morpheus-cli 0.9.24 → 0.9.31

package/README.md

@@ -14,7 +14,8 @@ It runs as a daemon and orchestrates LLMs, MCP tools, DevKit tools, memory, and
 - Chronos temporal scheduler for recurring and one-time Oracle executions.
 - Smith remote agent system for DevKit execution on isolated machines via WebSocket.
 - Multi-channel output via ChannelRegistry (Telegram, Discord) with per-job routing.
-- Rich operational visibility in UI (chat traces, tasks, usage, logs).
+- Google Workspace automation via 102 built-in skills (Gmail, Drive, Sheets, Calendar, Docs, Tasks).
+- Rich operational visibility in UI (chat traces, tasks, usage, logs, real-time activity visualization).
 
 ## Multi-Agent Roles
 - `Oracle`: orchestration and routing. Decides direct answer vs async delegation.
@@ -325,6 +326,7 @@ Adding a new channel requires only implementing `IChannelAdapter` (`channel`, `s
 ## Web UI
 
 The dashboard includes:
+- **Dashboard** with real-time 3D agent visualization and Matrix-style activity feed (live agent events via SSE)
 - Chat with session management and browser notifications
 - Tasks page (stats, filters, details, retry, pagination)
 - Agent settings (Oracle/Sati/Neo/Apoc/Trinity/Smiths)
@@ -335,7 +337,7 @@ The dashboard includes:
 - Chronos scheduler (create/edit/delete jobs, execution history)
 - Smiths management (add/edit/delete, real-time status, ping)
 - Audit dashboard (session audit, tool call tracking, cost breakdowns with currency conversion)
-- Webhooks and notification inbox
+- Webhooks and notification inbox (with per-webhook API key toggle for public/secured webhooks)
 - Logs viewer
 - Danger Zone (Settings → reset sessions, tasks, jobs, audit, or factory reset)
 - Display currency setting (Settings → Interface): converts USD costs to BRL, EUR, CAD, JPY, GBP, AUD, CHF, ARS, or any custom currency
@@ -430,6 +432,10 @@ audio:
     voice: Kore              # voice name (provider-specific)
     style_prompt: ""         # optional tone/style prefix (Gemini only)
 
+gws:                         # Google Workspace integration
+  enabled: true              # sync and use GWS skills (default: true)
+  service_account_json: ""   # path to Google Service Account JSON key
+
 currency:                    # display currency for cost dashboards
   code: USD                  # ISO 4217 code (e.g. BRL, EUR)
   symbol: $                  # symbol shown in UI
@@ -519,6 +525,8 @@ Generic Morpheus overrides (selected):
 | `MORPHEUS_DISCORD_ALLOWED_USERS` | `channels.discord.allowedUsers` |
 | `MORPHEUS_UI_ENABLED` | `ui.enabled` |
 | `MORPHEUS_UI_PORT` | `ui.port` |
+| `MORPHEUS_GWS_ENABLED` | `gws.enabled` |
+| `MORPHEUS_GWS_SERVICE_ACCOUNT_JSON` | `gws.service_account_json` |
 | `MORPHEUS_LOGGING_ENABLED` | `logging.enabled` |
 | `MORPHEUS_LOGGING_LEVEL` | `logging.level` |
 | `MORPHEUS_LOGGING_RETENTION` | `logging.retention` |
@@ -619,6 +627,87 @@ Copy them to your skills directory:
 cp -r examples/skills/* ~/.morpheus/skills/
 ```
 
+## Google Workspace (GWS) Integration
+
+Morpheus integrates with Google Workspace via the `gws` CLI tool. 102 built-in skills provide structured instructions for automating Gmail, Drive, Sheets, Calendar, Docs, Tasks, and more.
+
+### Prerequisites
+
+1. **Install the `gws` CLI:**
+   ```bash
+   npm install -g @nicholasgriffintn/google-workspace-cli
+   ```
+
+2. **Create a Google Service Account:**
+   - Go to [Google Cloud Console](https://console.cloud.google.com/)
+   - Create or select a project
+   - Enable desired APIs (Gmail, Drive, Sheets, Calendar, Docs, etc.)
