multi-gws 0.0.1

package/LICENSE

@@ -0,0 +1,21 @@
+MIT License
+
+Copyright (c) 2026 mgws contributors
+
+Permission is hereby granted, free of charge, to any person obtaining a copy
+of this software and associated documentation files (the "Software"), to deal
+in the Software without restriction, including without limitation the rights
+to use, copy, modify, merge, publish, distribute, sublicense, and/or sell
+copies of the Software, and to permit persons to whom the Software is
+furnished to do so, subject to the following conditions:
+
+The above copyright notice and this permission notice shall be included in all
+copies or substantial portions of the Software.
+
+THE SOFTWARE IS PROVIDED "AS IS", WITHOUT WARRANTY OF ANY KIND, EXPRESS OR
+IMPLIED, INCLUDING BUT NOT LIMITED TO THE WARRANTIES OF MERCHANTABILITY,
+FITNESS FOR A PARTICULAR PURPOSE AND NONINFRINGEMENT. IN NO EVENT SHALL THE
+AUTHORS OR COPYRIGHT HOLDERS BE LIABLE FOR ANY CLAIM, DAMAGES OR OTHER
+LIABILITY, WHETHER IN AN ACTION OF CONTRACT, TORT OR OTHERWISE, ARISING FROM,
+OUT OF OR IN CONNECTION WITH THE SOFTWARE OR THE USE OR OTHER DEALINGS IN THE
+SOFTWARE.

package/README.md

@@ -0,0 +1,51 @@
+# multi-gws
+
+`multi-gws` provides the `mgws` command, a multi-account safety wrapper for the [Google Workspace CLI](https://github.com/googleworkspace/cli). It selects repository-local account credentials, blocks permanent deletion, and requires confirmation for consequential operations while forwarding the rest of the `gws` command surface.
+
+## Requirements
+
+- Node.js 22.9 or newer
+- npm 11
+
+## Usage
+
+Run a Google Workspace command with a connected account:
+
+```bash
+mgws run <account-slug> <gws arguments...>
+```
+
+Add or reconnect an account:
+
+```bash
+mgws account add <email-address> --gmail=<none|read|manage> --drive=<none|read|manage>
+```
+
+`mgws` treats the current working directory as the workspace. Shared OAuth configuration belongs at `credentials/google-oauth-client.json`; account state is stored under `accounts/<account-slug>/gws/`.
+
+## Development
+
+```bash
+npm install
+npm run check
+```
+
+The package uses TypeScript 7, Vitest, and Biome. Commander provides the CLI structure while `mgws run` preserves trailing `gws` arguments for forwarding.
+
+## Releasing
+
+Maintainers can run `npm run release` from a clean `main` branch. The command
+publishes the current version when it is not on npm yet; subsequent runs bump
+the patch version. Use `npm run release -- minor` or `npm run release -- major`
+to select a larger version bump. The workflow verifies the package, creates and
+pushes the Git tag, and publishes to npm using the current npm credentials.
+
+When npm requires a one-time password, provide the current code for that release:
+
+```bash
+NPM_CONFIG_OTP=<code> npm run release
+```
+
+## License
+
+MIT

package/dist/account-add.d.ts

@@ -0,0 +1,9 @@
+import type { AccountAccess } from "./account-permissions.js";
+export interface AddAccountOptions extends AccountAccess {
+    email: string;
+    login: boolean;
+    workspaceRoot?: string;
+}
+export declare function accountSlug(email: string): string;
+export declare function addAccount({ email, gmail, drive, login, workspaceRoot, }: AddAccountOptions): number;
+//# sourceMappingURL=account-add.d.ts.map

package/dist/account-add.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"account-add.d.ts","sourceRoot":"","sources":["../src/account-add.ts"],"names":[],"mappings":"AAUA,OAAO,KAAK,EAAE,aAAa,EAAE,MAAM,0BAA0B,CAAC;AAI9D,MAAM,WAAW,iBAAkB,SAAQ,aAAa;IACtD,KAAK,EAAE,MAAM,CAAC;IACd,KAAK,EAAE,OAAO,CAAC;IACf,aAAa,CAAC,EAAE,MAAM,CAAC;CACxB;AAqBD,wBAAgB,WAAW,CAAC,KAAK,EAAE,MAAM,GAAG,MAAM,CAgBjD;AAED,wBAAgB,UAAU,CAAC,EACzB,KAAK,EACL,KAAK,EACL,KAAK,EACL,KAAK,EACL,aAAa,GACd,EAAE,iBAAiB,GAAG,MAAM,CAmG5B"}

package/dist/account-add.js

@@ -0,0 +1,110 @@
+import { spawnSync } from "node:child_process";
+import { createHash } from "node:crypto";
+import { chmodSync, copyFileSync, lstatSync, mkdirSync, writeFileSync, } from "node:fs";
+import { join, resolve } from "node:path";
+import { resolveAccountScopes } from "./account-permissions.js";
+import { CliError, EXIT, errorCode } from "./errors.js";
+function isFile(path) {
+    try {
+        return lstatSync(path).isFile();
+    }
+    catch (error) {
+        if (errorCode(error) === "ENOENT")
+            return false;
+        throw error;
+    }
+}
+function pathExists(path) {
+    try {
+        lstatSync(path);
+        return true;
+    }
+    catch (error) {
+        if (errorCode(error) === "ENOENT")
+            return false;
+        throw error;
+    }
+}
+export function accountSlug(email) {
+    const normalizedEmail = email.toLowerCase();
+    const readableSlug = normalizedEmail
+        .replace(/[^a-z0-9]+/g, "-")
+        .replace(/^-+|-+$/g, "");
+    if (readableSlug.length === 0) {
+        throw new CliError(EXIT.usage, `could not derive an account slug from: ${email}`);
+    }
+    const fingerprint = createHash("sha256")
+        .update(normalizedEmail)
+        .digest("base64url")
+        .slice(0, 16);
+    return `${readableSlug}-${fingerprint}`;
+}
+export function addAccount({ email, gmail, drive, login, workspaceRoot, }) {
+    if (!/^[^@\s]+@[^@\s]+\.[^@\s]+$/.test(email)) {
+        throw new CliError(EXIT.usage, `invalid email address: ${email}`);
+    }
+    const scopes = resolveAccountScopes({ gmail, drive });
+    const slug = accountSlug(email);
+    const root = resolve(workspaceRoot ?? process.cwd());
+    const credentialsDir = join(root, "credentials");
+    const oauthClient = join(credentialsDir, "google-oauth-client.json");
+    const accountDir = join(root, "accounts", slug);
+    const configDir = join(accountDir, "gws");
+    const accountOauthClient = join(configDir, "client_secret.json");
+    const accessProfile = join(configDir, "access.json");
+    if (!isFile(oauthClient)) {
+        throw new CliError(EXIT.noInput, `OAuth client must be a regular file, not a symlink: ${oauthClient}`);
+    }
+    const credentialsDirectory = lstatSync(credentialsDir);
+    if (!credentialsDirectory.isDirectory() ||
+        credentialsDirectory.isSymbolicLink()) {
+        throw new CliError(EXIT.noInput, `credentials path must be a regular directory: ${credentialsDir}`);
+    }
+    chmodSync(credentialsDir, 0o700);
+    chmodSync(oauthClient, 0o600);
+    mkdirSync(configDir, { recursive: true, mode: 0o700 });
+    chmodSync(accountDir, 0o700);
+    chmodSync(configDir, 0o700);
+    if (pathExists(accountOauthClient)) {
+        const accountOauthClientFile = lstatSync(accountOauthClient);
+        if (!accountOauthClientFile.isFile() ||
+            accountOauthClientFile.isSymbolicLink()) {
+            throw new CliError(EXIT.noInput, `account OAuth client must be a regular file: ${accountOauthClient}`);
+        }
+    }
+    copyFileSync(oauthClient, accountOauthClient);
+    chmodSync(accountOauthClient, 0o600);
+    const saveAccessProfile = () => {
+        writeFileSync(accessProfile, `${JSON.stringify({ email, gmail, drive }, null, 2)}\n`, {
+            mode: 0o600,
+        });
+        chmodSync(accessProfile, 0o600);
+    };
+    console.log(`Account slug: ${slug}`);
+    console.log(`Gmail access: ${gmail}`);
+    console.log(`Drive access: ${drive}`);
+    if (!login) {
+        saveAccessProfile();
+        console.log("Skipped OAuth login (--no-login).");
+        return 0;
+    }
+    const result = spawnSync(process.execPath, [
+        process.argv[1] ?? "mgws",
+        "run",
+        slug,
+        "auth",
+        "login",
+        "--scopes",
+        scopes.join(","),
+    ], { cwd: root, stdio: "inherit" });
+    if (result.error) {
+        throw new CliError(EXIT.unavailable, `could not start OAuth login: ${result.error.message}`);
+    }
+    if (result.status !== null) {
+        if (result.status === 0)
+            saveAccessProfile();
+        return result.status;
+    }
+    throw new CliError(1, `OAuth login terminated by signal ${result.signal ?? "unknown"}`);
+}
+//# sourceMappingURL=account-add.js.map

