gws — ratovarius fork

An independently maintained public fork of googleworkspace/cli. Built on the original project's work, with Google Docs reading, review, export, and credential-handling improvements under development on develop. main is the release baseline. Original authorship, history, and the Apache-2.0 license are preserved.

See what this fork adds and its upstream PRs, or contribute here. The initial upstream contribution is the credential-preservation fix. Other feature development continues in this fork. See the develop → main release flow.

One CLI for all of Google Workspace — built for humans and AI agents.
Drive, Gmail, Calendar, and every Workspace API. Zero boilerplate. Structured JSON output. 40+ agent skills included.

Note

This fork is maintained by ratovarius. It is not an officially supported Google product.

Install this fork from source · Report an issue

gws doesn't ship a static list of commands. It reads Google's own Discovery Service at runtime and builds its entire command surface dynamically. When Google Workspace adds an API endpoint or method, gws picks it up automatically.

Important

This project is under active development. Expect breaking changes as we march toward v1.0.

Contents

• Prerequisites
• Installation
• Quick Start
• Why gws?
• Authentication
• AI Agent Skills
• Advanced Usage
• Environment Variables
• Exit Codes
• Architecture
• Troubleshooting
• Development

Prerequisites

• Stable Rust and Cargo — to build this fork from source
• Python 3.10+ — for the optional Docs review and export companions (POSIX systems)
• A Google Cloud project — required for OAuth credentials. You can create one via the Google Cloud Console or with the gcloud CLI or with the gws auth setup command.
• A Google account with access to Google Workspace

Installation

Install the fork's release baseline from main:

cargo install --git https://github.com/ratovarius/googleworkspace-cli --branch main --locked google-workspace-cli

To try the unreleased Docs improvements and review companions, explicitly use --branch develop instead, or keep a development checkout:

git clone --branch develop https://github.com/ratovarius/googleworkspace-cli.git
cd googleworkspace-cli
cargo build --workspace --locked
export PATH="$PWD/target/debug:$PATH"

On develop, see examples/docs-review/README.md and examples/docs-review-bundle/README.md for their commands. Check command -v gws to confirm which installed binary your shell will use.

This initial fork publication provides source on GitHub. The upstream @googleworkspace/cli npm package, google-workspace-cli crates.io package, Homebrew package, and upstream releases install the original distribution and do not include fork-only improvements. For a reproducible source build, replace --branch main with --rev COMMIT_SHA using the fork commit you have reviewed.

Quick Start

gws auth setup     # walks you through Google Cloud project config
gws auth login     # subsequent OAuth login
gws drive files list --params '{"pageSize": 5}'

Why gws?

For humans — stop writing curl calls against REST docs. gws gives you --help on every resource, --dry-run to preview requests, and auto‑pagination.

For AI agents — every response is structured JSON. Pair it with the included agent skills and your LLM can manage Workspace without custom tooling.

# List the 10 most recent files
gws drive files list --params '{"pageSize": 10}'

# Create a spreadsheet
gws sheets spreadsheets create --json '{"properties": {"title": "Q1 Budget"}}'

# Send a Chat message
gws chat spaces messages create \
  --params '{"parent": "spaces/xyz"}' \
  --json '{"text": "Deploy complete."}' \
  --dry-run

# Introspect any method's request/response schema
gws schema drive.files.list

# Stream paginated results as NDJSON
gws drive files list --params '{"pageSize": 100}' --page-all | jq -r '.files[].name'

Discovery-generated API commands and gws docs +write support credential-free --dry-run: they validate inputs and display the request without obtaining a token, accessing the keyring, reading or changing stored credentials, or sending the API request.

# Preview a Docs append without signing in
gws docs +write --document DOC_ID --text 'Hello, world!' --dry-run

These previews work offline with a fresh cached Discovery schema (24-hour TTL). First use or an expired cache can still fetch the schema over the network. Other helpers may need authenticated reads to prepare their plans; this guarantee applies to raw API commands and docs +write.

