fix(kiloclaw): google setup improvements

[iscekic]

Summary

• ToS error detection: Use case-insensitive /terms/i regex instead of brittle includes('Terms of Service') for GCP project creation error handling
• userId slash handling: encodeURIComponent() for push endpoint/audience URLs and regex sanitization for Pub/Sub subscription names, preventing breakage when user IDs contain /
• Auto-enable gmail notifications: updateGoogleCredentials now sets gmailNotificationsEnabled: true upon connecting a Google account (disconnect already resets to false)
• TOOLS.md gog section: Idempotently appends a Google Workspace section to TOOLS.md in start-openclaw.sh when KILOCLAW_GOG_CONFIG_TARBALL is set, so the openclaw agent knows gog is available

Test plan

• All 804 kiloclaw tests pass
• Verify OIDC audience percent-encoding is preserved by Google Pub/Sub before deploying userId slash fix to production (see commit message for details)
• Deploy to dev and run google-setup end-to-end

[kilo-code-bot]

Code Review Summary

Status: 1 Issue Found | Recommendation: Address before merge

Overview

Severity	Count
CRITICAL	0
WARNING	1
SUGGESTION	0

Issue Details (click to expand)

WARNING

File	Line	Issue
kiloclaw/src/durable-objects/kiloclaw-instance/index.ts	474	Unconditionally re-enables Gmail notifications when storing credentials, even when the setup flow could not configure push notifications.

Fix these issues in Kilo Cloud

Other Observations (not in diff)

N/A

Files Reviewed (5 files)

• cloudflare-gmail-push/src/routes/push.ts - 0 issues
• kiloclaw/google-setup/setup.mjs - 0 issues
• kiloclaw/src/durable-objects/kiloclaw-instance.test.ts - 0 issues
• kiloclaw/src/durable-objects/kiloclaw-instance/index.ts - 1 issue
• kiloclaw/start-openclaw.sh - 0 issues

---

_{Reviewed by gpt-5.4-20260305 · 682,632 tokens}