limbo-ai 1.32.0 → 2026.4.1

package/Dockerfile

@@ -0,0 +1,116 @@
+# syntax=docker/dockerfile:1
+
+# OpenClaw version — pin to avoid surprise upgrades in production
+ARG OPENCLAW_VERSION=latest
+
+# ──────────────────────────────────────────────
+# Stage 1: deps — build MCP server native addons
+# better-sqlite3 requires python3/make/g++ for node-gyp compilation.
+# This stage is discarded after extracting node_modules.
+# ──────────────────────────────────────────────
+FROM node:22-slim AS deps
+
+# Build tools for native addons (better-sqlite3 requires compilation)
+RUN apt-get update && apt-get install -y --no-install-recommends python3 make g++ && rm -rf /var/lib/apt/lists/*
+
+WORKDIR /build
+
+# Copy MCP server manifest and lockfile (layer cached unless these change)
+COPY mcp-server/package.json mcp-server/package-lock.json* ./mcp-server/
+
+# Install deps without running lifecycle scripts, then rebuild better-sqlite3
+# native addon explicitly. Verify with an in-memory open/close smoke test.
+RUN cd mcp-server \
+  && npm ci --omit=dev --ignore-scripts \
+  && cd node_modules/better-sqlite3 \
+  && npx node-gyp rebuild --release \
+  && cd /build \
+  && node -e "const d=require('/build/mcp-server/node_modules/better-sqlite3');const db=d(':memory:');db.close();console.log('better-sqlite3 OK')"
+
+# ──────────────────────────────────────────────
+# Stage 2: runtime — OpenClaw + MCP server + workspace
+# Migrated from ZeroClaw (Rust binary) to OpenClaw (Node.js npm package).
+# OpenClaw is installed globally via npm — no custom binary build needed.
+# ──────────────────────────────────────────────
+FROM node:22-slim AS runtime
+
+ARG OPENCLAW_VERSION
+
+# Runtime system deps:
+#   gettext-base — envsubst for config template rendering
+#   tzdata       — timezone support
+#   tini         — minimal init for proper signal handling (PID 1 reaping)
+#   libssl3      — OpenSSL 3 shared lib needed by OpenClaw's ACP runtime (codex-acp)
+#   python3      — required by OpenClaw's pinned-write-helper for safe atomic file writes
+RUN apt-get update && apt-get install -y --no-install-recommends gettext-base tzdata tini libssl3 python3 ca-certificates && rm -rf /var/lib/apt/lists/* \
+  && groupadd -r limbo && useradd --create-home -r -g limbo limbo
+
+# Install OpenClaw globally — replaces the ZeroClaw Rust binary.
+# Pinned via OPENCLAW_VERSION build arg (default: latest).
+# @googleworkspace/cli (gws) — Google Calendar integration (optional feature).
+RUN npm install -g "openclaw@${OPENCLAW_VERSION}" "@googleworkspace/cli"
+