Fields absent from Discovery

Raw API methods with a request body accept --allow-unknown-fields alongside --json. Use it explicitly when an API supports fields that its public Discovery document does not yet describe. It allows unknown properties recursively, including nested objects and array elements, and forwards their values unchanged. JSON is still parsed and serialized normally; whitespace and key order may change.

Validation remains strict by default. With the flag, known-field types, enums and required fields are still checked, as are JSON syntax, required URL parameters and file paths. It does not allow new enum values on a known field. The flag is local to raw methods and does not apply to handwritten + helpers.

For example, Docs suggestions and comments require a Cloud project enrolled in the Google Workspace Developer Preview Program. Google still enforces API availability, OAuth scopes, document permissions and server-side validation. This flag grants no additional access.

Docs suggestions

gws docs +suggest provides a guided workflow for Google Docs suggestions. It can insert text, replace one exact text run, propose a range deletion, list the structured document with suggestion context, and accept, reject, or delete an existing suggestion:

gws docs +suggest insert --document DOC_ID --text 'Suggested text'
gws docs +suggest replace --document DOC_ID --find 'old text' --text 'new text'
gws docs +suggest delete-text --document DOC_ID --start-index 10 --end-index 20
gws docs +suggest list --document DOC_ID
gws docs +suggest accept --document DOC_ID --suggestion-id SUGGESTION_ID

The helper applies the preview-only writeMode request fields internally, so these commands do not need --allow-unknown-fields. Suggestion writes remain subject to Google Workspace Developer Preview access and document permissions.

Reading comments and their text anchors

Use --include-comments with gws docs +read to retrieve comment threads and resolve each anchored range to the text it refers to:

gws docs +read --document DOC_ID --include-comments

Each comment includes its thread data, anchor ranges, and referencedText, an array with one value per anchored range. Unresolvable ranges are returned as null; comments remain opt-in because they may contain sensitive content.

Create a comment without manually constructing the preview API payload:

gws docs +comment create \
  --document DOC_ID \
  --text 'Please review this.' \
  --start-index 1 \
  --end-index 20

The helper validates that the indexes are non-negative and ordered, then leaves document-boundary and UTF-16 boundary validation to Google. It applies the preview-field opt-in internally, so --allow-unknown-fields is not required. The request still requires edit access and Google Workspace Developer Preview availability.

# Preview a suggested insertion (Docs Developer Preview).
gws docs documents batchUpdate \
  --params '{"documentId":"DOCUMENT_ID"}' \
  --json '{"requests":[{"insertText":{"location":{"index":1},"text":"Suggested text"}}],"writeControl":{"writeMode":"SUGGEST"}}' \
  --allow-unknown-fields --dry-run

# Preview a comment anchored to existing text; adjust the range for your document.
gws docs documents batchUpdate \
  --params '{"documentId":"DOCUMENT_ID"}' \
  --json '{"requests":[{"insertComment":{"content":"Please review this text.","range":{"startIndex":1,"endIndex":5}}}]}' \
  --allow-unknown-fields --dry-run

--dry-run uses the same validation policy and shows the request without sending it. It cannot verify preview enrollment or server acceptance. Remove --dry-run to submit a request. See the Docs request reference for preview field requirements.

Authentication

The CLI supports multiple auth workflows so it works on your laptop, in CI, and on a server.

Which setup should I use?

I have…	Use
gcloud installed and authenticated	gws auth setup (fastest)
A GCP project but no gcloud	Manual OAuth setup
An existing OAuth access token	GOOGLE_WORKSPACE_CLI_TOKEN
Existing Credentials	GOOGLE_WORKSPACE_CLI_CREDENTIALS_FILE

Interactive (local desktop)

Credentials are encrypted at rest (AES-256-GCM) with the key stored in your OS keyring (or ~/.config/gws/.encryption_key when GOOGLE_WORKSPACE_CLI_KEYRING_BACKEND=file).

gws auth setup       # one-time: creates a Cloud project, enables APIs, logs you in
gws auth login       # subsequent scope selection and login

gws auth setup requires the gcloud CLI. If you don't have gcloud, use the manual setup below instead.

