NVIDIA · hunglp6d · Jun 29, 2026 · Jun 30, 2026 · Jun 30, 2026 · Jul 1, 2026
diff --git a/ci/reviewed-npm-lifecycle-allowlist.json b/ci/reviewed-npm-lifecycle-allowlist.json
@@ -5,6 +5,7 @@
     "@openclaw/brave-plugin@2026.6.10",
     "@openclaw/diagnostics-otel@2026.6.10",
     "@openclaw/discord@2026.6.10",
+    "@openclaw/googlechat@2026.6.10",
     "@openclaw/msteams@2026.6.10",
     "@openclaw/slack@2026.6.10",
     "@openclaw/whatsapp@2026.6.10",

diff --git a/docs/index.yml b/docs/index.yml
@@ -215,6 +215,9 @@ navigation:
                   - page: "Set Up Slack"
                     path: _build/agent-variants/manage-sandboxes/set-up-slack.openclaw.generated.mdx
                     slug: set-up-slack
+                  - page: "Set Up Google Chat"
+                    path: manage-sandboxes/set-up-google-chat.mdx
+                    slug: set-up-google-chat
                   - page: "Set Up WeChat"
                     path: _build/agent-variants/manage-sandboxes/set-up-wechat.openclaw.generated.mdx
                     slug: set-up-wechat

diff --git a/docs/manage-sandboxes/add-channels-after-onboarding.mdx b/docs/manage-sandboxes/add-channels-after-onboarding.mdx
@@ -32,13 +32,28 @@ $$nemoclaw my-assistant channels add whatsapp
 $$nemoclaw my-assistant channels add teams
 ```
 
+<AgentOnly variant="openclaw">
+Add experimental Google Chat through its interactive enrollment flow:
+
+```bash
+$$nemoclaw my-assistant channels add googlechat
+```
+
+Refer to [Set Up Google Chat](set-up-google-chat) before running the command.
+</AgentOnly>
+
 `channels add` accepts mixed-case input such as `Telegram`, then stores and prints the canonical lowercase name.
 It collects the inputs the channel needs, registers bridge providers with the OpenShell gateway when it captures tokens, records the channel in the sandbox registry, and asks whether to rebuild immediately.
 
 Telegram, Discord, Slack, and Microsoft Teams prompt for credentials and configuration.
 WeChat runs an interactive host-side QR scan.
 WhatsApp collects no token because pairing happens inside the rebuilt sandbox.
 
+<AgentOnly variant="openclaw">
+Google Chat prompts for a service-account JSON key and pauses while you configure its public webhook endpoint.
+It cannot be added non-interactively.
+</AgentOnly>
+
 ## Apply Policy and Rebuild
 
 `channels add` requires the matching built-in network policy preset YAML.

diff --git a/docs/manage-sandboxes/enable-channels-during-onboarding.mdx b/docs/manage-sandboxes/enable-channels-during-onboarding.mdx
@@ -9,13 +9,21 @@ keywords: ["nemoclaw onboard messaging", "messaging channel picker", "channel en
 content:
   type: "how_to"
 ---
+import { AgentOnly } from "../_components/AgentGuide";
+
 Enable channels during onboarding when you are creating or recreating a sandbox.
 
 ## Use the Interactive Picker
 
 When the wizard reaches **Messaging channels**, it lists Telegram, Discord, Slack, WeChat, WhatsApp, and Microsoft Teams when the selected agent supports them.
 Press a channel number to toggle it on or off, then press **Enter** when done.
 
+<AgentOnly variant="openclaw">
+The OpenClaw picker also lists experimental Google Chat.
+Google Chat enrollment is interactive because you must set and confirm the public HTTP endpoint in Google Cloud Console.
+Refer to [Set Up Google Chat](set-up-google-chat) before selecting it.
+</AgentOnly>
+
 If you select no channels, pressing **Enter** skips messaging setup.
 If a token-based channel token is not already in the environment or credential store, the wizard prompts for it and saves it.
 
@@ -56,6 +64,11 @@ This release does not support non-interactive WeChat configuration because the i
 Run `$$nemoclaw onboard` interactively when you want to enable WeChat.
 For non-interactive WhatsApp selection, set `WHATSAPP_ALLOWED_IDS` to a nonempty comma-separated sender list.
 
+<AgentOnly variant="openclaw">
+Google Chat also requires interactive enrollment.
+NemoClaw skips it in non-interactive mode even when you supply its environment variables.
+</AgentOnly>
+
 ## Run Onboarding
 
