crewly 1.20.291 → 1.20.292

package/config/skills/agent/core/calendar-create/SKILL.md

@@ -63,7 +63,7 @@ Missing `--summary` / `--start` / `--end` → `{"error":"Missing required parame
 
 ## Choosing a Google account
 
-Several Google accounts can be connected at once. Without `--account` the call uses the default one (the first you connected, or whichever you marked default on the Connections page). Name one explicitly when it matters:
+Several Google accounts can be connected at once. Without `--account` the call uses the default one (the first you connected, or whichever the owner marked default). Name one explicitly when it matters:
 
 ```bash
 bash execute.sh --account work@company.com ...

package/config/skills/agent/core/calendar-list/SKILL.md

@@ -59,7 +59,7 @@ when the owner has not connected Google Workspace.
 
 ## Choosing a Google account
 
-Several Google accounts can be connected at once. Without `--account` the call uses the default one (the first you connected, or whichever you marked default on the Connections page). Name one explicitly when it matters:
+Several Google accounts can be connected at once. Without `--account` the call uses the default one (the first you connected, or whichever the owner marked default). Name one explicitly when it matters:
 
 ```bash
 bash execute.sh --account work@company.com ...

package/config/skills/agent/core/docs-comment/SKILL.md

@@ -100,8 +100,10 @@ older connections do not include. When the output has
 `"reconnectLinkSent":true`, the harness has already sent the owner a one-tap
 reconnect card in Slack: tell them in one line what you will do once it is
 granted, and retry when you get `[GOOGLE] Google Drive reconnected — retry your
-comment.` Without it, run `google-connect --product drive --channel <chat-channel-id>` to
-post the card yourself. Do not paste a link yourself.
+comment.` The card's link does not expire. If the owner says it did not work (or
+there is no `reconnectLinkSent`), run `google-connect --product drive --resend` for a
+fresh card, or give them https://crewlyai.com/portal/integrations/google?products=drive&auto=1
+to open directly. Never send them to Crewly settings or the Connections page.
 
 `{"success":false,"reason":"not_connected","hint":"…"}` (exit 1): Google
 Drive is not connected. Use `google-connect --product drive` the same way.
@@ -115,7 +117,7 @@ wrong, or the account cannot see the document.
 
 ## Choosing a Google account
 
-Several Google accounts can be connected at once. Without `--account` the call uses the default one (the first you connected, or whichever you marked default on the Connections page). Name one explicitly when it matters:
+Several Google accounts can be connected at once. Without `--account` the call uses the default one (the first you connected, or whichever the owner marked default). Name one explicitly when it matters:
 
 ```bash
 bash execute.sh list --doc 1AbC… --account work@company.com

package/config/skills/agent/core/docs-read/SKILL.md

@@ -45,13 +45,15 @@ bash execute.sh --id "https://docs.google.com/document/d/1AbC…/edit"
 ## Failures
 
 `{"success":false,"reason":"not_connected","hint":"<connect URL>"}` (exit 1)
-when the owner has not connected Google Workspace (Settings → Integrations).
+when the owner has not connected Google Workspace. Run the `google-connect` skill
+to post the owner a one-tap card in Slack (never send them to Crewly settings or
+the Connections page — they are usually on a phone). Manual fallback: https://crewlyai.com/portal/integrations/google.
 A `403` with `reason: "google_error"` on a write means the file was not
 created by Crewly — the grant only edits files Crewly made (`drive.file`).
 
 ## Choosing a Google account
 
-Several Google accounts can be connected at once. Without `--account` the call uses the default one (the first you connected, or whichever you marked default on the Connections page). Name one explicitly when it matters:
+Several Google accounts can be connected at once. Without `--account` the call uses the default one (the first you connected, or whichever the owner marked default). Name one explicitly when it matters:
 
 ```bash
 bash execute.sh --account work@company.com ...

package/config/skills/agent/core/docs-write/SKILL.md

@@ -50,13 +50,15 @@ re-connect Google Workspace once the scope is enabled".
 ## Failures
 
 `{"success":false,"reason":"not_connected","hint":"<connect URL>"}` (exit 1)
-when the owner has not connected Google Workspace (Settings → Integrations).
+when the owner has not connected Google Workspace. Run the `google-connect` skill
+to post the owner a one-tap card in Slack (never send them to Crewly settings or
+the Connections page — they are usually on a phone). Manual fallback: https://crewlyai.com/portal/integrations/google.
 A `403` with `reason: "google_error"` on a write means the file was not
 created by Crewly — the grant only edits files Crewly made (`drive.file`).
 
