crewly 1.20.35 → 1.20.47

package/config/skills/agent/computer-use/execute.sh

@@ -35,6 +35,14 @@ INPUT=$(read_json_input "${1:-}")
 ACTION=$(echo "$INPUT" | jq -r '.action // empty')
 [ -z "$ACTION" ] && error_exit "Missing required parameter: action"
 
+# ---------------------------------------------------------------------------
+# Safety rails (permissions, stop switch, desktop lock, destructive-key and
+# secure-field refusals, audit) — shared with the marketplace fork.
+# ---------------------------------------------------------------------------
+source "${SCRIPT_DIR}/../../_common/desktop-guards.sh"
+cu_apply_guards
+
+
 # ---------------------------------------------------------------------------
 # Helper: get screen dimensions and scale factor
 # ---------------------------------------------------------------------------
@@ -56,9 +64,15 @@ get_screen_info() {
 # optionally overlays a grid, optionally crops.
 # ---------------------------------------------------------------------------
 do_screenshot() {
-  local output="${TMPDIR_CU}/screen_$(date +%s%N).png"
+  local output=$(echo "$INPUT" | jq -r '.output // empty')
+  [ -z "$output" ] && output="${TMPDIR_CU}/screen_$(date +%s%N).png"
   local grid=$(echo "$INPUT" | jq -r '.grid // empty')
   local crop_json=$(echo "$INPUT" | jq -r '.crop // empty')
+  # Cap the width the caller wants to reason in. A model's pointing accuracy
+  # falls off on a wide image because it is downsampled before the model sees
+  # it, and one reasoning in the original coordinate space then points at the
+  # wrong place — so the caller asks for the width it will think in.
+  local max_width=$(echo "$INPUT" | jq -r '.maxWidth // empty')
 
   # Capture full screen (silent)
   screencapture -x "$output"
@@ -82,6 +96,15 @@ do_screenshot() {
   local img_h
   img_h=$(sips -g pixelHeight "$output" | tail -1 | awk '{print $2}')
 
+  # Then, if asked, shrink further to the caller's reasoning width. Never
+  # enlarge: a small screen is already easier to point at, and scaling up
+  # would invent precision the model does not have.
+  if [ -n "$max_width" ] && [ "$max_width" -gt 0 ] 2>/dev/null && [ "$img_w" -gt "$max_width" ]; then
+    sips --resampleWidth "$max_width" "$output" --out "$output" >/dev/null 2>&1
+    img_w=$(sips -g pixelWidth "$output" | tail -1 | awk '{print $2}')
+    img_h=$(sips -g pixelHeight "$output" | tail -1 | awk '{print $2}')
+  fi
+
   # Crop FIRST, then grid — so grid labels show absolute screen coordinates
   local origin_x=0 origin_y=0
   if [ -n "$crop_json" ]; then
@@ -289,7 +312,9 @@ do_key() {
   if [ ${#parts[@]} -eq 1 ]; then
     key_name="${parts[0]}"
   else
-    key_name="${parts[-1]}"
+    # macOS ships bash 3.2, which has no negative array indices — using one
+    # here made every modifier combo fail with "bad array subscript".
+    key_name="${parts[$(( ${#parts[@]} - 1 ))]}"
     for ((i=0; i<${#parts[@]}-1; i++)); do
       case "${parts[$i]}" in
         command|cmd)   modifiers="${modifiers}command down, " ;;
@@ -844,9 +869,221 @@ do_click_at() {
   " >/dev/null 2>&1
 }
 
