google-accounts

Use when setting up, managing, or switching between Google CLI account contexts — scaffolds google-cli.json, adds client contexts, validates auth, and switches active context across gogcli, goplaces, gaql-cli, and gcloud.

Model	Source
sonnet	pack: google-cli

Full Reference

Google Accounts

Unified multi-account context management for the google-cli pack. Manages google-cli.json at the project root — named contexts that map to per-tool account settings. The GOOGLE_CLI_CONTEXT env var overrides the active context at runtime. Four modes: setup (first-time scaffold), add (new client context), check (validate all auth), switch (change active context).

Mandatory Announcement — FIRST OUTPUT before anything else:

┏━ ⚡ google-accounts ━━━━━━━━━━━━━━━━━━━━━━━━━━━┓
┃ [one-line description of what mode/action]      ┃
┗━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━┛

No exceptions. Box frame first, then work.

Quick Reference

Item	Value
Config file	google-cli.json (project root)
Env override	GOOGLE_CLI_CONTEXT
Tools covered	gogcli, goplaces, gaql-cli/mcc-gaql, gcloud
Credentials	Always env:VAR_NAME, never raw values

Reference Index

I want to…	File
Understand google-cli.json schema, field reference	reference/schema.md

━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━

Phase 1: SETUP

Triggered by: first-time use, “set up google accounts”, no google-cli.json exists.

1. Detect installed tools:

   which gog       # gogcli
   which goplaces  # goplaces
   which gaql      # gaql-cli
   which gcloud    # gcloud SDK

2. For each installed tool, detect current auth state:

   • gogcli: gog auth list --check → extract active email
   • goplaces: echo $GOOGLE_PLACES_API_KEY → non-empty = ready, use env:GOOGLE_PLACES_API_KEY
   • gaql-cli: check ~/.config/gaql/config.toml or $GOOGLE_ADS_CONFIGURATION_FILE_PATH for customer_id
   • gcloud: gcloud config get-value account + gcloud config configurations list → extract active config name

3. Build default context from detected state — skip tools that are not installed.

4. Write google-cli.json to project root:

   {
     "default": "main",
     "contexts": {
       "main": {
         "gogcli": "[email protected]",
         "goplaces": "env:GOOGLE_PLACES_API_KEY",
         "gcloud": "detected-config-name",
         "ads": {
           "customer_id": "detected-or-null",
           "login_customer_id": null
         }
       }
     }
   }

5. Show the generated file, explain how to add more contexts with google-accounts add.

━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━

Phase 2: ADD

Triggered by: “add client context acme”, “add google account”, “new context”.

1. Ask context name if not provided.

2. For each installed tool, ask for account/key/config:

   • gogcli: “Which Google account email for this context?”
   • goplaces: “Which env var holds the Places API key for this context? (e.g. ACME_PLACES_KEY)”
   • gcloud: “Which gcloud configuration name? Run gcloud config configurations list to see options.”
   • ads: “Google Ads customer ID? (xxx-xxx-xxxx format)” + “MCC login_customer_id? (null if direct account)”

3. Validate auth works for each entry before writing:

   • gogcli: gog auth list --check and verify email is listed
   • goplaces: env var non-empty ([ -n "$VAR_NAME" ])
   • gcloud: gcloud config configurations describe <name> exits 0
   • ads: customer_id matches ^\d{3}-\d{3}-\d{4}$ format

4. Append new context to google-cli.json. If file does not exist, run SETUP first.

━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━

Phase 3: CHECK

Triggered by: “check google accounts”, “validate auth”, “account status”.

1. Read google-cli.json. If missing, prompt to run SETUP.

2. For each context, for each tool entry, validate:

   Tool	Validation Command	Pass Condition
   gogcli	gog auth list --check	Context email is listed
   goplaces	[ -n "${RESOLVED_VAR}" ]	Env var is set and non-empty
   gcloud	gcloud config configurations describe <name>	Exits 0
   ads	Format check	customer_id matches xxx-xxx-xxxx

3. Report table: context × tool with ✓/✗ status:

   Context    gogcli            goplaces          gcloud            ads
   main       ✓ [email protected]  ✓ key set         ✓ default         ✓ 123-456-7890
   acme       ✓ [email protected]   ✗ key missing     ✓ acme-prod       ✓ 987-654-3210

4. For each ✗, explain the fix:

   • gogcli missing: gog auth add <email>
   • goplaces missing: set the env var in .env / .envrc
   • gcloud missing: gcloud config configurations create <name>
   • ads format error: re-enter in xxx-xxx-xxxx format

━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━

Phase 4: SWITCH

Triggered by: “switch to acme”, “use acme context”, “set active context”.

1. Validate target context exists in google-cli.json. If not found, list available contexts.

2. Update default field in google-cli.json:

   { "default": "acme", "contexts": { ... } }

3. Output .envrc snippet for the new context:

   export GOOGLE_CLI_CONTEXT="acme"
   export GOG_ACCOUNT="[email protected]"
   export GOOGLE_PLACES_API_KEY="${ACME_PLACES_KEY}"
   export CLOUDSDK_ACTIVE_CONFIG_NAME="acme-prod"

   Tell the user to paste into .envrc and run direnv allow — or source manually.

4. Activate gcloud config for immediate effect:

   gcloud config configurations activate acme-prod

   Skip if no gcloud entry in the context.

━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━

What This Skill Does NOT Do

• Modify upstream tools’ config files (gogcli keyring, gaql config.toml, gcloud configs)
• Create gcloud configurations — outputs the creation command, user runs it
• Store secrets — always env:VAR_NAME references, never raw values
• Block on missing tools — skips tools not installed, reports what was skipped

Integration

Need	Skill / Rule
Routed by	google-pimp → routing table
Enforced by	google-cli-context rule (passive — reads active context before CLI commands)
Pairs with	google-workspace-workflow (multi-account pipelines)
Pairs with	google-ads-workflow (MCC ops with context injection)