 ```bash

diff --git a/docs/manage-sandboxes/manage-messaging-channels.mdx b/docs/manage-sandboxes/manage-messaging-channels.mdx
@@ -21,6 +21,11 @@ Rebuild the sandbox after the update so the image reflects the current channel s
 For WeChat, the cached-token shortcut applies.
 Remove WeChat first when you intend to acquire a fresh account through a new QR scan.
 
+<AgentOnly variant="openclaw">
+For Google Chat, re-add the channel and paste the replacement service-account JSON.
+NemoClaw updates the gateway-side refresh material, and the sandbox continues to receive only gateway-minted access tokens.
+</AgentOnly>
+
 For detailed token rotation procedures, refer to [Credential Rotation](../../security/credential-rotation).
 
 ## Remove a Channel
@@ -36,6 +41,11 @@ $$nemoclaw my-assistant channels remove teams
 `channels remove wechat` clears the bot token, deletes the `<sandbox>-wechat-bridge` provider, and removes `wechat` from the enabled-channel set.
 The next rebuild omits WeChat configuration and per-account state files.
 
+<AgentOnly variant="openclaw">
+`channels remove googlechat` detaches and deletes the `<sandbox>-googlechat-bridge` provider before the rebuild removes Google Chat configuration and the matching policy preset.
+It also stops the dedicated cloudflared process and webhook proxy for that sandbox.
+</AgentOnly>
+
 For in-sandbox QR-paired channels such as WhatsApp, `channels remove` destructively clears the session directory before rebuild so stale auth files do not reconnect the channel.
 
 <AgentOnly variant="openclaw">
@@ -76,6 +86,12 @@ For WeChat, `channels stop wechat` followed by rebuild keeps the per-account sta
 A later `channels start wechat` plus rebuild revives the bridge against the same iLink account without a fresh QR scan.
 The bot token remains in the OpenShell provider across the stop and start cycle.
 
+<AgentOnly variant="openclaw">
+Google Chat stop and start cycles also preserve the bridge provider and its gateway-side refresh material.
+They preserve the dedicated public webhook endpoint so the Google Cloud configuration can keep the same URL.
+The next rebuild reuses that provider without requiring the service-account JSON again.
+</AgentOnly>
+
 When `channels start` re-enables a channel, NemoClaw reapplies the matching built-in policy preset before rebuild.
 If policy restoration fails, the command keeps the channel disabled and exits without rebuilding into a partially active state.
 

diff --git a/docs/manage-sandboxes/messaging-channels.mdx b/docs/manage-sandboxes/messaging-channels.mdx
@@ -3,9 +3,9 @@
 # SPDX-License-Identifier: Apache-2.0
 title: "Choose Messaging Channels"
 sidebar-title: "Choose Messaging Channels"
-description: "Compare the supported Telegram, Discord, Slack, WeChat, WhatsApp, and Microsoft Teams messaging paths."
+description: "Compare the supported messaging paths, including experimental Google Chat for OpenClaw."
 description-agent: "Compares supported and experimental messaging channels, their credential or pairing requirements, and their NemoClaw runtime boundaries. Use when choosing a channel for OpenClaw or Hermes."
-keywords: ["nemoclaw messaging channels", "telegram", "discord", "slack", "wechat", "whatsapp", "microsoft teams"]
+keywords: ["nemoclaw messaging channels", "telegram", "discord", "slack", "google chat", "wechat", "whatsapp", "microsoft teams"]
 content:
   type: "concept"
 skill:
@@ -14,6 +14,7 @@ skill:
 import { AgentOnly } from "../_components/AgentGuide";
 
 NemoClaw supports Telegram, Discord, Slack, WeChat, WhatsApp, and Microsoft Teams for OpenClaw and Hermes sandboxes.
+Google Chat is available for OpenClaw sandboxes only.
 OpenShell-managed processes and gateway resources carry channel traffic.
 
