@intent-systems/nexus 2026.1.5-3

package/skills/gog/scripts/cdp/auth_add_accounts.py

@@ -0,0 +1,209 @@
+#!/usr/bin/env python3
+"""
+Automate `gog auth add` for multiple Google accounts using CDP Chrome.
+
+How it works:
+- Runs: gog auth add <email> --services ... --force-consent
+- Captures the OAuth URL printed by gog
+- Opens that URL in CDP-attached Chrome (Playwright connect_over_cdp)
+- Clicks through account chooser + consent buttons
+- Waits for gog to receive the localhost callback and store tokens
+
+Usage:
+  python auth_add_accounts.py --emails a@b.com c@d.com
+"""
+
+import argparse
+import re
+import subprocess
+import time
+from playwright.sync_api import sync_playwright
+
+
+URL_RE = re.compile(r"https://accounts\\.google\\.com/o/oauth2/auth\\?[^\\s]+")
+ANSI_ESCAPE_RE = re.compile(r"\x1b\[[0-9;]*[A-Za-z]")
+URL_PREFIX = "https://accounts.google.com/o/oauth2/auth?"
+
+
+def parse_args():
+    ap = argparse.ArgumentParser()
+    ap.add_argument("--emails", nargs="+", required=True, help="Account emails to authorize")
+    ap.add_argument(
+        "--services",
+        default="gmail,calendar,drive,contacts,sheets,people,tasks",
+        help="gog services (comma-separated)",
+    )
+    ap.add_argument("--cdp", default="http://127.0.0.1:9222", help="CDP endpoint (default: 127.0.0.1:9222)")
+    ap.add_argument("--timeout", type=int, default=120, help="Timeout per account in seconds")
+    return ap.parse_args()
+
+
+def run_gog_auth_add(email: str, services: str) -> subprocess.Popen:
+    cmd = ["gog", "auth", "add", email, "--services", services, "--force-consent"]
+    # gog waits for localhost callback; keep it running
+    return subprocess.Popen(cmd, stdout=subprocess.PIPE, stderr=subprocess.STDOUT, text=True)
+
+
+def read_oauth_url(proc: subprocess.Popen, timeout_s: int = 30) -> str:
+    start = time.time()
+    buf = []
+    while time.time() - start < timeout_s:
+        # If process already exited, stop waiting.
+        if proc.poll() is not None:
+            break
+
+        line = proc.stdout.readline() if proc.stdout else ""
+        if line:
+            buf.append(line)
+            clean = ANSI_ESCAPE_RE.sub("", line)
+
+            # Fast path: look for URL prefix (more robust than regex on wrapped/colored output)
+            idx = clean.find(URL_PREFIX)
+            if idx != -1:
+                candidate = clean[idx:].strip()
+                # If wrapped, remove internal whitespace/newlines by joining subsequent lines later.
+                # For single-line URLs, first token is enough.
+                first = candidate.split()[0]
+                if first.startswith(URL_PREFIX):
+                    return first
+
+            m = URL_RE.search(clean)
+            if m:
+                return m.group(0)
+        else:
+            time.sleep(0.05)
+
+    # Fallback: try to reconstruct from the full buffer (handles wrapped URLs)
+    joined = ANSI_ESCAPE_RE.sub("", "".join(buf))
+    idx = joined.find(URL_PREFIX)
+    if idx != -1:
+        tail = joined[idx:]
+        # Remove whitespace entirely to undo hard wraps
+        tail_compact = "".join(tail.split())
+        # Stop at first obvious terminator
+        term_idx = tail_compact.find("authorizationcanceled")
+        if term_idx != -1:
+            tail_compact = tail_compact[:term_idx]
+        if tail_compact.startswith(URL_PREFIX):
+            return tail_compact
+
+    raise RuntimeError("Timed out waiting for OAuth URL. Output so far:\n" + "".join(buf[-50:]))
+
+
+def click_if_exists(page, text_regex: str) -> bool:
+    loc = page.locator(f"text=/{text_regex}/i").first
+    try:
+        if loc.count() > 0:
+            loc.click(timeout=1500)
+            return True
+    except Exception:
+        return False
+    return False
+
+
+def click_email(page, email: str) -> bool:
+    loc = page.locator(f"text={email}").first
+    try:
+        loc.wait_for(state="visible", timeout=8000)
+        loc.click()
+        return True
+    except Exception:
+        return False
+
+
+def drive_consent_flow(page, email: str, max_steps: int = 30):
+    # Step 1: choose account if account chooser is shown
+    click_email(page, email)
+    page.wait_for_timeout(1000)
+
+    # Step 2: click through consent screens until redirect to localhost
+    for _ in range(max_steps):
+        url = page.url
+        if url.startswith("http://127.0.0.1:") or url.startswith("http://localhost:"):
+            return
+
+        # Common consent buttons
+        if click_if_exists(page, r"^continue$"):
+            page.wait_for_timeout(1200)
+            continue
+        if click_if_exists(page, r"^next$"):
+            page.wait_for_timeout(1200)
+            continue
+        if click_if_exists(page, r"^allow$"):
+            page.wait_for_timeout(1500)
+            continue
+        if click_if_exists(page, r"^accept$"):
+            page.wait_for_timeout(1500)
+            continue
+        if click_if_exists(page, r"^agree$"):
+            page.wait_for_timeout(1500)
+            continue
+
+        # looser matches
+        if click_if_exists(page, r"continue"):
+            page.wait_for_timeout(1200)
+            continue
+        if click_if_exists(page, r"allow"):
+            page.wait_for_timeout(1500)
+            continue
+
+        # wait for navigation changes
+        page.wait_for_timeout(1200)
+
+    raise RuntimeError(f"Consent flow did not complete for {email}. Current URL: {page.url}")
+
+
+def main():
+    args = parse_args()
+
+    with sync_playwright() as p:
+        browser = p.chromium.connect_over_cdp(args.cdp)
+        ctx = browser.contexts[0]
+        ctx.set_default_timeout(30000)
+        page = ctx.new_page()
+
+        failures = []
+
+        for email in args.emails:
+            print(f"\n=== Authorizing {email} ===")
+            proc = run_gog_auth_add(email, args.services)
+            try:
+                oauth_url = read_oauth_url(proc)
+                print("OAuth URL captured")
+                page.goto(oauth_url, wait_until="domcontentloaded")
+                page.wait_for_timeout(1500)
+                drive_consent_flow(page, email)
+
+                # Wait for gog to finish
+                try:
+                    exit_code = proc.wait(timeout=args.timeout)
+                except subprocess.TimeoutExpired:
+                    proc.kill()
+                    raise RuntimeError("gog auth add timed out waiting for callback")
+
+                if exit_code != 0:
+                    out = proc.stdout.read() if proc.stdout else ""
+                    raise RuntimeError(f"gog auth add failed with exit code {exit_code}:\n{out}")
+
+                print(f"Token stored for {email}")
+            except Exception as e:
+                try:
+                    proc.kill()
+                except Exception:
+                    pass
+                failures.append((email, str(e)))
+                print(f"Failed for {email}: {e}")
+
+        browser.close()
+
+    if failures:
+        print("\n=== Failures ===")
+        for email, err in failures:
+            print(f"- {email}: {err}")
+        raise SystemExit(1)
+
+    print("\nAll accounts authorized. Verify with: gog auth list")
+
+
+if __name__ == "__main__":
+    main()

package/skills/gog/scripts/cdp/auth_add_accounts_manual.py

@@ -0,0 +1,206 @@
+#!/usr/bin/env python3
+"""
+Automate `gog auth add --manual` for multiple Google accounts using CDP Chrome.
+
+Why manual mode?
+- `gog auth add` starts a local callback server and may time out if the browser
+  isn't opened quickly (or network changes interrupt it).
+- `--manual` prints an OAuth URL and asks for the final redirect URL.
+  We can 100% automate that via Playwright CDP by reading the redirect from the browser.
+
+Usage:
+  python auth_add_accounts_manual.py --emails a@b.com c@d.com
+"""
+
+import argparse
+import re
+import subprocess
+import time
+from playwright.sync_api import sync_playwright
+
+
+URL_PREFIX = "https://accounts.google.com/o/oauth2/auth?"