+# Apply local patch for openclaw#63851 — the guarded fetch drops FormData fields,
+# breaking Groq audio transcription. Remove this once upstream PR #64349 ships in
+# a released openclaw version; the patcher is idempotent and fails loudly if
+# the openclaw code shape has changed.
+COPY scripts/patch-openclaw-audio.mjs /tmp/patch-openclaw-audio.mjs
+RUN node /tmp/patch-openclaw-audio.mjs && rm /tmp/patch-openclaw-audio.mjs
+
+# App directories
+WORKDIR /app
+
+# MCP server: source code first, then node_modules from deps stage (overrides host binaries)
+COPY --chown=limbo:limbo mcp-server/ ./mcp-server/
+COPY --from=deps /build/mcp-server/node_modules ./mcp-server/node_modules
+
+# Setup wizard server (zero dependencies — plain Node.js HTTP server)
+COPY --chown=limbo:limbo setup-server/ /app/setup-server/
+
+# System workspace files (product-owned, root-owned for read-only enforcement via symlinks)
+COPY workspace/system/ ./workspace/system/
+
+# Skills (product-owned, synced to OpenClaw workspace on boot by entrypoint)
+COPY workspace/skills/ ./workspace/skills/
+
+# User workspace templates (limbo-owned, seeded on first run)
+COPY --chown=limbo:limbo workspace/templates/ ./workspace/templates/
+
+# Migration runner (no external deps — pure Node.js stdlib)
+COPY --chown=limbo:limbo migrations/ ./migrations/
+
+# Shared libs (telegram-notify, wakeup routine)
+COPY --chown=limbo:limbo lib/ ./lib/
+
+# Package metadata (version read by wakeup routine)
+COPY --chown=limbo:limbo package.json ./package.json
+
+# User-facing release notes (parsed by wakeup routine for update messages)
+COPY --chown=limbo:limbo RELEASES.md ./RELEASES.md
+
+# OpenClaw config template (populated by entrypoint from env vars)
+COPY --chown=limbo:limbo openclaw.json.template ./openclaw.json.template
+
+# Entrypoint script
+COPY scripts/entrypoint.sh /entrypoint.sh
+RUN chmod +x /entrypoint.sh
+
+# Pre-create dirs with correct ownership for image-layer defaults
+RUN mkdir -p /data && chown limbo:limbo /data
+RUN mkdir -p /flags && chown limbo:limbo /flags
+RUN mkdir -p /home/limbo/.openclaw && chown limbo:limbo /home/limbo/.openclaw
+# Fix npm cache ownership — npm install -g runs as root but limbo user needs write access at runtime
+RUN mkdir -p /home/limbo/.npm && chown -R limbo:limbo /home/limbo/.npm
+RUN chown limbo:limbo /app
+
+# Data volume — vault, db, config, memory, backups, logs
+VOLUME ["/data"]
+
+# OpenClaw gateway port
+EXPOSE 18789
+
+# Run as non-root limbo user
+USER limbo
+
+# tini as init process for proper signal forwarding and zombie reaping
+ENTRYPOINT ["/usr/bin/tini", "--", "/entrypoint.sh"]

