@intent-systems/nexus 2026.1.5-3

package/skills/github/SKILL.md

@@ -0,0 +1,26 @@
+---
+name: github
+description: Authenticate to GitHub for CLI/API access (used by the gh tool).
+homepage: https://cli.github.com/
+metadata: {"nexus":{"type":"connector","provides":["repo-access","ci-cd"],"requires":{"bins":["gh"],"credentials":["github"],"env":["GITHUB_TOKEN"]},"primaryEnv":"GITHUB_TOKEN"}}
+---
+
+# GitHub Connector
+
+This connector manages GitHub authentication for `gh` and API access.
+
+## Docs
+
+- `docs/setup.md`
+- `docs/troubleshooting.md`
+
+## Quick check
+
+```bash
+gh auth status
+```
+
+## Notes
+
+- Use `GITHUB_TOKEN` for automation/CI.
+- For interactive use, `gh auth login` is easiest.

package/skills/github/docs/setup.md

@@ -0,0 +1,21 @@
+# GitHub Connector Setup
+
+## Authenticate with gh (interactive)
+
+```bash
+gh auth login
+gh auth status
+```
+
+## Token-based auth (automation)
+
+```bash
+export GITHUB_TOKEN="your-token-here"
+```
+
+Create a token at https://github.com/settings/tokens and grant only the scopes you need.
+
+## Notes
+
+- When not in a git repo, pass `--repo owner/repo`.
+- For CI, prefer `GITHUB_TOKEN` and `gh auth status` to verify.

package/skills/github/docs/troubleshooting.md

@@ -0,0 +1,24 @@
+# GitHub Connector Troubleshooting
+
+## Not logged in
+
+```bash
+gh auth login
+gh auth status
+```
+
+## Repo not found (outside git dir)
+
+Use explicit `--repo`:
+
+```bash
+gh pr list --repo owner/repo
+```
+
+## Token not picked up
+
+Ensure `GITHUB_TOKEN` is exported:
+
+```bash
+export GITHUB_TOKEN="your-token-here"
+```

package/skills/gog/SKILL.md

@@ -0,0 +1,104 @@
+---
+name: gog
+description: Google Workspace CLI for Gmail, Calendar, Drive, Contacts, Sheets, People, and Tasks.
+homepage: https://gogcli.sh
+metadata: {"nexus":{"emoji":"📧","type":"tool","provides":["email-read","email-send","calendar","contacts","cloud-storage"],"requires":{"bins":["gog"],"credentials":["google-oauth"]},"install":[{"id":"brew","kind":"brew","formula":"steipete/tap/gogcli","bins":["gog"],"label":"Install gog (brew)"}]}}
+---
+
+# gog
+
+Google Workspace CLI. Requires OAuth setup via the `google-oauth` connector.
+
+## Docs
+
+- `docs/setup.md`
+- `docs/portability.md`
+- `docs/troubleshooting.md`
+- `scripts/cdp/README.md` (CDP automation)
+
+## Quick Start
+
+```bash
+gog gmail search "is:unread" --max 10
+gog calendar events --json
+gog drive ls --max 5
+```
+
+## Commands
+
+### Gmail
+```bash
+gog gmail search "newer_than:7d" --max 20
+gog gmail labels list
+gog gmail send --to user@example.com --subject "Hi" --body "Hello"
+gog gmail thread get <threadId>
+```
+
+### Calendar
+```bash
+gog calendar calendars
+gog calendar events                           # All calendars
+gog calendar events <calendarId> --from 2026-01-01 --to 2026-01-31
+gog calendar create <calendarId> --summary "Meeting" --start "2026-01-15T10:00:00"
+```
+
+### Drive
+```bash
+gog drive ls                                  # Root folder
+gog drive ls --parent <folderId>
+gog drive search "budget" --max 10
+gog drive download <fileId> --out ./file.pdf
+gog drive upload ./doc.pdf --parent <folderId>
+```
+
+### Contacts / People
+```bash
+gog contacts list --max 50
+gog people me                                 # Your profile
+```
+
+### Tasks
+```bash
+gog tasks lists
+gog tasks list <tasklistId>
+gog tasks add <tasklistId> --title "Do the thing"
+```
+
+### Sheets
+```bash
+gog sheets get <spreadsheetId> "Sheet1!A1:D10" --json
+gog sheets update <spreadsheetId> "Sheet1!A1:B2" --values-json '[["A","B"],["1","2"]]'
+gog sheets append <spreadsheetId> "Sheet1!A:C" --values-json '[["x","y","z"]]'
+```
+
+### Docs / Slides
+```bash
+gog docs cat <docId>
+gog docs export <docId> --format txt --out ./doc.txt
+gog slides export <presentationId> --format pdf --out ./deck.pdf
+```
+
+## Multi-Account
+
+```bash
+gog auth list                                 # See all accounts
+gog gmail search "test" --account user@gmail.com
+export GOG_ACCOUNT=user@gmail.com             # Set default
+```
+
+## Flags
+
+| Flag | Description |
+| --- | --- |
+| `--account` | Specify which Google account to use |
+| `--json` | Output as JSON (for scripting) |
+| `--plain` | TSV output, no colors |
+| `--max N` | Limit results |
+| `--force` | Skip confirmations |
+| `--no-input` | Never prompt (CI mode) |
+
+## Setup & Portability
+
+- First-time setup: `docs/setup.md`
+- Moving to another machine: `docs/portability.md`
+- Browser automation scripts: `scripts/cdp/README.md`