+REDIRECT_PREFIX = "http://localhost:1"
+
+# Strip common ANSI sequences and control chars that break URL parsing
+ANSI_ESCAPE_RE = re.compile(r"\x1b\\[[0-9;]*[A-Za-z]|\x1b\\][^\\x1b]*\\x1b\\\\")
+
+
+def parse_args():
+    ap = argparse.ArgumentParser()
+    ap.add_argument("--emails", nargs="+", required=True, help="Account emails to authorize")
+    ap.add_argument(
+        "--services",
+        default="gmail,calendar,drive,contacts,sheets,people,tasks",
+        help="gog services (comma-separated)",
+    )
+    ap.add_argument("--cdp", default="http://127.0.0.1:9222", help="CDP endpoint (default: 127.0.0.1:9222)")
+    ap.add_argument("--timeout", type=int, default=180, help="Timeout per account in seconds")
+    return ap.parse_args()
+
+
+def _printable(s: str) -> str:
+    # Remove ANSI + non-printable (keep URL chars)
+    s = ANSI_ESCAPE_RE.sub("", s)
+    return "".join(ch for ch in s if ch.isprintable() or ch in "\n\t ")
+
+
+def run_gog_manual(email: str, services: str) -> subprocess.Popen:
+    cmd = [
+        "gog",
+        "auth",
+        "add",
+        email,
+        "--services",
+        services,
+        "--force-consent",
+        "--manual",
+    ]
+    return subprocess.Popen(
+        cmd,
+        stdout=subprocess.PIPE,
+        stderr=subprocess.STDOUT,
+        stdin=subprocess.PIPE,
+        text=True,
+        bufsize=1,
+    )
+
+
+def read_auth_url(proc: subprocess.Popen, timeout_s: int = 30) -> str:
+    start = time.time()
+    buf = []
+    while time.time() - start < timeout_s:
+        if proc.poll() is not None:
+            break
+        line = proc.stdout.readline() if proc.stdout else ""
+        if not line:
+            time.sleep(0.05)
+            continue
+        clean = _printable(line)
+        buf.append(clean)
+        idx = clean.find(URL_PREFIX)
+        if idx != -1:
+            candidate = clean[idx:].strip()
+            # remove whitespace (handles line wraps)
+            return "".join(candidate.split())
+
+    joined = "".join(buf)
+    idx = joined.find(URL_PREFIX)
+    if idx != -1:
+        tail = joined[idx:]
+        return "".join(tail.split())
+
+    raise RuntimeError("Timed out waiting for OAuth URL. Output so far:\n" + "".join(buf[-80:]))
+
+
+def click_if_exists(page, text_regex: str) -> bool:
+    loc = page.locator(f"text=/{text_regex}/i").first
+    try:
+        if loc.count() > 0:
+            loc.click(timeout=1500)
+            return True
+    except Exception:
+        return False
+    return False
+
+
+def click_email(page, email: str):
+    loc = page.locator(f"text={email}").first
+    try:
+        loc.wait_for(state="visible", timeout=8000)
+        loc.click()
+        return True
+    except Exception:
+        return False
+
+
+def drive_consent(page, email: str, max_steps: int = 40):
+    # Choose account if shown
+    click_email(page, email)
+    page.wait_for_timeout(800)
+
+    for _ in range(max_steps):
+        url = page.url
+        if url.startswith(REDIRECT_PREFIX):
+            return url
+
+        # Common buttons
+        for pat in (r"^continue$", r"^next$", r"^allow$", r"^accept$", r"^agree$"):
+            if click_if_exists(page, pat):
+                page.wait_for_timeout(1200)
+                break
+        else:
+            # looser matches
+            if click_if_exists(page, r"continue"):
+                page.wait_for_timeout(1200)
+            elif click_if_exists(page, r"allow"):
+                page.wait_for_timeout(1500)
+            else:
+                page.wait_for_timeout(1000)
+
+    raise RuntimeError(f"Consent flow did not reach redirect for {email}. Current URL: {page.url}")
+
+
+def main():
+    args = parse_args()
+
+    with sync_playwright() as p:
+        failures = []
+
+        for email in args.emails:
+            print(f"\n=== Authorizing (manual) {email} ===")
+            proc = run_gog_manual(email, args.services)
+            try:
+                oauth_url = read_auth_url(proc)
+                print("OAuth URL captured")
+
+                # Reconnect to CDP each iteration to avoid stale/closed pages
+                browser = p.chromium.connect_over_cdp(args.cdp)
+                ctx = browser.contexts[0]
+                ctx.set_default_timeout(30000)
+                page = ctx.new_page()
+
+                page.goto(oauth_url, wait_until="domcontentloaded")
+                page.wait_for_timeout(1200)
+
+                redirect_url = drive_consent(page, email)
+                print("Redirect captured")
+
+                browser.close()
+
+                # Send redirect URL back to gog
+                if not proc.stdin:
+                    raise RuntimeError("gog stdin not available")
+                proc.stdin.write(redirect_url + "\n")
+                proc.stdin.flush()
+
+                try:
+                    exit_code = proc.wait(timeout=args.timeout)
+                except subprocess.TimeoutExpired:
+                    proc.kill()
+                    raise RuntimeError("gog auth add --manual timed out waiting for token store")
+
+                out_rest = proc.stdout.read() if proc.stdout else ""
+                if exit_code != 0:
+                    raise RuntimeError(f"gog auth add --manual failed (exit {exit_code}):\n{_printable(out_rest)}")
+
+                print(f"Token stored for {email}")
+            except Exception as e:
+                try:
+                    proc.kill()
+                except Exception:
+                    pass
+                failures.append((email, str(e)))
+                print(f"Failed for {email}: {e}")
+
+    if failures:
+        print("\n=== Failures ===")
+        for email, err in failures:
+            print(f"- {email}: {err}")
+        raise SystemExit(1)
+
+    print("\nAll accounts authorized. Verify with: gog auth list")
+
+
+if __name__ == "__main__":
+    main()

package/skills/gog/scripts/cdp/create_oauth_client.py

@@ -0,0 +1,165 @@
+#!/usr/bin/env python3
+"""
+Create a Google OAuth "Desktop app" client in Cloud Console via CDP Chrome and download credentials.json.
