Pi Google Workspace

Local, least-privilege Google Workspace tools for Pi.

The extension calls Google's official APIs directly. It does not use a hosted connector, MCP server, or third-party Google integration.

Features

• Read-only Gmail search and message retrieval.
• Read-only Google Calendar event listing with intentionally minimal output.
• Gmail draft creation plus native-quality Reply/Reply all drafts: resolves recipients, keeps the thread and uses the configured Gmail HTML signature. Every draft is gated by interactive confirmation; it never sends email.
• Read-only Google Drive search when explicitly authorized.
• Local OAuth refresh-token handling; tokens never enter the repository or chat.

It deliberately does not send email or modify Calendar or Drive.

Install

Install from a local checkout:

pi install D:\path\to\pi-google-workspace

pi install /path/to/pi-google-workspace

Then run /reload in Pi.

Configuration

Set PI_GOOGLE_TOKEN_PATH to your local OAuth authorized-user JSON file before starting Pi. This is recommended on every platform:

$env:PI_GOOGLE_TOKEN_PATH = "C:\secure\path\google_token.json"
pi

export PI_GOOGLE_TOKEN_PATH="$HOME/.local/share/pi-google-workspace/google_token.json"
pi

For signatures with Gmail-hosted inline images, store the corresponding private image assets under signature-assets/ beside the token (for example, signature-0.png). Override that directory with PI_GOOGLE_SIGNATURE_ASSETS_PATH when needed. These assets are local-only and must never enter the repository.

Without that variable, the extension looks for a token at the platform-specific default:

• Windows: %LOCALAPPDATA%\pi-google-workspace\google_token.json
• Linux/macOS: $XDG_DATA_HOME/pi-google-workspace/google_token.json, or ~/.local/share/pi-google-workspace/google_token.json

See docs/google-workspace.md for OAuth scopes, security rules, and verification.

License

MIT. This repository is intentionally not published to npm.