package/dist/account-add.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"account-add.js","sourceRoot":"","sources":["../src/account-add.ts"],"names":[],"mappings":"AAAA,OAAO,EAAE,SAAS,EAAE,MAAM,oBAAoB,CAAC;AAC/C,OAAO,EAAE,UAAU,EAAE,MAAM,aAAa,CAAC;AACzC,OAAO,EACL,SAAS,EACT,YAAY,EACZ,SAAS,EACT,SAAS,EACT,aAAa,GACd,MAAM,SAAS,CAAC;AACjB,OAAO,EAAE,IAAI,EAAE,OAAO,EAAE,MAAM,WAAW,CAAC;AAE1C,OAAO,EAAE,oBAAoB,EAAE,MAAM,0BAA0B,CAAC;AAChE,OAAO,EAAE,QAAQ,EAAE,IAAI,EAAE,SAAS,EAAE,MAAM,aAAa,CAAC;AAQxD,SAAS,MAAM,CAAC,IAAY;IAC1B,IAAI,CAAC;QACH,OAAO,SAAS,CAAC,IAAI,CAAC,CAAC,MAAM,EAAE,CAAC;IAClC,CAAC;IAAC,OAAO,KAAK,EAAE,CAAC;QACf,IAAI,SAAS,CAAC,KAAK,CAAC,KAAK,QAAQ;YAAE,OAAO,KAAK,CAAC;QAChD,MAAM,KAAK,CAAC;IACd,CAAC;AACH,CAAC;AAED,SAAS,UAAU,CAAC,IAAY;IAC9B,IAAI,CAAC;QACH,SAAS,CAAC,IAAI,CAAC,CAAC;QAChB,OAAO,IAAI,CAAC;IACd,CAAC;IAAC,OAAO,KAAK,EAAE,CAAC;QACf,IAAI,SAAS,CAAC,KAAK,CAAC,KAAK,QAAQ;YAAE,OAAO,KAAK,CAAC;QAChD,MAAM,KAAK,CAAC;IACd,CAAC;AACH,CAAC;AAED,MAAM,UAAU,WAAW,CAAC,KAAa;IACvC,MAAM,eAAe,GAAG,KAAK,CAAC,WAAW,EAAE,CAAC;IAC5C,MAAM,YAAY,GAAG,eAAe;SACjC,OAAO,CAAC,aAAa,EAAE,GAAG,CAAC;SAC3B,OAAO,CAAC,UAAU,EAAE,EAAE,CAAC,CAAC;IAC3B,IAAI,YAAY,CAAC,MAAM,KAAK,CAAC,EAAE,CAAC;QAC9B,MAAM,IAAI,QAAQ,CAChB,IAAI,CAAC,KAAK,EACV,0CAA0C,KAAK,EAAE,CAClD,CAAC;IACJ,CAAC;IACD,MAAM,WAAW,GAAG,UAAU,CAAC,QAAQ,CAAC;SACrC,MAAM,CAAC,eAAe,CAAC;SACvB,MAAM,CAAC,WAAW,CAAC;SACnB,KAAK,CAAC,CAAC,EAAE,EAAE,CAAC,CAAC;IAChB,OAAO,GAAG,YAAY,IAAI,WAAW,EAAE,CAAC;AAC1C,CAAC;AAED,MAAM,UAAU,UAAU,CAAC,EACzB,KAAK,EACL,KAAK,EACL,KAAK,EACL,KAAK,EACL,aAAa,GACK;IAClB,IAAI,CAAC,4BAA4B,CAAC,IAAI,CAAC,KAAK,CAAC,EAAE,CAAC;QAC9C,MAAM,IAAI,QAAQ,CAAC,IAAI,CAAC,KAAK,EAAE,0BAA0B,KAAK,EAAE,CAAC,CAAC;IACpE,CAAC;IACD,MAAM,MAAM,GAAG,oBAAoB,CAAC,EAAE,KAAK,EAAE,KAAK,EAAE,CAAC,CAAC;IACtD,MAAM,IAAI,GAAG,WAAW,CAAC,KAAK,CAAC,CAAC;IAChC,MAAM,IAAI,GAAG,OAAO,CAAC,aAAa,IAAI,OAAO,CAAC,GAAG,EAAE,CAAC,CAAC;IACrD,MAAM,cAAc,GAAG,IAAI,CAAC,IAAI,EAAE,aAAa,CAAC,CAAC;IACjD,MAAM,WAAW,GAAG,IAAI,CAAC,cAAc,EAAE,0BAA0B,CAAC,CAAC;IACrE,MAAM,UAAU,GAAG,IAAI,CAAC,IAAI,EAAE,UAAU,EAAE,IAAI,CAAC,CAAC;IAChD,MAAM,SAAS,GAAG,IAAI,CAAC,UAAU,EAAE,KAAK,CAAC,CAAC;IAC1C,MAAM,kBAAkB,GAAG,IAAI,CAAC,SAAS,EAAE,oBAAoB,CAAC,CAAC;IACjE,MAAM,aAAa,GAAG,IAAI,CAAC,SAAS,EAAE,aAAa,CAAC,CAAC;IAErD,IAAI,CAAC,MAAM,CAAC,WAAW,CAAC,EAAE,CAAC;QACzB,MAAM,IAAI,QAAQ,CAChB,IAAI,CAAC,OAAO,EACZ,uDAAuD,WAAW,EAAE,CACrE,CAAC;IACJ,CAAC;IACD,MAAM,oBAAoB,GAAG,SAAS,CAAC,cAAc,CAAC,CAAC;IACvD,IACE,CAAC,oBAAoB,CAAC,WAAW,EAAE;QACnC,oBAAoB,CAAC,cAAc,EAAE,EACrC,CAAC;QACD,MAAM,IAAI,QAAQ,CAChB,IAAI,CAAC,OAAO,EACZ,iDAAiD,cAAc,EAAE,CAClE,CAAC;IACJ,CAAC;IACD,SAAS,CAAC,cAAc,EAAE,KAAK,CAAC,CAAC;IACjC,SAAS,CAAC,WAAW,EAAE,KAAK,CAAC,CAAC;IAE9B,SAAS,CAAC,SAAS,EAAE,EAAE,SAAS,EAAE,IAAI,EAAE,IAAI,EAAE,KAAK,EAAE,CAAC,CAAC;IACvD,SAAS,CAAC,UAAU,EAAE,KAAK,CAAC,CAAC;IAC7B,SAAS,CAAC,SAAS,EAAE,KAAK,CAAC,CAAC;IAE5B,IAAI,UAAU,CAAC,kBAAkB,CAAC,EAAE,CAAC;QACnC,MAAM,sBAAsB,GAAG,SAAS,CAAC,kBAAkB,CAAC,CAAC;QAC7D,IACE,CAAC,sBAAsB,CAAC,MAAM,EAAE;YAChC,sBAAsB,CAAC,cAAc,EAAE,EACvC,CAAC;YACD,MAAM,IAAI,QAAQ,CAChB,IAAI,CAAC,OAAO,EACZ,gDAAgD,kBAAkB,EAAE,CACrE,CAAC;QACJ,CAAC;IACH,CAAC;IACD,YAAY,CAAC,WAAW,EAAE,kBAAkB,CAAC,CAAC;IAC9C,SAAS,CAAC,kBAAkB,EAAE,KAAK,CAAC,CAAC;IAErC,MAAM,iBAAiB,GAAG,GAAS,EAAE;QACnC,aAAa,CACX,aAAa,EACb,GAAG,IAAI,CAAC,SAAS,CAAC,EAAE,KAAK,EAAE,KAAK,EAAE,KAAK,EAAE,EAAE,IAAI,EAAE,CAAC,CAAC,IAAI,EACvD;YACE,IAAI,EAAE,KAAK;SACZ,CACF,CAAC;QACF,SAAS,CAAC,aAAa,EAAE,KAAK,CAAC,CAAC;IAClC,CAAC,CAAC;IAEF,OAAO,CAAC,GAAG,CAAC,iBAAiB,IAAI,EAAE,CAAC,CAAC;IACrC,OAAO,CAAC,GAAG,CAAC,iBAAiB,KAAK,EAAE,CAAC,CAAC;IACtC,OAAO,CAAC,GAAG,CAAC,iBAAiB,KAAK,EAAE,CAAC,CAAC;IACtC,IAAI,CAAC,KAAK,EAAE,CAAC;QACX,iBAAiB,EAAE,CAAC;QACpB,OAAO,CAAC,GAAG,CAAC,mCAAmC,CAAC,CAAC;QACjD,OAAO,CAAC,CAAC;IACX,CAAC;IAED,MAAM,MAAM,GAAG,SAAS,CACtB,OAAO,CAAC,QAAQ,EAChB;QACE,OAAO,CAAC,IAAI,CAAC,CAAC,CAAC,IAAI,MAAM;QACzB,KAAK;QACL,IAAI;QACJ,MAAM;QACN,OAAO;QACP,UAAU;QACV,MAAM,CAAC,IAAI,CAAC,GAAG,CAAC;KACjB,EACD,EAAE,GAAG,EAAE,IAAI,EAAE,KAAK,EAAE,SAAS,EAAE,CAChC,CAAC;IACF,IAAI,MAAM,CAAC,KAAK,EAAE,CAAC;QACjB,MAAM,IAAI,QAAQ,CAChB,IAAI,CAAC,WAAW,EAChB,gCAAgC,MAAM,CAAC,KAAK,CAAC,OAAO,EAAE,CACvD,CAAC;IACJ,CAAC;IACD,IAAI,MAAM,CAAC,MAAM,KAAK,IAAI,EAAE,CAAC;QAC3B,IAAI,MAAM,CAAC,MAAM,KAAK,CAAC;YAAE,iBAAiB,EAAE,CAAC;QAC7C,OAAO,MAAM,CAAC,MAAM,CAAC;IACvB,CAAC;IACD,MAAM,IAAI,QAAQ,CAChB,CAAC,EACD,oCAAoC,MAAM,CAAC,MAAM,IAAI,SAAS,EAAE,CACjE,CAAC;AACJ,CAAC"}