package/cli.js

@@ -768,6 +768,7 @@ function normalizeConfig(cfg, existingEnv = {}) {
     GATEWAY_TOKEN: gatewayToken,
     VOICE_ENABLED: cfg.voiceEnabled || existingEnv.VOICE_ENABLED || 'false',
     WEB_SEARCH_ENABLED: cfg.webSearchEnabled || existingEnv.WEB_SEARCH_ENABLED || 'false',
+    GOOGLE_CALENDAR_ENABLED: cfg.googleCalendarEnabled || existingEnv.GOOGLE_CALENDAR_ENABLED || 'false',
   };
 
   return base;
@@ -2341,6 +2342,63 @@ async function cmdSwitchBrain() {
   } catch {}
 }
 
+async function cmdConnectCalendar() {
+  const existingEnv = parseEnvFile();
+  if (!existingEnv.MODEL_PROVIDER) {
+    die('No existing configuration found. Run `limbo start` first to set up.');
+  }
+
+  if (existingEnv.GOOGLE_CALENDAR_ENABLED === 'true') {
+    ok('Google Calendar is already connected.');
+    return;
+  }
+
+  // Resolve port from existing config
+  if (existingEnv.LIMBO_PORT) {
+    const parsed = parseInt(existingEnv.LIMBO_PORT, 10);
+    if (Number.isFinite(parsed) && parsed >= 1 && parsed <= 65535) PORT = parsed;
+  }
+
+  ensureComposeFile(false);
+
+  const lang = existingEnv.CLI_LANGUAGE || 'en';
+  header(lang === 'es' ? 'Conectar Google Calendar' : 'Connect Google Calendar');
+
+  // Write CONNECT_CALENDAR_MODE to .env (preserve existing config)
+  const envContent = fs.readFileSync(ENV_FILE, 'utf8');
+  const cleaned = envContent.replace(/^CONNECT_CALENDAR_MODE=.*\n?/gm, '');
+  fs.writeFileSync(ENV_FILE, cleaned + 'CONNECT_CALENDAR_MODE=true\n', { mode: 0o600 });
+
+  pullOrBuildImage(lang);
+  ensureVolumePermissions();
+
+  log(lang === 'es' ? 'Iniciando wizard de Google Calendar...' : 'Starting Google Calendar setup wizard...');
+  const upResult = runDockerCompose(['up', '-d', '--remove-orphans', '--force-recreate'], { stdio: 'pipe' });
+  if (upResult.status !== 0) {
+    process.stderr.write(upResult.stderr || '');
+    die('Container failed to start. Run `limbo logs` to investigate.');
+  }
+
+  const wizardUrl = extractWizardUrl();
+
+  let tunnel = null;
+  if (isServerEnvironment() || process.argv.includes('--tunnel')) {
+    tunnel = await createSetupTunnel(PORT);
+  }
+
+  const displayUrl = wizardUrl || `http://127.0.0.1:${PORT}`;
+  if (!wizardUrl) {
+    warn('Could not extract setup token from container logs.');
+  }
+  printWizardUrl(displayUrl, tunnel);
+
+  try {
+    const envAfter = fs.readFileSync(ENV_FILE, 'utf8');
+    const final = envAfter.replace(/^CONNECT_CALENDAR_MODE=.*\n?/gm, '');
+    if (final !== envAfter) fs.writeFileSync(ENV_FILE, final, { mode: 0o600 });
+  } catch {}
+}
+
 function cmdHelp() {
   console.log(`
 ${c.bold}limbo${c.reset} - personal AI memory agent
@@ -2354,9 +2412,10 @@ ${c.bold}Commands:${c.reset}
   logs          Tail container logs
   update        Pull latest image and restart
   status        Show container status
-  config        Configure optional features (voice, web-search)
-  switch-brain  Change your AI provider (opens a quick wizard)
-  help          Show this help
+  config             Configure optional features (voice, web-search)
+  switch-brain       Change your AI provider (opens a quick wizard)
+  connect-calendar   Connect Google Calendar (opens a quick wizard)
+  help               Show this help
 
 ${c.bold}Flags:${c.reset}
   --cli                Use interactive CLI prompts instead of the web setup wizard
@@ -2481,6 +2540,7 @@ if (require.main === module) {
       case 'status':  cmdStatus(); break;
       case 'config':  cmdConfig(); break;
       case 'switch-brain': await cmdSwitchBrain(); break;
+      case 'connect-calendar': await cmdConnectCalendar(); break;
       case 'version':
       case '--version':
       case '-v':      console.log(require('./package.json').version); break;

package/mcp-server/index.js

@@ -15,6 +15,7 @@ import { vaultUpdateMap } from "./tools/update-map.js";
 import { vaultStoreFile } from "./tools/store-file.js";
 import { vaultGetFile } from "./tools/get-file.js";
 import { workspaceRead, workspaceWrite } from "./tools/workspace.js";
+import { calendarRead, calendarCreate, calendarDelete, calendarUpdate } from "./tools/google-calendar.js";
 import { updateInstance } from "./tools/update-instance.js";
 
