`, `
`, plain links — Gmail-composer shaped) is the only HTML that ever goes out. - Write body files as UTF-8. After creating or updating a draft, read it back (`gmail.py thread`/draft read) and confirm em dashes, quotes, and any emoji came through intact — mojibake (`â€¦`-style garble) in a sent mail is unrecoverable. ## Calendar reads For "what is on my schedule today?", first get the user's timezone (`GET /calendar/v3/users/me/settings/timezone` — the sandbox clock is UTC, so never assume it), compute the local day bounds, and call: ```bash curl -sS --get 'https://www.googleapis.com/calendar/v3/calendars/primary/events' \ -H "Authorization: Bearer $VAULT_TOKEN_WWW_GOOGLEAPIS_COM" \ --data-urlencode "timeMin=$TIME_MIN" \ --data-urlencode "timeMax=$TIME_MAX" \ --data-urlencode "singleEvents=true" \ --data-urlencode "orderBy=startTime" \ --data-urlencode "maxResults=250" ``` If the response has a `nextPageToken`, keep fetching — a truncated page silently drops meetings. `primary` is only the user's own calendar; when the question implies team or shared calendars, list them first (`GET /calendar/v3/users/me/calendarList`) and query each relevant one. Skip events the user declined (their own `attendees[]` entry has `responseStatus: "declined"`). Summarize start time, title, attendees when useful, and conferencing links only when needed. Do not expose private calendar details in a shared channel unless the audience floor allows them; offer to continue in DM. ## Google Tasks Tasks is served under `www.googleapis.com/tasks/v1`, so it uses the same `$VAULT_TOKEN_WWW_GOOGLEAPIS_COM` token. List the task lists, then the tasks in one: ```bash curl -sS 'https://www.googleapis.com/tasks/v1/users/@me/lists' \ -H "Authorization: Bearer $VAULT_TOKEN_WWW_GOOGLEAPIS_COM" curl -sS --get 'https://www.googleapis.com/tasks/v1/lists/LIST_ID/tasks' \ -H "Authorization: Bearer $VAULT_TOKEN_WWW_GOOGLEAPIS_COM" \ --data-urlencode "showCompleted=false" \ --data-urlencode "maxResults=100" ``` Both endpoints page (default 20 items): follow `nextPageToken` before treating a list as complete. Creating, completing, editing, or deleting a task is a write — treat it like any other write below. Example creation after approval: ```bash curl -sS -X POST 'https://www.googleapis.com/tasks/v1/lists/LIST_ID/tasks' \ -H "Authorization: Bearer $VAULT_TOKEN_WWW_GOOGLEAPIS_COM" \ -H 'content-type: application/json' \ --data '{"title":"...","notes":"...","due":"2026-07-20T00:00:00.000Z"}' ``` ## Writes require approval Creating drafts, sending mail, modifying labels, deleting mail, or editing calendar events is a write. Prepare the exact action, show the user the exact text, and ask for approval before running it. `send-draft` only ever fires on an explicitly approved draft. Calendar event creation after approval: ```bash curl -sS -X POST 'https://www.googleapis.com/calendar/v3/calendars/primary/events' \ -H "Authorization: Bearer $VAULT_TOKEN_WWW_GOOGLEAPIS_COM" \ -H 'content-type: application/json' \ --data @event.json ``` Always show what changed and keep enough IDs in the workspace to undo or inspect later.