package/dist/account-permissions.d.ts

@@ -0,0 +1,9 @@
+export declare const ACCESS_LEVELS: readonly ["none", "read", "manage"];
+export type AccessLevel = (typeof ACCESS_LEVELS)[number];
+export interface AccountAccess {
+    gmail: AccessLevel;
+    drive: AccessLevel;
+}
+export declare function isAccessLevel(value: string): value is AccessLevel;
+export declare function resolveAccountScopes({ gmail, drive, }: AccountAccess): string[];
+//# sourceMappingURL=account-permissions.d.ts.map

package/dist/account-permissions.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"account-permissions.d.ts","sourceRoot":"","sources":["../src/account-permissions.ts"],"names":[],"mappings":"AAAA,eAAO,MAAM,aAAa,YAAI,MAAM,EAAE,MAAM,EAAE,QAAQ,CAAU,CAAC;AAEjE,MAAM,MAAM,WAAW,GAAG,CAAC,OAAO,aAAa,CAAC,CAAC,MAAM,CAAC,CAAC;AAEzD,MAAM,WAAW,aAAa;IAC5B,KAAK,EAAE,WAAW,CAAC;IACnB,KAAK,EAAE,WAAW,CAAC;CACpB;AAkBD,wBAAgB,aAAa,CAAC,KAAK,EAAE,MAAM,GAAG,KAAK,IAAI,WAAW,CAEjE;AAED,wBAAgB,oBAAoB,CAAC,EACnC,KAAK,EACL,KAAK,GACN,EAAE,aAAa,GAAG,MAAM,EAAE,CAM1B"}

package/dist/account-permissions.js

@@ -0,0 +1,25 @@
+export const ACCESS_LEVELS = ["none", "read", "manage"];
+const GMAIL_SCOPES = {
+    none: [],
+    read: ["https://www.googleapis.com/auth/gmail.readonly"],
+    manage: [
+        "https://www.googleapis.com/auth/gmail.modify",
+        "https://www.googleapis.com/auth/gmail.labels",
+        "https://www.googleapis.com/auth/gmail.settings.basic",
+    ],
+};
+const DRIVE_SCOPES = {
+    none: [],
+    read: ["https://www.googleapis.com/auth/drive.readonly"],
+    manage: ["https://www.googleapis.com/auth/drive"],
+};
+export function isAccessLevel(value) {
+    return ACCESS_LEVELS.includes(value);
+}
+export function resolveAccountScopes({ gmail, drive, }) {
+    if (gmail === "none" && drive === "none") {
+        throw new RangeError("at least one of Gmail or Drive must be enabled");
+    }
+    return [...GMAIL_SCOPES[gmail], ...DRIVE_SCOPES[drive]];
+}
+//# sourceMappingURL=account-permissions.js.map