 ## Choosing a Google account
 
-Several Google accounts can be connected at once. Without `--account` the call uses the default one (the first you connected, or whichever you marked default on the Connections page). Name one explicitly when it matters:
+Several Google accounts can be connected at once. Without `--account` the call uses the default one (the first you connected, or whichever the owner marked default). Name one explicitly when it matters:
 
 ```bash
 bash execute.sh --account work@company.com ...

package/config/skills/agent/core/drive-read/SKILL.md

@@ -39,13 +39,15 @@ Files over 10 MB are refused with a `webViewLink` to open instead.
 ## Failures
 
 `{"success":false,"reason":"not_connected","hint":"<connect URL>"}` (exit 1)
-when the owner has not connected Google Workspace (Settings → Integrations).
+when the owner has not connected Google Workspace. Run the `google-connect` skill
+to post the owner a one-tap card in Slack (never send them to Crewly settings or
+the Connections page — they are usually on a phone). Manual fallback: https://crewlyai.com/portal/integrations/google.
 A `403` with `reason: "google_error"` on a write means the file was not
 created by Crewly — the grant only edits files Crewly made (`drive.file`).
 
 ## Choosing a Google account
 
-Several Google accounts can be connected at once. Without `--account` the call uses the default one (the first you connected, or whichever you marked default on the Connections page). Name one explicitly when it matters:
+Several Google accounts can be connected at once. Without `--account` the call uses the default one (the first you connected, or whichever the owner marked default). Name one explicitly when it matters:
 
 ```bash
 bash execute.sh --account work@company.com ...

package/config/skills/agent/core/drive-search/SKILL.md

@@ -41,13 +41,15 @@ else → `drive-read`.
 ## Failures
 
 `{"success":false,"reason":"not_connected","hint":"<connect URL>"}` (exit 1)
-when the owner has not connected Google Workspace (Settings → Integrations).
+when the owner has not connected Google Workspace. Run the `google-connect` skill
+to post the owner a one-tap card in Slack (never send them to Crewly settings or
+the Connections page — they are usually on a phone). Manual fallback: https://crewlyai.com/portal/integrations/google.
 A `403` with `reason: "google_error"` on a write means the file was not
 created by Crewly — the grant only edits files Crewly made (`drive.file`).
 
 ## Choosing a Google account
 
-Several Google accounts can be connected at once. Without `--account` the call uses the default one (the first you connected, or whichever you marked default on the Connections page). Name one explicitly when it matters:
+Several Google accounts can be connected at once. Without `--account` the call uses the default one (the first you connected, or whichever the owner marked default). Name one explicitly when it matters:
 
 ```bash
 bash execute.sh --account work@company.com ...

package/config/skills/agent/core/drive-upload/SKILL.md

@@ -40,13 +40,15 @@ permissions are the owner's — this skill does not change sharing).
 ## Failures
 
 `{"success":false,"reason":"not_connected","hint":"<connect URL>"}` (exit 1)
-when the owner has not connected Google Workspace (Settings → Integrations).
+when the owner has not connected Google Workspace. Run the `google-connect` skill
+to post the owner a one-tap card in Slack (never send them to Crewly settings or
+the Connections page — they are usually on a phone). Manual fallback: https://crewlyai.com/portal/integrations/google.
 A `403` with `reason: "google_error"` on a write means the file was not
 created by Crewly — the grant only edits files Crewly made (`drive.file`).
 
 ## Choosing a Google account
 
-Several Google accounts can be connected at once. Without `--account` the call uses the default one (the first you connected, or whichever you marked default on the Connections page). Name one explicitly when it matters:
+Several Google accounts can be connected at once. Without `--account` the call uses the default one (the first you connected, or whichever the owner marked default). Name one explicitly when it matters:
 
 ```bash
 bash execute.sh --account work@company.com ...

package/config/skills/agent/core/gmail-read/SKILL.md

@@ -62,7 +62,7 @@ with a 404 message when the id is unknown.
 