+   - IAM & Admin → Service Accounts → Create Service Account
+   - Grant the service account [Domain-Wide Delegation](https://developers.google.com/workspace/guides/create-credentials#service-account) if needed
+   - Create a JSON key and download it
+
+3. **Configure Morpheus:**
+
+   Add to `~/.morpheus/zaion.yaml`:
+   ```yaml
+   gws:
+     enabled: true
+     service_account_json: /path/to/your-service-account-key.json
+   ```
+
+   Or via environment variable:
+   ```bash
+   MORPHEUS_GWS_SERVICE_ACCOUNT_JSON=/path/to/your-service-account-key.json
+   ```
+
+### How It Works
+
+GWS skills are synced automatically at startup from the built-in `gws-skills/skills/` directory to `~/.morpheus/skills/`. Skills are organized in four categories:
+
+| Category | Count | Description |
+|---|---|---|
+| **Services** | 17 | Core API skills (`gws-gmail`, `gws-drive`, `gws-sheets`, `gws-calendar`, `gws-docs`, `gws-tasks`, etc.) |
+| **Helpers** | 22 | Shortcut skills for common operations (`gws-gmail-send`, `gws-drive-upload`, `gws-sheets-append`, `gws-calendar-insert`) |
+| **Personas** | 10 | Role-based skill bundles (`persona-exec-assistant`, `persona-project-manager`, `persona-hr-coordinator`) |
+| **Recipes** | 42+ | Multi-step task sequences (`recipe-create-doc-from-template`, `recipe-send-team-announcement`, `recipe-plan-weekly-schedule`) |
+
+### Usage Examples
+
+Just ask Morpheus naturally — Apoc auto-detects GWS tasks and loads the right skills:
+
+```
+"Send an email to alice@example.com with the weekly report"
+"Create a Google Sheet named 'Q2 Budget' with columns for category, amount, and notes"
+"List my unread Gmail messages"
+"Add an event to my calendar tomorrow at 10 AM: Team standup"
+"Upload specs/spec.md to my Google Drive"
+```
+
+Oracle can also explicitly load skills via `load_skill` when needed.
+
+### Skill Customization
+
+GWS skills use smart sync with MD5 hashing:
+- **New skills**: Automatically copied on startup
+- **Unmodified skills**: Updated to latest version
+- **User-customized skills**: Preserved (your edits are never overwritten)
+
+To customize a skill, edit the `SKILL.md` file in `~/.morpheus/skills/<skill-name>/`. Your changes will be preserved across updates.
+
+### Docker
+
+Add the service account JSON as a volume mount:
+
+```bash
+docker run -d \
+  --name morpheus-agent \
+  -p 3333:3333 \
+  -e MORPHEUS_GWS_SERVICE_ACCOUNT_JSON=/root/.morpheus/gws/credentials.json \
+  -v /path/to/your-key.json:/root/.morpheus/gws/credentials.json:ro \
+  -v morpheus_data:/root/.morpheus \
+  morpheus
+```
+
 ## Link — Document RAG
 
 Link is a documentation specialist subagent that provides RAG (Retrieval-Augmented Generation) over user documents.
@@ -810,8 +899,14 @@ src/
   runtime/
     container.ts         # ServiceContainer — DI composition root
     oracle.ts            # Orchestration brain
+    gws-sync.ts          # Smart sync of built-in GWS skills
+    display.ts           # Activity event emission for real-time visualization
     ports/               # Port interfaces (INotifier, ITaskEnqueuer, IChatHistory, ILLMProviderFactory, IAuditEmitter)
     adapters/            # Concrete adapter implementations for ports
+    skills/
+      registry.ts        # SkillRegistry singleton — manages loaded skills
+      loader.ts          # Discovers and parses SKILL.md files
+      tool.ts            # load_skill tool for Oracle
     providers/
       factory.ts         # ProviderFactory — strategy-based LLM creation
       strategies.ts      # IProviderStrategy + per-provider implementations

package/dist/channels/telegram.js

@@ -266,13 +266,42 @@ export class TelegramAdapter {
                     // Send "typing" status
                     await ctx.sendChatAction('typing');
                     const sessionId = await this.getSessionForUser(userId);
-                    // Process with Agent
-                    const response = await this.oracle.chat(text, undefined, false, {
+                    // Process with Agent - with a 30s timeout to avoid blocking the bot's update loop.