package/dist/account-permissions.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"account-permissions.js","sourceRoot":"","sources":["../src/account-permissions.ts"],"names":[],"mappings":"AAAA,MAAM,CAAC,MAAM,aAAa,GAAG,CAAC,MAAM,EAAE,MAAM,EAAE,QAAQ,CAAU,CAAC;AASjE,MAAM,YAAY,GAA2C;IAC3D,IAAI,EAAE,EAAE;IACR,IAAI,EAAE,CAAC,gDAAgD,CAAC;IACxD,MAAM,EAAE;QACN,8CAA8C;QAC9C,8CAA8C;QAC9C,sDAAsD;KACvD;CACF,CAAC;AAEF,MAAM,YAAY,GAA2C;IAC3D,IAAI,EAAE,EAAE;IACR,IAAI,EAAE,CAAC,gDAAgD,CAAC;IACxD,MAAM,EAAE,CAAC,uCAAuC,CAAC;CAClD,CAAC;AAEF,MAAM,UAAU,aAAa,CAAC,KAAa;IACzC,OAAO,aAAa,CAAC,QAAQ,CAAC,KAAoB,CAAC,CAAC;AACtD,CAAC;AAED,MAAM,UAAU,oBAAoB,CAAC,EACnC,KAAK,EACL,KAAK,GACS;IACd,IAAI,KAAK,KAAK,MAAM,IAAI,KAAK,KAAK,MAAM,EAAE,CAAC;QACzC,MAAM,IAAI,UAAU,CAAC,gDAAgD,CAAC,CAAC;IACzE,CAAC;IAED,OAAO,CAAC,GAAG,YAAY,CAAC,KAAK,CAAC,EAAE,GAAG,YAAY,CAAC,KAAK,CAAC,CAAC,CAAC;AAC1D,CAAC"}

package/dist/cli.d.ts

@@ -0,0 +1,3 @@
+#!/usr/bin/env node
+export {};
+//# sourceMappingURL=cli.d.ts.map

package/dist/cli.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"cli.d.ts","sourceRoot":"","sources":["../src/cli.ts"],"names":[],"mappings":""}

package/dist/cli.js

@@ -0,0 +1,93 @@
+#!/usr/bin/env node
+import { readFileSync } from "node:fs";
+import { Command, CommanderError, Option } from "commander";
+import { addAccount } from "./account-add.js";
+import { ACCESS_LEVELS, isAccessLevel } from "./account-permissions.js";
+import { CliError, EXIT } from "./errors.js";
+import { runGws } from "./run.js";
+const packageMetadata = JSON.parse(readFileSync(new URL("../package.json", import.meta.url), "utf8"));
+function accessLevel(value) {
+    if (!isAccessLevel(value)) {
+        throw new CommanderError(EXIT.usage, "mgws.invalidAccess", `expected one of: ${ACCESS_LEVELS.join(", ")}`);
+    }
+    return value;
+}
+const program = new Command()
+    .name("mgws")
+    .description(packageMetadata.description)
+    .version(packageMetadata.version)
+    .showHelpAfterError()
+    .exitOverride();
+program
+    .command("run")
+    .description("Run gws with an isolated account and safety policy")
+    .argument("<account>", "account slug")
+    .argument("<gws-arguments...>", "arguments forwarded to gws")
+    .option("--confirm", "confirm an action that changes external state")
+    .allowUnknownOption()
+    .action((account, gwsArguments, options) => {
+    process.exitCode = runGws({
+        account,
+        confirmed: options.confirm === true,
+        gwsArguments,
+    });
+});
+const account = program
+    .command("account")
+    .description("Manage isolated Google accounts");
+account
+    .command("add")
+    .description("Connect a Google account")
+    .argument("<email>", "Google account email address")
+    .addOption(new Option("--gmail <level>", "Gmail permission level")
+    .argParser(accessLevel)
+    .makeOptionMandatory())
+    .addOption(new Option("--drive <level>", "Drive permission level")
+    .argParser(accessLevel)
+    .makeOptionMandatory())
+    .option("--no-login", "create account state without starting OAuth")
+    .action((email, options) => {
+    if (!isAccessLevel(options.gmail) || !isAccessLevel(options.drive)) {
+        throw new CliError(EXIT.usage, "invalid permission level");
+    }
+    process.exitCode = addAccount({
+        email,
+        gmail: options.gmail,
+        drive: options.drive,
+        login: options.login,
+    });
+});
+try {
+    const rawArguments = process.argv.slice(2);
+    const accountSlug = rawArguments[1];
+    if (rawArguments[0] === "run" &&
+        accountSlug !== undefined &&
+        accountSlug !== "--help" &&
+        accountSlug !== "-h") {
+        const gwsArguments = rawArguments.slice(2);
+        const confirmed = gwsArguments[0] === "--confirm";
+        if (confirmed)
+            gwsArguments.shift();
+        process.exitCode = runGws({
+            account: accountSlug,
+            confirmed,
+            gwsArguments,
+        });
+    }
+    else {
+        program.parse();
+    }
+}
+catch (error) {
+    if (error instanceof CliError) {
+        console.error(`mgws: ${error.message}`);
+        process.exitCode = error.status;
+    }
+    else if (error instanceof CommanderError) {
+        process.exitCode = error.exitCode;
+    }
+    else {
+        throw error;
+    }
+}
+//# sourceMappingURL=cli.js.map