package/skills/gog/docs/portability.md

@@ -0,0 +1,94 @@
+# gog Portability
+
+How to move your Google auth to another machine.
+
+## The Pattern: 1Password is the Source of Truth
+
+**Always export tokens to 1Password immediately after auth.** This makes portability trivial.
+
+## Export Tokens (Do This After Every Auth)
+
+```bash
+# Export to temp file
+gog auth tokens export you@gmail.com --out /tmp/gog-token.json
+
+# Store in 1Password
+op document create /tmp/gog-token.json --title "gog-you@gmail.com" --vault Personal
+
+# Clean up (token file contains secrets!)
+rm /tmp/gog-token.json
+```
+
+## Import Tokens (On New Machine)
+
+```bash
+# 1. Install gog
+brew install steipete/tap/gogcli
+
+# 2. Copy credentials.json (same one works everywhere)
+# Either from 1Password or from old machine
+cp /path/to/credentials.json ~/.config/gog/credentials.json
+# Or: gog auth credentials /path/to/credentials.json
+
+# 3. Download token from 1Password
+op document get "gog-you@gmail.com" --out-file /tmp/gog-token.json
+
+# 4. Import into keychain
+gog auth tokens import /tmp/gog-token.json
+
+# 5. Clean up
+rm /tmp/gog-token.json
+
+# 6. Verify
+gog auth list
+gog gmail labels list --account you@gmail.com
+```
+
+## Bulk Export/Import
+
+```bash
+# Export all accounts
+for email in $(gog auth list --plain | cut -f1); do
+  gog auth tokens export "$email" --out "/tmp/gog-${email}.json"
+  op document create "/tmp/gog-${email}.json" --title "gog-${email}" --vault Personal
+  rm "/tmp/gog-${email}.json"
+done
+
+# Import all (on new machine)
+for item in $(op document list --vault Personal --format json | jq -r '.[] | select(.title | startswith("gog-")) | .title'); do
+  op document get "$item" --out-file "/tmp/${item}.json"
+  gog auth tokens import "/tmp/${item}.json"
+  rm "/tmp/${item}.json"
+done
+```
+
+## What's Portable
+
+| Item | How to Move |
+|------|-------------|
+| `credentials.json` | Copy file (safe to share, it's just client config) |
+| Refresh tokens | Export -> 1Password -> Import |
+| Account list | Rebuilt automatically when you import tokens |
+
+## Security notes
+
+- `credentials.json` is not a secret (client config only).
+- Refresh tokens are secrets; store them in 1Password or another secure vault.
+- Remove temporary token files after export/import.
+
+## Why 1Password?
+
+- Single source of truth for all secrets
+- Syncs across machines automatically
+- Encrypted, biometric unlock
+- Scriptable with `op` CLI for automation
+
+## Re-Auth (If Tokens Expire)
+
+Tokens rarely expire, but if they do:
+
+```bash
+gog auth remove you@gmail.com --force
+gog auth add you@gmail.com --services gmail,calendar,drive,contacts,sheets,people,tasks
+# Then export to 1Password again
+```