Warning

Scope limits in testing mode: If your OAuth app is unverified (testing mode), Google limits consent to ~25 scopes. The recommended scope preset includes 85+ scopes and will fail for unverified apps (especially for @gmail.com accounts). Choose individual services instead to filter the scope picker:

gws auth login -s drive,gmail,sheets

Manual OAuth setup (Google Cloud Console)

Use this when gws auth setup cannot automate project/client creation, or when you want explicit control.

1. Open Google Cloud Console in the target project:
   • OAuth consent screen: https://console.cloud.google.com/apis/credentials/consent?project=<PROJECT_ID>
   • Credentials: https://console.cloud.google.com/apis/credentials?project=<PROJECT_ID>
2. Configure OAuth branding/audience if prompted:
   • App type: External (testing mode is fine)
3. Add your account under Test users
4. Create an OAuth client:
   • Type: Desktop app
5. Download the client JSON and save it to:
   • ~/.config/gws/client_secret.json

Important

You must add yourself as a test user. In the OAuth consent screen, click Test users → Add users and enter your Google account email. Without this, login will fail with a generic "Access blocked" error.

Then run:

gws auth login

Browser-assisted auth (human or agent)

You can complete OAuth either manually or with browser automation.

• Human flow: run gws auth login, open the printed URL, approve scopes.
• Agent-assisted flow: the agent opens the URL, selects account, handles consent prompts, and returns control once the localhost callback succeeds.

If consent shows "Google hasn't verified this app" (testing mode), click Continue. If scope checkboxes appear, select required scopes (or Select all) before continuing.

Headless / CI (export flow)

1. Complete interactive auth on a machine with a browser.
2. Export credentials:

   gws auth export --unmasked > credentials.json

3. On the headless machine:

   export GOOGLE_WORKSPACE_CLI_CREDENTIALS_FILE=/path/to/credentials.json
   gws drive files list   # just works

Service Account (server-to-server)

Point to your key file; no login needed.

export GOOGLE_WORKSPACE_CLI_CREDENTIALS_FILE=/path/to/service-account.json
gws drive files list

Pre-obtained Access Token

Useful when another tool (e.g. gcloud) already mints tokens for your environment.

export GOOGLE_WORKSPACE_CLI_TOKEN=$(gcloud auth print-access-token)

Precedence

Priority	Source	Set via
1	Access token	GOOGLE_WORKSPACE_CLI_TOKEN
2	Credentials file	GOOGLE_WORKSPACE_CLI_CREDENTIALS_FILE
3	Encrypted credentials	gws auth login
4	Plaintext credentials	~/.config/gws/credentials.json

Environment variables can also live in a .env file.

Troubleshooting saved credentials

If gws cannot read or decrypt credentials.enc (including a keyring access failure), it returns an authentication error and preserves that file, token_cache.json, and sa_token_cache.json. It does not silently switch to plaintext credentials or Application Default Credentials (ADC). This applies to the default configuration directory and GOOGLE_WORKSPACE_CLI_CONFIG_DIR.

Check that you are using the original configuration directory and can access its original OS keyring or encryption key. Back up the configuration before changing key storage or replacing credentials. Preservation does not recover a lost key. If you intentionally want to discard saved credentials and sign in again, use gws auth logout followed by gws auth login; logout still removes saved credentials and token caches.

An explicit GOOGLE_WORKSPACE_CLI_TOKEN or GOOGLE_WORKSPACE_CLI_CREDENTIALS_FILE still takes precedence. A missing or invalid explicit credentials file is an error. When no encrypted credentials file exists, the usual plaintext and ADC fallback remains available.

