Your own key to Apps Script

#!/usr/bin/env node
// gas-auth.js — ONE-TIME sign-in so an AI assistant can push code into YOUR
// Google Apps Script projects. Needs ~/.config/gas-oauth/client_secret.json
// (downloaded from your own Google Cloud project — see the guide, step 3).
// Writes ~/.config/gas-oauth/token.json. Run again only if access is revoked.
'use strict';
const fs = require('fs');
const os = require('os');
const path = require('path');
const readline = require('readline');

const DIR = path.join(os.homedir(), '.config', 'gas-oauth');
const SECRET = path.join(DIR, 'client_secret.json');
const TOKEN = path.join(DIR, 'token.json');
const SCOPES = [
  'https://www.googleapis.com/auth/script.projects',    // create + update script code
  'https://www.googleapis.com/auth/script.deployments', // publish web-app deployments
];
const REDIRECT = 'http://localhost';

(async () => {
  if (!fs.existsSync(SECRET)) {
    console.error('Missing ' + SECRET);
    console.error('Download the Desktop-app client JSON from Google Cloud (guide step 3), rename it client_secret.json, and put it there.');
    process.exit(1);
  }
  const installed = JSON.parse(fs.readFileSync(SECRET, 'utf8')).installed;
  if (!installed) {
    console.error('client_secret.json is not a "Desktop app" client (no "installed" key). Create a Desktop app client and download that JSON.');
    process.exit(1);
  }
  const url = 'https://accounts.google.com/o/oauth2/v2/auth?' + new URLSearchParams({
    client_id: installed.client_id,
    redirect_uri: REDIRECT,
    response_type: 'code',
    scope: SCOPES.join(' '),
    access_type: 'offline',
    prompt: 'consent',
  });
  console.log('\n1. Open this link in a browser where you are signed in to your SCHOOL account:\n');
  console.log(url + '\n');
  console.log('2. Click Allow. The browser then shows a "localhost refused to connect" page. That is expected.');
  console.log('3. Copy the WHOLE address from that page\'s address bar and paste it below.\n');
  const rl = readline.createInterface({ input: process.stdin, output: process.stdout });
  const pasted = await new Promise((r) => rl.question('Paste the address: ', (a) => { rl.close(); r(a.trim()); }));
  let code = null;
  try { code = new URL(pasted).searchParams.get('code'); } catch (e) { /* not a URL */ }
  if (!code) { const m = pasted.match(/code=([^&\s]+)/); code = m ? decodeURIComponent(m[1]) : null; }
  if (!code) {
    console.error('No code found. Paste the entire address, it starts with http://localhost/?code=');
    process.exit(1);
  }
  const res = await fetch('https://oauth2.googleapis.com/token', {
    method: 'POST',
    headers: { 'Content-Type': 'application/x-www-form-urlencoded' },
    body: new URLSearchParams({
      code: code,
      client_id: installed.client_id,
      client_secret: installed.client_secret,
      redirect_uri: REDIRECT,
      grant_type: 'authorization_code',
    }),
  });
  const data = await res.json();
  if (!res.ok || !data.refresh_token) {
    console.error('Google did not return a long-lived token:\n' + JSON.stringify(data, null, 2));
    console.error('If everything else looks fine but refresh_token is missing: remove the app at https://myaccount.google.com/permissions and run this again.');
    process.exit(1);
  }
  fs.mkdirSync(DIR, { recursive: true });
  fs.writeFileSync(TOKEN, JSON.stringify({
    refresh_token: data.refresh_token,
    access_token: data.access_token,
    expires_in: data.expires_in,
    scope: data.scope,
    token_type: data.token_type,
  }, null, 2) + '\n', { mode: 0o600 });
  try { fs.chmodSync(SECRET, 0o600); } catch (e) { /* Windows */ }
  console.log('\nSaved ' + TOKEN + '. Done. You will not need to do this again.');
})().catch((e) => { console.error(e.message); process.exit(1); });

