gws is a production-grade Rust CLI for driving Google Workspace APIs (Gmail, Drive, Calendar, Sheets, Docs, Chat, Tasks, Classroom, Admin, and more). Its defining architectural bet is dynamic command generation: instead of shipping generated API client crates, it fetches Google's Discovery Service JSON at runtime, builds a clap command tree from the schema, and executes generic HTTP calls against resolved endpoints. A two-phase argument parse extracts the service name first, then re-parses with the dynamically constructed command set, keeping the entire Google API surface reachable without codegen. The repo is a Cargo workspace split into a reusable library crate (google-workspace: discovery models, validation, HTTP client) and the CLI binary crate, and is distributed via crates.io, npm (binary downloader), GitHub Releases, and Nix. Beyond raw API calls, a helper-command system (`+send`, `+upload`, `+agenda`, `+triage`) is implemented through a `Helper` trait that injects subcommands for multi-step workflows — MIME construction for Gmail, streaming multipart uploads for Drive, calendar agenda assembly, and cross-service orchestrations. Authentication supports interactive OAuth2 login, service accounts, pre-obtained tokens, and Application Default Credentials, with credentials encrypted at rest (AES-256-GCM) in an OS keyring or file fallback. A ratatui-based interactive setup wizard bootstraps a GCP project, enables APIs, and configures OAuth consent via gcloud. Output is structured (JSON/table/YAML/CSV/NDJSON) with stable, documented exit codes, making it suitable for both shell scripting and LLM tool calling. The repository also functions as an AI-agent integration layer: it ships 100+ SKILL.md files (per-service references, multi-step recipes, role-based personas) plus TOML registries defining personas and recipes, with a generator that produces skill documentation from CLI metadata. An experimental Model Armor integration sanitizes prompts and responses for prompt-injection attacks. Engineering quality is high throughout: extensive unit tests (several hundred cases, including security-focused edge cases), CI covering 7 build targets with real-credential API smoke tests, cargo-deny dependency auditing, changeset-based automated releases, and a Nix flake for reproducible builds. Notable risks: the entire command surface depends on Google's Discovery Documents staying available and compatible; the Gmail helper module is ~3000 lines and approaching a maintainability ceiling; two divergent OAuth implementations (yup-oauth2 fast path vs proxy-aware reqwest fallback) add maintenance burden; 15+ environment variables increase configuration complexity; and hardcoded API lists in setup tooling must be manually updated as Google adds services. These are real but moderate concerns in an otherwise well-architected, actively maintained codebase.