+# =============================================================================
+# Element-level perception and action (Phase 2)
+#
+# Everything above works in screen coordinates: the agent takes a screenshot,
+# guesses where a button is, and clicks a point. That misses, costs an image
+# per step, and breaks on a different theme or window position.
+#
+# These work in elements. `snapshot` returns refs (@e1, @e2 …) with roles,
+# names and frames; `click`/`type` accept a ref and go through the
+# accessibility action, which does not care where the window sits or whether
+# something overlaps it.
+# =============================================================================
+
+# ---------------------------------------------------------------------------
+# snapshot — the elements of an app, as refs the agent can act on.
+# ---------------------------------------------------------------------------
+do_snapshot() {
+  local app max flags=()
+  app=$(printf '%s' "$INPUT" | jq -r '.app // empty')
+  max=$(printf '%s' "$INPUT" | jq -r '.max // empty')
+  [ -n "$app" ] && flags+=(--app "$app")
+  [ -n "$max" ] && flags+=(--max "$max")
+  [ "$(printf '%s' "$INPUT" | jq -r '.allWindows // false')" = "true" ] && flags+=(--all-windows)
+  [ "$(printf '%s' "$INPUT" | jq -r '.menus // false')" = "true" ] && flags+=(--menus)
+  cu_perceive snapshot ${flags[@]+"${flags[@]}"}
+}
+
+# ---------------------------------------------------------------------------
+# click-ref — press an element by ref.
+#
+# AXPress first: it reaches a button that is scrolled out of view or covered
+# by another window, which a coordinate click cannot. Falls back to clicking
+# the element's centre for the many controls that expose no press action.
+# ---------------------------------------------------------------------------
+do_click_ref() {
+  local ref result ok cx cy
+  ref=$(printf '%s' "$INPUT" | jq -r '.ref // empty')
+  require_param "ref" "$ref"
+
+  result=$(cu_perceive press --ref "$ref" 2>&1) || { printf '%s\n' "$result"; exit 1; }
+  ok=$(printf '%s' "$result" | jq -r '.success // false')
+  if [ "$ok" = "true" ]; then
+    printf '%s' "$result" | jq -c '{success:true, action:"click-ref", ref:.ref, method:"AXPress"}'
+    return 0
+  fi
+
+  # No press action (or it refused) — click where the element is.
+  cx=$(printf '%s' "$result" | jq -r '.center[0] // empty')
+  cy=$(printf '%s' "$result" | jq -r '.center[1] // empty')
+  if [ -z "$cx" ] || [ -z "$cy" ]; then
+    printf '%s\n' "$result"
+    exit 1
+  fi
+  do_click_at "$cx" "$cy"
+  jq -n --arg r "$ref" --argjson x "$cx" --argjson y "$cy" \
+    '{success:true, action:"click-ref", ref:$r, method:"coordinate-fallback", x:$x, y:$y}'
+}
+
+# ---------------------------------------------------------------------------
+# fill-ref — set a field's value directly.
+#
+# More reliable than typing: no dependence on focus, on the keyboard layout,
+# or on an input method being in the right mode.
+# ---------------------------------------------------------------------------
+do_fill_ref() {
+  local ref text
+  ref=$(printf '%s' "$INPUT" | jq -r '.ref // empty')
+  text=$(printf '%s' "$INPUT" | jq -r '.text // empty')
+  require_param "ref" "$ref"
+  require_param "text" "$text"
+  cu_perceive set-value --ref "$ref" --text "$text"
+}
+
+# ---------------------------------------------------------------------------
+# resolve — what is at this ref now.
+#
+# Worth calling after something may have changed the window: it reports
+# whether the element still matches what the snapshot recorded.
+# ---------------------------------------------------------------------------
+do_resolve() {
+  local ref
+  ref=$(printf '%s' "$INPUT" | jq -r '.ref // empty')
+  require_param "ref" "$ref"
+  cu_perceive resolve --ref "$ref"
+}
+
+# ---------------------------------------------------------------------------
+# ocr — the text on screen and where it is.
+#
+# Covers what accessibility does not expose: a canvas, a PDF page, an app
+# that simply does not implement AX. Local and free (macOS Vision).
+# ---------------------------------------------------------------------------
+do_ocr() {
+  local region flags=()
+  region=$(printf '%s' "$INPUT" | jq -r 'if .region then "\(.region.x),\(.region.y),\(.region.w),\(.region.h)" else empty end')
+  [ -n "$region" ] && flags+=(--region "$region")
+  local image; image=$(printf '%s' "$INPUT" | jq -r '.image // empty')
+  [ -n "$image" ] && flags+=(--image "$image")
+  cu_perceive ocr ${flags[@]+"${flags[@]}"}
+}
+
+# ---------------------------------------------------------------------------
+# displays — every screen and its frame, so coordinates are unambiguous.
+# ---------------------------------------------------------------------------
+do_displays() {
+  cu_perceive displays
+}
+
+# ---------------------------------------------------------------------------
+# wait-for — block until the screen is in the expected state.
+#
+# The alternative is sleeping and hoping: an agent that clicks during an
+# animation hits nothing, and one that sleeps long enough to be safe is slow
+# on every step instead.
+#
+#   {"action":"wait-for","app":"Numbers"}        that app is frontmost
+#   {"action":"wait-for","ref":"@e12"}           that element resolves
+#   {"action":"wait-for","text":"Export"}        that text is on screen
+#   {"action":"wait-for","idle":true}            the screen stopped changing
+# ---------------------------------------------------------------------------
