crewly 1.16.0 → 1.17.1

package/config/skills/agent/core/gmail-read/execute.sh

@@ -0,0 +1,62 @@
+#!/bin/bash
+# =============================================================================
+# gmail-read — Read one message from the owner's Gmail (read-only)
+#
+# Backed by GET /api/google/gmail/messages/:id.
+#
+# Usage:
+#   bash execute.sh --id 18f0a1b2c3d4e5f6
+#   bash execute.sh '{"id":"18f0a1b2c3d4e5f6"}'
+# =============================================================================
+set -euo pipefail
+SCRIPT_DIR="$(cd "$(dirname "${BASH_SOURCE[0]}")" && pwd)"
+source "${SCRIPT_DIR}/../../_common/lib.sh"
+
+print_usage() {
+  cat <<'EOF_USAGE'
+Usage:
+  bash execute.sh --id <gmail message id>
+  bash execute.sh '{"id":"<gmail message id>"}'
+
+Options:
+  --id   | -i   Gmail message id (required; from gmail-search)
+  --help | -h   Show this help
+EOF_USAGE
+}
+
+INPUT_JSON=""
+ID=""
+
+if [[ $# -gt 0 && ${1:0:1} == '{' ]]; then
+  INPUT_JSON="$1"
+  shift || true
+fi
+
+while [[ $# -gt 0 ]]; do
+  case "$1" in
+    --id|-i)   [ $# -ge 2 ] || error_exit "--id requires a value"; ID="$2"; shift 2 ;;
+    --help|-h) print_usage; exit 0 ;;
+    *) error_exit "Unknown option: $1" ;;
+  esac
+done
+
+if [ -n "$INPUT_JSON" ]; then
+  INPUT=$(read_json_input "$INPUT_JSON")
+  [ -z "$ID" ] && ID=$(printf '%s' "$INPUT" | jq -r '.id // .messageId // empty')
+fi
+
+require_param "id (--id)" "$ID"
+
+ID_ENC=$(jq -rn --arg v "$ID" '$v|@uri')
+RESPONSE=$(api_call GET "/google/gmail/messages/${ID_ENC}" 2>&1) || {
+  printf '%s' "$RESPONSE" | jq -c '{success: false, reason: (.details.error // .details // .error // "unknown"), hint: (.details.hint // ""), message: (.details.message // "")}' 2>/dev/null \
+    || jq -n --arg r "$RESPONSE" '{success: false, reason: $r}'
+  exit 1
+}
+
+# Oversized bodies are parked on disk by api_call; pass that envelope through.
+if printf '%s' "$RESPONSE" | jq -e '.truncated == true' >/dev/null 2>&1; then
+  printf '%s\n' "$RESPONSE"; exit 0
+fi
+
+printf '%s' "$RESPONSE" | jq -c '.data | {id, threadId, from, to, cc, subject, date, messageId, body, bodyType, attachments}'