AI Agent Skills

The repo ships 100+ Agent Skills (SKILL.md files) — one for every supported API, plus higher-level helpers for common workflows and 50 curated recipes for Gmail, Drive, Docs, Calendar, and Sheets. See the full Skills Index for the complete list.

# Install all skills at once
npx skills add https://github.com/ratovarius/googleworkspace-cli

# Or pick only what you need
npx skills add https://github.com/ratovarius/googleworkspace-cli/tree/main/skills/gws-drive
npx skills add https://github.com/ratovarius/googleworkspace-cli/tree/main/skills/gws-gmail

OpenClaw setup

# Symlink all skills (stays in sync with repo)
ln -s $(pwd)/skills/gws-* ~/.openclaw/skills/

# Or copy specific skills
cp -r skills/gws-drive skills/gws-gmail ~/.openclaw/skills/

Install this fork using the source instructions above before using agent skills. An agent installer that uses the upstream npm package will install the original distribution.

Gemini CLI Extension

1. Authenticate the CLI first:

   gws auth setup

2. Install the extension into the Gemini CLI:

   gemini extensions install https://github.com/ratovarius/googleworkspace-cli

Installing this extension gives your Gemini CLI agent direct access to all gws commands and Google Workspace agent skills. Because gws handles its own authentication securely, you simply need to authenticate your terminal once prior to using the agent, and the extension will automatically inherit your credentials.

Advanced Usage

Multipart Uploads

gws drive files create --json '{"name": "report.pdf"}' --upload ./report.pdf

Output and upload file roots

--output and --upload accept paths within the current working directory (CWD) by default, including absolute paths that resolve inside CWD. To allow files elsewhere, set a trusted operator environment variable to an existing directory:

mkdir -p /tmp/gws-files
export GOOGLE_WORKSPACE_CLI_FILE_ROOT=/tmp/gws-files
gws drive files get --params '{"fileId":"FILE_ID","alt":"media"}' \
  --output /tmp/gws-files/report.pdf
gws drive files create --json '{"name":"report.pdf"}' \
  --upload /tmp/gws-files/report.pdf

The root replaces the allowed file boundary; relative CLI paths still resolve from CWD. For example, --output report.pdf is rejected if CWD is outside the configured root. The root is canonicalized and must exist as a directory; an empty or invalid value fails validation. Relative root settings resolve from CWD too. With an explicit root, CLI paths containing .. components are rejected. Control characters and symlinks escaping the boundary are rejected; symlinks resolving inside it are allowed, but dangling symlinks are rejected. These CLI file flags require a UTF-8 canonical path. If a symlink resolves to a path with unsupported encoding, the command returns a validation error rather than dropping the upload or selecting the default output file.

This setting affects only these file flags, not --dir or --output-dir. It does not create parent directories or change the default download filename when --output is omitted. Validation cannot prevent another local process from replacing a path component between validation and I/O; choose a root whose directories you control. Unset the variable to restore the CWD boundary.

Pagination

Flag	Description	Default
--page-all	Auto-paginate, one JSON line per page (NDJSON)	off
--page-limit <N>	Max pages to fetch	10
--page-delay <MS>	Delay between pages	100 ms

Google Sheets — Shell Escaping

Sheets ranges use ! which bash interprets as history expansion. Always wrap values in single quotes:

# Read cells A1:C10 from "Sheet1"
gws sheets spreadsheets values get \
  --params '{"spreadsheetId": "SPREADSHEET_ID", "range": "Sheet1!A1:C10"}'

# Append rows
gws sheets spreadsheets values append \
  --params '{"spreadsheetId": "ID", "range": "Sheet1!A1", "valueInputOption": "USER_ENTERED"}' \
  --json '{"values": [["Name", "Score"], ["Alice", 95]]}'

Helper Commands

Some services ship hand-crafted helper commands alongside the auto-generated Discovery surface. Helper commands are prefixed with + so they are visually distinct and never collide with Discovery-generated method names.