+do_wait_for() {
+  local app ref text idle timeout deadline
+  app=$(printf '%s' "$INPUT" | jq -r '.app // empty')
+  ref=$(printf '%s' "$INPUT" | jq -r '.ref // empty')
+  text=$(printf '%s' "$INPUT" | jq -r '.text // empty')
+  idle=$(printf '%s' "$INPUT" | jq -r '.idle // false')
+  timeout=$(printf '%s' "$INPUT" | jq -r '.timeoutMs // 10000')
+  deadline=$(( $(date +%s) + timeout / 1000 ))
+
+  if [ -z "$app" ] && [ -z "$ref" ] && [ -z "$text" ] && [ "$idle" != "true" ]; then
+    error_exit "wait-for needs one of: app, ref, text, idle"
+  fi
+
+  local previous="" current
+  while [ "$(date +%s)" -le "$deadline" ]; do
+    if [ -n "$app" ]; then
+      local front
+      front=$(osascript -e 'tell application "System Events" to get name of first process whose frontmost is true' 2>/dev/null)
+      if [ "$front" = "$app" ]; then
+        jq -n --arg a "$app" '{success:true, action:"wait-for", matched:"app", app:$a}'; return 0
+      fi
+    fi
+    if [ -n "$ref" ]; then
+      if cu_perceive resolve --ref "$ref" 2>/dev/null | jq -e '.success and .matches' >/dev/null 2>&1; then
+        jq -n --arg r "$ref" '{success:true, action:"wait-for", matched:"ref", ref:$r}'; return 0
+      fi
+    fi
+    if [ -n "$text" ]; then
+      if cu_perceive ocr 2>/dev/null | jq -e --arg t "$text" '[.items[]?.text | select(contains($t))] | length > 0' >/dev/null 2>&1; then
+        jq -n --arg t "$text" '{success:true, action:"wait-for", matched:"text", text:$t}'; return 0
+      fi
+    fi
+    if [ "$idle" = "true" ]; then
+      # Two consecutive identical frames mean nothing is animating.
+      local shot="${TMPDIR_CU}/idle-$$.png"
+      screencapture -x -t jpg "$shot" 2>/dev/null
+      current=$(shasum -a 1 "$shot" 2>/dev/null | cut -d' ' -f1)
+      rm -f "$shot"
+      if [ -n "$previous" ] && [ "$current" = "$previous" ]; then
+        jq -n '{success:true, action:"wait-for", matched:"idle"}'; return 0
+      fi
+      previous="$current"
+    fi
+    sleep 0.4
+  done
+
+  cu_fail "wait_timeout" \
+    "Nothing matched within ${timeout}ms. Take a snapshot to see what is actually on screen." \
+    "$(jq -n --argjson t "$timeout" '{timeoutMs:$t}')"
+}
+
+# ---------------------------------------------------------------------------
+# request-human — hand the machine back for something an agent must not do.
+#
+# The deleted `vnc-browser` skill described this and shipped no script. The
+# honest version is smaller than a VNC tunnel and covers the cases that
+# actually arise: a CAPTCHA, a two-factor prompt, a login, a decision the
+# owner has to make. The agent pauses itself, says what it needs and why, and
+# waits — rather than trying to be clever, which for a login means typing a
+# password it must never type.
+#
+# Pausing (not stopping) is the point: the owner deals with it and the task
+# picks up, using the same banner button they already have.
+# ---------------------------------------------------------------------------
+do_request_human() {
+  local reason detail shot
+  reason=$(printf '%s' "$INPUT" | jq -r '.reason // empty')
+  detail=$(printf '%s' "$INPUT" | jq -r '.detail // empty')
+  require_param "reason" "$reason"
+
+  # A picture of what the agent is stuck on is worth more than its
+  # description of it, and the owner may be reading this on a phone.
+  shot=$(capture_thumb handover 2>/dev/null || true)
+
+  # Pause rather than stop: the task is not cancelled, it is waiting.
+  printf 'awaiting-human\n' > "$DESKTOP_PAUSE" 2>/dev/null || true
+  cu_presence begin --agent "$HOLDER" --goal "needs you: $reason"
+
+  jq -n --arg r "$reason" --arg d "$detail" --arg s "$HOLDER" --arg shot "$shot" \
+    '{success:true, action:"request-human", waiting:true, reason:$r,
+      detail:$d, agent:$s,
+      note:"Desktop control is paused until the owner resumes it (banner → Resume, or remove ~/.crewly/desktop.pause). Do not try to work around this."}
+     + (if $shot == "" then {} else {screenshot:$shot} end)'
+}
+
 # ---------------------------------------------------------------------------
 # Action dispatch
+#
+# The "after" audit shot is taken on the way out, so the log holds a pair
+# showing what the action actually changed — the point of keeping evidence at
+# all. It runs on every exit path, including a failure, because a failed
+# action that moved something is exactly what one wants to look at later.
 # ---------------------------------------------------------------------------
+trap 'cu_log_after 2>/dev/null || true' EXIT
+
 case "$ACTION" in
   screenshot)  do_screenshot ;;
   click)       do_click ;;
@@ -860,5 +1097,14 @@ case "$ACTION" in
   list-apps)   do_list_apps ;;
   find)        do_find ;;
   click-text)  do_click_text ;;
-  *)           error_exit "Unknown action: $ACTION. Valid: screenshot, click, move, type, key, scroll, drag, focus, open-url, list-apps, find, click-text" ;;
+  check-permissions) do_check_permissions ;;
+  snapshot)    do_snapshot ;;
+  click-ref)   do_click_ref ;;
+  fill-ref)    do_fill_ref ;;
+  resolve)     do_resolve ;;
+  ocr)         do_ocr ;;
+  displays)    do_displays ;;
+  wait-for)    do_wait_for ;;
+  request-human) do_request_human ;;
+  *)           error_exit "Unknown action: $ACTION. Valid: screenshot, click, move, type, key, scroll, drag, focus, open-url, list-apps, find, click-text, check-permissions, snapshot, click-ref, fill-ref, resolve, ocr, displays, wait-for, request-human" ;;
 esac