#!/usr/bin/env node
// gas-push.js — push the files in ./gas/ to a Google Apps Script project.
// Run it inside a project folder that contains:
//   gas.json            {"title": "My Script"}   (scriptId is filled in on first push)
//   gas/appsscript.json the manifest (time zone, scopes)
//   gas/*.gs            the code   (gas/*.html for web pages, optional)
// First run creates the project in the signed-in Google account; later runs update it.
// Uses ~/.config/gas-oauth/ from gas-auth.js. No clasp, no npm installs.
'use strict';
const fs = require('fs');
const os = require('os');
const path = require('path');

const CRED_DIR = path.join(os.homedir(), '.config', 'gas-oauth');
const CLIENT_SECRET_PATH = path.join(CRED_DIR, 'client_secret.json');
const TOKEN_PATH = path.join(CRED_DIR, 'token.json');
const CONFIG_PATH = path.resolve('gas.json');
const SRC_DIR = path.resolve('gas');
const API = 'https://script.googleapis.com/v1';

const readJson = (p) => JSON.parse(fs.readFileSync(p, 'utf8'));
const writeJson = (p, o) => fs.writeFileSync(p, JSON.stringify(o, null, 2) + '\n');

async function refreshAccessToken() {
  if (!fs.existsSync(TOKEN_PATH)) throw new Error('No ' + TOKEN_PATH + ' - run gas-auth.js first.');
  const secret = readJson(CLIENT_SECRET_PATH).installed;
  const token = readJson(TOKEN_PATH);
  const res = await fetch('https://oauth2.googleapis.com/token', {
    method: 'POST',
    headers: { 'Content-Type': 'application/x-www-form-urlencoded' },
    body: new URLSearchParams({
      client_id: secret.client_id,
      client_secret: secret.client_secret,
      refresh_token: token.refresh_token,
      grant_type: 'refresh_token',
    }),
  });
  if (!res.ok) throw new Error('Sign-in expired or revoked (' + res.status + '). Run gas-auth.js again.');
  const fresh = await res.json();
  token.access_token = fresh.access_token;
  token.expires_in = fresh.expires_in;
  writeJson(TOKEN_PATH, token);
  return fresh.access_token;
}

async function api(accessToken, method, url, body) {
  const res = await fetch(url, {
    method,
    headers: { Authorization: 'Bearer ' + accessToken, 'Content-Type': 'application/json' },
    body: body ? JSON.stringify(body) : undefined,
  });
  const text = await res.text();
  if (!res.ok) {
    if (/not enabled the Apps Script API/i.test(text)) {
      throw new Error('Turn on the Apps Script API for your account at https://script.google.com/home/usersettings and run again.');
    }
    throw new Error(method + ' ' + url + ' -> ' + res.status + ' ' + text.slice(0, 400));
  }
  return text ? JSON.parse(text) : {};
}

function loadSource() {
  if (!fs.existsSync(SRC_DIR)) throw new Error('No gas/ folder here. Run this inside your project folder.');
  const files = [];
  for (const name of fs.readdirSync(SRC_DIR)) {
    const full = path.join(SRC_DIR, name);
    if (!fs.statSync(full).isFile()) continue;
    const source = fs.readFileSync(full, 'utf8');
    if (name === 'appsscript.json') files.push({ name: 'appsscript', type: 'JSON', source });
    else if (name.endsWith('.gs')) files.push({ name: name.replace(/\.gs$/, ''), type: 'SERVER_JS', source });
    else if (name.endsWith('.html')) files.push({ name: name.replace(/\.html$/, ''), type: 'HTML', source });
  }
  if (!files.some((f) => f.name === 'appsscript')) throw new Error('gas/appsscript.json is required (the manifest).');
  return files;
}

(async () => {
  if (!fs.existsSync(CONFIG_PATH)) throw new Error('No gas.json here. Create one: {"title": "My Script"}');
  const config = readJson(CONFIG_PATH);
  if (!config.title) throw new Error('gas.json needs a "title".');
  const accessToken = await refreshAccessToken();

  if (!config.scriptId) {
    console.log('Creating Apps Script project "%s"...', config.title);
    const created = await api(accessToken, 'POST', API + '/projects', { title: config.title });
    config.scriptId = created.scriptId;
    writeJson(CONFIG_PATH, config);
  } else {
    console.log('Updating existing project %s', config.scriptId);
  }

  const files = loadSource();
  await api(accessToken, 'PUT', API + '/projects/' + config.scriptId + '/content', { files });
  config.lastPushedAt = new Date().toISOString();
  config.editorUrl = 'https://script.google.com/d/' + config.scriptId + '/edit';
  writeJson(CONFIG_PATH, config);

  console.log('Pushed %d file(s): %s', files.length, files.map((f) => f.name).join(', '));
  console.log('Open it: %s', config.editorUrl);
})().catch((err) => {
  console.error('push failed: ' + err.message);
  process.exit(1);
});