 For token-based channels, NemoClaw registers credentials with OpenShell providers.
@@ -25,10 +26,10 @@ Microsoft Teams uses Bot Framework credentials plus a public HTTPS webhook that
 NemoClaw writes the selected channel configuration into the sandbox image and keeps runtime delivery under OpenShell control.
 
 <Warning title="Experimental Channels">
-WeChat, WhatsApp, and Microsoft Teams are experimental.
+Google Chat, WeChat, WhatsApp, and Microsoft Teams are experimental.
 WeChat and WhatsApp rely on QR-based pairing flows that are more fragile than token-based bots.
 
-Microsoft Teams requires an externally reachable webhook path that depends on your host networking setup.
+Google Chat and Microsoft Teams require externally reachable webhook paths that depend on your host networking setup.
 Interfaces, defaults, and supported features can change, and NVIDIA does not recommend these channels for production use.
 </Warning>
 
@@ -43,6 +44,11 @@ Interfaces, defaults, and supported features can change, and NVIDIA does not rec
 | WhatsApp | In-sandbox QR pairing | Hermes sender allowlist and non-interactive channel selection | [Set Up WhatsApp](set-up-whatsapp) |
 | Microsoft Teams | `MSTEAMS_APP_ID`, `MSTEAMS_APP_PASSWORD`, `MSTEAMS_TENANT_ID` | User allowlist, webhook port, mention mode | [Set Up Microsoft Teams](set-up-microsoft-teams) |
 
+<AgentOnly variant="openclaw">
+Google Chat requires a service-account JSON key and a public HTTPS endpoint for the OpenClaw webhook.
+Refer to [Set Up Google Chat](set-up-google-chat) for the interactive tunnel, audience, and account-principal flow.
+</AgentOnly>
+
 ## Prepare the Host and Policy
 
 - Use a machine where you can run `$$nemoclaw onboard`.