package/dist/cli.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"cli.js","sourceRoot":"","sources":["../src/cli.ts"],"names":[],"mappings":";AAEA,OAAO,EAAE,YAAY,EAAE,MAAM,SAAS,CAAC;AACvC,OAAO,EAAE,OAAO,EAAE,cAAc,EAAE,MAAM,EAAE,MAAM,WAAW,CAAC;AAC5D,OAAO,EAAE,UAAU,EAAE,MAAM,kBAAkB,CAAC;AAC9C,OAAO,EAAE,aAAa,EAAE,aAAa,EAAE,MAAM,0BAA0B,CAAC;AACxE,OAAO,EAAE,QAAQ,EAAE,IAAI,EAAE,MAAM,aAAa,CAAC;AAC7C,OAAO,EAAE,MAAM,EAAE,MAAM,UAAU,CAAC;AAOlC,MAAM,eAAe,GAAG,IAAI,CAAC,KAAK,CAChC,YAAY,CAAC,IAAI,GAAG,CAAC,iBAAiB,EAAE,OAAO,IAAI,CAAC,GAAG,CAAC,EAAE,MAAM,CAAC,CAC/C,CAAC;AAErB,SAAS,WAAW,CAAC,KAAa;IAChC,IAAI,CAAC,aAAa,CAAC,KAAK,CAAC,EAAE,CAAC;QAC1B,MAAM,IAAI,cAAc,CACtB,IAAI,CAAC,KAAK,EACV,oBAAoB,EACpB,oBAAoB,aAAa,CAAC,IAAI,CAAC,IAAI,CAAC,EAAE,CAC/C,CAAC;IACJ,CAAC;IACD,OAAO,KAAK,CAAC;AACf,CAAC;AAED,MAAM,OAAO,GAAG,IAAI,OAAO,EAAE;KAC1B,IAAI,CAAC,MAAM,CAAC;KACZ,WAAW,CAAC,eAAe,CAAC,WAAW,CAAC;KACxC,OAAO,CAAC,eAAe,CAAC,OAAO,CAAC;KAChC,kBAAkB,EAAE;KACpB,YAAY,EAAE,CAAC;AAElB,OAAO;KACJ,OAAO,CAAC,KAAK,CAAC;KACd,WAAW,CAAC,oDAAoD,CAAC;KACjE,QAAQ,CAAC,WAAW,EAAE,cAAc,CAAC;KACrC,QAAQ,CAAC,oBAAoB,EAAE,4BAA4B,CAAC;KAC5D,MAAM,CAAC,WAAW,EAAE,+CAA+C,CAAC;KACpE,kBAAkB,EAAE;KACpB,MAAM,CACL,CACE,OAAe,EACf,YAAsB,EACtB,OAA8B,EAC9B,EAAE;IACF,OAAO,CAAC,QAAQ,GAAG,MAAM,CAAC;QACxB,OAAO;QACP,SAAS,EAAE,OAAO,CAAC,OAAO,KAAK,IAAI;QACnC,YAAY;KACb,CAAC,CAAC;AACL,CAAC,CACF,CAAC;AAEJ,MAAM,OAAO,GAAG,OAAO;KACpB,OAAO,CAAC,SAAS,CAAC;KAClB,WAAW,CAAC,iCAAiC,CAAC,CAAC;AAElD,OAAO;KACJ,OAAO,CAAC,KAAK,CAAC;KACd,WAAW,CAAC,0BAA0B,CAAC;KACvC,QAAQ,CAAC,SAAS,EAAE,8BAA8B,CAAC;KACnD,SAAS,CACR,IAAI,MAAM,CAAC,iBAAiB,EAAE,wBAAwB,CAAC;KACpD,SAAS,CAAC,WAAW,CAAC;KACtB,mBAAmB,EAAE,CACzB;KACA,SAAS,CACR,IAAI,MAAM,CAAC,iBAAiB,EAAE,wBAAwB,CAAC;KACpD,SAAS,CAAC,WAAW,CAAC;KACtB,mBAAmB,EAAE,CACzB;KACA,MAAM,CAAC,YAAY,EAAE,6CAA6C,CAAC;KACnE,MAAM,CACL,CACE,KAAa,EACb,OAAyD,EACzD,EAAE;IACF,IAAI,CAAC,aAAa,CAAC,OAAO,CAAC,KAAK,CAAC,IAAI,CAAC,aAAa,CAAC,OAAO,CAAC,KAAK,CAAC,EAAE,CAAC;QACnE,MAAM,IAAI,QAAQ,CAAC,IAAI,CAAC,KAAK,EAAE,0BAA0B,CAAC,CAAC;IAC7D,CAAC;IACD,OAAO,CAAC,QAAQ,GAAG,UAAU,CAAC;QAC5B,KAAK;QACL,KAAK,EAAE,OAAO,CAAC,KAAK;QACpB,KAAK,EAAE,OAAO,CAAC,KAAK;QACpB,KAAK,EAAE,OAAO,CAAC,KAAK;KACrB,CAAC,CAAC;AACL,CAAC,CACF,CAAC;AAEJ,IAAI,CAAC;IACH,MAAM,YAAY,GAAG,OAAO,CAAC,IAAI,CAAC,KAAK,CAAC,CAAC,CAAC,CAAC;IAC3C,MAAM,WAAW,GAAG,YAAY,CAAC,CAAC,CAAC,CAAC;IAEpC,IACE,YAAY,CAAC,CAAC,CAAC,KAAK,KAAK;QACzB,WAAW,KAAK,SAAS;QACzB,WAAW,KAAK,QAAQ;QACxB,WAAW,KAAK,IAAI,EACpB,CAAC;QACD,MAAM,YAAY,GAAG,YAAY,CAAC,KAAK,CAAC,CAAC,CAAC,CAAC;QAC3C,MAAM,SAAS,GAAG,YAAY,CAAC,CAAC,CAAC,KAAK,WAAW,CAAC;QAClD,IAAI,SAAS;YAAE,YAAY,CAAC,KAAK,EAAE,CAAC;QACpC,OAAO,CAAC,QAAQ,GAAG,MAAM,CAAC;YACxB,OAAO,EAAE,WAAW;YACpB,SAAS;YACT,YAAY;SACb,CAAC,CAAC;IACL,CAAC;SAAM,CAAC;QACN,OAAO,CAAC,KAAK,EAAE,CAAC;IAClB,CAAC;AACH,CAAC;AAAC,OAAO,KAAK,EAAE,CAAC;IACf,IAAI,KAAK,YAAY,QAAQ,EAAE,CAAC;QAC9B,OAAO,CAAC,KAAK,CAAC,SAAS,KAAK,CAAC,OAAO,EAAE,CAAC,CAAC;QACxC,OAAO,CAAC,QAAQ,GAAG,KAAK,CAAC,MAAM,CAAC;IAClC,CAAC;SAAM,IAAI,KAAK,YAAY,cAAc,EAAE,CAAC;QAC3C,OAAO,CAAC,QAAQ,GAAG,KAAK,CAAC,QAAQ,CAAC;IACpC,CAAC;SAAM,CAAC;QACN,MAAM,KAAK,CAAC;IACd,CAAC;AACH,CAAC"}

package/dist/errors.d.ts

@@ -0,0 +1,12 @@
+export declare const EXIT: {
+    readonly usage: 64;
+    readonly noInput: 66;
+    readonly unavailable: 69;
+    readonly noPermission: 77;
+};
+export declare class CliError extends Error {
+    readonly status: number;
+    constructor(status: number, message: string);
+}
+export declare function errorCode(error: unknown): string | undefined;
+//# sourceMappingURL=errors.d.ts.map

package/dist/errors.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"errors.d.ts","sourceRoot":"","sources":["../src/errors.ts"],"names":[],"mappings":"AAAA,eAAO,MAAM,IAAI;aACf,KAAK,EAAE,EAAE;aACT,OAAO,EAAE,EAAE;aACX,WAAW,EAAE,EAAE;aACf,YAAY,EAAE,EAAE;CACR,CAAC;AAEX,qBAAa,QAAS,SAAQ,KAAK;IAE/B,QAAQ,CAAC,MAAM,EAAE,MAAM;IADzB,YACW,MAAM,EAAE,MAAM,EACvB,OAAO,EAAE,MAAM,EAIhB;CACF;AAED,wBAAgB,SAAS,CAAC,KAAK,EAAE,OAAO,GAAG,MAAM,GAAG,SAAS,CAM5D"}

package/dist/errors.js

@@ -0,0 +1,22 @@
+export const EXIT = {
+    usage: 64,
+    noInput: 66,
+    unavailable: 69,
+    noPermission: 77,
+};
+export class CliError extends Error {
+    status;
+    constructor(status, message) {
+        super(message);
+        this.status = status;
+        this.name = "CliError";
+    }
+}
+export function errorCode(error) {
+    return error instanceof Error &&
+        "code" in error &&
+        typeof error.code === "string"
+        ? error.code
+        : undefined;
+}
+//# sourceMappingURL=errors.js.map