package/config/skills/agent/core/gmail-read/execute.test.sh

@@ -0,0 +1,68 @@
+#!/bin/bash
+# Tests for gmail-read — run with: bash execute.test.sh
+# Spins up a python HTTP stub as the backend, asserts the request path the
+# skill sends and the JSON it prints. Exit 0 on pass.
+set -u
+HERE="$(cd "$(dirname "${BASH_SOURCE[0]}")" && pwd)"
+EXEC="$HERE/execute.sh"
+PASS=0; FAIL=0
+check() {
+  local name="$1"; local got="$2"; local want="$3"
+  if [ "$got" = "$want" ]; then PASS=$((PASS+1)); else FAIL=$((FAIL+1)); echo "FAIL: $name"; echo "  want: $want"; echo "  got:  $got"; fi
+}
+
+PORT=18802
+STUB_LOG="$(mktemp)"; export STUB_LOG; export STUB_PORT="$PORT"
+python3 -u <<'PY' >/dev/null 2>&1 &
+from http.server import BaseHTTPRequestHandler, HTTPServer
+import json, os
+LOG = os.environ['STUB_LOG']; PORT = int(os.environ['STUB_PORT'])
+MSG = {'id': 'm1', 'threadId': 't1', 'from': 'ann@example.com', 'to': 'owner@example.com', 'cc': '',
+       'subject': 'Q3', 'date': 'D', 'messageId': '<abc@x>', 'snippet': 's', 'body': 'Hi\nthere', 'bodyType': 'text',
+       'attachments': [{'filename': 'deck.pdf', 'mimeType': 'application/pdf', 'size': 12, 'attachmentId': 'A1'}],
+       'labelIds': ['INBOX']}
+class H(BaseHTTPRequestHandler):
+    def do_GET(self):
+        open(LOG, 'w').write(json.dumps({'method': 'GET', 'path': self.path}))
+        if self.path.endswith('/missing'):
+            self.send_response(404); self.send_header('Content-Type', 'application/json'); self.end_headers()
+            self.wfile.write(json.dumps({'success': False, 'error': 'google_error', 'message': 'Requested entity was not found.', 'hint': 'Google or Crewly Cloud failed; retry later.'}).encode()); return
+        if self.path.endswith('/no-grant'):
+            self.send_response(409); self.send_header('Content-Type', 'application/json'); self.end_headers()
+            self.wfile.write(json.dumps({'success': False, 'error': 'not_connected', 'message': 'no grant', 'hint': 'https://cloud/start?token=j'}).encode()); return
+        self.send_response(200); self.send_header('Content-Type', 'application/json'); self.end_headers()
+        self.wfile.write(json.dumps({'success': True, 'data': MSG}).encode())
+    def log_message(self, *a, **k): pass
+HTTPServer(('127.0.0.1', PORT), H).serve_forever()
+PY
+STUB_PID=$!
+disown "$STUB_PID" 2>/dev/null || true
+trap 'kill "$STUB_PID" >/dev/null 2>&1; rm -f "$STUB_LOG"' EXIT
+for i in $(seq 1 30); do curl -s -o /dev/null -m 0.2 "http://127.0.0.1:${PORT}/" 2>/dev/null && break; sleep 0.1; done
+
+run() { CREWLY_API_URL="http://127.0.0.1:${PORT}" bash "$EXEC" "$@" 2>/dev/null; }
+run_err() { CREWLY_API_URL="http://127.0.0.1:${PORT}" bash "$EXEC" "$@" 2>&1 >/dev/null | jq -r '.error' 2>/dev/null; }
+
+WANT='{"id":"m1","threadId":"t1","from":"ann@example.com","to":"owner@example.com","cc":"","subject":"Q3","date":"D","messageId":"<abc@x>","body":"Hi\nthere","bodyType":"text","attachments":[{"filename":"deck.pdf","mimeType":"application/pdf","size":12,"attachmentId":"A1"}]}'
+
+OUT=$(run --id m1)
+check "flags: output (no snippet/labelIds)" "$OUT" "$WANT"
+check "flags: path" "$(jq -r .path "$STUB_LOG")" "/api/google/gmail/messages/m1"
+
+OUT=$(run '{"id":"m 1"}')
+check "json: output" "$OUT" "$WANT"
+check "json: id is URL-encoded" "$(jq -r .path "$STUB_LOG")" "/api/google/gmail/messages/m%201"
+
+OUT=$(CREWLY_API_URL="http://127.0.0.1:${PORT}" bash "$EXEC" --id missing 2>/dev/null); RC=$?
+check "404: exit code" "$RC" "1"
+check "404: reason" "$(printf '%s' "$OUT" | jq -r .reason)" "google_error"
+check "404: message" "$(printf '%s' "$OUT" | jq -r .message)" "Requested entity was not found."
+
+OUT=$(CREWLY_API_URL="http://127.0.0.1:${PORT}" bash "$EXEC" --id no-grant 2>/dev/null)
+check "409: hint is the connect URL" "$(printf '%s' "$OUT" | jq -r .hint)" "https://cloud/start?token=j"
+
+check "missing id errors" "$(run_err)" "Missing required parameter: id (--id)"
+check "unknown option errors" "$(run_err --bogus 1)" "Unknown option: --bogus"
+
+echo "=== Results: $PASS passed, $FAIL failed ==="
+[ "$FAIL" -eq 0 ]

