2 refresh tokens encrypted in your database, never in local files** because refresh tokens grant long-lived access to user data, and storing them in plaintext or in application files risks unauthorized access if the storage is compromised.
-
-6. **Handle token refresh transparently with the Google client library's built-in credential management** because access tokens expire after one hour, and manual refresh logic is error-prone. The client libraries handle refresh, retry, and caching automatically.
-
-7. **Use the Gmail API's `users.messages.send` with RFC 2822 formatted messages** because the Gmail API requires base64url-encoded RFC 2822 messages, and constructing them correctly with headers, MIME parts, and attachments avoids silent delivery failures.
-
-8. **Implement Gmail search with the `q` parameter using Gmail search operators** because the Gmail API supports the same search syntax as the Gmail web UI (from:, to:, subject:, has:attachment, after:, before:), enabling complex queries without client-side filtering.
-
-9. **Use Drive API v3 with `fields` parameter to request only needed metadata** because Drive API responses include dozens of fields by default, and specifying fields reduces response size, latency, and quota consumption.
-
-10. **Manage shared drive permissions with the `supportsAllDrives` parameter** because shared drives have different permission semantics than personal drives, and omitting this parameter causes permission operations to fail silently or return incomplete results.
-
-11. **Read and write Sheets data with `valueRenderOption` and `valueInputOption` set explicitly** because the default render option returns formatted strings instead of raw values, and the default input option may reinterpret data as dates or formulas unexpectedly.
-
-12. **Use batch requests to combine multiple API calls into a single HTTP request** because Google Workspace APIs enforce per-user and per-project quota limits, and batch requests reduce HTTP overhead and count as a single quota unit for up to 100 sub-requests.
-
-13. **Implement exponential backoff for quota errors (HTTP 429) and server errors (HTTP 500, 503)** because Google APIs enforce strict rate limits, and aggressive retries without backoff trigger longer lockouts and cascading failures.
-
-14. **Use Google Calendar's `freebusy` endpoint for availability checks** because querying individual events and computing availability client-side is slow, permission-sensitive, and error-prone. The freebusy API returns aggregated availability without exposing event details.
-
-15. **Preserve Sheets formulas and formatting when writing data** because overwriting cells with raw values destroys formulas that other cells depend on. Use `valueInputOption: "USER_ENTERED"` when the input should be parsed as formulas, and `"RAW"` for literal values.
-
-16. **Create webhook push notifications with the Drive and Calendar watch APIs** because polling for changes wastes quota and introduces latency. Push notifications deliver changes in near-real-time to your registered webhook endpoint.
-
-## Output Format
-
-```
-## Authentication Setup
-[OAuth2 or service account configuration, scopes, token storage]
-
-## API Integration
-[Implementation code with error handling, pagination, and field selection]
-
-## Batch Operations
-[Batch request construction, quota management, retry logic]
-
-## Testing Plan
-[Mock strategies, test account setup, quota-safe test patterns]
-```
-
-## References
-
-| File                            | Load when                                                                                   |
-| ------------------------------- | ------------------------------------------------------------------------------------------- |
-| `references/auth-and-scopes.md` | Configuring OAuth2 consent, PKCE flows, service accounts, scopes, or token management.     |
-| `references/sheets-api-patterns.md` | Reading, writing, formatting, or batch-updating Google Sheets data.                    |
-| `references/workspace-automation.md` | Coordinating Drive, Gmail, Sheets, and Calendar automations with quota awareness.      |
-
-## Examples
-
-- "Set up OAuth2 with PKCE for a web app that reads user Google Drive files."
-- "Batch-update 500 rows in a Google Sheet with formula preservation and error handling."
-- "Send templated Gmail messages with attachments using a service account."
-
-## Claude Platform Notes
-
-- Use `$ARGUMENTS` to access user-provided arguments passed when the skill is invoked.
-- Reference skill-local files with `${CLAUDE_SKILL_DIR}/references/<file>` for portable paths.
-- When `context: fork` is set, the skill runs in an isolated subagent context; the `agent` field names the fork target.
-- Custom subagents in `.claude/agents/*.md` support YAML frontmatter: `name`, `description`, `tools`, `model`, `maxTurns`, `memory`, `handoffs`.