package/config/skills/agent/core/calendar-create/SKILL.md

@@ -60,3 +60,13 @@ bash execute.sh '{"summary":"Standup","start":"2026-09-21T09:00:00Z","end":"2026
 Missing `--summary` / `--start` / `--end` → `{"error":"Missing required parameter: …"}` on stderr, exit 1.
 `{"success":false,"reason":"not_connected","hint":"<connect URL>"}` (exit 1) when the owner has not connected Google Workspace;
 `reason` `validation` when Google cannot parse a time.
+
+## Choosing a Google account
+
+Several Google accounts can be connected at once. Without `--account` the call uses the default one (the first you connected, or whichever you marked default on the Connections page). Name one explicitly when it matters:
+
+```bash
+bash execute.sh --account work@company.com ...
+```
+
+The account must be connected *for this product* — Google consent is per product (Gmail / Calendar / Drive), so an account connected only for Calendar cannot read Drive.

package/config/skills/agent/core/calendar-create/execute.sh

@@ -28,6 +28,7 @@ Options:
   --description   Body text
   --attendee      Attendee email (repeat for several)
   --calendar      Calendar id (default: primary)
+  --account     Which connected Google account to act as (default: your primary)
   --help | -h     Show this help
 EOF_USAGE
 }
@@ -41,6 +42,7 @@ if [[ $# -gt 0 && ${1:0:1} == '{' ]]; then
   shift || true
 fi
 
+ACCOUNT=""
 while [[ $# -gt 0 ]]; do
   case "$1" in
     --summary|--title) [ $# -ge 2 ] || error_exit "--summary requires a value";     SUMMARY="$2";     shift 2 ;;
@@ -51,6 +53,7 @@ while [[ $# -gt 0 ]]; do
     --calendar|-c)     [ $# -ge 2 ] || error_exit "--calendar requires a value";    CALENDAR="$2";    shift 2 ;;
     --attendee)        [ $# -ge 2 ] || error_exit "--attendee requires a value"
                        ATTENDEES_JSON=$(jq -cn --argjson arr "$ATTENDEES_JSON" --arg v "$2" '$arr + [$v]'); shift 2 ;;
+    --account)  [ $# -ge 2 ] || error_exit "--account requires a value"; ACCOUNT="$2"; shift 2 ;;
     --help|-h)         print_usage; exit 0 ;;
     *) error_exit "Unknown option: $1" ;;
   esac
@@ -67,7 +70,10 @@ if [ -n "$INPUT_JSON" ]; then
   if [ "$(printf '%s' "$ATTENDEES_JSON" | jq 'length')" -eq 0 ]; then
     ATTENDEES_JSON=$(printf '%s' "$INPUT" | jq -c '(.attendees // []) | if type == "string" then split(",") | map(gsub("^\\s+|\\s+$"; "")) | map(select(. != "")) else . end')
   fi
+  [ -z "$ACCOUNT" ] && ACCOUNT=$(printf '%s' "$INPUT" | jq -r '.account // empty')
 fi
+# Route the call at one connected Google account; unset means the default.
+[ -n "$ACCOUNT" ] && export CREWLY_GOOGLE_ACCOUNT="$ACCOUNT"
 
 require_param "summary (--summary)" "$SUMMARY"
 require_param "start (--start)" "$START"

package/config/skills/agent/core/calendar-list/SKILL.md

@@ -56,3 +56,13 @@ bash execute.sh '{"calendarId":"team@group.calendar.google.com","from":"…","to
 