 ## Choosing a Google account
 
-Several Google accounts can be connected at once. Without `--account` the call uses the default one (the first you connected, or whichever you marked default on the Connections page). Name one explicitly when it matters:
+Several Google accounts can be connected at once. Without `--account` the call uses the default one (the first you connected, or whichever the owner marked default). Name one explicitly when it matters:
 
 ```bash
 bash execute.sh --account work@company.com ...

package/config/skills/agent/core/gmail-search/SKILL.md

@@ -33,7 +33,7 @@ execution:
 # Gmail Search
 
 Runs a Gmail search on the owner's mailbox and prints the hits. Uses the
-Google Workspace connection the owner made under Settings → Integrations;
+Google Workspace connection the owner made in Crewly;
 the mail content goes straight from Google to this instance.
 
 ```bash
@@ -60,12 +60,13 @@ Use the `id` with `gmail-read` to get the body; `threadId` + `gmail-read`'s
 ## Failures
 
 `{"success":false,"reason":"not_connected","hint":"<connect URL>"}` — the
-owner has not connected Google Workspace yet; hand them the hint URL (or
-point them to Settings → Integrations → Google Workspace). Exit code 1.
+owner has not connected Google Workspace yet; run the `google-connect` skill so
+they get a one-tap card in Slack (manual fallback: https://crewlyai.com/portal/integrations/google; never
+Crewly settings or the Connections page). Exit code 1.
 
 ## Choosing a Google account
 
-Several Google accounts can be connected at once. Without `--account` the call uses the default one (the first you connected, or whichever you marked default on the Connections page). Name one explicitly when it matters:
+Several Google accounts can be connected at once. Without `--account` the call uses the default one (the first you connected, or whichever the owner marked default). Name one explicitly when it matters:
 
 ```bash
 bash execute.sh --account work@company.com ...

package/config/skills/agent/core/gmail-send/SKILL.md

@@ -103,13 +103,13 @@ There is no output shape in which you have sent an email.
 Missing `--to` / `--subject` / body → `{"error":"Missing required parameter: …"}` on stderr, exit 1, nothing sent.
 `{"success":false,"reason":"not_connected","hint":"<connect URL>"}` (exit 1) when the owner has not connected Google Workspace.
 
-`{"success":false,"reason":"reauth_required","hint":"A reconnect link was sent to the owner in Slack. …","reconnectLinkSent":true}` (exit 1): the Gmail connection cannot save drafts yet (connections made before 2026-10-08 lack that permission). The harness has already sent the owner a one-tap reconnect card in Slack. Tell them in one line that you need them to tap it — do not ask them to open Connections, and do not paste a link. When it is done you get `[GOOGLE] Gmail reconnected — retry your draft.`; run the same command again.
+`{"success":false,"reason":"reauth_required","hint":"A reconnect link was sent to the owner in Slack. …","reconnectLinkSent":true}` (exit 1): the Gmail connection cannot save drafts yet (connections made before 2026-10-08 lack that permission). The harness has already sent the owner a one-tap reconnect card in Slack. Tell them in one line that you need them to tap it — do not send them to Crewly settings or Connections. The card's link does not expire; if they say it failed, run the `google-connect` skill for a fresh one, or give them https://crewlyai.com/portal/integrations/google. When it is done you get `[GOOGLE] Gmail reconnected — retry your draft.`; run the same command again.
 
 `{"success":false,"reason":"not_connected",…,"reconnectLinkSent":true}` (exit 1): Gmail access expired or was revoked. Same as above: the owner already has the card; wait for `[GOOGLE] Gmail reconnected …` and retry.
 
 ## Choosing a Google account
 
-Several Google accounts can be connected at once. Without `--account` the call uses the default one (the first you connected, or whichever you marked default on the Connections page). Name one explicitly when it matters:
+Several Google accounts can be connected at once. Without `--account` the call uses the default one (the first you connected, or whichever the owner marked default). Name one explicitly when it matters:
 
 ```bash
 bash execute.sh --account work@company.com ...