package/config/skills/agent/core/gmail-search/SKILL.md

@@ -0,0 +1,64 @@
+---
+name: Gmail Search
+description: Search the owner's Gmail (via the Google Workspace grant held by Crewly Cloud) and list matching messages with sender, subject, date and snippet. Read-only.
+version: 1.0.0
+category: communication
+skillType: claude-skill
+assignableRoles:
+  - orchestrator
+  - team-leader
+  - developer
+  - operations
+  - ops
+  - sales
+  - support
+  - generalist
+triggers:
+  - search gmail
+  - search email
+  - find email
+  - check inbox
+tags:
+  - google
+  - gmail
+  - email
+execution:
+  type: script
+  script:
+    file: execute.sh
+    interpreter: bash
+    timeoutMs: 30000
+---
+
+# Gmail Search
+
+Runs a Gmail search on the owner's mailbox and prints the hits. Uses the
+Google Workspace connection the owner made under Settings → Integrations;
+the mail content goes straight from Google to this instance.
+
+```bash
+bash execute.sh --query "is:unread from:ann@example.com newer_than:2d" --max 10
+bash execute.sh '{"query":"subject:invoice has:attachment","max":5}'
+```
+
+## Parameters
+
+| Name | Required | Meaning |
+|---|---|---|
+| `--query` / `-q` (`query`) | yes | Gmail search syntax (`from:`, `subject:`, `is:unread`, `newer_than:7d`, `has:attachment`, …) |
+| `--max` / `-n` (`max`) | no | Result cap, default 20, max 100 |
+
+## Output
+
+```json
+{"query":"is:unread","count":2,"messages":[{"id":"18f…","threadId":"18f…","from":"Ann <ann@example.com>","to":"owner@example.com","subject":"Q3 numbers","date":"Thu, 18 Sep 2026 10:00:00 +0000","snippet":"Here are the…"}]}
+```
+
+Use the `id` with `gmail-read` to get the body; `threadId` + `gmail-read`'s
+`messageId` with `gmail-send` to reply in-thread.
+
+## Failures
+
+`{"success":false,"reason":"not_connected","hint":"<connect URL>"}` — the
+owner has not connected Google Workspace yet; hand them the hint URL (or
+point them to Settings → Integrations → Google Workspace). Exit code 1.

package/config/skills/agent/core/gmail-search/execute.sh

@@ -0,0 +1,70 @@
+#!/bin/bash
+# =============================================================================
+# gmail-search — Search the owner's Gmail (read-only)
+#
+# Backed by GET /api/google/gmail/search?q=&max= (Cloud holds the Google
+# grant; this instance talks to Gmail directly).
+#
+# Usage:
+#   bash execute.sh --query "is:unread from:ann" [--max 10]
+#   bash execute.sh '{"query":"is:unread","max":10}'
+# =============================================================================
+set -euo pipefail
+SCRIPT_DIR="$(cd "$(dirname "${BASH_SOURCE[0]}")" && pwd)"
+source "${SCRIPT_DIR}/../../_common/lib.sh"
+
+print_usage() {
+  cat <<'EOF_USAGE'
+Usage:
+  bash execute.sh --query "is:unread from:ann" [--max 10]
+  bash execute.sh '{"query":"is:unread","max":10}'
+
+Options:
+  --query | -q   Gmail search query (required)
+  --max   | -n   Result cap (default 20, max 100)
+  --help  | -h   Show this help
+EOF_USAGE
+}
+
+INPUT_JSON=""
+QUERY=""
+MAX=""
+
+if [[ $# -gt 0 && ${1:0:1} == '{' ]]; then
+  INPUT_JSON="$1"
+  shift || true
+fi
+
+while [[ $# -gt 0 ]]; do
+  case "$1" in
+    --query|-q) [ $# -ge 2 ] || error_exit "--query requires a value"; QUERY="$2"; shift 2 ;;
+    --max|-n)   [ $# -ge 2 ] || error_exit "--max requires a value";   MAX="$2";   shift 2 ;;
+    --help|-h)  print_usage; exit 0 ;;
+    *) error_exit "Unknown option: $1" ;;
+  esac
+done
+
+if [ -n "$INPUT_JSON" ]; then
+  INPUT=$(read_json_input "$INPUT_JSON")
+  [ -z "$QUERY" ] && QUERY=$(printf '%s' "$INPUT" | jq -r '.query // .q // empty')
+  [ -z "$MAX" ] && MAX=$(printf '%s' "$INPUT" | jq -r '.max // empty')
+fi
+
+require_param "query (--query)" "$QUERY"
+
+Q_ENC=$(jq -rn --arg v "$QUERY" '$v|@uri')
+ENDPOINT="/google/gmail/search?q=${Q_ENC}"
+[ -n "$MAX" ] && ENDPOINT="${ENDPOINT}&max=$(jq -rn --arg v "$MAX" '$v|@uri')"
+
+RESPONSE=$(api_call GET "$ENDPOINT" 2>&1) || {
+  printf '%s' "$RESPONSE" | jq -c '{success: false, reason: (.details.error // .details // .error // "unknown"), hint: (.details.hint // ""), message: (.details.message // "")}' 2>/dev/null \
+    || jq -n --arg r "$RESPONSE" '{success: false, reason: $r}'
+  exit 1
+}
+
+# Oversized bodies are parked on disk by api_call; pass that envelope through.
+if printf '%s' "$RESPONSE" | jq -e '.truncated == true' >/dev/null 2>&1; then
+  printf '%s\n' "$RESPONSE"; exit 0
+fi
+
+printf '%s' "$RESPONSE" | jq -c '{query: .data.query, count: .data.count, messages: [.data.messages[] | {id, threadId, from, to, subject, date, snippet}]}'