 `{"success":false,"reason":"not_connected","hint":"<connect URL>"}` (exit 1)
 when the owner has not connected Google Workspace.
+
+## Choosing a Google account
+
+Several Google accounts can be connected at once. Without `--account` the call uses the default one (the first you connected, or whichever you marked default on the Connections page). Name one explicitly when it matters:
+
+```bash
+bash execute.sh --account work@company.com ...
+```
+
+The account must be connected *for this product* — Google consent is per product (Gmail / Calendar / Drive), so an account connected only for Calendar cannot read Drive.

package/config/skills/agent/core/calendar-list/execute.sh

@@ -24,6 +24,7 @@ Options:
   --to          Upper bound (default: now + 7 days)
   --calendar    Calendar id (default: primary)
   --max         Result cap (default 50, max 250)
+  --account     Which connected Google account to act as (default: your primary)
   --help | -h   Show this help
 EOF_USAGE
 }
@@ -48,12 +49,14 @@ if [[ $# -gt 0 && ${1:0:1} == '{' ]]; then
   shift || true
 fi
 
+ACCOUNT=""
 while [[ $# -gt 0 ]]; do
   case "$1" in
     --from)        [ $# -ge 2 ] || error_exit "--from requires a value";     FROM="$2";     shift 2 ;;
     --to)          [ $# -ge 2 ] || error_exit "--to requires a value";       TO="$2";       shift 2 ;;
     --calendar|-c) [ $# -ge 2 ] || error_exit "--calendar requires a value"; CALENDAR="$2"; shift 2 ;;
     --max|-n)      [ $# -ge 2 ] || error_exit "--max requires a value";      MAX="$2";      shift 2 ;;
+    --account)  [ $# -ge 2 ] || error_exit "--account requires a value"; ACCOUNT="$2"; shift 2 ;;
     --help|-h)     print_usage; exit 0 ;;
     *) error_exit "Unknown option: $1" ;;
   esac
@@ -65,7 +68,10 @@ if [ -n "$INPUT_JSON" ]; then
   [ -z "$TO" ]       && TO=$(printf '%s' "$INPUT" | jq -r '.to // .timeMax // empty')
   [ -z "$CALENDAR" ] && CALENDAR=$(printf '%s' "$INPUT" | jq -r '.calendarId // .calendar // empty')
   [ -z "$MAX" ]      && MAX=$(printf '%s' "$INPUT" | jq -r '.max // empty')
+  [ -z "$ACCOUNT" ] && ACCOUNT=$(printf '%s' "$INPUT" | jq -r '.account // empty')
 fi
+# Route the call at one connected Google account; unset means the default.
+[ -n "$ACCOUNT" ] && export CREWLY_GOOGLE_ACCOUNT="$ACCOUNT"
 
 [ -z "$FROM" ] && FROM=$(date -u +%Y-%m-%dT%H:%M:%SZ)
 [ -z "$TO" ] && TO=$(iso_now_plus_days "$DEFAULT_WINDOW_DAYS")

package/config/skills/agent/core/docs-read/SKILL.md

@@ -48,3 +48,13 @@ bash execute.sh --id "https://docs.google.com/document/d/1AbC…/edit"
 when the owner has not connected Google Workspace (Settings → Integrations).
 A `403` with `reason: "google_error"` on a write means the file was not
 created by Crewly — the grant only edits files Crewly made (`drive.file`).
+
+## Choosing a Google account
+
+Several Google accounts can be connected at once. Without `--account` the call uses the default one (the first you connected, or whichever you marked default on the Connections page). Name one explicitly when it matters:
+
+```bash
+bash execute.sh --account work@company.com ...
+```
+
+The account must be connected *for this product* — Google consent is per product (Gmail / Calendar / Drive), so an account connected only for Calendar cannot read Drive.

package/config/skills/agent/core/docs-read/execute.sh

@@ -20,6 +20,7 @@ Usage:
 
 Options:
   --id          Document id (from drive-search or the docs.google.com URL)
+  --account     Which connected Google account to act as (default: your primary)
   --help | -h   Show this help
 EOF_USAGE
 }
@@ -48,10 +49,11 @@ if [[ $# -gt 0 && ${1:0:1} == '{' ]]; then
   INPUT_JSON="$1"
   shift || true
 fi
-ID=""
+ID=""; ACCOUNT=""
 while [[ $# -gt 0 ]]; do
   case "$1" in
     --id)      [ $# -ge 2 ] || error_exit "--id requires a value"; ID="$2"; shift 2 ;;
+    --account)  [ $# -ge 2 ] || error_exit "--account requires a value"; ACCOUNT="$2"; shift 2 ;;
     --help|-h) print_usage; exit 0 ;;
     *) error_exit "Unknown option: $1" ;;
   esac
@@ -59,7 +61,10 @@ done
 if [ -n "$INPUT_JSON" ]; then
   INPUT=$(read_json_input "$INPUT_JSON")
   [ -z "$ID" ] && ID=$(printf '%s' "$INPUT" | jq -r '.id // .documentId // empty')
+  [ -z "$ACCOUNT" ] && ACCOUNT=$(printf '%s' "$INPUT" | jq -r '.account // empty')
 fi
+# Route the call at one connected Google account; unset means the default.
+[ -n "$ACCOUNT" ] && export CREWLY_GOOGLE_ACCOUNT="$ACCOUNT"
 # Accept a full docs.google.com URL too.
 ID=$(printf '%s' "$ID" | sed -E 's#.*/document/d/([^/?]+).*#\1#')
 require_param "id (--id)" "$ID"