+                    const CHAT_TIMEOUT_MS = 30000;
+                    let timeoutTriggered = false;
+                    const chatPromise = this.oracle.chat(text, undefined, false, {
                         origin_channel: 'telegram',
                         session_id: sessionId,
                         origin_message_id: String(ctx.message.message_id),
                         origin_user_id: userId,
                     });
+                    const response = await Promise.race([
+                        chatPromise,
+                        new Promise((resolve) => setTimeout(() => {
+                            timeoutTriggered = true;
+                            resolve(null);
+                        }, CHAT_TIMEOUT_MS))
+                    ]);
+                    if (timeoutTriggered) {
+                        await ctx.reply("⏳ I'm still working on that, it's taking a bit longer than usual. I'll send the response as soon as it's ready!");
+                        // Wait for actual response in background
+                        const finalResponse = await chatPromise;
+                        if (finalResponse) {
+                            const rich = await toTelegramRichText(finalResponse);
+                            for (const chunk of rich.chunks) {
+                                try {
+                                    await ctx.reply(chunk, { parse_mode: rich.parse_mode });
+                                }
+                                catch {
+                                    const plain = stripHtmlTags(chunk).slice(0, 4096);
+                                    if (plain)
+                                        await ctx.reply(plain);
+                                }
+                            }
+                            this.display.log(`Responded to @${user} (delayed): ${finalResponse.slice(0, 50)}...`, { source: 'Telegram' });
+                        }
+                        return;
+                    }
                     if (response) {
                         const rich = await toTelegramRichText(response);
                         for (const chunk of rich.chunks) {
@@ -285,7 +314,7 @@ export class TelegramAdapter {
                                     await ctx.reply(plain);
                             }
                         }
-                        this.display.log(`Responded to @${user}: ${response}`, { source: 'Telegram' });
+                        this.display.log(`Responded to @${user}: ${response.slice(0, 50)}...`, { source: 'Telegram' });
                     }
                 }
                 catch (error) {
@@ -389,126 +418,33 @@ export class TelegramAdapter {
                     await ctx.reply(`🎤 Transcription: "${text}"`);
                     await ctx.sendChatAction('typing');
                     const sessionId = await this.getSessionForUser(userId);
-                    // Process with Agent
-                    const response = await this.oracle.chat(text, usage, true, {
+                    // Process with Agent - with a 30s timeout to avoid blocking the bot's update loop.
+                    const CHAT_TIMEOUT_MS = 30000;
+                    let timeoutTriggered = false;
+                    const chatPromise = this.oracle.chat(text, usage, true, {
                         origin_channel: 'telegram',
                         session_id: sessionId,
                         origin_message_id: String(ctx.message.message_id),
                         origin_user_id: userId,
                     });
-                    // if (listeningMsg) {
-                    //   try {
-                    //     await ctx.telegram.deleteMessage(ctx.chat.id, listeningMsg.message_id);
-                    //   } catch (e) {
-                    //     // Ignore delete error
-                    //   }
-                    // }
-                    if (response) {
-                        const ttsConfig = config.audio.tts;
-                        if (ttsConfig?.enabled && this.ttsTelephonist?.synthesize) {
-                            // TTS path: synthesize and send as voice message
-                            let ttsFilePath = null;
-                            const ttsStart = Date.now();
-                            try {
-                                this.display.startActivity('telephonist', 'Synthesizing TTS...');
-                                const ttsApiKey = getUsableApiKey(ttsConfig.apiKey) ||
-                                    getUsableApiKey(config.audio.apiKey) ||
-                                    (config.llm.provider === (ttsConfig.provider === 'google' ? 'gemini' : ttsConfig.provider)
-                                        ? getUsableApiKey(config.llm.api_key) : undefined);
-                                const ttsResult = await this.ttsTelephonist.synthesize(response, ttsApiKey || '', ttsConfig.voice, ttsConfig.style_prompt);