 /**
@@ -260,6 +261,126 @@ server.setRequestHandler(ListToolsRequestSchema, async () => ({
         required: ["filename", "content"],
       },
     },
+    {
+      name: "calendar_read",
+      description:
+        "List upcoming Google Calendar events. Returns events within a date range. Defaults to today if no range specified. Use when the user asks about their schedule, meetings, or availability.",
+      inputSchema: {
+        type: "object",
+        properties: {
+          startDate: {
+            type: "string",
+            description:
+              "Start of range in ISO 8601 date format (e.g. '2026-04-09'). Defaults to today.",
+          },
+          endDate: {
+            type: "string",
+            description:
+              "End of range in ISO 8601 date format (e.g. '2026-04-10'). Defaults to end of startDate.",
+          },
+          maxResults: {
+            type: "number",
+            description:
+              "Maximum number of events to return. Default: 25, max: 100.",
+          },
+        },
+        required: [],
+      },
+    },
+    {
+      name: "calendar_create",
+      description:
+        "Create a new Google Calendar event. Requires a title and start time. Duration defaults to 60 minutes. Always confirm details with the user before creating. IMPORTANT: pass the user's timeZone (read from USER.md) so the event lands at the correct local time.",
+      inputSchema: {
+        type: "object",
+        properties: {
+          title: {
+            type: "string",
+            description: "Event title/summary",
+          },
+          startTime: {
+            type: "string",
+            description:
+              "Event start time. Either ISO 8601 without offset (e.g. '2026-04-09T14:00:00') — in which case pass timeZone — or with offset (e.g. '2026-04-09T14:00:00-03:00').",
+          },
+          duration: {
+            type: "number",
+            description: "Duration in minutes. Default: 60.",
+          },
+          description: {
+            type: "string",
+            description: "Optional event description/notes",
+          },
+          location: {
+            type: "string",
+            description: "Optional event location",
+          },
+          timeZone: {
+            type: "string",
+            description:
+              "IANA timezone identifier (e.g. 'America/Argentina/Buenos_Aires'). Read from USER.md. Required when startTime has no offset.",
+          },
+        },
+        required: ["title", "startTime"],
+      },
+    },
+    {
+      name: "calendar_delete",
+      description:
+        "Delete a Google Calendar event by its id. Get the id first via calendar_read. Always confirm with the user before deleting — this is irreversible.",
+      inputSchema: {
+        type: "object",
+        properties: {
+          eventId: {
+            type: "string",
+            description: "Google Calendar event id (from calendar_read results)",
+          },
+        },
+        required: ["eventId"],
+      },
+    },
+    {
+      name: "calendar_update",
+      description:
+        "Update an existing Google Calendar event. Only the provided fields are changed (PATCH). Get the event id first via calendar_read. Always confirm changes with the user before applying.",
+      inputSchema: {
+        type: "object",
+        properties: {
+          eventId: {
+            type: "string",
+            description: "Google Calendar event id (from calendar_read results)",
+          },
+          title: {
+            type: "string",
+            description: "New event title/summary",
+          },
+          startTime: {
+            type: "string",
+            description:
+              "New event start time. ISO 8601, with or without offset. When changing the time, pass timeZone too.",
+          },
+          duration: {
+            type: "number",
+            description:
+              "New duration in minutes. Must be passed together with startTime (duration-only updates not supported).",
+          },
+          description: {
+            type: "string",
+            description: "New event description",
+          },
+          location: {
+            type: "string",
+            description: "New event location",
+          },
+          timeZone: {
+            type: "string",
+            description:
+              "IANA timezone (e.g. 'America/Argentina/Buenos_Aires'). Read from USER.md. Required when startTime has no offset.",
+          },
+        },
+        required: ["eventId"],
+      },
+    },
     {
       name: "update_instance",
       description:
@@ -277,7 +398,12 @@ server.setRequestHandler(ListToolsRequestSchema, async () => ({
 server.setRequestHandler(CallToolRequestSchema, async (request) => {
   const { name, arguments: args } = request.params;
 
-  log(`tool_call: ${name}`);
+  // Include params as JSON in the log line so eval assertions can verify
+  // tool arguments (e.g. calendar_create was called with the right timeZone).
+  // The provider's parser matches `tool_call: <name>` first — the trailing
+  // JSON is ignored by the existing regex, so this is backwards compatible.
+  const paramsStr = args && Object.keys(args).length ? ` params=${JSON.stringify(args)}` : "";
+  log(`tool_call: ${name}${paramsStr}`);
   evalLog({ type: "tool_call", tool: name, params: args });
 
   try {
@@ -381,6 +507,38 @@ server.setRequestHandler(CallToolRequestSchema, async (request) => {
         break;
       }
 