package/config/skills/agent/core/docs-write/SKILL.md

@@ -53,3 +53,13 @@ re-connect Google Workspace once the scope is enabled".
 when the owner has not connected Google Workspace (Settings → Integrations).
 A `403` with `reason: "google_error"` on a write means the file was not
 created by Crewly — the grant only edits files Crewly made (`drive.file`).
+
+## Choosing a Google account
+
+Several Google accounts can be connected at once. Without `--account` the call uses the default one (the first you connected, or whichever you marked default on the Connections page). Name one explicitly when it matters:
+
+```bash
+bash execute.sh --account work@company.com ...
+```
+
+The account must be connected *for this product* — Google consent is per product (Gmail / Calendar / Drive), so an account connected only for Calendar cannot read Drive.

package/config/skills/agent/core/docs-write/execute.sh

@@ -27,6 +27,7 @@ Options:
   --id          Append to this document instead (must be one Crewly created, or the grant needs the Docs scope)
   --text        Body text (plain; blank line = new paragraph)
   --text-file   Read the body from a file
+  --account     Which connected Google account to act as (default: your primary)
   --help | -h   Show this help
 EOF_USAGE
 }
@@ -55,13 +56,14 @@ if [[ $# -gt 0 && ${1:0:1} == '{' ]]; then
   INPUT_JSON="$1"
   shift || true
 fi
-TITLE=""; ID=""; TEXT=""; TEXT_FILE=""
+TITLE=""; ID=""; TEXT=""; TEXT_FILE=""; ACCOUNT=""
 while [[ $# -gt 0 ]]; do
   case "$1" in
     --title)     [ $# -ge 2 ] || error_exit "--title requires a value";     TITLE="$2";     shift 2 ;;
     --id)        [ $# -ge 2 ] || error_exit "--id requires a value";        ID="$2";        shift 2 ;;
     --text)      [ $# -ge 2 ] || error_exit "--text requires a value";      TEXT="$2";      shift 2 ;;
     --text-file) [ $# -ge 2 ] || error_exit "--text-file requires a value"; TEXT_FILE="$2"; shift 2 ;;
+    --account)  [ $# -ge 2 ] || error_exit "--account requires a value"; ACCOUNT="$2"; shift 2 ;;
     --help|-h)   print_usage; exit 0 ;;
     *) error_exit "Unknown option: $1" ;;
   esac
@@ -71,7 +73,10 @@ if [ -n "$INPUT_JSON" ]; then
   [ -z "$TITLE" ] && TITLE=$(printf '%s' "$INPUT" | jq -r '.title // empty')
   [ -z "$ID" ]    && ID=$(printf '%s' "$INPUT" | jq -r '.id // .documentId // empty')
   [ -z "$TEXT" ]  && TEXT=$(printf '%s' "$INPUT" | jq -r '.text // .body // empty')
+  [ -z "$ACCOUNT" ] && ACCOUNT=$(printf '%s' "$INPUT" | jq -r '.account // empty')
 fi
+# Route the call at one connected Google account; unset means the default.
+[ -n "$ACCOUNT" ] && export CREWLY_GOOGLE_ACCOUNT="$ACCOUNT"
 if [ -n "$TEXT_FILE" ]; then
   [ -f "$TEXT_FILE" ] || error_exit "text file not found: $TEXT_FILE"
   TEXT=$(cat "$TEXT_FILE")

package/config/skills/agent/core/drive-read/SKILL.md

@@ -51,3 +51,13 @@ Files over 10 MB are refused with a `webViewLink` to open instead.
 when the owner has not connected Google Workspace (Settings → Integrations).
 A `403` with `reason: "google_error"` on a write means the file was not
 created by Crewly — the grant only edits files Crewly made (`drive.file`).
+
+## Choosing a Google account
+
+Several Google accounts can be connected at once. Without `--account` the call uses the default one (the first you connected, or whichever you marked default on the Connections page). Name one explicitly when it matters:
+
+```bash
+bash execute.sh --account work@company.com ...
+```
+
+The account must be connected *for this product* — Google consent is per product (Gmail / Calendar / Drive), so an account connected only for Calendar cannot read Drive.