-                                ttsFilePath = ttsResult.filePath;
-                                const ttsDurationMs = Date.now() - ttsStart;
-                                this.display.endActivity('telephonist', true);
-                                // OGG/Opus → replyWithVoice; everything else (mp3, wav) → replyWithAudio
-                                const isOgg = ttsResult.mimeType.includes('ogg') || ttsResult.mimeType.includes('opus');
-                                if (isOgg) {
-                                    await ctx.replyWithVoice({ source: ttsFilePath });
-                                }
-                                else {
-                                    await ctx.replyWithAudio({ source: ttsFilePath });
-                                }
-                                this.display.log(`Responded to @${user} (TTS audio)`, { source: 'Telegram' });
-                                // Audit TTS success
-                                try {
-                                    const auditSessionId = await this.getSessionForUser(userId);
-                                    AuditRepository.getInstance().insert({
-                                        session_id: auditSessionId,
-                                        event_type: 'telephonist',
-                                        agent: 'telephonist',
-                                        provider: ttsConfig.provider,
-                                        model: ttsConfig.model,
-                                        input_tokens: ttsResult.usage.input_tokens || null,
-                                        output_tokens: ttsResult.usage.output_tokens || null,
-                                        duration_ms: ttsDurationMs,
-                                        status: 'success',
-                                        metadata: {
-                                            operation: 'tts',
-                                            characters: response.length,
-                                            voice: ttsConfig.voice,
-                                            user,
-                                        },
-                                    });
-                                }
-                                catch {
-                                    // Audit failure never breaks the main flow
-                                }
-                            }
-                            catch (ttsError) {
-                                this.display.endActivity('telephonist', false);
-                                const ttsDetail = ttsError?.message || String(ttsError);
-                                this.display.log(`TTS synthesis failed for @${user}: ${ttsDetail} — falling back to text`, { source: 'Telephonist', level: 'warning' });
-                                // Audit TTS failure
-                                try {
-                                    const auditSessionId = await this.getSessionForUser(userId);
-                                    AuditRepository.getInstance().insert({
-                                        session_id: auditSessionId,
-                                        event_type: 'telephonist',
-                                        agent: 'telephonist',
-                                        provider: ttsConfig.provider,
-                                        model: ttsConfig.model,
-                                        duration_ms: Date.now() - ttsStart,
-                                        status: 'error',
-                                        metadata: { operation: 'tts', error: ttsDetail, user },
-                                    });
-                                }
-                                catch {
-                                    // Audit failure never breaks the main flow
-                                }
-                                // Fallback to text
-                                const rich = await toTelegramRichText(response);
-                                for (const chunk of rich.chunks) {
-                                    try {
-                                        await ctx.reply(chunk, { parse_mode: rich.parse_mode });
-                                    }
-                                    catch {
-                                        const plain = stripHtmlTags(chunk).slice(0, 4096);
-                                        if (plain)
-                                            await ctx.reply(plain);
-                                    }
-                                }
-                            }
-                            finally {
-                                // Cleanup TTS temp file
-                                if (ttsFilePath) {
-                                    await fs.promises.unlink(ttsFilePath).catch(() => { });