package/dist/errors.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"errors.js","sourceRoot":"","sources":["../src/errors.ts"],"names":[],"mappings":"AAAA,MAAM,CAAC,MAAM,IAAI,GAAG;IAClB,KAAK,EAAE,EAAE;IACT,OAAO,EAAE,EAAE;IACX,WAAW,EAAE,EAAE;IACf,YAAY,EAAE,EAAE;CACR,CAAC;AAEX,MAAM,OAAO,QAAS,SAAQ,KAAK;IAEtB,MAAM;IADjB,YACW,MAAc,EACvB,OAAe;QAEf,KAAK,CAAC,OAAO,CAAC,CAAC;sBAHN,MAAM;QAIf,IAAI,CAAC,IAAI,GAAG,UAAU,CAAC;IACzB,CAAC;CACF;AAED,MAAM,UAAU,SAAS,CAAC,KAAc;IACtC,OAAO,KAAK,YAAY,KAAK;QAC3B,MAAM,IAAI,KAAK;QACf,OAAO,KAAK,CAAC,IAAI,KAAK,QAAQ;QAC9B,CAAC,CAAC,KAAK,CAAC,IAAI;QACZ,CAAC,CAAC,SAAS,CAAC;AAChB,CAAC"}

package/dist/gws-command-policy.d.ts

@@ -0,0 +1,11 @@
+export type CommandPolicy = {
+    action: "allow";
+} | {
+    action: "confirm";
+    reason: string;
+} | {
+    action: "prohibit";
+    reason: string;
+};
+export declare function classifyGwsCommand(args: readonly string[]): CommandPolicy;
+//# sourceMappingURL=gws-command-policy.d.ts.map

package/dist/gws-command-policy.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"gws-command-policy.d.ts","sourceRoot":"","sources":["../src/gws-command-policy.ts"],"names":[],"mappings":"AAmCA,MAAM,MAAM,aAAa,GACrB;IAAE,MAAM,EAAE,OAAO,CAAA;CAAE,GACnB;IAAE,MAAM,EAAE,SAAS,CAAC;IAAC,MAAM,EAAE,MAAM,CAAA;CAAE,GACrC;IAAE,MAAM,EAAE,UAAU,CAAC;IAAC,MAAM,EAAE,MAAM,CAAA;CAAE,CAAC;AA0B3C,wBAAgB,kBAAkB,CAAC,IAAI,EAAE,SAAS,MAAM,EAAE,GAAG,aAAa,CA+CzE"}

package/dist/gws-command-policy.js

@@ -0,0 +1,97 @@
+const GMAIL_CONFIRM_ALIASES = new Set([
+    "+send",
+    "+reply",
+    "+reply-all",
+    "+forward",
+]);
+const GMAIL_PROHIBITED_METHODS = new Set([
+    "messages:delete",
+    "messages:batchDelete",
+    "threads:delete",
+    "drafts:delete",
+]);
+const GMAIL_CONFIRM_METHODS = new Set(["drafts:send", "messages:send"]);
+const DRIVE_PROHIBITED_METHODS = new Set([
+    "files:delete",
+    "files:emptyTrash",
+    "revisions:delete",
+]);
+const DRIVE_CONFIRM_METHODS = new Set([
+    "permissions:create",
+    "permissions:update",
+    "permissions:delete",
+]);
+const GWS_VALUE_FLAGS = new Set([
+    "--api-version",
+    "--format",
+    "--json",
+    "--output",
+    "--page-delay",
+    "--page-limit",
+    "--params",
+    "--upload",
+    "--upload-content-type",
+]);
+function positionalArguments(args) {
+    const positional = [];
+    for (let index = 0; index < args.length; index += 1) {
+        const argument = args[index];
+        if (argument === undefined)
+            continue;
+        if (!argument.startsWith("--")) {
+            positional.push(argument);
+            continue;
+        }
+        const flag = argument.split("=", 1)[0];
+        if (flag !== undefined &&
+            GWS_VALUE_FLAGS.has(flag) &&
+            !argument.includes("=")) {
+            index += 1;
+        }
+    }
+    return positional;
+}
+export function classifyGwsCommand(args) {
+    const [serviceWithVersion, resource, collection, method] = positionalArguments(args);
+    const service = serviceWithVersion?.split(":", 1)[0];
+    if (service === "gmail") {
+        if (resource !== undefined && GMAIL_CONFIRM_ALIASES.has(resource)) {
+            return {
+                action: "confirm",
+                reason: "Sending email requires explicit confirmation",
+            };
+        }
+        if (resource === "users") {
+            const operation = `${collection ?? ""}:${method ?? ""}`;
+            if (GMAIL_PROHIBITED_METHODS.has(operation)) {
+                return {
+                    action: "prohibit",
+                    reason: "Permanent Gmail deletion is prohibited",
+                };
+            }
+            if (GMAIL_CONFIRM_METHODS.has(operation)) {
+                return {
+                    action: "confirm",
+                    reason: "Sending email requires explicit confirmation",
+                };
+            }
+        }
+    }
+    if (service === "drive") {
+        const operation = `${resource ?? ""}:${collection ?? ""}`;
+        if (DRIVE_PROHIBITED_METHODS.has(operation)) {
+            return {
+                action: "prohibit",
+                reason: "Permanent Drive deletion is prohibited",
+            };
+        }
+        if (DRIVE_CONFIRM_METHODS.has(operation)) {
+            return {
+                action: "confirm",
+                reason: "Drive permission changes require explicit confirmation",
+            };
+        }
+    }
+    return { action: "allow" };
+}
+//# sourceMappingURL=gws-command-policy.js.map