package/skills/gog/docs/setup.md

@@ -0,0 +1,76 @@
+# gog Setup Guide
+
+## Prerequisites
+
+1. **gog CLI** installed.
+2. **google-oauth connector** configured (`credentials.json` in `~/.config/gog/`).
+3. **1Password CLI** installed and signed in (for token portability).
+4. **Google account(s)** you want to connect.
+
+## Install gog
+
+```bash
+brew install steipete/tap/gogcli
+gog --version
+```
+
+## Configure OAuth client
+
+The OAuth client setup lives in the `google-oauth` connector guide:
+- `skills/google-oauth/SKILL.md`
+
+If you want automation, see:
+- `skills/gog/scripts/cdp/README.md`
+
+## Quick Setup (Recommended)
+
+If `credentials.json` is already configured:
+
+```bash
+# 1. Auth each account (browser opens, click Allow)
+gog auth add you@gmail.com --services gmail,calendar,drive,contacts,sheets,people,tasks
+
+# 2. Export token to 1Password immediately
+gog auth tokens export you@gmail.com --out /tmp/gog-token.json
+op document create /tmp/gog-token.json --title "gog-you@gmail.com" --vault Personal
+rm /tmp/gog-token.json
+
+# 3. Verify
+gog gmail labels list --account you@gmail.com
+```
+
+Repeat for each Google account.
+
+## Authorize accounts
+
+```bash
+gog auth add you@gmail.com --services gmail,calendar,drive,contacts,sheets,people,tasks
+```
+
+Browser opens -> Click through:
+1. "Choose an account" -> select yours
+2. "Google hasn't verified this app" -> Advanced -> "Go to gog-cli (unsafe)"
+3. Permission list -> "Allow"
+
+## What gets stored
+
+| Location | Contents |
+|----------|----------|
+| `~/.config/gog/credentials.json` | OAuth client config (shareable) |
+| macOS Keychain | Refresh tokens (per account) |
+| 1Password (recommended) | Exported token files for portability |
+
+## After setup
+
+```bash
+# Verify all accounts
+gog auth list
+
+# Test each one
+gog gmail labels list --account you@gmail.com
+gog drive ls --account you@gmail.com
+```
+
+## Troubleshooting
+
+See `docs/troubleshooting.md` for common failures (access_denied, APIs not enabled, CDP issues).

package/skills/gog/docs/troubleshooting.md

@@ -0,0 +1,94 @@
+# gog Troubleshooting
+
+## access_denied / "developer hasn't given you access"
+
+**Symptom:** OAuth consent fails with access_denied.
+
+**Cause:** Your account is not listed as a Test user for the OAuth consent screen.
+
+**Fix:**
+
+1. Go to https://console.cloud.google.com/auth/audience
+2. Under "Test users", click "Add users".
+3. Add your email addresses and save.
+4. Re-run `gog auth add ...` after a minute or two.
+
+## APIs not enabled
+
+**Symptom:** Errors like "Gmail API has not been used in project" or `accessNotConfigured`.
+
+**Cause:** Required APIs not enabled for the GCP project.
+
+**Fix:**
+
+Enable these APIs in Cloud Console:
+- Gmail API
+- Google Calendar API
+- Google Drive API
+- Google People API
+- Google Sheets API
+- Google Tasks API
+
+Optional CLI (if `gcloud` is installed):
+
+```bash
+gcloud services enable gmail.googleapis.com
+gcloud services enable calendar-json.googleapis.com
+gcloud services enable drive.googleapis.com
+gcloud services enable people.googleapis.com
+gcloud services enable sheets.googleapis.com
+gcloud services enable tasks.googleapis.com
+```
+
+## Tokens not portable between machines
+
+**Symptom:** gog works on one machine but not another.
+
+**Cause:** Tokens are in local keychain, not backed up to 1Password.
+
+**Fix:**
+
+```bash
+gog auth tokens export you@gmail.com --out /tmp/gog-token.json
+op document create /tmp/gog-token.json --title "gog-you@gmail.com" --vault Personal
+rm /tmp/gog-token.json
+
+# On the new machine
+op document get "gog-you@gmail.com" --out-file /tmp/gog-token.json
+gog auth tokens import /tmp/gog-token.json
+rm /tmp/gog-token.json
+```
+
+## Workspace account requires admin approval
+
+**Symptom:** OAuth consent says "Admin approval required".
+
+**Cause:** Google Workspace policy blocks unapproved apps.
+
+**Fix:**
+
+- Ask your Workspace admin to approve the app, or
+- Use a personal Gmail account instead.
+
+## CDP automation fails
+
+**Symptom:** CDP scripts hang or error.
+
+**Cause:** Chrome not running with `--remote-debugging-port`, or profile copy issues.
+
+**Fix:**
+
+```bash
+curl -s http://127.0.0.1:9222/json/version
+
+# If not running, restart the CDP Chrome session
+pkill -9 "Google Chrome"
+cd skills/gog/scripts/cdp
+bash launch_cdp_chrome.sh
+```
+
+Re-run the script you were using:
+
+```bash
+python auth_add_accounts.py --emails you@gmail.com
+```