package/config/skills/agent/core/gmail-search/execute.test.sh

@@ -0,0 +1,67 @@
+#!/bin/bash
+# Tests for gmail-search — run with: bash execute.test.sh
+# Spins up a python HTTP stub as the backend, asserts the request path the
+# skill sends and the JSON it prints. Exit 0 on pass.
+set -u
+HERE="$(cd "$(dirname "${BASH_SOURCE[0]}")" && pwd)"
+EXEC="$HERE/execute.sh"
+PASS=0; FAIL=0
+check() {
+  local name="$1"; local got="$2"; local want="$3"
+  if [ "$got" = "$want" ]; then PASS=$((PASS+1)); else FAIL=$((FAIL+1)); echo "FAIL: $name"; echo "  want: $want"; echo "  got:  $got"; fi
+}
+
+PORT=18801
+STUB_LOG="$(mktemp)"; export STUB_LOG; export STUB_PORT="$PORT"
+python3 -u <<'PY' >/dev/null 2>&1 &
+from http.server import BaseHTTPRequestHandler, HTTPServer
+from urllib.parse import urlparse, parse_qs
+import json, os
+LOG = os.environ['STUB_LOG']; PORT = int(os.environ['STUB_PORT'])
+HIT = {'id': 'm1', 'threadId': 't1', 'from': 'Ann <ann@example.com>', 'to': 'owner@example.com',
+       'subject': 'Q3 numbers', 'date': 'D', 'snippet': 'hi', 'labelIds': ['INBOX']}
+class H(BaseHTTPRequestHandler):
+    def do_GET(self):
+        open(LOG, 'w').write(json.dumps({'method': 'GET', 'path': self.path}))
+        qs = parse_qs(urlparse(self.path).query)
+        q = qs.get('q', [''])[0]
+        if q == 'no-grant':
+            self.send_response(409); self.send_header('Content-Type', 'application/json'); self.end_headers()
+            self.wfile.write(json.dumps({'success': False, 'error': 'not_connected', 'message': 'no grant',
+                                         'hint': 'https://api.crewlyai.com/api/cloud/google/workspace/start?token=j'}).encode()); return
+        self.send_response(200); self.send_header('Content-Type', 'application/json'); self.end_headers()
+        self.wfile.write(json.dumps({'success': True, 'data': {'query': q, 'count': 1, 'messages': [HIT]}}).encode())
+    def log_message(self, *a, **k): pass
+HTTPServer(('127.0.0.1', PORT), H).serve_forever()
+PY
+STUB_PID=$!
+disown "$STUB_PID" 2>/dev/null || true
+trap 'kill "$STUB_PID" >/dev/null 2>&1; rm -f "$STUB_LOG"' EXIT
+for i in $(seq 1 30); do curl -s -o /dev/null -m 0.2 "http://127.0.0.1:${PORT}/" 2>/dev/null && break; sleep 0.1; done
+
+run() { CREWLY_API_URL="http://127.0.0.1:${PORT}" bash "$EXEC" "$@" 2>/dev/null; }
+run_err() { CREWLY_API_URL="http://127.0.0.1:${PORT}" bash "$EXEC" "$@" 2>&1 >/dev/null | jq -r '.error' 2>/dev/null; }
+
+WANT='{"query":"is:unread from:ann","count":1,"messages":[{"id":"m1","threadId":"t1","from":"Ann <ann@example.com>","to":"owner@example.com","subject":"Q3 numbers","date":"D","snippet":"hi"}]}'
+
+# --- flags ---
+OUT=$(run --query "is:unread from:ann" --max 5)
+check "flags: output drops labelIds" "$OUT" "$WANT"
+check "flags: path is URL-encoded with max" "$(jq -r .path "$STUB_LOG")" "/api/google/gmail/search?q=is%3Aunread%20from%3Aann&max=5"
+
+# --- JSON input ---
+OUT=$(run '{"query":"is:unread from:ann"}')
+check "json: output" "$OUT" "$WANT"
+check "json: no max when absent" "$(jq -r .path "$STUB_LOG")" "/api/google/gmail/search?q=is%3Aunread%20from%3Aann"
+
+# --- not connected → success:false + hint, exit 1 ---
+OUT=$(CREWLY_API_URL="http://127.0.0.1:${PORT}" bash "$EXEC" --query no-grant 2>/dev/null); RC=$?
+check "409: exit code" "$RC" "1"
+check "409: reason + hint" "$OUT" '{"success":false,"reason":"not_connected","hint":"https://api.crewlyai.com/api/cloud/google/workspace/start?token=j","message":"no grant"}'
+
+# --- validation ---
+check "missing query errors" "$(run_err --max 3)" "Missing required parameter: query (--query)"
+check "unknown option errors" "$(run_err --bogus 1)" "Unknown option: --bogus"
+
+echo "=== Results: $PASS passed, $FAIL failed ==="
+[ "$FAIL" -eq 0 ]