+
+This automates:
+- Enable Gmail API + Calendar API (best-effort)
+- APIs & Services -> Credentials -> Create credentials -> OAuth client ID -> Desktop app
+- Download JSON to ~/.config/gog/credentials.json (default)
+
+Usage:
+  python create_oauth_client.py --project <gcp-project-id> --name gog-cli
+"""
+
+import argparse
+import os
+import re
+from pathlib import Path
+from playwright.sync_api import sync_playwright
+
+
+def parse_args():
+    ap = argparse.ArgumentParser()
+    ap.add_argument("--project", required=True, help="GCP project id (e.g. gen-lang-client-xxxx)")
+    ap.add_argument("--name", default="gog-cli", help="OAuth client name (default: gog-cli)")
+    ap.add_argument("--cdp", default="http://127.0.0.1:9222", help="CDP endpoint (default: 127.0.0.1:9222)")
+    ap.add_argument(
+        "--out",
+        default=os.path.expanduser("~/.config/gog/credentials.json"),
+        help="Where to save the downloaded credentials.json",
+    )
+    return ap.parse_args()
+
+
+def snap(page, path: str):
+    page.screenshot(path=path, full_page=True)
+    print(f"[screenshot] {path}")
+
+
+def click_text(page, text_regex: str, timeout=15000):
+    loc = page.locator(f"text=/{text_regex}/i").first
+    loc.wait_for(state="visible", timeout=timeout)
+    loc.click()
+
+
+def maybe_enable_api(page, url: str, label: str):
+    page.goto(url, wait_until="domcontentloaded")
+    page.wait_for_timeout(2000)
+    snap(page, f"/private/tmp/gog-cdp-api-{label}.png")
+
+    enable = page.get_by_role("button", name=re.compile(r"^enable$", re.I))
+    if enable.count() == 0:
+        enable = page.get_by_role("button", name=re.compile(r"enable", re.I))
+
+    if enable.count() > 0:
+        try:
+            enable.first.click(timeout=3000)
+            page.wait_for_timeout(2000)
+            snap(page, f"/private/tmp/gog-cdp-api-{label}-enabled.png")
+            print(f"[api] enabled {label}")
+        except Exception:
+            print(f"[api] enable button found but click failed for {label}")
+    else:
+        print(f"[api] no enable button detected for {label} (maybe already enabled)")
+
+
+def create_oauth_client(page, project: str, name: str, out_path: Path):
+    creds_url = f"https://console.cloud.google.com/apis/credentials?project={project}"
+    page.goto(creds_url, wait_until="domcontentloaded")
+    page.wait_for_timeout(2000)
+    snap(page, "/private/tmp/gog-cdp-creds-start.png")
+
+    # Open Create credentials menu
+    try:
+        page.get_by_role("button", name=re.compile(r"create credentials", re.I)).first.click(timeout=10000)
+    except Exception:
+        click_text(page, r"\+\s*create credentials|create credentials")
+
+    page.wait_for_timeout(800)
+    snap(page, "/private/tmp/gog-cdp-creds-menu.png")
+
+    # Pick OAuth client ID
+    try:
+        page.get_by_role("menuitem", name=re.compile(r"oauth\s*client\s*id", re.I)).first.click(timeout=8000)
+    except Exception:
+        click_text(page, r"oauth\s*client\s*id")
+
+    page.wait_for_timeout(2500)
+    snap(page, "/private/tmp/gog-cdp-oauth-client-page.png")
+
+    # Select Desktop app in Application type combobox
+    try:
+        combo = page.get_by_role("combobox", name=re.compile(r"application type", re.I)).first
+        combo.click(timeout=8000)
+        page.wait_for_timeout(300)
+        click_text(page, r"desktop")
+    except Exception:
+        click_text(page, r"application type")
+        page.wait_for_timeout(300)
+        click_text(page, r"desktop")
+
+    # Fill Name
+    try:
+        page.get_by_role("textbox", name=re.compile(r"name", re.I)).first.fill(name)
+    except Exception:
+        # fallback: first textbox
+        tbs = page.get_by_role("textbox")
+        if tbs.count() > 0:
+            tbs.first.fill(name)
+
+    snap(page, "/private/tmp/gog-cdp-oauth-client-filled.png")
+
+    # Create
+    try:
+        page.get_by_role("button", name=re.compile(r"^create$", re.I)).first.click(timeout=10000)
+    except Exception:
+        click_text(page, r"^create$")
+
+    page.wait_for_timeout(2500)
+    snap(page, "/private/tmp/gog-cdp-oauth-client-created.png")
+
+    # Download JSON
+    out_path.parent.mkdir(parents=True, exist_ok=True)
+    with page.expect_download(timeout=20000) as dl_info:
+        try:
+            page.get_by_role("button", name=re.compile(r"download", re.I)).first.click(timeout=8000)
+        except Exception:
+            click_text(page, r"download")
+
+    download = dl_info.value
+    download.save_as(str(out_path))
+    print(f"[oauth] downloaded credentials to {out_path}")
+
+
+def main():
+    args = parse_args()
+    out = Path(args.out)
+
+    with sync_playwright() as p:
+        browser = p.chromium.connect_over_cdp(args.cdp)
+        ctx = browser.contexts[0]
+        ctx.set_default_timeout(30000)
+        page = ctx.new_page()
+
+        # Best-effort API enable (optional but useful for onboarding)
+        maybe_enable_api(
+            page,
+            f"https://console.cloud.google.com/apis/library/gmail.googleapis.com?project={args.project}",
+            "gmail",
+        )
+        maybe_enable_api(
+            page,
+            f"https://console.cloud.google.com/apis/library/calendar-json.googleapis.com?project={args.project}",
+            "calendar",
+        )
+
+        create_oauth_client(page, args.project, args.name, out)
+
+        browser.close()
+
+    print("\nNext:")
+    print(f"  gog auth credentials {out}")
+
+
+if __name__ == "__main__":
+    main()

package/skills/gog/scripts/cdp/launch_cdp_chrome.sh

@@ -0,0 +1,58 @@
+#!/bin/bash
+# Launch a dedicated Chrome instance with CDP enabled (port 9222)
+#
+# Why: lets Playwright attach to an already-logged-in session by copying a minimal Chrome profile.
+#
+# This script is safe-ish:
+# - It DOES NOT touch your live Chrome profile
+# - It copies a minimal set of files into Nexus state, then launches a separate Chrome instance
+#
+# Usage:
+#   bash launch_cdp_chrome.sh
+
+set -euo pipefail
+
+PORT="${CDP_PORT:-9222}"
+
+SRC="$HOME/Library/Application Support/Google/Chrome"
+DEST="$HOME/nexus/state/browser/cdp/chrome-user-data"
+
+mkdir -p "$DEST/Default"
+
+echo "Preparing copied Chrome profile at:"
+echo "  $DEST"
+
+# Copy minimal set that preserves logins/cookies.
+# (We avoid copying the entire profile to keep this light and reduce corruption risk.)
+for p in \
+  "Cookies" "Cookies-journal" \
+  "Preferences" "Secure Preferences" \
+  "Web Data" "Web Data-journal" \
+  "Login Data" "Login Data-journal" \
+  "Network" "Sessions"; do
+  if [ -e "$SRC/Default/$p" ]; then
+    rm -rf "$DEST/Default/$p" 2>/dev/null || true
+    cp -R "$SRC/Default/$p" "$DEST/Default/" 2>/dev/null || true
+  fi
+done
+
+# Copy Local State (Chrome expects this; contains metadata/encryption material).
+cp "$SRC/Local State" "$DEST/" 2>/dev/null || true
+
+echo "Launching Chrome with CDP on port $PORT..."
+open -na "Google Chrome" --args \
+  --remote-debugging-port="$PORT" \
+  --user-data-dir="$DEST" \
+  --profile-directory=Default
+
+echo "Waiting for CDP endpoint..."
+for i in {1..40}; do
+  if curl -s "http://127.0.0.1:$PORT/json/version" >/dev/null 2>&1; then
+    echo "CDP ready: http://127.0.0.1:$PORT"
+    exit 0
+  fi
+  sleep 0.25
+done
+
+echo "CDP did not become ready on port $PORT" >&2
+exit 1