package/config/skills/agent/core/google-connect/SKILL.md

@@ -23,22 +23,25 @@ execution:
 
 # Google Connect
 
-When a Google skill answers `not_connected`, the owner has not granted that
-product yet. Do **not** improvise an authorization link: the one this
-instance can build carries a Cloud session token, and posting it into a
-channel publishes a credential. It also expires within the hour, so the link
-you paste is usually dead by the time anyone clicks it.
-
-Run this instead. It posts a card with an **Add** button that only the
-person who asked can see, backed by a single-use link.
+When a Google skill answers `not_connected` or `reauth_required`, the owner has
+to grant (or re-grant) a product. Do **not** improvise an authorization link:
+never build one by hand and never paste one. Run this instead. It posts a card
+with a button that only the person who asked can see; the button opens the
+Crewly portal's Google page, so the link carries no credential and **never
+expires**. The owner can tap it hours later, from a phone.
 
 ```bash
-bash execute.sh --product gmail --channel <chat-channel-id>
+bash execute.sh --product gmail [--channel <chat-channel-id>] [--account me@example.com]
 ```
 
-`--channel` is the id in the `[CHAT:…]` header of the message you are
-answering.
+- `--channel` is the id in the `[CHAT:…]` or `[SLACK-THREAD:…]` header of the
+  message you are answering. It is optional: without it, or if it cannot be
+  resolved, the card goes where you are working with the owner, else their DM.
+- Every call posts a fresh card. If the owner says the last card did not work,
+  run it again (`--resend` is accepted to make that intent explicit).
+- Never tell the owner to open Crewly settings or the Connections page — they
+  are usually on a phone and cannot reach it. If they cannot find the card, the
+  manual fallback is https://crewlyai.com/portal/integrations/google
 
-After running it, say in one line that you have asked for access and what
-you will do once it is granted. Do not repeat the link — there is no link
-to repeat.
+After running it, say in one line that you have asked for access and what you
+will do once it is granted. Do not repeat a link.

package/config/skills/agent/core/google-connect/execute.sh

@@ -3,11 +3,11 @@
 # google-connect — Ask the owner to authorize a Google product, in Slack
 #
 # Backed by POST /api/google/connect-card, which posts a Block Kit card whose
-# button carries a single-use ticket. Never build an authorization link by
-# hand: the one this instance can build embeds the Cloud session token.
+# button opens the Cloud portal's Google page (no token in the link, and it
+# never expires). Never build an authorization link by hand.
 #
 # Usage:
-#   bash execute.sh --product gmail --channel chat-abc123
+#   bash execute.sh --product gmail [--channel chat-abc123] [--account me@x.com] [--resend]
 # =============================================================================
 set -euo pipefail
 SCRIPT_DIR="$(cd "$(dirname "${BASH_SOURCE[0]}")" && pwd)"
@@ -16,32 +16,49 @@ source "${SCRIPT_DIR}/../../_common/lib.sh"
 print_usage() {
   cat <<'EOF_USAGE'
 Usage:
-  bash execute.sh --product <gmail|calendar|drive> --channel <chat-channel-id>
+  bash execute.sh --product <gmail|calendar|drive> [--channel <id>] [--account <email>] [--resend]
 
 Options:
   --product   Which Google product needs access (required)
-  --channel   The chat channel you are answering in — the id in [CHAT:…] (required)
+  --channel   The id in the [CHAT:...] / [SLACK-THREAD:...] header of the message you are
+              answering. Optional: without it (or if it cannot be resolved) the card goes
+              where you are working, else the owner's DM.
+  --account   Google account to reconnect, when it matters
+  --resend    The owner said the last card did not work; every call posts a fresh card
+              (accepted for clarity, the flag changes nothing)
 EOF_USAGE
 }
 
 PRODUCT=""
 CHANNEL=""
+ACCOUNT=""
 while [ $# -gt 0 ]; do
   case "$1" in
     --product) PRODUCT="${2:-}"; shift 2 ;;
     --channel) CHANNEL="${2:-}"; shift 2 ;;
+    --account) ACCOUNT="${2:-}"; shift 2 ;;
+    --resend) shift ;;
     -h|--help) print_usage; exit 0 ;;
     *) echo "Unknown option: $1" >&2; print_usage >&2; exit 2 ;;
   esac
 done
 