+      case "calendar_read": {
+        const events = await calendarRead(args);
+        result = {
+          content: [{ type: "text", text: JSON.stringify(events, null, 2) }],
+        };
+        break;
+      }
+
+      case "calendar_create": {
+        const event = await calendarCreate(args);
+        result = {
+          content: [{ type: "text", text: JSON.stringify(event, null, 2) }],
+        };
+        break;
+      }
+
+      case "calendar_delete": {
+        const deleted = await calendarDelete(args);
+        result = {
+          content: [{ type: "text", text: JSON.stringify(deleted, null, 2) }],
+        };
+        break;
+      }
+
+      case "calendar_update": {
+        const updated = await calendarUpdate(args);
+        result = {
+          content: [{ type: "text", text: JSON.stringify(updated, null, 2) }],
+        };
+        break;
+      }
+
       case "update_instance": {
         result = await updateInstance();
         break;

package/mcp-server/tools/google-calendar.js

@@ -0,0 +1,277 @@
+// mcp-server/tools/google-calendar.js — Google Calendar MCP tools (gws CLI wrappers)
+import { execFile } from 'node:child_process';
+import { promisify } from 'node:util';
+
+const execFileAsync = promisify(execFile);
+
+function ensureEnabled() {
+  if (process.env.GOOGLE_CALENDAR_ENABLED !== 'true') {
+    throw new Error(
+      'Google Calendar is not connected. Enable it by running: limbo connect-calendar'
+    );
+  }
+}
+
+/**
+ * Call gws CLI and return parsed JSON output.
+ * gws reads credentials from GOOGLE_WORKSPACE_CLI_CREDENTIALS_FILE env var.
+ *
+ * cwd=/tmp: gws ALWAYS writes a side-file to cwd (e.g. "download.html" for
+ * empty-body responses). On read-only root filesystems this fails with
+ * "Failed to create output file". /tmp is a tmpfs in the hardened container.
+ */
+async function callGws(args) {
+  const { stdout } = await execFileAsync('gws', args, {
+    env: process.env,
+    cwd: '/tmp',
+    timeout: 30_000,
+  });
+  return JSON.parse(stdout);
+}
+
+/**
+ * Call gws CLI for operations that return no body (HTTP 204, e.g. delete).
+ * Skip JSON parsing — gws still writes a placeholder file but we don't read it.
+ */
+async function callGwsNoBody(args) {
+  await execFileAsync('gws', args, {
+    env: process.env,
+    cwd: '/tmp',
+    timeout: 30_000,
+  });
+}
+
+/**
+ * List Google Calendar events for a date range.
+ * @param {object} opts
+ * @param {string} [opts.startDate] - ISO date, defaults to today
+ * @param {string} [opts.endDate] - ISO date, defaults to end of startDate
+ * @param {number} [opts.maxResults] - max events, default 25
+ */
+export async function calendarRead({ startDate, endDate, maxResults } = {}) {
+  ensureEnabled();
+
+  const now = new Date();
+  // Default start = today at 00:00 (local time)
+  const start = startDate ? new Date(startDate) : new Date(now.getFullYear(), now.getMonth(), now.getDate());
+  // Default end = start + 24h (full day of events).
+  // If endDate is given and equals startDate (or is a bare date), extend to end-of-day
+  // so the caller gets all events on that day, not an empty range.
+  let end;
+  if (endDate) {
+    end = new Date(endDate);
+    if (end.getTime() <= start.getTime()) {
+      end = new Date(end.getTime() + 24 * 60 * 60 * 1000);
+    }
+  } else {
+    end = new Date(start.getTime() + 24 * 60 * 60 * 1000);
+  }
+
+  // Google Calendar API wants RFC 3339 timestamps
+  const timeMin = start.toISOString();
+  const timeMax = end.toISOString();
+  const max = Math.min(maxResults || 25, 100);
+
+  const params = {
+    calendarId: 'primary',
+    timeMin,
+    timeMax,
+    maxResults: max,
+    singleEvents: true,
+    orderBy: 'startTime',
+  };
+
+  const result = await callGws([
+    'calendar', 'events', 'list',
+    '--params', JSON.stringify(params),
