mirror of
https://github.com/tiennm99/goclaw.git
synced 2026-10-16 16:15:40 +00:00
feat(runtime): add Google Workspace CLI support
This commit is contained in:
Goon committed
1 parent
68684e4859
commit
12fb1baf79
13 files changed
+336
-12
No files matched your search
@@ -39,10 +39,11 @@ Pre-installed runtimes depend on the Docker image variant you deploy. The Packag
|
||||
|
||||
| Variant | Published tag | Build args | Pre-installed runtimes |
|
||||
|---------|---------------|------------|------------------------|
|
||||
| Minimal | `latest` | `ENABLE_PYTHON=false`, `ENABLE_NODE=false`, `ENABLE_FULL_SKILLS=false` | No Python or Node.js runtimes |
|
||||
| Python | `python` | `ENABLE_PYTHON=true` | `python3`, `py3-pip`, `edge-tts` |
|
||||
| Node | `node` | `ENABLE_NODE=true` | `nodejs`, `npm` |
|
||||
| Full | `full` | `ENABLE_FULL_SKILLS=true` | `python3`, `py3-pip`, `nodejs`, `npm`, `pandoc`, `github-cli`, bundled skill deps |
|
||||
| Latest | `latest` | `ENABLE_PYTHON=true`, `ENABLE_NODE=false`, `ENABLE_FULL_SKILLS=false` | `python3`, `py3-pip`, shared Python deps |
|
||||
| Base | `base` | `ENABLE_PYTHON=false`, `ENABLE_NODE=false`, `ENABLE_FULL_SKILLS=false` | No Python or Node.js runtimes |
|
||||
| Full | `full` | `ENABLE_FULL_SKILLS=true` | `python3`, `py3-pip`, `nodejs`, `npm`, `pandoc`, `github-cli`, bundled skill deps, Workspace CLI |
|
||||
| Custom Python | not published | `ENABLE_PYTHON=true` | `python3`, `py3-pip`, shared Python deps |
|
||||
| Custom Node | not published | `ENABLE_NODE=true` | `nodejs`, `npm` |
|
||||
|
||||
### Full Variant Extras
|
||||
|
||||
@@ -62,6 +63,7 @@ Pre-installed runtimes depend on the Docker image variant you deploy. The Packag
|
||||
|---------|---------|
|
||||
| `docx` | docx skill (document creation) |
|
||||
| `pptxgenjs` | pptx skill (presentation creation) |
|
||||
| `@googleworkspace/cli` (`gws`) | Google Workspace CLI for Drive, Gmail, Calendar, and Workspace APIs |
|
||||
|
||||
---
|
||||
|
||||
@@ -113,8 +115,10 @@ Default `{runtimeDir}` resolution:
|
||||
The system prompt and UI should treat runtime availability as variant-dependent:
|
||||
|
||||
```
|
||||
Minimal `latest`: Python/Node may be missing in the container.
|
||||
`python`, `node`, and `full` variants pre-install different runtimes.
|
||||
Published `latest`: Python is present; Node may be missing in the container.
|
||||
Published `full`: Python, Node, and full skill extras are present.
|
||||
Published `base`: Python and Node are absent.
|
||||
Custom builds can set ENABLE_PYTHON=true or ENABLE_NODE=true.