package/config/skills/agent/core/gmail-send/SKILL.md

@@ -0,0 +1,69 @@
+---
+name: Gmail Send
+description: Send an email from the owner's Gmail account (via the Google Workspace grant held by Crewly Cloud). Sends on the owner's behalf — needs the owner's go-ahead unless the task brief grants it. Supports in-thread replies and a dry-run preview.
+version: 1.0.0
+category: communication
+skillType: claude-skill
+assignableRoles:
+  - orchestrator
+  - team-leader
+  - operations
+  - ops
+  - sales
+  - support
+  - generalist
+triggers:
+  - send email
+  - reply to email
+  - email someone
+tags:
+  - google
+  - gmail
+  - email
+execution:
+  type: script
+  script:
+    file: execute.sh
+    interpreter: bash
+    timeoutMs: 30000
+---
+
+# Gmail Send
+
+Sends a plain-text email **as the owner**. Because the message carries the
+owner's name, only send when the owner has said so in this conversation or
+the task brief explicitly grants sending; otherwise draft with `--dry-run`
+and show the preview.
+
+```bash
+bash execute.sh --to ann@example.com --subject "Re: Q3 numbers" --text "Looks good, thanks!"
+bash execute.sh --to ann@example.com --subject "Re: Q3 numbers" --text-file /tmp/reply.txt \
+  --thread-id 18f0a1b2c3d4e5f6 --in-reply-to "<abc@mail.example.com>"
+bash execute.sh '{"to":"ann@example.com","subject":"Hi","text":"…"}'
+```
+
+## Parameters
+
+| Name | Required | Meaning |
+|---|---|---|
+| `--to` (`to`) | yes | Recipient(s), comma-separated |
+| `--subject` (`subject`) | yes | Subject (UTF-8 fine) |
+| `--text` / `--text-file` (`text`) | yes | Plain-text body, inline or from a file |
+| `--cc` (`cc`) | no | Cc recipient(s) |
+| `--thread-id` (`threadId`) | no | Gmail thread to reply in (from `gmail-search`) |
+| `--in-reply-to` (`inReplyTo`) | no | `messageId` of the message being answered (from `gmail-read`) |
+| `--dry-run` | no | Print the message preview; send nothing |
+
+`CREWLY_GMAIL_SEND_DRY_RUN=1` in the environment forces dry-run for every
+call — nothing is sent, no request leaves this machine.
+
+## Output
+
+Sent: `{"success":true,"id":"18f…","threadId":"18f…"}`
+
+Dry run: `{"success":true,"dryRun":true,"preview":"To: …\nSubject: …\n\n<body>"}`
+
+## Failures
+
+Missing `--to` / `--subject` / body → `{"error":"Missing required parameter: …"}` on stderr, exit 1, nothing sent.
+`{"success":false,"reason":"not_connected","hint":"<connect URL>"}` (exit 1) when the owner has not connected Google Workspace.