+    '--format', 'json',
+  ]);
+
+  // Map to simplified format
+  const items = result.items || [];
+  return items.map(ev => ({
+    id: ev.id,
+    summary: ev.summary || '(no title)',
+    start: ev.start?.dateTime || ev.start?.date || null,
+    end: ev.end?.dateTime || ev.end?.date || null,
+    location: ev.location || null,
+    status: ev.status || 'confirmed',
+    htmlLink: ev.htmlLink || null,
+  }));
+}
+
+/**
+ * Create a Google Calendar event.
+ * @param {object} opts
+ * @param {string} opts.title - Event summary (required)
+ * @param {string} opts.startTime - ISO datetime, with or without timezone offset (required)
+ * @param {number} [opts.duration] - Minutes, default 60
+ * @param {string} [opts.description] - Event description
+ * @param {string} [opts.location] - Event location
+ * @param {string} [opts.timeZone] - IANA timezone (e.g. "America/Argentina/Buenos_Aires").
+ *   If the startTime has no offset, this tells Google how to interpret it.
+ *   The agent should pass this from USER.md.
+ */
+export async function calendarCreate({ title, startTime, duration, description, location, timeZone } = {}) {
+  ensureEnabled();
+
+  if (!title) throw new Error('title is required');
+  if (!startTime) throw new Error('startTime is required');
+
+  // Preserve the literal startTime string if the agent passed one without offset —
+  // Google will interpret it using the provided timeZone. If the agent passed an
+  // offset (e.g. "2026-04-11T11:00:00-03:00"), normalize to ISO.
+  const hasOffset = /[+-]\d{2}:\d{2}$|Z$/.test(startTime);
+  let startDateTimeStr;
+  let endDateTimeStr;
+  const durationMin = duration || 60;
+
+  if (hasOffset) {
+    const start = new Date(startTime);
+    const end = new Date(start.getTime() + durationMin * 60 * 1000);
+    startDateTimeStr = start.toISOString();
+    endDateTimeStr = end.toISOString();
+  } else {
+    // No offset — keep it as a "floating" local time and let Google interpret it
+    // via the timeZone field. Compute end by parsing the local-time components.
+    const m = startTime.match(/^(\d{4})-(\d{2})-(\d{2})T(\d{2}):(\d{2})(?::(\d{2}))?$/);
+    if (!m) throw new Error(`Invalid startTime format: ${startTime}`);
+    const [, y, mo, d, h, min, s] = m;
+    const startMs = Date.UTC(+y, +mo - 1, +d, +h, +min, +(s || 0));
+    const endMs = startMs + durationMin * 60 * 1000;
+    const fmt = (ms) => {
+      const dt = new Date(ms);
+      return `${dt.getUTCFullYear()}-${String(dt.getUTCMonth() + 1).padStart(2, '0')}-${String(dt.getUTCDate()).padStart(2, '0')}T${String(dt.getUTCHours()).padStart(2, '0')}:${String(dt.getUTCMinutes()).padStart(2, '0')}:${String(dt.getUTCSeconds()).padStart(2, '0')}`;
+    };
+    startDateTimeStr = fmt(startMs);
+    endDateTimeStr = fmt(endMs);
+  }
+
+  const event = {
+    summary: title,
+    start: { dateTime: startDateTimeStr },
+    end: { dateTime: endDateTimeStr },
+  };
+  // If the agent provided a timeZone (from USER.md), pass it to Google so the
+  // dateTime is interpreted correctly regardless of container clock.
+  if (timeZone) {
+    event.start.timeZone = timeZone;
+    event.end.timeZone = timeZone;
+  }
+  if (description) event.description = description;
+  if (location) event.location = location;
+
+  const result = await callGws([
+    'calendar', 'events', 'insert',
+    '--params', JSON.stringify({ calendarId: 'primary' }),
+    '--json', JSON.stringify(event),
+    '--format', 'json',
+  ]);
+
+  return {
+    id: result.id,
+    summary: result.summary,
+    start: result.start?.dateTime || result.start?.date,
+    end: result.end?.dateTime || result.end?.date,
+    htmlLink: result.htmlLink || null,
+  };
+}
+
+/**
+ * Delete a Google Calendar event by id.
+ * @param {object} opts
+ * @param {string} opts.eventId - The Google Calendar event id (from calendar_read)