|
||||
To install additional packages: pip3 install <pkg> or npm install -g <pkg>
|
||||
```
|
||||
|
||||
@@ -200,7 +204,7 @@ When a user uploads a skill with the same name via the UI, the managed version t
|
||||
To add a new package to the Docker image:
|
||||
|
||||
1. **Python**: Add to the `pip3 install` line in `Dockerfile` (usually `full`, sometimes `python`)
|
||||
2. **Node.js**: Add to the `npm install -g` line in `Dockerfile` (usually `full`, sometimes `node`)
|
||||
2. **Node.js**: Add to the `npm install -g` line in `Dockerfile` (usually `full`, sometimes a custom `ENABLE_NODE=true` build)
|
||||
3. **System tool**: Add to the `apk add` line in `Dockerfile`
|
||||
4. **Docs/UI guidance**: Update runtime variant docs and any UI copy that describes pre-installed tools
|
||||
5. **Rebuild**: `docker compose ... up -d --build`
|
||||
|
||||
@@ -301,6 +301,8 @@ SecureCLI is a feature that allows GoClaw to automatically inject credentials in
|
||||
|
||||
When an agent needs to run `gh auth`, `gcloud auth`, or other authenticated CLI commands, the admin can configure a SecureCLI binary with encrypted environment variables. The agent never sees the raw credentials — they are injected directly into the child process environment via Direct Exec Mode.
|
||||
|
||||
Built-in presets include `gh`, `gcloud`, `gws`, `aws`, `kubectl`, and `terraform`. The `gws` preset targets Google Workspace CLI (`@googleworkspace/cli`) and supports `GOOGLE_WORKSPACE_CLI_CREDENTIALS_FILE`, `GOOGLE_WORKSPACE_CLI_TOKEN`, `GOOGLE_WORKSPACE_CLI_CLIENT_ID`, and `GOOGLE_WORKSPACE_CLI_CLIENT_SECRET`.
|
||||
|
||||
### Database Schema
|
||||
|
||||
```sql
|
||||
@@ -334,6 +336,18 @@ CREATE TABLE secure_cli_binaries (
|
||||
| `POST` | `/v1/cli-credentials/{id}/test` | Dry-run test (requires admin) |
|
||||
| `GET` | `/v1/cli-credentials/presets` | List preset templates for common CLIs |
|
||||
|
||||
### Google Workspace CLI preset
|
||||
|
||||
The `gws` preset is intended for server-side Google Workspace reads and reviewed admin workflows. It blocks interactive credential commands (`gws auth setup`, `gws auth login`, `gws auth export`, `gws auth logout`) because those flows can create, expose, or clear credentials outside GoClaw's encrypted store.
|
||||
|
||||
Credential options:
|
||||
|
||||
- `GOOGLE_WORKSPACE_CLI_CREDENTIALS_FILE`: path to exported `gws` credentials or an OAuth credentials JSON file.
|
||||
- `GOOGLE_WORKSPACE_CLI_TOKEN`: pre-obtained OAuth access token.
|
||||
- `GOOGLE_WORKSPACE_CLI_CLIENT_ID` / `GOOGLE_WORKSPACE_CLI_CLIENT_SECRET`: optional OAuth client values for deployments that manage auth outside the agent turn.
|
||||
|
||||
Use `docs/google-workspace-cli.md` for command examples and smoke-test guidance.
|
||||
|
||||
### Features
|
||||
|
||||
- **Agent-specific or global:** Configs can be scoped to a single agent or shared across all agents (agent_id = null)
|
||||
|
||||
@@ -0,0 +1,88 @@
|
||||
# Google Workspace CLI Integration
|
||||
|
||||
GoClaw supports Google Workspace CLI through the `gws` binary from `@googleworkspace/cli`.
|
||||
|
||||
## Runtime availability
|
||||
|
||||
- Published `full` image: `gws` is preinstalled.
|
||||
- Published `latest` image: Python is available, but Node/npm and `gws` are not preinstalled.
|
||||
- Published `base` image: Python and Node/npm are not preinstalled.
|
||||
- Custom Node-enabled builds: set `ENABLE_NODE=true`, then install `npm:@googleworkspace/cli` from the Packages page or `/v1/packages/install`.
|
||||
|
||||
`gws` requires Node.js 18+ when installed through npm.
|
||||
|
||||
## SecureCLI setup
|
||||
|
||||
Create a SecureCLI credential from the `gws` preset. Provide at least one usable auth source:
|
||||
|
||||
- `GOOGLE_WORKSPACE_CLI_CREDENTIALS_FILE`: exported `gws` credentials or an OAuth credentials JSON file path.