package/config/skills/agent/core/gmail-send/execute.sh

@@ -0,0 +1,114 @@
+#!/bin/bash
+# =============================================================================
+# gmail-send — Send an email from the owner's Gmail
+#
+# Backed by POST /api/google/gmail/send. Refuses without --to and --subject.
+# With --dry-run or CREWLY_GMAIL_SEND_DRY_RUN=1 nothing is sent and no
+# request is made: the message preview is printed instead.
+#
+# Usage:
+#   bash execute.sh --to a@b.c --subject "Hi" --text "Hello" [--cc x@y.z]
+#                   [--thread-id <id>] [--in-reply-to "<msgid>"] [--dry-run]
+#   bash execute.sh '{"to":"a@b.c","subject":"Hi","text":"Hello"}'
+# =============================================================================
+set -euo pipefail
+SCRIPT_DIR="$(cd "$(dirname "${BASH_SOURCE[0]}")" && pwd)"
+source "${SCRIPT_DIR}/../../_common/lib.sh"
+
+print_usage() {
+  cat <<'EOF_USAGE'
+Usage:
+  bash execute.sh --to a@b.c --subject "Hi" --text "Hello" [--cc x@y.z]
+                  [--thread-id <gmail thread id>] [--in-reply-to "<message-id>"] [--dry-run]
+  bash execute.sh '{"to":"a@b.c","subject":"Hi","text":"Hello"}'
+
+Options:
+  --to            Recipient(s), comma-separated (required)
+  --subject       Subject (required)
+  --text          Plain-text body (or --text-file <path>)
+  --text-file     Read the body from a file
+  --cc            Cc recipient(s)
+  --thread-id     Reply inside this Gmail thread
+  --in-reply-to   Message-ID being answered (sets In-Reply-To / References)
+  --dry-run       Preview only; nothing is sent (also: CREWLY_GMAIL_SEND_DRY_RUN=1)
+  --help | -h     Show this help
+EOF_USAGE
+}
+
+INPUT_JSON=""
+TO=""; CC=""; SUBJECT=""; TEXT=""; TEXT_FILE=""; THREAD_ID=""; IN_REPLY_TO=""
+DRY_RUN="${CREWLY_GMAIL_SEND_DRY_RUN:-}"
+
+if [[ $# -gt 0 && ${1:0:1} == '{' ]]; then
+  INPUT_JSON="$1"
+  shift || true
+fi
+
+while [[ $# -gt 0 ]]; do
+  case "$1" in
+    --to)          [ $# -ge 2 ] || error_exit "--to requires a value";          TO="$2";          shift 2 ;;
+    --cc)          [ $# -ge 2 ] || error_exit "--cc requires a value";          CC="$2";          shift 2 ;;
+    --subject)     [ $# -ge 2 ] || error_exit "--subject requires a value";     SUBJECT="$2";     shift 2 ;;
+    --text|--body) [ $# -ge 2 ] || error_exit "--text requires a value";        TEXT="$2";        shift 2 ;;
+    --text-file)   [ $# -ge 2 ] || error_exit "--text-file requires a value";   TEXT_FILE="$2";   shift 2 ;;
+    --thread-id)   [ $# -ge 2 ] || error_exit "--thread-id requires a value";   THREAD_ID="$2";   shift 2 ;;
+    --in-reply-to) [ $# -ge 2 ] || error_exit "--in-reply-to requires a value"; IN_REPLY_TO="$2"; shift 2 ;;
+    --dry-run)     DRY_RUN=1; shift ;;
+    --help|-h)     print_usage; exit 0 ;;
+    *) error_exit "Unknown option: $1" ;;
+  esac
+done
+
+if [ -n "$INPUT_JSON" ]; then
+  INPUT=$(read_json_input "$INPUT_JSON")
+  [ -z "$TO" ]          && TO=$(printf '%s' "$INPUT" | jq -r '.to // empty')
+  [ -z "$CC" ]          && CC=$(printf '%s' "$INPUT" | jq -r '.cc // empty')
+  [ -z "$SUBJECT" ]     && SUBJECT=$(printf '%s' "$INPUT" | jq -r '.subject // empty')
+  [ -z "$TEXT" ]        && TEXT=$(printf '%s' "$INPUT" | jq -r '.text // .body // empty')
+  [ -z "$THREAD_ID" ]   && THREAD_ID=$(printf '%s' "$INPUT" | jq -r '.threadId // empty')
+  [ -z "$IN_REPLY_TO" ] && IN_REPLY_TO=$(printf '%s' "$INPUT" | jq -r '.inReplyTo // empty')
+  [ -z "$DRY_RUN" ]     && DRY_RUN=$(printf '%s' "$INPUT" | jq -r 'if .dryRun == true then "1" else "" end')
+fi
+
+if [ -n "$TEXT_FILE" ]; then
+  [ -f "$TEXT_FILE" ] || error_exit "text file not found: $TEXT_FILE"
+  TEXT=$(cat "$TEXT_FILE")
+fi
+
+require_param "to (--to)" "$TO"
+require_param "subject (--subject)" "$SUBJECT"
+require_param "text (--text or --text-file)" "$TEXT"
+
+# Dry run: no request leaves this machine. Print a readable preview of the
+# headers and body exactly as they will be sent.
+if [ "$DRY_RUN" = "1" ]; then
+  PREVIEW="To: ${TO}"
+  [ -n "$CC" ] && PREVIEW="${PREVIEW}
+Cc: ${CC}"
+  PREVIEW="${PREVIEW}
+Subject: ${SUBJECT}"
+  [ -n "$IN_REPLY_TO" ] && PREVIEW="${PREVIEW}
+In-Reply-To: ${IN_REPLY_TO}"
+  [ -n "$THREAD_ID" ] && PREVIEW="${PREVIEW}
+X-Gmail-Thread: ${THREAD_ID}"
+  PREVIEW="${PREVIEW}
+
+${TEXT}"
+  jq -cn --arg p "$PREVIEW" '{success: true, dryRun: true, preview: $p}'
+  exit 0
+fi
+
+BODY=$(jq -cn --arg to "$TO" --arg cc "$CC" --arg subject "$SUBJECT" --arg text "$TEXT" \
+  --arg threadId "$THREAD_ID" --arg inReplyTo "$IN_REPLY_TO" \
+  '{to: $to, subject: $subject, text: $text}
+   + (if $cc != "" then {cc: $cc} else {} end)
+   + (if $threadId != "" then {threadId: $threadId} else {} end)
+   + (if $inReplyTo != "" then {inReplyTo: $inReplyTo} else {} end)')
+
+RESPONSE=$(api_call POST "/google/gmail/send" "$BODY" 2>&1) || {
+  printf '%s' "$RESPONSE" | jq -c '{success: false, reason: (.details.error // .details // .error // "unknown"), hint: (.details.hint // ""), message: (.details.message // "")}' 2>/dev/null \
+    || jq -n --arg r "$RESPONSE" '{success: false, reason: $r}'
+  exit 1
+}
+
+printf '%s' "$RESPONSE" | jq -c '{success: (.success // false), id: .data.id, threadId: .data.threadId}'