+ */
+export async function calendarDelete({ eventId } = {}) {
+  ensureEnabled();
+  if (!eventId) throw new Error('eventId is required');
+
+  // events.delete returns HTTP 204 No Content — no JSON body to parse.
+  // Passing --format json triggers gws to create an output file on disk,
+  // which fails on read-only filesystems.
+  await callGwsNoBody([
+    'calendar', 'events', 'delete',
+    '--params', JSON.stringify({ calendarId: 'primary', eventId }),
+  ]);
+
+  return { id: eventId, deleted: true };
+}
+
+/**
+ * Update an existing Google Calendar event by id. Only the provided fields
+ * are changed (PATCH semantics).
+ * @param {object} opts
+ * @param {string} opts.eventId - Event id (required)
+ * @param {string} [opts.title] - New title/summary
+ * @param {string} [opts.startTime] - New start time (ISO, with or without offset)
+ * @param {number} [opts.duration] - New duration in minutes (updates endTime relative to startTime)
+ * @param {string} [opts.description] - New description
+ * @param {string} [opts.location] - New location
+ * @param {string} [opts.timeZone] - IANA timezone, passed from USER.md
+ */
+export async function calendarUpdate({ eventId, title, startTime, duration, description, location, timeZone } = {}) {
+  ensureEnabled();
+  if (!eventId) throw new Error('eventId is required');
+
+  const patch = {};
+  if (title) patch.summary = title;
+  if (description) patch.description = description;
+  if (location) patch.location = location;
+
+  if (startTime) {
+    // Same parsing logic as calendarCreate — respect floating time + timeZone.
+    const hasOffset = /[+-]\d{2}:\d{2}$|Z$/.test(startTime);
+    const durationMin = duration || 60;
+    let startDateTimeStr;
+    let endDateTimeStr;
+
+    if (hasOffset) {
+      const start = new Date(startTime);
+      const end = new Date(start.getTime() + durationMin * 60 * 1000);
+      startDateTimeStr = start.toISOString();
+      endDateTimeStr = end.toISOString();
+    } else {
+      const m = startTime.match(/^(\d{4})-(\d{2})-(\d{2})T(\d{2}):(\d{2})(?::(\d{2}))?$/);
+      if (!m) throw new Error(`Invalid startTime format: ${startTime}`);
+      const [, y, mo, d, h, min, s] = m;
+      const startMs = Date.UTC(+y, +mo - 1, +d, +h, +min, +(s || 0));
+      const endMs = startMs + durationMin * 60 * 1000;
+      const fmt = (ms) => {
+        const dt = new Date(ms);
+        return `${dt.getUTCFullYear()}-${String(dt.getUTCMonth() + 1).padStart(2, '0')}-${String(dt.getUTCDate()).padStart(2, '0')}T${String(dt.getUTCHours()).padStart(2, '0')}:${String(dt.getUTCMinutes()).padStart(2, '0')}:${String(dt.getUTCSeconds()).padStart(2, '0')}`;
+      };
+      startDateTimeStr = fmt(startMs);
+      endDateTimeStr = fmt(endMs);
+    }
+
+    patch.start = { dateTime: startDateTimeStr };
+    patch.end = { dateTime: endDateTimeStr };
+    if (timeZone) {
+      patch.start.timeZone = timeZone;
+      patch.end.timeZone = timeZone;
+    }
+  } else if (duration) {
+    // Duration change without startTime change: we'd need to read the current event
+    // first to compute the new end. Not supported yet — require startTime for now.
+    throw new Error('duration-only updates are not supported yet; pass startTime too');
+  }
+
+  if (Object.keys(patch).length === 0) {
+    throw new Error('No fields to update. Provide at least one of: title, startTime, description, location.');
+  }
+
+  const result = await callGws([
+    'calendar', 'events', 'patch',
+    '--params', JSON.stringify({ calendarId: 'primary', eventId }),
+    '--json', JSON.stringify(patch),
+    '--format', 'json',
+  ]);
+
+  return {
+    id: result.id,
+    summary: result.summary,
+    start: result.start?.dateTime || result.start?.date,
+    end: result.end?.dateTime || result.end?.date,
+    htmlLink: result.htmlLink || null,
+  };
+}