Time-aware helpers (+agenda, +standup-report, +weekly-digest, +meeting-prep) automatically use your Google account timezone (fetched from Calendar Settings API and cached for 24 hours). Override with --timezone/--tz on +agenda, or set the --timezone flag for explicit control.

Run gws <service> --help to see both Discovery methods and helper commands together.

gws gmail --help      # shows +send, +reply, +reply-all, +forward, +triage, +watch …
gws calendar --help   # shows +insert, +agenda …
gws drive --help      # shows +upload …

Full helper reference:

Service	Command	Description
gmail	+send	Send an email
gmail	+reply	Reply to a message (handles threading automatically)
gmail	+reply-all	Reply-all to a message
gmail	+forward	Forward a message to new recipients
gmail	+triage	Show unread inbox summary (sender, subject, date)
gmail	+watch	Watch for new emails and stream them as NDJSON
sheets	+append	Append a row to a spreadsheet
sheets	+read	Read values from a spreadsheet
docs	+write	Append text to a document
docs	+suggest	Create and manage document suggestions
docs	+comment	Create anchored document comments
chat	+send	Send a message to a space
drive	+upload	Upload a file with automatic metadata
calendar	+insert	Create a new event
calendar	+agenda	Show upcoming events (uses Google account timezone; override with --timezone)
script	+push	Replace all files in an Apps Script project with local files
workflow	+standup-report	Today's meetings + open tasks as a standup summary
workflow	+meeting-prep	Prepare for your next meeting: agenda, attendees, and linked docs
workflow	+email-to-task	Convert a Gmail message into a Google Tasks entry
workflow	+weekly-digest	Weekly summary: this week's meetings + unread email count
workflow	+file-announce	Announce a Drive file in a Chat space
events	+subscribe	Subscribe to Workspace events and stream them as NDJSON
events	+renew	Renew/reactivate Workspace Events subscriptions
modelarmor	+sanitize-prompt	Sanitize a user prompt through a Model Armor template
modelarmor	+sanitize-response	Sanitize a model response through a Model Armor template
modelarmor	+create-template	Create a new Model Armor template

Examples:

# Send an email
gws gmail +send --to alice@example.com --subject "Hello" --body "Hi there"

# Reply to a message
gws gmail +reply --message-id MESSAGE_ID --body "Thanks!"

# Append a row to a spreadsheet
gws sheets +append --spreadsheet SPREADSHEET_ID --values "Alice,95"

# Show today's calendar agenda
gws calendar +agenda

# Upload a file to Drive
gws drive +upload ./report.pdf --name "Q1 Report"

# Morning standup summary
gws workflow +standup-report

# Show today's agenda in a specific timezone
gws calendar +agenda --today --timezone America/New_York

Model Armor (Response Sanitization)

Integrate Google Cloud Model Armor to scan API responses for prompt injection before they reach your agent.

gws gmail users messages get --params '...' \
  --sanitize "projects/P/locations/L/templates/T"

Variable	Description
GOOGLE_WORKSPACE_CLI_SANITIZE_TEMPLATE	Default Model Armor template
GOOGLE_WORKSPACE_CLI_SANITIZE_MODE	warn (default) or block

Environment Variables

All variables are optional. See .env.example for a copy-paste template.

Variable	Description
GOOGLE_WORKSPACE_CLI_TOKEN	Pre-obtained OAuth2 access token (highest priority)
GOOGLE_WORKSPACE_CLI_CREDENTIALS_FILE	Path to OAuth credentials JSON (user or service account)
GOOGLE_WORKSPACE_CLI_CLIENT_ID	OAuth client ID (alternative to client_secret.json)
GOOGLE_WORKSPACE_CLI_CLIENT_SECRET	OAuth client secret (paired with CLIENT_ID)
GOOGLE_WORKSPACE_CLI_CONFIG_DIR	Override config directory (default: ~/.config/gws)
GOOGLE_WORKSPACE_CLI_FILE_ROOT	Existing directory allowed for --output / --upload paths (default: CWD); relative CLI paths remain CWD-relative
GOOGLE_WORKSPACE_CLI_SANITIZE_TEMPLATE	Default Model Armor template
GOOGLE_WORKSPACE_CLI_SANITIZE_MODE	warn (default) or block
GOOGLE_WORKSPACE_CLI_LOG	Log level for stderr (e.g., gws=debug). Off by default.
GOOGLE_WORKSPACE_CLI_LOG_FILE	Directory for JSON log files with daily rotation. Off by default.
GOOGLE_WORKSPACE_PROJECT_ID	GCP project ID override for quota/billing and fallback for helper commands