package/config/skills/agent/core/gmail-send/execute.test.sh

@@ -0,0 +1,83 @@
+#!/bin/bash
+# Tests for gmail-send — run with: bash execute.test.sh
+# Spins up a python HTTP stub as the backend, asserts the request body the
+# skill sends, the JSON it prints, and that dry-run makes NO request.
+set -u
+HERE="$(cd "$(dirname "${BASH_SOURCE[0]}")" && pwd)"
+EXEC="$HERE/execute.sh"
+PASS=0; FAIL=0
+check() {
+  local name="$1"; local got="$2"; local want="$3"
+  if [ "$got" = "$want" ]; then PASS=$((PASS+1)); else FAIL=$((FAIL+1)); echo "FAIL: $name"; echo "  want: $want"; echo "  got:  $got"; fi
+}
+
+PORT=18803
+STUB_LOG="$(mktemp)"; export STUB_LOG; export STUB_PORT="$PORT"
+python3 -u <<'PY' >/dev/null 2>&1 &
+from http.server import BaseHTTPRequestHandler, HTTPServer
+import json, os
+LOG = os.environ['STUB_LOG']; PORT = int(os.environ['STUB_PORT'])
+class H(BaseHTTPRequestHandler):
+    def do_POST(self):
+        n = int(self.headers.get('content-length', '0')); body = self.rfile.read(n).decode() if n else ''
+        data = json.loads(body or '{}')
+        open(LOG, 'w').write(json.dumps({'method': 'POST', 'path': self.path, 'body': data}))
+        if data.get('to') == 'no-grant@example.com':
+            self.send_response(409); self.send_header('Content-Type', 'application/json'); self.end_headers()
+            self.wfile.write(json.dumps({'success': False, 'error': 'not_connected', 'message': 'no grant', 'hint': 'https://cloud/start?token=j'}).encode()); return
+        self.send_response(200); self.send_header('Content-Type', 'application/json'); self.end_headers()
+        self.wfile.write(json.dumps({'success': True, 'data': {'id': 's1', 'threadId': data.get('threadId', 'tNew'), 'labelIds': ['SENT']}}).encode())
+    def log_message(self, *a, **k): pass
+HTTPServer(('127.0.0.1', PORT), H).serve_forever()
+PY
+STUB_PID=$!
+disown "$STUB_PID" 2>/dev/null || true
+trap 'kill "$STUB_PID" >/dev/null 2>&1; rm -f "$STUB_LOG"' EXIT
+for i in $(seq 1 30); do curl -s -o /dev/null -m 0.2 "http://127.0.0.1:${PORT}/" 2>/dev/null && break; sleep 0.1; done
+
+run() { CREWLY_API_URL="http://127.0.0.1:${PORT}" CREWLY_GMAIL_SEND_DRY_RUN="" bash "$EXEC" "$@" 2>/dev/null; }
+run_err() { CREWLY_API_URL="http://127.0.0.1:${PORT}" CREWLY_GMAIL_SEND_DRY_RUN="" bash "$EXEC" "$@" 2>&1 >/dev/null | jq -r '.error' 2>/dev/null; }
+
+# --- send with all fields ---
+OUT=$(run --to ann@example.com --cc bob@example.com --subject "Re: 第三季度" --text "Looks good" --thread-id t1 --in-reply-to "<abc@x>")
+check "send: output" "$OUT" '{"success":true,"id":"s1","threadId":"t1"}'
+check "send: path" "$(jq -r .path "$STUB_LOG")" "/api/google/gmail/send"
+check "send: body" "$(jq -c .body "$STUB_LOG")" '{"to":"ann@example.com","subject":"Re: 第三季度","text":"Looks good","cc":"bob@example.com","threadId":"t1","inReplyTo":"<abc@x>"}'
+
+# --- minimal + JSON input + text file ---
+TMP=$(mktemp); printf 'line one\nline two' > "$TMP"
+OUT=$(run '{"to":"a@b.c","subject":"Hi"}' --text-file "$TMP"); rm -f "$TMP"
+check "json+file: output" "$OUT" '{"success":true,"id":"s1","threadId":"tNew"}'
+check "json+file: body omits optional keys" "$(jq -c .body "$STUB_LOG")" '{"to":"a@b.c","subject":"Hi","text":"line one\nline two"}'
+
+# --- dry run via env: no request, preview printed ---
+: > "$STUB_LOG"
+OUT=$(CREWLY_API_URL="http://127.0.0.1:${PORT}" CREWLY_GMAIL_SEND_DRY_RUN=1 bash "$EXEC" --to a@b.c --cc c@d.e --subject "Hi" --text "hello" --in-reply-to "<m@x>" 2>/dev/null); RC=$?
+check "env dry-run: exit 0" "$RC" "0"
+check "env dry-run: preview" "$OUT" '{"success":true,"dryRun":true,"preview":"To: a@b.c\nCc: c@d.e\nSubject: Hi\nIn-Reply-To: <m@x>\n\nhello"}'
+check "env dry-run: no request made" "$(cat "$STUB_LOG")" ""
+
+# --- dry run via flag ---
+OUT=$(run --to a@b.c --subject "Hi" --text "x" --dry-run)
+check "flag dry-run: preview" "$OUT" '{"success":true,"dryRun":true,"preview":"To: a@b.c\nSubject: Hi\n\nx"}'
+check "flag dry-run: no request made" "$(cat "$STUB_LOG")" ""
+
+# --- dry run still validates ---
+check "dry-run without --to refuses" "$(CREWLY_GMAIL_SEND_DRY_RUN=1 run_err --subject Hi --text x)" "Missing required parameter: to (--to)"
+
+# --- backend 409 ---
+OUT=$(CREWLY_API_URL="http://127.0.0.1:${PORT}" CREWLY_GMAIL_SEND_DRY_RUN="" bash "$EXEC" --to no-grant@example.com --subject Hi --text x 2>/dev/null); RC=$?
+check "409: exit code" "$RC" "1"
+check "409: reason + hint" "$OUT" '{"success":false,"reason":"not_connected","hint":"https://cloud/start?token=j","message":"no grant"}'
+
+# --- validation (nothing sent) ---
+: > "$STUB_LOG"
+check "missing to errors" "$(run_err --subject Hi --text x)" "Missing required parameter: to (--to)"
+check "missing subject errors" "$(run_err --to a@b.c --text x)" "Missing required parameter: subject (--subject)"
+check "missing text errors" "$(run_err --to a@b.c --subject Hi)" "Missing required parameter: text (--text or --text-file)"
+check "missing text file errors" "$(run_err --to a@b.c --subject Hi --text-file /nonexistent/x.txt)" "text file not found: /nonexistent/x.txt"
+check "validation: no request made" "$(cat "$STUB_LOG")" ""
+check "unknown option errors" "$(run_err --bogus 1)" "Unknown option: --bogus"
+
+echo "=== Results: $PASS passed, $FAIL failed ==="
+[ "$FAIL" -eq 0 ]