diff --git a/docs/manage-sandboxes/set-up-google-chat.mdx b/docs/manage-sandboxes/set-up-google-chat.mdx
@@ -0,0 +1,112 @@
+---
+# SPDX-FileCopyrightText: Copyright (c) 2026 NVIDIA CORPORATION & AFFILIATES. All rights reserved.
+# SPDX-License-Identifier: Apache-2.0
+title: "Set Up Google Chat"
+sidebar-title: "Set Up Google Chat"
+description: "Configure the experimental Google Chat webhook, service account, access controls, and OpenShell credential boundary for OpenClaw."
+description-agent: "Explains the experimental OpenClaw-only Google Chat setup, including its interactive public webhook flow, service-account key, audience, DM allowlist, personal-account principal discovery, and gateway-minted outbound token. Use before enabling Google Chat."
+keywords: ["nemoclaw google chat", "google chat api bot", "google chat webhook", "google chat service account"]
+content:
+  type: "how_to"
+---
+Google Chat support is experimental and available only for OpenClaw sandboxes.
+It receives events at `/googlechat` on the OpenClaw dashboard port and sends replies through the Google Chat API.
+
+<Warning title="Webhook Only">
+The automatic public endpoint accepts only `POST /googlechat` and denies dashboard, health, WebSocket, and other control paths.
+Continue to open the Control UI through `http://127.0.0.1:18789`; the Google Chat URL is not a dashboard URL.
+</Warning>
+
+## Prepare the Google Cloud Configuration
+
+Prepare the Google Cloud resources before you enable the channel.
+
+- Enable the Google Chat API and configure the Chat app that the sandbox will run.
+- Create a service account and download a JSON key.
+- Minify the service-account JSON to one line before you paste it at the `GOOGLECHAT_SERVICE_ACCOUNT` prompt.
+- Choose an HTTP endpoint connection in **Google Chat API** > **Configuration** > **Connection settings**.
+
+Keep the JSON key available on the trusted host during enrollment.
+Do not copy it into the sandbox or its OpenClaw configuration.
+
+## Prepare the Public Webhook
+
+The default `app-url` audience flow starts a dedicated cloudflared service in front of a loopback-only webhook proxy.
+The proxy forwards only `POST /googlechat` to OpenClaw and limits webhook request bodies to 1 MiB.
+It is separate from `nemoclaw tunnel start`, which remains the explicit full-dashboard tunnel command.
+Install `cloudflared` on the host before enrollment when you do not already have a public endpoint.
+
+When the dedicated Google Chat tunnel is not running, NemoClaw starts it and prints the exact HTTPS endpoint ending in `/googlechat`.
+Copy that complete URL into the Google Chat API HTTP endpoint field without adding a trailing slash, then confirm the prompt.
+NemoClaw stops the dedicated tunnel and webhook proxy if you do not confirm the endpoint or if enrollment fails before confirmation.
+
+If `GOOGLECHAT_AUDIENCE` already contains the public webhook URL, NemoClaw uses it and does not start or change cloudflared.
+That operator-managed endpoint must preserve `/googlechat` and deny every other dashboard or control path before forwarding to OpenClaw.
+
+Google Chat enrollment always requires an interactive terminal.
+NemoClaw skips the channel when `NEMOCLAW_NON_INTERACTIVE=1`, even if you provide the audience and service-account environment variables.
+
+## Configure Access
+
+Leave `GOOGLECHAT_ALLOWED_USERS` empty to use OpenClaw's manual DM pairing flow.
+To use an allowlist, set it to comma-separated Google Chat user IDs such as `users/123456789`, not email addresses.
+Google Chat email addresses do not match this ID-based allowlist.
+
+Google Workspace accounts do not need `GOOGLECHAT_APP_PRINCIPAL`.
+Leave that prompt empty unless you use a personal or standalone Google account.
+
+## Enable Google Chat
+
+For a new sandbox, run `nemoclaw onboard` and select Google Chat in the messaging picker.
+For an existing OpenClaw sandbox, run:
+
+```bash
+nemoclaw my-assistant channels add googlechat
+```
+
+Follow the prompts to confirm the public endpoint, paste the service-account JSON, configure access, and rebuild the sandbox.
+NemoClaw applies the `googlechat` network policy preset and registers a sandbox-scoped `<sandbox>-googlechat-bridge` provider with OpenShell.
+
+OpenShell uses the service-account key as gateway-side refresh material to mint short-lived tokens with the `chat.bot` scope.
+NemoClaw passes the private key to the OpenShell command through an ephemeral child-process environment value, not through a command-line argument.
+The service-account private key does not enter the sandbox, and the OpenShell proxy inserts the minted bearer token into allowed requests to `chat.googleapis.com`.
+
+The channel policy permits Node.js to read the Google Chat REST API and to create, update, or delete messages under the `/v1/spaces/` tree.
+It also permits Node.js GET requests to any path on `www.googleapis.com` because the Google authentication library controls the public certificate URL used to verify inbound event tokens.
+
+## Complete Personal Account Discovery
+
+Personal or standalone Google accounts need the add-on's numeric app principal.
+This value is a Google-assigned numeric ID, not an email address.
+
+If you do not know the value, leave `GOOGLECHAT_APP_PRINCIPAL` empty during the first enrollment, then start the rebuilt sandbox and follow these steps:
+
+1. Watch the OpenClaw logs for the discovery message.
+
+   ```bash
+   nemoclaw my-assistant logs --follow | grep "unexpected add-on principal"
+   ```
+
+2. Send one direct message to the bot.
+   The bot does not reply during this discovery attempt.
+
+3. Copy the numeric value from `unexpected add-on principal: <value>`.
+
+4. Re-add the channel with the value and accept the rebuild prompt.
+
+   ```bash
+   GOOGLECHAT_APP_PRINCIPAL="<numeric-id>" nemoclaw my-assistant channels add googlechat
+   ```
+
+The re-add flow prompts for the service-account JSON again when it is not already present in the current host environment.
+
+## Verify the Channel
+
+After the rebuild, send a direct message from an allowed or paired account and confirm that OpenClaw replies.
+If the webhook returns an error, verify that the public endpoint still ends in `/googlechat`, the dedicated tunnel and webhook proxy are running, and the Google Chat API configuration contains the exact same URL.
+
+Use the host-side `channels stop`, `channels start`, and `channels remove` commands to manage the integration.
+`channels stop googlechat` leaves the dedicated endpoint running so `channels start googlechat` can keep the same Google Cloud endpoint URL.
+`channels remove googlechat` and `nemoclaw <name> destroy` stop the dedicated cloudflared process and webhook proxy.
+`nemoclaw tunnel stop` does not stop the dedicated Google Chat endpoint; it controls the separate full-dashboard tunnel.
+Refer to [Manage Messaging Channels](manage-messaging-channels) for lifecycle behavior.
diff --git a/src/lib/actions/sandbox/destroy.ts b/src/lib/actions/sandbox/destroy.ts
@@ -61,6 +61,7 @@ export type CleanupSandboxServicesDeps = {
   unloadOllamaModels?: () => void;
   runOpenshell?: RunOpenshell;
   rmSync?: typeof fs.rmSync;
+  stopGooglechatWebhookTunnel?: (sandboxName: string) => string;
 };
 