-if [ -z "$PRODUCT" ] || [ -z "$CHANNEL" ]; then
-  echo "Both --product and --channel are required." >&2
+if [ -z "$PRODUCT" ]; then
+  echo "--product is required." >&2
   print_usage >&2
   exit 2
 fi
 
-BODY=$(printf '{"product":"%s","channelId":"%s"}' "$PRODUCT" "$CHANNEL")
+# Values go into JSON by hand (no jq dependency): refuse anything that could break out.
+for v in "$PRODUCT" "$CHANNEL" "$ACCOUNT"; do
+  case "$v" in
+    *[\"\\]*|*$'\n'*) echo "Arguments must not contain quotes, backslashes or newlines." >&2; exit 2 ;;
+  esac
+done
+BODY=$(printf '{"product":"%s"' "$PRODUCT")
+[ -n "$CHANNEL" ] && BODY="${BODY},$(printf '"channelId":"%s"' "$CHANNEL")"
+[ -n "$ACCOUNT" ] && BODY="${BODY},$(printf '"account":"%s"' "$ACCOUNT")"
+BODY="${BODY}}"
 RESPONSE=$(api_call POST "/google/connect-card" "$BODY" 2>&1) || {
   echo "$RESPONSE" >&2
   exit 1

package/config/skills/agent/core/sheets-read/SKILL.md

@@ -48,13 +48,15 @@ come back as numbers, dates as the sheet's formatted string.
 ## Failures
 
 `{"success":false,"reason":"not_connected","hint":"<connect URL>"}` (exit 1)
-when the owner has not connected Google Workspace (Settings → Integrations).
+when the owner has not connected Google Workspace. Run the `google-connect` skill
+to post the owner a one-tap card in Slack (never send them to Crewly settings or
+the Connections page — they are usually on a phone). Manual fallback: https://crewlyai.com/portal/integrations/google.
 A `403` with `reason: "google_error"` on a write means the file was not
 created by Crewly — the grant only edits files Crewly made (`drive.file`).
 
 ## Choosing a Google account
 
-Several Google accounts can be connected at once. Without `--account` the call uses the default one (the first you connected, or whichever you marked default on the Connections page). Name one explicitly when it matters:
+Several Google accounts can be connected at once. Without `--account` the call uses the default one (the first you connected, or whichever the owner marked default). Name one explicitly when it matters:
 
 ```bash
 bash execute.sh --account work@company.com ...

package/config/skills/agent/core/sheets-write/SKILL.md

@@ -51,13 +51,15 @@ the owner made outside Crewly needs the Sheets write scope (`403 google_error`).
 ## Failures
 
 `{"success":false,"reason":"not_connected","hint":"<connect URL>"}` (exit 1)
-when the owner has not connected Google Workspace (Settings → Integrations).
+when the owner has not connected Google Workspace. Run the `google-connect` skill
+to post the owner a one-tap card in Slack (never send them to Crewly settings or
+the Connections page — they are usually on a phone). Manual fallback: https://crewlyai.com/portal/integrations/google.
 A `403` with `reason: "google_error"` on a write means the file was not
 created by Crewly — the grant only edits files Crewly made (`drive.file`).
 
 ## Choosing a Google account
 
-Several Google accounts can be connected at once. Without `--account` the call uses the default one (the first you connected, or whichever you marked default on the Connections page). Name one explicitly when it matters:
+Several Google accounts can be connected at once. Without `--account` the call uses the default one (the first you connected, or whichever the owner marked default). Name one explicitly when it matters:
 
 ```bash
 bash execute.sh --account work@company.com ...

package/config/skills/agent/core/slides-create/SKILL.md

@@ -56,13 +56,15 @@ For designed decks (brand templates, images, video) use the Canva skills.
 ## Failures
 
 `{"success":false,"reason":"not_connected","hint":"<connect URL>"}` (exit 1)
-when the owner has not connected Google Workspace (Settings → Integrations).
+when the owner has not connected Google Workspace. Run the `google-connect` skill
+to post the owner a one-tap card in Slack (never send them to Crewly settings or
+the Connections page — they are usually on a phone). Manual fallback: https://crewlyai.com/portal/integrations/google.
 A `403` with `reason: "google_error"` on a write means the file was not
 created by Crewly — the grant only edits files Crewly made (`drive.file`).
 