-                                }
-                            }
-                        }
-                        else {
-                            // Text path (TTS disabled)
-                            const rich = await toTelegramRichText(response);
-                            for (const chunk of rich.chunks) {
-                                try {
-                                    await ctx.reply(chunk, { parse_mode: rich.parse_mode });
-                                }
-                                catch {
-                                    const plain = stripHtmlTags(chunk).slice(0, 4096);
-                                    if (plain)
-                                        await ctx.reply(plain);
-                                }
-                            }
-                            this.display.log(`Responded to @${user} (via audio)`, { source: 'Telegram' });
+                    const response = await Promise.race([
+                        chatPromise,
+                        new Promise((resolve) => setTimeout(() => {
+                            timeoutTriggered = true;
+                            resolve(null);
+                        }, CHAT_TIMEOUT_MS))
+                    ]);
+                    if (timeoutTriggered) {
+                        await ctx.reply("⏳ I'm still working on that, it's taking a bit longer than usual. I'll send the response as soon as it's ready!");
+                        // Wait for actual response in background
+                        const finalResponse = await chatPromise;
+                        if (finalResponse) {
+                            await this.handleAgentResponse(ctx, finalResponse, config, user, userId);
                         }
+                        return;
+                    }
+                    if (response) {
+                        await this.handleAgentResponse(ctx, response, config, user, userId);
                     }
                 }
                 catch (error) {
@@ -876,11 +812,17 @@ export class TelegramAdapter {
                     ctx.answerCbQuery(`Error: ${error.message}`).catch(() => { });
                 }
             });
-            this.bot.launch().catch((err) => {
-                if (this.isConnected) {
-                    this.display.log(`Telegram bot error: ${err}`, { source: 'Telegram', level: 'error' });
+            // Global error handler to prevent crashes on long-running tasks or network errors
+            this.bot.catch((err, ctx) => {
+                const updateId = ctx?.update?.update_id;
+                const errorMsg = err?.message || String(err);
+                this.display.log(`Unhandled Telegram error (Update: ${updateId}): ${errorMsg}`, { source: 'Telegram', level: 'error' });
+                // If it's a timeout error, notify the user if possible
+                if (errorMsg.includes('timeout') || errorMsg.includes('90000')) {
+                    ctx.reply("⏳ Sorry, that request is taking longer than expected. I'm still working on it, but the connection timed out. I'll notify you once it's done.").catch(() => { });
                 }
             });
+            this.launchBot();
             this.isConnected = true;
             // Check if there's a restart notification to send
             this.checkAndSendRestartNotification().catch((err) => {
@@ -1955,4 +1897,107 @@ How can I assist you today?`;
             await ctx.reply('An error occurred while retrieving the list of MCP servers\\. Please check the logs for more details\\.', { parse_mode: 'MarkdownV2' });
         }
     }
+    launchBot() {
+        if (!this.bot)
+            return;
+        this.bot.launch().catch((err) => {
+            this.display.log(`Telegram bot error: ${err.message || String(err)}`, { source: 'Telegram', level: 'error' });
+            if (this.isConnected) {
+                this.display.log('Attempting to restart Telegram bot in 5 seconds...', { source: 'Telegram', level: 'info' });
+                setTimeout(() => {
+                    if (this.isConnected)
+                        this.launchBot();
+                }, 5000);
+            }
+        });
+    }
+    async handleAgentResponse(ctx, response, config, user, userId) {
+        const ttsConfig = config.audio.tts;
+        if (ttsConfig?.enabled && this.ttsTelephonist?.synthesize) {
+            // TTS path: synthesize and send as voice message
+            let ttsFilePath = null;
+            const ttsStart = Date.now();
+            try {
+                this.display.startActivity('telephonist', 'Synthesizing TTS...');
+                const ttsApiKey = getUsableApiKey(ttsConfig.apiKey) ||
+                    getUsableApiKey(config.audio.apiKey) ||
+                    (config.llm.provider === (ttsConfig.provider === 'google' ? 'gemini' : ttsConfig.provider)