package/skills/gog/scripts/cdp/README.md

@@ -0,0 +1,90 @@
+## gog CDP autopilot
+
+This folder contains scripts for a fully automated `gog` onboarding using your already-logged-in Chrome.
+
+Why CDP?
+- Normal browser automation launches a fresh browser -> you have to re-login.
+- CDP (Chrome DevTools Protocol) lets Playwright control a Chrome instance that has your existing cookies/session.
+
+### What this accomplishes
+
+1. Launch a dedicated Chrome instance with `--remote-debugging-port`
+2. Attach Playwright over CDP
+3. (Optional) Create OAuth client + download `credentials.json`
+4. Add your emails as OAuth Test users (required when publishing status is Testing)
+5. Run `gog auth add` for multiple accounts and click through consent automatically
+
+### Prereqs
+
+- `brew install steipete/tap/gogcli` (provides `gog`)
+- `uv` installed
+- macOS: Google Chrome installed
+
+### 0) One-time environment setup
+
+```bash
+mkdir -p ~/nexus/state/browser/cdp
+cd ~/nexus/state/browser/cdp
+
+uv venv --python 3.11
+source .venv/bin/activate
+uv pip install playwright==1.57.0
+python -m playwright install chromium
+```
+
+### 1) Launch CDP Chrome using a copied profile
+
+```bash
+bash ./launch_cdp_chrome.sh
+```
+
+This copies a minimal set of Chrome profile files into:
+`~/nexus/state/browser/cdp/chrome-user-data/`
+
+Then it launches:
+- port: `9222`
+- profile: `Default`
+
+Verify CDP is running:
+
+```bash
+curl -s http://127.0.0.1:9222/json/version
+```
+
+### 2) Ensure gog has OAuth client credentials
+
+If you already have a `credentials.json`, store it:
+
+```bash
+gog auth credentials /path/to/credentials.json
+```
+
+If you want to create it via CDP automation, see `create_oauth_client.py` (requires `GCP_PROJECT_ID`).
+
+### 3) Add OAuth test users (fixes `access_denied`)
+
+If your consent screen is Testing, add users:
+
+```bash
+python add_test_users.py \
+  --project "$GCP_PROJECT_ID" \
+  --emails tnapathy@gmail.com tyler@intent-systems.com tyler@merchcraft.com
+```
+
+### 4) Authorize multiple accounts (stores refresh tokens)
+
+```bash
+python auth_add_accounts.py \
+  --emails tnapathy@gmail.com tyler@intent-systems.com tyler@merchcraft.com
+```
+
+Verify:
+
+```bash
+gog auth list
+```
+
+### Notes
+
+- If you see "developer hasn't given you access" / `access_denied`, your user is not a Test user (or propagation hasn't completed yet).
+- Workspace accounts may require admin approval depending on org policies.

package/skills/gog/scripts/cdp/add_test_users.py

@@ -0,0 +1,69 @@
+#!/usr/bin/env python3
+"""
+Add OAuth "Test users" on Google Auth Platform -> Audience via CDP Chrome.
+
+This fixes the common error:
+  access_denied / "developer hasn't given you access"
+
+Usage:
+  python add_test_users.py --project <gcp-project-id> --emails a@b.com c@d.com
+"""
+
+import argparse
+import re
+from playwright.sync_api import sync_playwright
+
+
+def parse_args():
+    ap = argparse.ArgumentParser()
+    ap.add_argument("--project", required=True, help="GCP project id (e.g. gen-lang-client-xxxx)")
+    ap.add_argument("--emails", nargs="+", required=True, help="Emails to add as test users")
+    ap.add_argument("--cdp", default="http://127.0.0.1:9222", help="CDP endpoint (default: 127.0.0.1:9222)")
+    return ap.parse_args()
+
+
+def main():
+    args = parse_args()
+    url = f"https://console.cloud.google.com/auth/audience?project={args.project}"
+
+    with sync_playwright() as p:
+        browser = p.chromium.connect_over_cdp(args.cdp)
+        ctx = browser.contexts[0]
+        ctx.set_default_timeout(30000)
+
+        page = ctx.new_page()
+        page.goto(url, wait_until="domcontentloaded")
+        page.wait_for_timeout(2500)
+
+        # Open Add users panel
+        page.get_by_role("button", name=re.compile(r"add users", re.I)).first.click(timeout=10000)
+        page.wait_for_timeout(1500)
+
+        # Input expects "chips": type email + Enter
+        tb = page.get_by_role("textbox").first
+        tb.click()
+
+        for email in args.emails:
+            tb.fill("")
+            tb.type(email, delay=20)
+            tb.press("Enter")
+            page.wait_for_timeout(350)
+
+        # Save
+        page.get_by_role("button", name=re.compile(r"^save$", re.I)).first.click(timeout=10000)
+        page.wait_for_timeout(2500)
+
+        # Reload to verify
+        page.reload(wait_until="domcontentloaded")
+        page.wait_for_timeout(3000)
+        page.screenshot(path="/private/tmp/gog-cdp-add-test-users-verify.png", full_page=True)
+
+        print("Attempted to add test users.")
+        print("Screenshot: /private/tmp/gog-cdp-add-test-users-verify.png")
+        print("Next: run gog auth add for each account.")
+
+        browser.close()
+
+
+if __name__ == "__main__":
+    main()