DevCom.AgenticRuntime.Plugin.GoogleWorkspace 1.0.8

Google Workspace Plugin

DevCom Agentic Platform (DAP) plugin that adds a Google Drive folder-watch trigger plus Gmail and Google Drive skills. One shared google-oauth2 credential (authorize once) powers the trigger and every skill over the Drive v3 and Gmail v1 REST APIs — no Google SDK.

Features

• Google Drive Folder Watch trigger (google-drive-folder-watch) — polls a Drive folder and fires agents when a new file appears. The file's bytes are stored as an attachment blob and the file name / mime type / Drive id / folder path are passed to the agent, together with folderUrl — the watched folder's Drive link (.../drive/folders/<id>, or .../drive/my-drive for My Drive root) — in both the JSON payload and the trigger message. The watched folder path is Scriban-templated (e.g. Invoices/{{ now | date.to_string '%Y-%m' }}).
• Google Drive skills — drive-list-folders, drive-list-files, drive-get-file, drive-move-file, drive-upload-file (details below).
• Gmail skill — gmail-send.
• Credential probe — the trigger's "Test Connection" refreshes a token and calls Drive about.get to confirm authorization.

Credential

All surfaces use the platform google-oauth2 credential type (Authorization Code flow with access_type=offline&prompt=consent). Create the credential, click Authorize with Google, then reference the same credential from the trigger config, and bind it to the skill on the agent's Skills tab — nothing is passed in the tool call.

Required fields: ClientId, ClientSecret (from a Google Cloud Console Web application OAuth client), Scope (defaults to drive gmail.send). The redirect URI is /api/credentials/{credentialId}/oauth2/authorize — the platform's generic CredentialsController handles authorize/callback and stores the refresh token.

Google Drive skills

All Drive skills share the bound google-oauth2 credential. Folder paths are slash-separated from My Drive root (Invoices/Incoming; empty or root = My Drive root) and Scriban-templated (Invoices/{{ now | date.to_string '%Y-%m' }}). Trashed items are never returned; listings page through every result. Shared Drives / "Shared with me" items are included.

drive-list-folders and drive-list-files address the folder in one of three ways — the same modes the folder-watch trigger offers:

• folderPath — slash-separated path walked from My Drive root. It cannot reach folders outside My Drive ("Shared with me", Shared drives): those are never children of root.
• folderId — the raw Drive folder id (Scriban-templated). Works for any folder the authorized account can see.
• folderUrl — a Drive share link (https://drive.google.com/drive/folders/<id>, with or without ?usp=…; also /drive/u/<n>/folders/<id> and open?id=<id>); the id is taken from it.

folderId and folderUrl are mutually exclusive (passing both is an error). Either of them wins over folderPath, which is then ignored. An id/URL is checked with files.get first, so an id that does not exist or is not a folder fails with a clear message rather than an empty listing, and the result carries the folder's Drive display name as folderName (in place of folderPath). Path-addressed calls are unchanged.

Known limitation: links that carry a resourcekey (…/folders/<id>?resourcekey=…) are reduced to the id and the key is not sent. Drive requires the key (in X-Goog-Drive-Resource-Keys) only for a link-shared folder the authorized account has no direct access to; such a folder comes back as "not found", and the error says so. Share the folder with the authorized account instead — the same applies to the folder-watch trigger's "By URL" mode.

Known limitation: for the root of a Shared drive (its id starts with 0A…) Drive's files.get reports the name Drive, so folderName is "Drive" rather than the Shared drive's own name. Listing works normally; folders inside a Shared drive report their real names.

drive-get-file downloads the file (files.get?alt=media) and stores it as a tenant-scoped DAP binary blob — the same kind of attachment the folder-watch trigger produces — so the agent reads it with the standard read-file skill ({ "fileId": "<attachmentFileId>" }) or passes the id to drive-upload-file. The stored file keeps its Drive name and MIME type (falling back to application/octet-stream); files over 50 MB are rejected.

Google-native documents are not supported. Google Docs, Sheets, Slides, Forms, etc. (application/vnd.google-apps.*) cannot be downloaded via alt=media; drive-get-file rejects them with a clear error instead of exporting. They still appear in drive-list-files output (with their Google MIME type) so the agent can see and skip them. Drive shortcuts (application/vnd.google-apps.shortcut) are likewise rejected — fetch the target file by its own id. Only regular files — .docx, .csv, .txt, .pdf, images and the like — are fetched. includeFolders is ignored when mimeTypeFilter is set (folders have their own MIME type).

Errors (no credential bound, folder path segment not found, unknown folder id or an id that is not a folder, a folderUrl with no folder id, folderId and folderUrl together, unknown file id, folder passed as a file, non-downloadable file, permission denied) come back as skill failures with a human-readable message rather than a crashed invocation. Any other failure — a database error while storing the fetched file, an unexpected bug — is logged and reported to the agent only as a fixed "internal error" sentence, so host, database and role names never reach the transcript.

Installation

Install from the DAP admin Plugins page, or drop the package into the host's plugin directory.

Changelog

1.0.8

• feat(DAP-332): drive-list-files and drive-list-folders accept folderId or folderUrl as an alternative to folderPath, so they reach "Shared with me" and Shared-drive folders that have no My Drive path. The id/URL is validated as an existing folder and its display name is returned as folderName. folderId + folderUrl together is rejected before any credential lookup; either wins over folderPath. Path-only calls keep the same resolution, output and messages. A link's resourcekey is not sent; when such a link's folder is not found, the error says the folder must be shared with the authorized account.

1.0.7

• feat(DAP-332): new drive-list-files skill lists the files (optionally folders) inside a Drive folder path with an exact MIME-type filter, and new drive-get-file skill downloads a Drive file by id into a tenant-scoped DAP blob (attachmentFileId) readable via read-file. Google-native Docs/Sheets/Slides and shortcuts are rejected with a clear message; files over 50 MB are refused before buffering. drive-list-folders keeps its contract. Drive API and OAuth failures (GoogleDriveApiException, GoogleOAuthException) now reach the agent as a short reason in every Drive/Gmail skill — the raw Google payload goes to the log only. Any other unexpected exception (e.g. a database failure while storing the blob) is logged and reaches the agent as a fixed "internal error" sentence. drive-get-file sizes its download buffer from Content-Length and returns it without a copy, so a file peaks at its own size.

1.0.6

• feat(DAP-313): the folder-watch trigger emits folderUrl (the watched folder's Drive link) in the trigger payload and as a Folder URL: line in the agent message, for all three folder-selection modes. My Drive root emits https://drive.google.com/drive/my-drive. Existing trigger configs keep working unchanged.

1.0.0

• feat(CDEV-9964, DAP-246): Google Drive folder-watch trigger + Gmail/Drive skills over a shared google-oauth2 credential.