+                        ? getUsableApiKey(config.llm.api_key) : undefined);
+                const ttsResult = await this.ttsTelephonist.synthesize(response, ttsApiKey || '', ttsConfig.voice, ttsConfig.style_prompt);
+                ttsFilePath = ttsResult.filePath;
+                const ttsDurationMs = Date.now() - ttsStart;
+                this.display.endActivity('telephonist', true);
+                // OGG/Opus → replyWithVoice; everything else (mp3, wav) → replyWithAudio
+                const isOgg = ttsResult.mimeType.includes('ogg') || ttsResult.mimeType.includes('opus');
+                if (isOgg) {
+                    await ctx.replyWithVoice({ source: ttsFilePath });
+                }
+                else {
+                    await ctx.replyWithAudio({ source: ttsFilePath });
+                }
+                this.display.log(`Responded to @${user} (TTS audio)`, { source: 'Telegram' });
+                // Audit TTS success
+                try {
+                    const auditSessionId = await this.getSessionForUser(userId);
+                    AuditRepository.getInstance().insert({
+                        session_id: auditSessionId,
+                        event_type: 'telephonist',
+                        agent: 'telephonist',
+                        provider: ttsConfig.provider,
+                        model: ttsConfig.model,
+                        input_tokens: ttsResult.usage.input_tokens || null,
+                        output_tokens: ttsResult.usage.output_tokens || null,
+                        duration_ms: ttsDurationMs,
+                        status: 'success',
+                        metadata: {
+                            operation: 'tts',
+                            characters: response.length,
+                            voice: ttsConfig.voice,
+                            user,
+                        },
+                    });
+                }
+                catch {
+                    // Audit failure never breaks the main flow
+                }
+            }
+            catch (ttsError) {
+                this.display.endActivity('telephonist', false);
+                const ttsDetail = ttsError?.message || String(ttsError);
+                this.display.log(`TTS synthesis failed for @${user}: ${ttsDetail} — falling back to text`, { source: 'Telephonist', level: 'warning' });
+                // Fallback to text
+                const rich = await toTelegramRichText(response);
+                for (const chunk of rich.chunks) {
+                    try {
+                        await ctx.reply(chunk, { parse_mode: rich.parse_mode });
+                    }
+                    catch {
+                        const plain = stripHtmlTags(chunk).slice(0, 4096);
+                        if (plain)
+                            await ctx.reply(plain);
+                    }
+                }
+            }
+            finally {
+                if (ttsFilePath) {
+                    await fs.promises.unlink(ttsFilePath).catch(() => { });
+                }
+            }
+        }
+        else {
+            // Text path
+            const rich = await toTelegramRichText(response);
+            for (const chunk of rich.chunks) {
+                try {
+                    await ctx.reply(chunk, { parse_mode: rich.parse_mode });
+                }
+                catch {
+                    const plain = stripHtmlTags(chunk).slice(0, 4096);
+                    if (plain)
+                        await ctx.reply(plain);
+                }
+            }
+            this.display.log(`Responded to @${user}`, { source: 'Telegram' });
+        }
+    }
 }

package/dist/cli/commands/restart.js

@@ -9,6 +9,7 @@ import { renderBanner } from '../utils/render.js';
 import { TelegramAdapter } from '../../channels/telegram.js';
 import { ChannelRegistry } from '../../channels/registry.js';
 import { PATHS } from '../../config/paths.js';
+import { SkillRegistry } from '../../runtime/skills/index.js';
 import { Oracle } from '../../runtime/oracle.js';
 import { ProviderError } from '../../runtime/errors.js';
 import { HttpServer } from '../../http/server.js';
@@ -87,6 +88,17 @@ export const restartCommand = new Command('restart')
         if (options.ui) {
             display.log(chalk.blue(`Web UI enabled to port ${options.port}`), { source: 'Zaion' });
         }
+        // Initialize SkillRegistry before Oracle (so skills are available in system prompt)
+        try {
+            const skillRegistry = SkillRegistry.getInstance();
+            await skillRegistry.load();
+            const loadedSkills = skillRegistry.getAll();
+            const enabledCount = skillRegistry.getEnabled().length;
+            display.log(chalk.green(`✓ Skills loaded: ${loadedSkills.length} total, ${enabledCount} enabled`), { source: 'Skills' });
+        }