package/config/skills/agent/core/drive-read/execute.sh

@@ -21,6 +21,7 @@ Usage:
 Options:
   --id          Drive file id (required; from drive-search)
   --out         Save the content to this path instead of printing it (binary files are decoded)
+  --account     Which connected Google account to act as (default: your primary)
   --help | -h   Show this help
 EOF_USAGE
 }
@@ -49,11 +50,12 @@ if [[ $# -gt 0 && ${1:0:1} == '{' ]]; then
   INPUT_JSON="$1"
   shift || true
 fi
-ID=""; OUT_PATH=""
+ID=""; OUT_PATH=""; ACCOUNT=""
 while [[ $# -gt 0 ]]; do
   case "$1" in
     --id)      [ $# -ge 2 ] || error_exit "--id requires a value";  ID="$2";       shift 2 ;;
     --out|-o)  [ $# -ge 2 ] || error_exit "--out requires a value"; OUT_PATH="$2"; shift 2 ;;
+    --account)  [ $# -ge 2 ] || error_exit "--account requires a value"; ACCOUNT="$2"; shift 2 ;;
     --help|-h) print_usage; exit 0 ;;
     *) error_exit "Unknown option: $1" ;;
   esac
@@ -62,7 +64,10 @@ if [ -n "$INPUT_JSON" ]; then
   INPUT=$(read_json_input "$INPUT_JSON")
   [ -z "$ID" ]       && ID=$(printf '%s' "$INPUT" | jq -r '.id // .fileId // empty')
   [ -z "$OUT_PATH" ] && OUT_PATH=$(printf '%s' "$INPUT" | jq -r '.out // empty')
+  [ -z "$ACCOUNT" ] && ACCOUNT=$(printf '%s' "$INPUT" | jq -r '.account // empty')
 fi
+# Route the call at one connected Google account; unset means the default.
+[ -n "$ACCOUNT" ] && export CREWLY_GOOGLE_ACCOUNT="$ACCOUNT"
 require_param "id (--id)" "$ID"
 RESPONSE=$(call GET "/google/drive/files/$(uri "$ID")/content") || { printf '%s\n' "$RESPONSE"; exit 1; }
 if printf '%s' "$RESPONSE" | jq -e '.truncated == true' >/dev/null 2>&1; then printf '%s\n' "$RESPONSE"; exit 0; fi

package/config/skills/agent/core/drive-search/SKILL.md

@@ -53,3 +53,13 @@ else → `drive-read`.
 when the owner has not connected Google Workspace (Settings → Integrations).
 A `403` with `reason: "google_error"` on a write means the file was not
 created by Crewly — the grant only edits files Crewly made (`drive.file`).
+
+## Choosing a Google account
+
+Several Google accounts can be connected at once. Without `--account` the call uses the default one (the first you connected, or whichever you marked default on the Connections page). Name one explicitly when it matters:
+
+```bash
+bash execute.sh --account work@company.com ...
+```
+
+The account must be connected *for this product* — Google consent is per product (Gmail / Calendar / Drive), so an account connected only for Calendar cannot read Drive.

package/config/skills/agent/core/drive-search/execute.sh

@@ -23,6 +23,7 @@ Options:
   --mime        Restrict to a type: doc | sheet | slides | pdf | folder | any MIME type
   --folder      Restrict to a Drive folder id
   --max         Result cap (default 20, max 100)
+  --account     Which connected Google account to act as (default: your primary)
   --help | -h   Show this help
 EOF_USAGE
 }
@@ -51,13 +52,14 @@ if [[ $# -gt 0 && ${1:0:1} == '{' ]]; then
   INPUT_JSON="$1"
   shift || true
 fi
-QUERY=""; MIME=""; FOLDER=""; MAX=""
+QUERY=""; MIME=""; FOLDER=""; MAX=""; ACCOUNT=""
 while [[ $# -gt 0 ]]; do
   case "$1" in
     --query|-q) [ $# -ge 2 ] || error_exit "--query requires a value"; QUERY="$2"; shift 2 ;;
     --mime)     [ $# -ge 2 ] || error_exit "--mime requires a value";  MIME="$2";  shift 2 ;;
     --folder)   [ $# -ge 2 ] || error_exit "--folder requires a value"; FOLDER="$2"; shift 2 ;;
     --max|-n)   [ $# -ge 2 ] || error_exit "--max requires a value";   MAX="$2";   shift 2 ;;
+    --account)  [ $# -ge 2 ] || error_exit "--account requires a value"; ACCOUNT="$2"; shift 2 ;;
     --help|-h)  print_usage; exit 0 ;;
     *) error_exit "Unknown option: $1" ;;
   esac
@@ -68,7 +70,10 @@ if [ -n "$INPUT_JSON" ]; then
   [ -z "$MIME" ]   && MIME=$(printf '%s' "$INPUT" | jq -r '.mime // .mimeType // empty')
   [ -z "$FOLDER" ] && FOLDER=$(printf '%s' "$INPUT" | jq -r '.folder // .folderId // empty')
   [ -z "$MAX" ]    && MAX=$(printf '%s' "$INPUT" | jq -r '.max // empty')
+  [ -z "$ACCOUNT" ] && ACCOUNT=$(printf '%s' "$INPUT" | jq -r '.account // empty')
 fi
+# Route the call at one connected Google account; unset means the default.
+[ -n "$ACCOUNT" ] && export CREWLY_GOOGLE_ACCOUNT="$ACCOUNT"
 case "$MIME" in
   doc|docs) MIME="application/vnd.google-apps.document" ;;
   sheet|sheets) MIME="application/vnd.google-apps.spreadsheet" ;;