Environment variables can also be set in a .env file (loaded via dotenvy).

Exit Codes

gws uses structured exit codes so scripts can branch on the failure type without parsing error output.

Code	Meaning	Example cause
0	Success	Command completed normally
1	API error	Google returned a 4xx/5xx response
2	Auth error	Credentials missing, expired, or invalid
3	Validation error	Bad arguments, unknown service, invalid flag
4	Discovery error	Could not fetch the API schema document
5	Internal error	Unexpected failure

gws drive files list --params '{"fileId": "bad"}'
echo $?   # 1 — API error

gws unknown-service files list
echo $?   # 3 — validation error (unknown service)

Architecture

gws uses a two-phase parsing strategy:

1. Read argv[1] to identify the service (e.g. drive)
2. Fetch the service's Discovery Document (cached 24 h)
3. Build a clap::Command tree from the document's resources and methods
4. Re-parse the remaining arguments
5. Authenticate, build the HTTP request, execute

All output — success, errors, download metadata — is structured JSON.

Troubleshooting

"Access blocked" or 403 during login

Your OAuth app is in testing mode and your account is not listed as a test user.

Fix: Open the OAuth consent screen in your GCP project → Test users → Add users → enter your Google account email. Then retry gws auth login.

"Google hasn't verified this app"

Expected when your app is in testing mode. Click Advanced → Go to <app name> (unsafe) to proceed. This is safe for personal use; verification is only required to publish the app to other users.

Too many scopes / consent screen error

Unverified (testing mode) apps are limited to ~25 OAuth scopes. The recommended scope preset includes many scopes and will exceed this limit.

Fix: Select only the scopes you need:

gws auth login --scopes drive,gmail,calendar

gcloud CLI not found

gws auth setup requires the gcloud CLI to automate project creation. You have three options:

1. Install gcloud and use gcloud directly.
2. Re-run gws auth setup which wraps gcloud calls.
3. Skip gcloud entirely — set up OAuth credentials manually in the Cloud Console

redirect_uri_mismatch

The OAuth client was not created as a Desktop app type. In the Credentials page, delete the existing client, create a new one with type Desktop app, and download the new JSON.

API not enabled — accessNotConfigured

If a required Google API is not enabled for your GCP project, you will see a 403 error with reason accessNotConfigured:

{
  "error": {
    "code": 403,
    "message": "Gmail API has not been used in project 549352339482 ...",
    "reason": "accessNotConfigured",
    "enable_url": "https://console.developers.google.com/apis/api/gmail.googleapis.com/overview?project=549352339482"
  }
}

gws also prints an actionable hint to stderr:

💡 API not enabled for your GCP project.
   Enable it at: https://console.developers.google.com/apis/api/gmail.googleapis.com/overview?project=549352339482
   After enabling, wait a few seconds and retry your command.

Steps to fix:

1. Click the enable_url link (or copy it from the enable_url JSON field).
2. In the GCP Console, click Enable.
3. Wait ~10 seconds, then retry your gws command.

Tip

You can also run gws auth setup which walks you through enabling all required APIs for your project automatically.

Development

cargo build                       # dev build
cargo clippy -- -D warnings       # lint
cargo test                        # unit tests
./scripts/coverage.sh             # HTML coverage report → target/llvm-cov/html/

License

Apache-2.0

Disclaimer

Caution

This is not an officially supported Google product.