package/config/skills/orchestrator/list-missions/SKILL.md

@@ -0,0 +1,47 @@
+---
+name: List Missions
+description: List the company / team / project OKRs (Missions) with their approval state and Key Result progress. Use it at registration and whenever the owner asks "what are we working towards".
+version: 1.0.0
+category: management
+skillType: claude-skill
+assignableRoles:
+  - orchestrator
+  - team-leader
+triggers:
+  - list missions
+  - what are our goals
+  - okr status
+tags:
+  - okr
+  - mission
+  - goals
+execution:
+  type: script
+  script:
+    file: execute.sh
+    interpreter: bash
+    timeoutMs: 15000
+---
+
+# List Missions
+
+Compact view of every Mission: id, level, objective, approval state, status,
+parent, and the Key Results (current → target, status). Use `--full` for the
+raw `GET /api/missions` payload.
+
+```bash
+bash {{ORCHESTRATOR_SKILLS_PATH}}/list-missions/execute.sh
+bash {{ORCHESTRATOR_SKILLS_PATH}}/list-missions/execute.sh --pending   # only proposals awaiting the owner
+```
+
+## What to do with the result
+
+- **Pending proposals** (`approval.state = pending_approval`): mention them to
+  the owner the next time you talk. Do not execute, remind or decompose them.
+- **No missions at all** and the teams have completed work in the last week:
+  draft ONE company-level OKR from that work (objective + 2–3 Key Results
+  that can be measured from something in the system — a ticket board, a
+  build log, a folder count) and ask the owner whether to create it. Do not
+  create it yourself.
+- **Live missions with off-track KRs**: the hourly sweep already alerts the
+  owner; you only act when a review WorkItem lands in your queue.