 type ShieldsTimerNeutralizeResult = {
@@ -137,6 +138,13 @@ export function cleanupSandboxServices(
       return runtime.runOpenshell(args, opts);
     });
   const rmSync = deps.rmSync ?? fs.rmSync;
+  const stopGooglechatWebhookTunnel =
+    deps.stopGooglechatWebhookTunnel ??
+    ((name: string) => {
+      const lifecycle =
+        require("../../tunnel/googlechat-webhook-lifecycle") as typeof import("../../tunnel/googlechat-webhook-lifecycle");
+      return lifecycle.stopGooglechatWebhookTunnel(name);
+    });
 
   if (stopHostServices) {
     // `stopAll()` already runs `unloadOllamaModels()` unconditionally —
@@ -152,6 +160,14 @@ export function cleanupSandboxServices(
     }
   }
 
+  let googlechatServicesPidDir = `${servicesPidDir}-googlechat`;
+  try {
+    googlechatServicesPidDir = stopGooglechatWebhookTunnel(validatedSandboxName);
+  } catch (error) {
+    const message = error instanceof Error ? error.message : String(error);
+    console.warn(`  ${YW}⚠${R} Failed to stop Google Chat webhook tunnel: ${message}`);
+  }
+
   try {
     rmSync(servicesPidDir, {
       recursive: true,
@@ -160,6 +176,14 @@ export function cleanupSandboxServices(
   } catch {
     // PID directory may not exist — ignore.
   }
+  try {
+    rmSync(googlechatServicesPidDir, {
+      recursive: true,
+      force: true,
+    });
+  } catch {
+    // Dedicated Google Chat service directory may not exist — ignore.
+  }
 
   // Delete every per-sandbox messaging and search provider created during
   // onboard. Suppress stderr so "! Provider not found" noise doesn't appear

diff --git a/src/lib/actions/sandbox/policy-channel-dependencies.ts b/src/lib/actions/sandbox/policy-channel-dependencies.ts
@@ -24,6 +24,7 @@ type LegacyOnboardProvidersModule = {
 };
 
 type RebuildModule = typeof import("./rebuild");
+type GooglechatWebhookLifecycleModule = typeof import("../../tunnel/googlechat-webhook-lifecycle");
 
 /**
  * Injectable, late-bound boundary around provider registration and rebuild
@@ -47,4 +48,9 @@ export const policyChannelDependencies = {
     const rebuild = require("./rebuild") as RebuildModule;
     return rebuild.rebuildSandbox(sandboxName, args);
   },
+  stopGooglechatWebhookTunnel(sandboxName: string): void {
+    const lifecycle =
+      require("../../tunnel/googlechat-webhook-lifecycle") as GooglechatWebhookLifecycleModule;
+    lifecycle.stopGooglechatWebhookTunnel(sandboxName);
+  },
 };