$ show googleworkspace/cli
gws is a production-grade Rust CLI for driving Google Workspace APIs (Gmail, Drive, Calendar, Sheets, Docs, Chat, Tasks, Classroom, Admin, and more). Its defining architectural bet is dynamic command generation: instead of shipping generated API client crates, it fetches Google's Discovery Service JSON at runtime, builds a clap command tree from the schema, and executes generic HTTP calls against resolved endpoints. A two-phase argument parse extracts the service name first, then re-parses with the dynamically constructed command set, keeping the entire Google API surface reachable without codegen. The repo is a Cargo workspace split into a reusable library crate (google-workspace: discovery models, validation, HTTP client) and the CLI binary crate, and is distributed via crates.io, npm (binary downloader), GitHub Releases, and Nix. Beyond raw API calls, a helper-command system (`+send`, `+upload`, `+agenda`, `+triage`) is implemented through a `Helper` trait that injects subcommands for multi-step workflows — MIME construction for Gmail, streaming multipart uploads for Drive, calendar agenda assembly, and cross-service orchestrations. Authentication supports interactive OAuth2 login, service accounts, pre-obtained tokens, and Application Default Credentials, with credentials encrypted at rest (AES-256-GCM) in an OS keyring or file fallback. A ratatui-based interactive setup wizard bootstraps a GCP project, enables APIs, and configures OAuth consent via gcloud. Output is structured (JSON/table/YAML/CSV/NDJSON) with stable, documented exit codes, making it suitable for both shell scripting and LLM tool calling. The repository also functions as an AI-agent integration layer: it ships 100+ SKILL.md files (per-service references, multi-step recipes, role-based personas) plus TOML registries defining personas and recipes, with a generator that produces skill documentation from CLI metadata. An experimental Model Armor integration sanitizes prompts and responses for prompt-injection attacks. Engineering quality is high throughout: extensive unit tests (several hundred cases, including security-focused edge cases), CI covering 7 build targets with real-credential API smoke tests, cargo-deny dependency auditing, changeset-based automated releases, and a Nix flake for reproducible builds. Notable risks: the entire command surface depends on Google's Discovery Documents staying available and compatible; the Gmail helper module is ~3000 lines and approaching a maintainability ceiling; two divergent OAuth implementations (yup-oauth2 fast path vs proxy-aware reqwest fallback) add maintenance burden; 15+ environment variables increase configuration complexity; and hardcoded API lists in setup tooling must be manually updated as Google adds services. These are real but moderate concerns in an otherwise well-architected, actively maintained codebase.
The LLM identified 6 files worth highlighting for reuse:
Self-contained security validation module preventing path traversal (safe file/dir path checks), rejecting dangerous Unicode, validating resource names, and URL-encoding path segments. Solves recurring input-safety problems and can be dropped into any Rust project handling user-supplied filenames or Google API resource identifiers with minimal modification.
AES-256-GCM encrypted OAuth2 token storage implementing the yup-oauth2 TokenStorage trait, with OS keyring or file-based key management, atomic writes, and race-safe key generation. Demonstrates the secure-credential-persistence pattern; extracting it into another Rust OAuth2 client is straightforward and it is already trait-compatible with the ecosystem.
Atomic file write helpers (sync and async) using O_EXCL and 0600 permissions to prevent corruption and symlink attacks. A drop-in utility for any Rust application persisting credentials, caches, or state files — small, isolated, and free of internal dependencies.
Executes API calls built entirely from Discovery Document schemas: RFC 6570 URL template rendering with '{+var}' expansion, streaming multipart/related body construction with pre-computed Content-Length, recursive JSON schema validation, pagination control, retry logic, and binary response handling. Demonstrates a reusable schema-driven HTTP client pattern applicable to any discovery-based API ecosystem.
Complete serde models for Google Discovery Service documents plus an async fetch layer with TTL-based caching and fallback URLs. Extracting this module gives any Rust project typed access to the entire Google API surface description without generated client crates — the foundation of the CLI's dynamic command generation.
A generic ratatui/crossterm multi-select picker with vim keys, readonly interdependent options, and a step-progress setup wizard (picker/input/finish states). Framework-agnostic UI pattern that could be extracted into a standalone Rust TUI component — notably more polished than typical one-off scaffolding.