-- Use `model` field in agent frontmatter to select model per subagent (e.g., `model: opus` for complex analysis).
-- Set `maxTurns` to prevent runaway iterations (default: 25, orchestrator: 30).
-- Key agents support `memory: project` for cross-session learning (orchestrator, debugger, researcher, project-planner).
-- Hook templates in `.claude/hooks/` provide lifecycle event integration at `UserPromptSubmit` and other events.
-- Path-scoped rules: `.claude/rules/*.md` with `paths:` frontmatter for targeted guidance.
-- MCP skill tools (`skill_search`, `skill_get`, `skill_validate`, `skill_get_reference`) are available for dynamic skill discovery and loading.
-- Use `allowed-tools` in frontmatter to restrict tool access for security-sensitive skills.
-- Workflow skills can be compiled to `.claude/skills/<workflow-id>/SKILL.md` as `generatedSkills`.

package/workflows/workflows/agent-environment-setup/platforms/claude/skills/google-workspace/evals/assertions.md

@@ -1,47 +0,0 @@
-# Google Workspace Eval Assertions
-
-## Eval 1: OAuth2 Flow with Drive API
-
-This eval tests OAuth2 with PKCE for Google Drive access: scope selection, token management, encrypted storage, and Drive API file listing.
-
-### Assertions
-
-| # | Type     | What it checks                                  | Why it matters                                                                                       |
-|---|----------|-------------------------------------------------|------------------------------------------------------------------------------------------------------|
-| 1 | contains | `drive.readonly` — Narrow scope selection        | Requesting the full `drive` scope when only read access is needed grants unnecessary write permissions, increasing the security surface and triggering stricter consent review. |
-| 2 | contains | `code_verifier` — PKCE implementation            | PKCE prevents authorization code interception attacks that are possible when the code is transmitted through browser redirects on public clients. |
-| 3 | contains | `refresh_token` — Token persistence              | Refresh tokens provide long-lived access without re-authorization. Without storing them, users must re-authenticate on every session, degrading the experience. |
-| 4 | contains | `encrypt` — Token encryption at rest             | Refresh tokens grant access to user data. Storing them in plaintext means a database breach exposes every user's Google Drive to the attacker. |
-| 5 | contains | `files.list` — Drive API file listing            | The files.list endpoint with the `fields` parameter retrieves file metadata efficiently. Without field selection, the API returns all 30+ fields per file, wasting bandwidth. |
-
-### What a passing response looks like
-
-- OAuth2 configuration with `drive.readonly` scope and PKCE code challenge generation.
-- Authorization URL construction with `code_challenge`, `code_challenge_method=S256`, and `access_type=offline`.
-- Token exchange endpoint that validates the code_verifier and stores the encrypted refresh token.
-- Transparent token refresh using the Google client library's credential management.
-- Drive API call using `files.list` with `fields: "files(id, name, mimeType, modifiedTime)"` for efficient metadata retrieval.
-
----
-
-## Eval 2: Sheets API Batch Operations
-
-This eval tests Sheets API batch operations: reading with proper render options, batch writing with value input control, service account auth, and quota management.
-
-### Assertions
-
-| # | Type     | What it checks                                  | Why it matters                                                                                       |
-|---|----------|-------------------------------------------------|------------------------------------------------------------------------------------------------------|
-| 1 | contains | `valueRenderOption` — Read value control         | Without explicitly setting valueRenderOption, the API returns formatted strings by default, which corrupts numeric data with currency symbols, percentages, and locale-specific formatting. |
-| 2 | contains | `batchUpdate` — Batch write operation            | Writing 10,000+ cells individually exhausts the per-minute quota in seconds. Batch updates combine multiple writes into a single API call, respecting quota and reducing latency. |
-| 3 | contains | `valueInputOption` — Write value control         | Without setting valueInputOption, the API defaults to RAW, which means formulas are stored as text instead of being evaluated. USER_ENTERED parses formulas correctly. |
-| 4 | contains | `ServiceAccountCredentials` — Service account auth | Automated server-to-server operations require service account authentication because there is no user present to complete the OAuth2 consent flow. |
-| 5 | contains | `spreadsheets.readonly` — Appropriate scopes     | Reading and writing operations require different scopes. Using the narrowest scope for each operation follows least privilege and simplifies service account configuration. |
-
-### What a passing response looks like
-
-- Service account credentials loaded from a JSON key file or environment variable.