package/dist/gws-command-policy.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"gws-command-policy.js","sourceRoot":"","sources":["../src/gws-command-policy.ts"],"names":[],"mappings":"AAAA,MAAM,qBAAqB,GAAG,IAAI,GAAG,CAAC;IACpC,OAAO;IACP,QAAQ;IACR,YAAY;IACZ,UAAU;CACX,CAAC,CAAC;AACH,MAAM,wBAAwB,GAAG,IAAI,GAAG,CAAC;IACvC,iBAAiB;IACjB,sBAAsB;IACtB,gBAAgB;IAChB,eAAe;CAChB,CAAC,CAAC;AACH,MAAM,qBAAqB,GAAG,IAAI,GAAG,CAAC,CAAC,aAAa,EAAE,eAAe,CAAC,CAAC,CAAC;AACxE,MAAM,wBAAwB,GAAG,IAAI,GAAG,CAAC;IACvC,cAAc;IACd,kBAAkB;IAClB,kBAAkB;CACnB,CAAC,CAAC;AACH,MAAM,qBAAqB,GAAG,IAAI,GAAG,CAAC;IACpC,oBAAoB;IACpB,oBAAoB;IACpB,oBAAoB;CACrB,CAAC,CAAC;AACH,MAAM,eAAe,GAAG,IAAI,GAAG,CAAC;IAC9B,eAAe;IACf,UAAU;IACV,QAAQ;IACR,UAAU;IACV,cAAc;IACd,cAAc;IACd,UAAU;IACV,UAAU;IACV,uBAAuB;CACxB,CAAC,CAAC;AAOH,SAAS,mBAAmB,CAAC,IAAuB;IAClD,MAAM,UAAU,GAAa,EAAE,CAAC;IAEhC,KAAK,IAAI,KAAK,GAAG,CAAC,EAAE,KAAK,GAAG,IAAI,CAAC,MAAM,EAAE,KAAK,IAAI,CAAC,EAAE,CAAC;QACpD,MAAM,QAAQ,GAAG,IAAI,CAAC,KAAK,CAAC,CAAC;QAC7B,IAAI,QAAQ,KAAK,SAAS;YAAE,SAAS;QACrC,IAAI,CAAC,QAAQ,CAAC,UAAU,CAAC,IAAI,CAAC,EAAE,CAAC;YAC/B,UAAU,CAAC,IAAI,CAAC,QAAQ,CAAC,CAAC;YAC1B,SAAS;QACX,CAAC;QAED,MAAM,IAAI,GAAG,QAAQ,CAAC,KAAK,CAAC,GAAG,EAAE,CAAC,CAAC,CAAC,CAAC,CAAC,CAAC;QACvC,IACE,IAAI,KAAK,SAAS;YAClB,eAAe,CAAC,GAAG,CAAC,IAAI,CAAC;YACzB,CAAC,QAAQ,CAAC,QAAQ,CAAC,GAAG,CAAC,EACvB,CAAC;YACD,KAAK,IAAI,CAAC,CAAC;QACb,CAAC;IACH,CAAC;IAED,OAAO,UAAU,CAAC;AACpB,CAAC;AAED,MAAM,UAAU,kBAAkB,CAAC,IAAuB;IACxD,MAAM,CAAC,kBAAkB,EAAE,QAAQ,EAAE,UAAU,EAAE,MAAM,CAAC,GACtD,mBAAmB,CAAC,IAAI,CAAC,CAAC;IAC5B,MAAM,OAAO,GAAG,kBAAkB,EAAE,KAAK,CAAC,GAAG,EAAE,CAAC,CAAC,CAAC,CAAC,CAAC,CAAC;IAErD,IAAI,OAAO,KAAK,OAAO,EAAE,CAAC;QACxB,IAAI,QAAQ,KAAK,SAAS,IAAI,qBAAqB,CAAC,GAAG,CAAC,QAAQ,CAAC,EAAE,CAAC;YAClE,OAAO;gBACL,MAAM,EAAE,SAAS;gBACjB,MAAM,EAAE,8CAA8C;aACvD,CAAC;QACJ,CAAC;QAED,IAAI,QAAQ,KAAK,OAAO,EAAE,CAAC;YACzB,MAAM,SAAS,GAAG,GAAG,UAAU,IAAI,EAAE,IAAI,MAAM,IAAI,EAAE,EAAE,CAAC;YACxD,IAAI,wBAAwB,CAAC,GAAG,CAAC,SAAS,CAAC,EAAE,CAAC;gBAC5C,OAAO;oBACL,MAAM,EAAE,UAAU;oBAClB,MAAM,EAAE,wCAAwC;iBACjD,CAAC;YACJ,CAAC;YACD,IAAI,qBAAqB,CAAC,GAAG,CAAC,SAAS,CAAC,EAAE,CAAC;gBACzC,OAAO;oBACL,MAAM,EAAE,SAAS;oBACjB,MAAM,EAAE,8CAA8C;iBACvD,CAAC;YACJ,CAAC;QACH,CAAC;IACH,CAAC;IAED,IAAI,OAAO,KAAK,OAAO,EAAE,CAAC;QACxB,MAAM,SAAS,GAAG,GAAG,QAAQ,IAAI,EAAE,IAAI,UAAU,IAAI,EAAE,EAAE,CAAC;QAC1D,IAAI,wBAAwB,CAAC,GAAG,CAAC,SAAS,CAAC,EAAE,CAAC;YAC5C,OAAO;gBACL,MAAM,EAAE,UAAU;gBAClB,MAAM,EAAE,wCAAwC;aACjD,CAAC;QACJ,CAAC;QACD,IAAI,qBAAqB,CAAC,GAAG,CAAC,SAAS,CAAC,EAAE,CAAC;YACzC,OAAO;gBACL,MAAM,EAAE,SAAS;gBACjB,MAAM,EAAE,wDAAwD;aACjE,CAAC;QACJ,CAAC;IACH,CAAC;IAED,OAAO,EAAE,MAAM,EAAE,OAAO,EAAE,CAAC;AAC7B,CAAC"}

package/dist/run.d.ts

@@ -0,0 +1,9 @@
+export interface RunOptions {
+    account: string;
+    confirmed: boolean;
+    gwsArguments: string[];
+    workspaceRoot?: string;
+}
+export declare function resolveFileArguments(args: readonly string[], root: string): string[];
+export declare function runGws({ account, confirmed, gwsArguments, workspaceRoot, }: RunOptions): number;
+//# sourceMappingURL=run.d.ts.map

package/dist/run.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"run.d.ts","sourceRoot":"","sources":["../src/run.ts"],"names":[],"mappings":"AAkBA,MAAM,WAAW,UAAU;IACzB,OAAO,EAAE,MAAM,CAAC;IAChB,SAAS,EAAE,OAAO,CAAC;IACnB,YAAY,EAAE,MAAM,EAAE,CAAC;IACvB,aAAa,CAAC,EAAE,MAAM,CAAC;CACxB;AA0DD,wBAAgB,oBAAoB,CAClC,IAAI,EAAE,SAAS,MAAM,EAAE,EACvB,IAAI,EAAE,MAAM,GACX,MAAM,EAAE,CAiCV;AAED,wBAAgB,MAAM,CAAC,EACrB,OAAO,EACP,SAAS,EACT,YAAY,EACZ,aAAa,GACd,EAAE,UAAU,GAAG,MAAM,CAgFrB"}