+        catch (err) {
+            display.log(chalk.yellow(`Skills initialization warning: ${err.message}`), { source: 'Skills' });
+        }
         // Initialize Oracle
         const oracle = new Oracle(config);
         try {

package/dist/config/manager.js

@@ -343,6 +343,11 @@ export class ConfigManager {
                 max_active_jobs: resolveNumeric('MORPHEUS_CHRONOS_MAX_ACTIVE_JOBS', config.chronos.max_active_jobs, 100),
             };
         }
+        // Apply precedence to GWS config
+        const gwsConfig = {
+            service_account_json: resolveString('MORPHEUS_GWS_SERVICE_ACCOUNT_JSON', config.gws?.service_account_json, ''),
+            enabled: resolveBoolean('MORPHEUS_GWS_ENABLED', config.gws?.enabled, true),
+        };
         // Apply precedence to DevKit config
         // Migration: if devkit is absent but apoc.working_dir exists, migrate it
         const rawDevKit = config.devkit ?? {};
@@ -409,6 +414,22 @@ export class ConfigManager {
     async save(newConfig) {
         // Deep merge or overwrite? simpler to overwrite for now or merge top level
         let updated = { ...this.config, ...newConfig };
+        // If GWS credentials string is provided, save it to file
+        if (newConfig.gws?.service_account_json_content) {
+            const content = newConfig.gws.service_account_json_content;
+            try {
+                // Validate JSON
+                JSON.parse(content);
+                await fs.ensureDir(PATHS.gws);
+                await fs.writeFile(PATHS.gwsCredentials, content, 'utf8');
+                // Update the path in config and remove the raw content
+                newConfig.gws.service_account_json = PATHS.gwsCredentials;
+                delete newConfig.gws.service_account_json_content;
+            }
+            catch (err) {
+                throw new Error(`Invalid Google Service Account JSON: ${err instanceof Error ? err.message : String(err)}`);
+            }
+        }
         // Encrypt API keys before saving if MORPHEUS_SECRET is set
         updated = this.encryptAgentApiKeys(updated);
         // Validate before saving
@@ -524,7 +545,7 @@ export class ConfigManager {
             sandbox_dir: process.cwd(),
             readonly_mode: false,
             allowed_shell_commands: [],
-            allowed_paths: [PATHS.docs, PATHS.skills],
+            allowed_paths: [PATHS.docs, PATHS.skills, PATHS.gws],
             enable_filesystem: true,
             enable_shell: true,
             enable_git: true,
@@ -535,12 +556,23 @@ export class ConfigManager {
             const merged = { ...defaults, ...this.config.devkit };
             // Ensure allowed_paths has default if empty or undefined
             if (!merged.allowed_paths?.length) {
-                merged.allowed_paths = [PATHS.docs, PATHS.skills];
+                merged.allowed_paths = [PATHS.docs, PATHS.skills, PATHS.gws];
+            }
+            else if (!merged.allowed_paths.includes(PATHS.gws)) {
+                // Force inclusion of GWS path if it's not there
+                merged.allowed_paths.push(PATHS.gws);
             }
             return merged;
         }
         return defaults;
     }
+    getGwsConfig() {
+        const defaults = { enabled: true };
+        if (this.config.gws) {
+            return { ...defaults, ...this.config.gws };
+        }
+        return defaults;
+    }
     /**
      * Returns encryption status for all agent API keys.
      */

package/dist/config/paths.js

@@ -16,6 +16,8 @@ export const PATHS = {
     mcps: path.join(MORPHEUS_ROOT, 'mcps.json'),
     skills: path.join(MORPHEUS_ROOT, 'skills'),
     docs: path.join(MORPHEUS_ROOT, 'docs'),
+    gws: path.join(MORPHEUS_ROOT, 'gws'),
+    gwsCredentials: path.join(MORPHEUS_ROOT, 'gws', 'credentials.json'),
     shortMemoryDb: path.join(MORPHEUS_ROOT, 'memory', 'short-memory.db'),
     trinityDb: path.join(MORPHEUS_ROOT, 'memory', 'trinity.db'),
     satiDb: path.join(MORPHEUS_ROOT, 'memory', 'sati-memory.db'),

package/dist/config/schemas.js

@@ -98,6 +98,11 @@ export const CurrencyConfigSchema = z.object({
     symbol: z.string().min(1).default('$'),
     rate: z.number().positive().default(1.0),
 });
+export const GwsConfigSchema = z.object({
+    service_account_json: z.string().optional(),
+    service_account_json_content: z.string().optional(),
+    enabled: z.boolean().default(true),
+});
 // Zod Schema matching MorpheusConfig interface
 export const ConfigSchema = z.object({
     agent: z.object({
@@ -123,6 +128,7 @@ export const ConfigSchema = z.object({
     chronos: ChronosConfigSchema.optional(),
     devkit: DevKitConfigSchema.optional(),
     smiths: SmithsConfigSchema.optional(),
+    gws: GwsConfigSchema.optional(),
     setup: SetupConfigSchema.optional(),
     currency: CurrencyConfigSchema.optional(),
     verbose_mode: z.boolean().default(true),