-- Read operation with `valueRenderOption: "UNFORMATTED_VALUE"` to get raw numbers without formatting.
-- Data processing logic that aggregates sales by month from the raw values.
-- Batch write using `spreadsheets.values.batchUpdate` with multiple value ranges and `valueInputOption: "USER_ENTERED"`.
-- Error handling for quota exhaustion (HTTP 429) with exponential backoff and retry.

package/workflows/workflows/agent-environment-setup/platforms/claude/skills/google-workspace/evals/evals.json

@@ -1,66 +0,0 @@
-[
-  {
-    "name": "oauth2-flow-with-drive-api",
-    "description": "Validate that the skill produces a secure OAuth2 implementation with PKCE for a web app accessing the Google Drive API, including token storage, refresh handling, and proper scope configuration.",
-    "input": "Implement OAuth2 authentication with PKCE for a Next.js web application that needs to access users' Google Drive files. Users should be able to sign in with their Google account, browse their Drive files, and download selected files. Use the narrowest possible scopes. Store refresh tokens encrypted in a PostgreSQL database. Handle token refresh transparently. Implement proper error handling for revoked tokens and expired sessions.",
-    "assertions": [
-      {
-        "type": "contains",
-        "value": "drive.readonly",
-        "description": "Must request the narrowest scope (drive.readonly or drive.file) instead of the full drive scope to minimize security surface and simplify consent review."
-      },
-      {
-        "type": "contains",
-        "value": "code_verifier",
-        "description": "Must implement PKCE with code_verifier and code_challenge parameters to protect the authorization code exchange from interception attacks."
-      },
-      {
-        "type": "contains",
-        "value": "refresh_token",
-        "description": "Must handle refresh token storage and usage for maintaining long-lived access without requiring users to re-authorize on every session."
-      },
-      {
-        "type": "contains",
-        "value": "encrypt",
-        "description": "Must encrypt refresh tokens before storing in the database to protect user credentials from database compromise."
-      },
-      {
-        "type": "contains",
-        "value": "files.list",
-        "description": "Must use the Drive API files.list endpoint with fields parameter to retrieve file metadata efficiently without over-fetching."
-      }
-    ]
-  },
-  {
-    "name": "sheets-api-batch-operations",
-    "description": "Validate that the skill produces efficient Sheets API batch operations with proper value handling, formula preservation, error handling, and quota management.",
-    "input": "Build a reporting service that reads sales data from one Google Sheet, processes it, and writes summary reports to another Sheet. The source sheet has 10,000 rows with formulas in calculated columns. Read all data preserving formula results. Process the data to generate monthly summaries. Write the summaries to a target sheet using batch updates. Preserve existing formatting in the target sheet. Handle quota limits with batch requests. Use a service account for authentication.",
-    "assertions": [
-      {
-        "type": "contains",
-        "value": "valueRenderOption",
-        "description": "Must set valueRenderOption (FORMATTED_VALUE or UNFORMATTED_VALUE) explicitly when reading to control whether formula results or raw values are returned."
-      },
-      {
-        "type": "contains",
-        "value": "batchUpdate",
-        "description": "Must use spreadsheets.values.batchUpdate or spreadsheets.batchUpdate for writing multiple ranges in a single API call to reduce quota consumption."
-      },
-      {
-        "type": "contains",
-        "value": "valueInputOption",
-        "description": "Must set valueInputOption (RAW or USER_ENTERED) explicitly when writing to control whether values are treated as literals or parsed as formulas."
-      },
-      {
-        "type": "contains",
-        "value": "ServiceAccountCredentials",
-        "description": "Must authenticate using service account credentials for server-to-server access without user interaction."
-      },
-      {
-        "type": "contains",
-        "value": "spreadsheets.readonly",
-        "description": "Must request appropriate scopes (spreadsheets.readonly for reading, spreadsheets for writing) to follow the principle of least privilege."
-      }
-    ]
-  }
-]