gog is a comprehensive, production-grade CLI tool for Google Workspace automation that unifies 20+ Google services (Gmail, Calendar, Drive, Docs, Sheets, Slides, Forms, Meet, Chat, Contacts, Tasks, Classroom, YouTube, Analytics, Search Console, Admin, Groups, Keep, Photos, Maps, Apps Script) into a single binary. It excels at task-first workflows: searching and sanitizing mail, resolving calendar names, auditing Drive sharing, editing Docs, appending Sheet tables, building Slides from Markdown, managing Workspace users, and performing encrypted backups. The architecture is a modular monolith with clean internal package boundaries for each service domain. Key entry points are cmd/gog/main.go and the Kong-based command tree in internal/cmd. Primary data flows: command invocation -> account/client resolution -> authenticated Google API client creation -> API execution -> structured output (JSON, plain TSV, or human-readable tables). External dependencies include Google APIs, OAuth2, keyring backends (macOS Keychain, Windows Credential Manager, Linux Secret Service, encrypted file), MCP for agent integration, and age encryption for backups. The codebase demonstrates exceptional craftsmanship in cross-platform secret storage, Gmail push notification processing, sed-style Docs editing with UTF-16 index tracking, atomic Docs request batching, encrypted backup with Git shard checkpointing, email open tracking with versioned key rotation and bot detection, and build-time safety profile compilation to hash-based allow/deny switches. Active development with recent commits, comprehensive test coverage (unit + integration + live tests), and modern dependency versions.
gws is a production-grade Rust CLI for driving Google Workspace APIs (Gmail, Drive, Calendar, Sheets, Docs, Chat, Tasks, Classroom, Admin, and more). Its defining architectural bet is dynamic command generation: instead of shipping generated API client crates, it fetches Google's Discovery Service JSON at runtime, builds a clap command tree from the schema, and executes generic HTTP calls against resolved endpoints. A two-phase argument parse extracts the service name first, then re-parses with the dynamically constructed command set, keeping the entire Google API surface reachable without codegen. The repo is a Cargo workspace split into a reusable library crate (google-workspace: discovery models, validation, HTTP client) and the CLI binary crate, and is distributed via crates.io, npm (binary downloader), GitHub Releases, and Nix. Beyond raw API calls, a helper-command system (`+send`, `+upload`, `+agenda`, `+triage`) is implemented through a `Helper` trait that injects subcommands for multi-step workflows — MIME construction for Gmail, streaming multipart uploads for Drive, calendar agenda assembly, and cross-service orchestrations. Authentication supports interactive OAuth2 login, service accounts, pre-obtained tokens, and Application Default Credentials, with credentials encrypted at rest (AES-256-GCM) in an OS keyring or file fallback. A ratatui-based interactive setup wizard bootstraps a GCP project, enables APIs, and configures OAuth consent via gcloud. Output is structured (JSON/table/YAML/CSV/NDJSON) with stable, documented exit codes, making it suitable for both shell scripting and LLM tool calling. The repository also functions as an AI-agent integration layer: it ships 100+ SKILL.md files (per-service references, multi-step recipes, role-based personas) plus TOML registries defining personas and recipes, with a generator that produces skill documentation from CLI metadata. An experimental Model Armor integration sanitizes prompts and responses for prompt-injection attacks. Engineering quality is high throughout: extensive unit tests (several hundred cases, including security-focused edge cases), CI covering 7 build targets with real-credential API smoke tests, cargo-deny dependency auditing, changeset-based automated releases, and a Nix flake for reproducible builds. Notable risks: the entire command surface depends on Google's Discovery Documents staying available and compatible; the Gmail helper module is ~3000 lines and approaching a maintainability ceiling; two divergent OAuth implementations (yup-oauth2 fast path vs proxy-aware reqwest fallback) add maintenance burden; 15+ environment variables increase configuration complexity; and hardcoded API lists in setup tooling must be manually updated as Google adds services. These are real but moderate concerns in an otherwise well-architected, actively maintained codebase.
Hermes is an open-source document management system developed by HashiCorp for creating, reviewing, approving, and publishing internal technical documents (RFCs, PRDs, FRDs). It provides a full-stack application with a Go REST API backend, an Ember.js web frontend, and a Microsoft Word add-in (React/Fluent UI) for editing document metadata directly in documents. The system supports dual content backends: Google Workspace (Drive, Docs, People API) and Microsoft SharePoint/Microsoft Graph, with file storage, permission management, and email notifications. Search is powered by Algolia with faceted filtering, and persistent storage uses PostgreSQL via GORM, though the architecture is in transition from Algolia as the primary data store to PostgreSQL. Authentication supports Google OAuth, Microsoft OAuth, and AWS ALB OIDC/Okta. The API exposes REST endpoints under `/api/v1/` and `/api/v2/` for documents, drafts, approvals, reviews, projects, people, products, and subscriptions. Key background processes include a document indexer that synchronizes file metadata to Algolia and a migration command to move data from Algolia to PostgreSQL. The Ember frontend provides a dashboard, document browsing with advanced search, project management, and settings. The Office add-in enables users to manage related resources, update document status, and edit custom fields without leaving Word. Externally, Hermes depends on Google Workspace APIs, Microsoft Graph API, Algolia, PostgreSQL, and optionally Datadog for tracing and Google Analytics for frontend metrics. It is configured via HCL files and environment variables, with Docker and Docker Compose support for local development. The project is in alpha stage and not an official HashiCorp product, but it is actively developed with CI/CD pipelines, extensive unit/integration tests (Go, Ember QUnit), and a comprehensive test harness using Mirage for the frontend.