package/config/skills/agent/core/drive-upload/SKILL.md

@@ -52,3 +52,13 @@ permissions are the owner's — this skill does not change sharing).
 when the owner has not connected Google Workspace (Settings → Integrations).
 A `403` with `reason: "google_error"` on a write means the file was not
 created by Crewly — the grant only edits files Crewly made (`drive.file`).
+
+## Choosing a Google account
+
+Several Google accounts can be connected at once. Without `--account` the call uses the default one (the first you connected, or whichever you marked default on the Connections page). Name one explicitly when it matters:
+
+```bash
+bash execute.sh --account work@company.com ...
+```
+
+The account must be connected *for this product* — Google consent is per product (Gmail / Calendar / Drive), so an account connected only for Calendar cannot read Drive.

package/config/skills/agent/core/drive-upload/execute.sh

@@ -28,6 +28,7 @@ Options:
   --mime        MIME type override
   --folder      Destination folder id (default: My Drive root)
   --convert     Convert on upload: doc | sheet | slides (e.g. a .docx/.csv/.pptx becomes a Google-native file)
+  --account     Which connected Google account to act as (default: your primary)
   --help | -h   Show this help
 EOF_USAGE
 }
@@ -56,7 +57,7 @@ if [[ $# -gt 0 && ${1:0:1} == '{' ]]; then
   INPUT_JSON="$1"
   shift || true
 fi
-FILE=""; NAME=""; TEXT=""; MIME=""; FOLDER=""; CONVERT=""
+FILE=""; NAME=""; TEXT=""; MIME=""; FOLDER=""; CONVERT=""; ACCOUNT=""
 while [[ $# -gt 0 ]]; do
   case "$1" in
     --path|-p) [ $# -ge 2 ] || error_exit "--path requires a value";    FILE="$2";    shift 2 ;;
@@ -65,6 +66,7 @@ while [[ $# -gt 0 ]]; do
     --mime)    [ $# -ge 2 ] || error_exit "--mime requires a value";    MIME="$2";    shift 2 ;;
     --folder)  [ $# -ge 2 ] || error_exit "--folder requires a value";  FOLDER="$2";  shift 2 ;;
     --convert) [ $# -ge 2 ] || error_exit "--convert requires a value"; CONVERT="$2"; shift 2 ;;
+    --account)  [ $# -ge 2 ] || error_exit "--account requires a value"; ACCOUNT="$2"; shift 2 ;;
     --help|-h) print_usage; exit 0 ;;
     *) error_exit "Unknown option: $1" ;;
   esac
@@ -77,7 +79,10 @@ if [ -n "$INPUT_JSON" ]; then
   [ -z "$MIME" ]    && MIME=$(printf '%s' "$INPUT" | jq -r '.mime // .mimeType // empty')
   [ -z "$FOLDER" ]  && FOLDER=$(printf '%s' "$INPUT" | jq -r '.folder // .folderId // empty')
   [ -z "$CONVERT" ] && CONVERT=$(printf '%s' "$INPUT" | jq -r '.convert // .convertTo // empty')
+  [ -z "$ACCOUNT" ] && ACCOUNT=$(printf '%s' "$INPUT" | jq -r '.account // empty')
 fi
+# Route the call at one connected Google account; unset means the default.
+[ -n "$ACCOUNT" ] && export CREWLY_GOOGLE_ACCOUNT="$ACCOUNT"
 case "$CONVERT" in
   doc|docs) CONVERT="application/vnd.google-apps.document" ;;
   sheet|sheets) CONVERT="application/vnd.google-apps.spreadsheet" ;;