|
||||
- `GOOGLE_WORKSPACE_CLI_TOKEN`: pre-obtained OAuth access token.
|
||||
- `GOOGLE_WORKSPACE_CLI_CLIENT_ID` and `GOOGLE_WORKSPACE_CLI_CLIENT_SECRET`: optional OAuth client values for external auth flows.
|
||||
|
||||
The preset blocks these interactive or credential-exporting commands:
|
||||
|
||||
- `gws auth setup`
|
||||
- `gws auth login`
|
||||
- `gws auth export`
|
||||
- `gws auth logout`
|
||||
|
||||
Run those flows outside agent execution, then store the resulting token or credentials file path in SecureCLI.
|
||||
|
||||
## Agent command patterns
|
||||
|
||||
Use `--params` for query parameters and `--json` for request bodies. Prefer read-only commands unless an admin has explicitly approved writes.
|
||||
|
||||
Drive:
|
||||
|
||||
```sh
|
||||
gws drive files list --params '{"pageSize": 10}'
|
||||
```
|
||||
|
||||
Gmail:
|
||||
|
||||
```sh
|
||||
gws gmail users messages list --params '{"userId": "me", "maxResults": 10}'
|
||||
```
|
||||
|
||||
Calendar:
|
||||
|
||||
```sh
|
||||
gws calendar events list --params '{"calendarId": "primary", "maxResults": 10}'
|
||||
```
|
||||
|
||||
Pagination:
|
||||
|
||||
```sh
|
||||
gws drive files list --params '{"pageSize": 100}' --page-all
|
||||
```
|
||||
|
||||
Schema inspection:
|
||||
|
||||
```sh
|
||||
gws schema drive.files.list
|
||||
```
|
||||
|
||||
## Validation
|
||||
|
||||
Without credentials, local validation can only prove packaging and credential injection:
|
||||
|
||||
```sh
|
||||
gws --help
|
||||
gws drive files list --help
|
||||
```
|
||||
|
||||
With credentials available, run these smoke tests from a SecureCLI-enabled agent or equivalent runtime:
|
||||
|
||||
```sh
|
||||
gws drive files list --params '{"pageSize": 1}'
|
||||
gws gmail users messages list --params '{"userId": "me", "maxResults": 1}'
|
||||
gws calendar events list --params '{"calendarId": "primary", "maxResults": 1}'
|
||||
```
|
||||
|
||||
Do not mark live Google Workspace validation complete unless all three authenticated commands return successful JSON.
|
||||
|
||||
## Limitations
|
||||
|
||||
- Google Workspace auth and scopes are controlled by the configured Google account, OAuth app, token, or credentials file.
|
||||
- Domain-wide delegation and account impersonation are not represented by a GoClaw preset env var. Configure those in Google Workspace and the credential file if needed.
|
||||
- Write commands can modify Workspace data. Keep the default preset read-oriented, and create a separate reviewed SecureCLI config for approved write workflows.
|
||||
@@ -6,6 +6,18 @@ Significant changes, features, and fixes in reverse chronological order.
|
||||
|
||||
## 2026-05-24
|
||||
|
||||
### Google Workspace CLI runtime integration
|
||||
|
||||
**Features**
|
||||
|
||||
- Added `gws` as a preinstalled Google Workspace CLI in the full runtime image.
|
||||
- Added a SecureCLI `gws` preset with encrypted credential injection fields and guardrails for interactive auth/export commands.
|
||||
- Documented Drive, Gmail, and Calendar command patterns plus live credential smoke-test requirements.
|
||||
|
||||
**Tests**
|
||||
|
||||
- Added runtime binary discovery, SecureCLI preset, deny-pattern, and Dockerfile contract coverage for Google Workspace CLI.
|
||||
|
||||
### Browser cookie sync and config UI
|
||||
|
||||
**Features**
|
||||
|
||||
Reference in new issue
Block a user