 ## Choosing a Google account
 
-Several Google accounts can be connected at once. Without `--account` the call uses the default one (the first you connected, or whichever you marked default on the Connections page). Name one explicitly when it matters:
+Several Google accounts can be connected at once. Without `--account` the call uses the default one (the first you connected, or whichever the owner marked default). Name one explicitly when it matters:
 
 ```bash
 bash execute.sh --account work@company.com ...

package/config/skills/agent/core/slides-read/SKILL.md

@@ -44,13 +44,15 @@ bash execute.sh --id 1AbC…
 ## Failures
 
 `{"success":false,"reason":"not_connected","hint":"<connect URL>"}` (exit 1)
-when the owner has not connected Google Workspace (Settings → Integrations).
+when the owner has not connected Google Workspace. Run the `google-connect` skill
+to post the owner a one-tap card in Slack (never send them to Crewly settings or
+the Connections page — they are usually on a phone). Manual fallback: https://crewlyai.com/portal/integrations/google.
 A `403` with `reason: "google_error"` on a write means the file was not
 created by Crewly — the grant only edits files Crewly made (`drive.file`).
 
 ## Choosing a Google account
 
-Several Google accounts can be connected at once. Without `--account` the call uses the default one (the first you connected, or whichever you marked default on the Connections page). Name one explicitly when it matters:
+Several Google accounts can be connected at once. Without `--account` the call uses the default one (the first you connected, or whichever the owner marked default). Name one explicitly when it matters:
 
 ```bash
 bash execute.sh --account work@company.com ...

package/dist/backend/backend/src/constants.d.ts

@@ -4717,12 +4717,21 @@ export declare const GOOGLE_WORKSPACE_CONSTANTS: {
      * for want of a scope, or because the grant expired / was revoked.
      */
     readonly REAUTH: {
-        /** At most one card per product + Google account in this window (ms) */
-        readonly CARD_THROTTLE_MS: number;
-        /** How often to check whether the owner reconnected (ms) */
+        /**
+         * A card that went out less than this long ago is not repeated for the
+         * same product + Google account (concurrent failures share one card);
+         * after it, a new failure posts a fresh card unless the owner has
+         * reconnected (ms)
+         */
+        readonly CARD_RESEND_AFTER_MS: number;
+        /** First wait between looks at Cloud for the reconnect (ms) */
         readonly POLL_INTERVAL_MS: 30000;
-        /** Keep checking this long after the card's link expires (consent may still be finishing) (ms) */
-        readonly POLL_GRACE_MS: number;
+        /** The wait grows by this factor after each look... */
+        readonly POLL_BACKOFF_FACTOR: 1.5;
+        /** ...up to this ceiling (ms) */
+        readonly POLL_MAX_INTERVAL_MS: number;
+        /** The card link never expires, so keep watching for the reconnect this long (ms) */
+        readonly WATCH_MS: number;
         /** Give up posting the card after this long, so the skill call is not held (ms) */
         readonly POST_TIMEOUT_MS: 8000;
     };
@@ -4738,6 +4747,12 @@ export declare const GOOGLE_WORKSPACE_CONSTANTS: {
     readonly SLIDES_MAX_SLIDES: 60;
     /** Dashboard path the Cloud consent flow returns to */
     readonly SETTINGS_RETURN_PATH: "/connections?platform=google-workspace";
+    /**
+     * Cloud portal page that starts Google consent. It mints the consent
+     * ticket when the owner opens it, so a link to it never expires and
+     * carries no credential. Query: `products=<csv>&account=<email>&auto=1`.
+     */
+    readonly PORTAL_CONNECT_PATH: "/portal/integrations/google";
     /** Metadata headers requested on Gmail search hits */
     readonly GMAIL_SEARCH_HEADERS: readonly ["From", "To", "Subject", "Date"];
     /** RFC 2045 line width for base64 message bodies */