package/dist/run.js

@@ -0,0 +1,138 @@
+import { spawnSync } from "node:child_process";
+import { accessSync, chmodSync, constants, lstatSync, mkdirSync, statSync, writeFileSync, } from "node:fs";
+import { createRequire } from "node:module";
+import { isAbsolute, join, resolve } from "node:path";
+import { CliError, EXIT, errorCode } from "./errors.js";
+import { classifyGwsCommand } from "./gws-command-policy.js";
+const require = createRequire(import.meta.url);
+const FILE_PATH_FLAGS = new Set(["--output", "--upload"]);
+function isDirectory(path) {
+    try {
+        return statSync(path).isDirectory();
+    }
+    catch (error) {
+        if (errorCode(error) === "ENOENT")
+            return false;
+        throw error;
+    }
+}
+function isExecutable(path) {
+    try {
+        accessSync(path, constants.X_OK);
+        return true;
+    }
+    catch {
+        return false;
+    }
+}
+function isFile(path) {
+    try {
+        return statSync(path).isFile();
+    }
+    catch (error) {
+        if (errorCode(error) === "ENOENT")
+            return false;
+        throw error;
+    }
+}
+function ensureRuntimeDirectory(path) {
+    mkdirSync(path, { recursive: true, mode: 0o700 });
+    const directory = lstatSync(path);
+    if (!directory.isDirectory() || directory.isSymbolicLink()) {
+        throw new CliError(EXIT.noPermission, `unsafe runtime directory: ${path}`);
+    }
+    chmodSync(path, 0o700);
+    const dotenv = join(path, ".env");
+    try {
+        writeFileSync(dotenv, "", { flag: "wx", mode: 0o600 });
+    }
+    catch (error) {
+        if (errorCode(error) !== "EEXIST")
+            throw error;
+    }
+    const dotenvFile = lstatSync(dotenv);
+    if (!dotenvFile.isFile() ||
+        dotenvFile.isSymbolicLink() ||
+        dotenvFile.size !== 0) {
+        throw new CliError(EXIT.noPermission, `unsafe runtime environment file: ${dotenv}`);
+    }
+    chmodSync(dotenv, 0o600);
+}
+export function resolveFileArguments(args, root) {
+    const resolvedArgs = [];
+    for (let index = 0; index < args.length; index += 1) {
+        const argument = args[index];
+        if (argument === undefined)
+            continue;
+        if (FILE_PATH_FLAGS.has(argument) && index + 1 < args.length) {
+            const value = args[index + 1];
+            if (value !== undefined) {
+                resolvedArgs.push(argument, value === "-" || isAbsolute(value) ? value : resolve(root, value));
+                index += 1;
+                continue;
+            }
+        }
+        const inlineFlag = [...FILE_PATH_FLAGS].find((flag) => argument.startsWith(`${flag}=`));
+        if (inlineFlag !== undefined) {
+            const value = argument.slice(inlineFlag.length + 1);
+            resolvedArgs.push(`${inlineFlag}=${value === "-" || isAbsolute(value) ? value : resolve(root, value)}`);
+            continue;
+        }
+        resolvedArgs.push(argument);
+    }
+    return resolvedArgs;
+}
+export function runGws({ account, confirmed, gwsArguments, workspaceRoot, }) {
+    if (!/^[A-Za-z0-9._-]+$/.test(account) ||
+        account.startsWith(".") ||
+        account.includes("..")) {
+        throw new CliError(EXIT.usage, `invalid account slug: ${account}`);
+    }
+    if (gwsArguments.length === 0) {
+        throw new CliError(EXIT.usage, "missing gws arguments");
+    }
+    const root = resolve(workspaceRoot ?? process.cwd());
+    const configDir = join(root, "accounts", account, "gws");
+    const runtimeDir = join(configDir, ".runtime");
+    const gwsOverride = process.env.GWS_EXECUTABLE;
+    const gwsEntrypoint = require.resolve("@googleworkspace/cli/run.js");
+    const gwsExecutable = gwsOverride ?? process.execPath;
+    const gwsPrefixArgs = gwsOverride === undefined ? [gwsEntrypoint] : [];
+    if (!isDirectory(configDir)) {
+        throw new CliError(EXIT.noInput, `unknown account: ${account}\nask your agent to use $add-account to connect it`);
+    }
+    if (gwsOverride !== undefined
+        ? !isExecutable(gwsExecutable)
+        : !isFile(gwsEntrypoint)) {
+        throw new CliError(EXIT.unavailable, "gws is not installed; run: npm install");
+    }
+    const policy = classifyGwsCommand(gwsArguments);
+    if (policy.action === "prohibit")
+        throw new CliError(EXIT.noPermission, policy.reason);
+    if (policy.action === "confirm" && !confirmed) {
+        throw new CliError(EXIT.noPermission, `${policy.reason}\nafter confirmation, rerun with --confirm after the account slug`);
+    }
+    ensureRuntimeDirectory(runtimeDir);
+    const gwsEnv = { ...process.env };
+    delete gwsEnv.GOOGLE_WORKSPACE_CLI_CLIENT_ID;
+    delete gwsEnv.GOOGLE_WORKSPACE_CLI_CLIENT_SECRET;
+    delete gwsEnv.GOOGLE_WORKSPACE_CLI_CREDENTIALS_FILE;
+    const result = spawnSync(gwsExecutable, [...gwsPrefixArgs, ...resolveFileArguments(gwsArguments, root)], {
+        cwd: runtimeDir,
+        env: {
+            ...gwsEnv,
+            GOOGLE_APPLICATION_CREDENTIALS: join(runtimeDir, ".env", "no-adc"),
+            GOOGLE_WORKSPACE_CLI_CONFIG_DIR: configDir,
+            GOOGLE_WORKSPACE_CLI_KEYRING_BACKEND: "keyring",
+            GOOGLE_WORKSPACE_CLI_TOKEN: "",
+        },
+        stdio: "inherit",
+    });
+    if (result.error) {
+        throw new CliError(EXIT.unavailable, `could not run gws: ${result.error.message}`);
+    }
+    if (result.status !== null)
+        return result.status;
+    throw new CliError(1, `gws terminated by signal ${result.signal ?? "unknown"}`);
+}
+//# sourceMappingURL=run.js.map

package/dist/run.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"run.js","sourceRoot":"","sources":["../src/run.ts"],"names":[],"mappings":"AAAA,OAAO,EAAE,SAAS,EAAE,MAAM,oBAAoB,CAAC;AAC/C,OAAO,EACL,UAAU,EACV,SAAS,EACT,SAAS,EACT,SAAS,EACT,SAAS,EACT,QAAQ,EACR,aAAa,GACd,MAAM,SAAS,CAAC;AACjB,OAAO,EAAE,aAAa,EAAE,MAAM,aAAa,CAAC;AAC5C,OAAO,EAAE,UAAU,EAAE,IAAI,EAAE,OAAO,EAAE,MAAM,WAAW,CAAC;AACtD,OAAO,EAAE,QAAQ,EAAE,IAAI,EAAE,SAAS,EAAE,MAAM,aAAa,CAAC;AACxD,OAAO,EAAE,kBAAkB,EAAE,MAAM,yBAAyB,CAAC;AAE7D,MAAM,OAAO,GAAG,aAAa,CAAC,OAAO,IAAI,CAAC,GAAG,CAAC,CAAC;AAC/C,MAAM,eAAe,GAAG,IAAI,GAAG,CAAC,CAAC,UAAU,EAAE,UAAU,CAAC,CAAC,CAAC;AAS1D,SAAS,WAAW,CAAC,IAAY;IAC/B,IAAI,CAAC;QACH,OAAO,QAAQ,CAAC,IAAI,CAAC,CAAC,WAAW,EAAE,CAAC;IACtC,CAAC;IAAC,OAAO,KAAK,EAAE,CAAC;QACf,IAAI,SAAS,CAAC,KAAK,CAAC,KAAK,QAAQ;YAAE,OAAO,KAAK,CAAC;QAChD,MAAM,KAAK,CAAC;IACd,CAAC;AACH,CAAC;AAED,SAAS,YAAY,CAAC,IAAY;IAChC,IAAI,CAAC;QACH,UAAU,CAAC,IAAI,EAAE,SAAS,CAAC,IAAI,CAAC,CAAC;QACjC,OAAO,IAAI,CAAC;IACd,CAAC;IAAC,MAAM,CAAC;QACP,OAAO,KAAK,CAAC;IACf,CAAC;AACH,CAAC;AAED,SAAS,MAAM,CAAC,IAAY;IAC1B,IAAI,CAAC;QACH,OAAO,QAAQ,CAAC,IAAI,CAAC,CAAC,MAAM,EAAE,CAAC;IACjC,CAAC;IAAC,OAAO,KAAK,EAAE,CAAC;QACf,IAAI,SAAS,CAAC,KAAK,CAAC,KAAK,QAAQ;YAAE,OAAO,KAAK,CAAC;QAChD,MAAM,KAAK,CAAC;IACd,CAAC;AACH,CAAC;AAED,SAAS,sBAAsB,CAAC,IAAY;IAC1C,SAAS,CAAC,IAAI,EAAE,EAAE,SAAS,EAAE,IAAI,EAAE,IAAI,EAAE,KAAK,EAAE,CAAC,CAAC;IAClD,MAAM,SAAS,GAAG,SAAS,CAAC,IAAI,CAAC,CAAC;IAClC,IAAI,CAAC,SAAS,CAAC,WAAW,EAAE,IAAI,SAAS,CAAC,cAAc,EAAE,EAAE,CAAC;QAC3D,MAAM,IAAI,QAAQ,CAAC,IAAI,CAAC,YAAY,EAAE,6BAA6B,IAAI,EAAE,CAAC,CAAC;IAC7E,CAAC;IACD,SAAS,CAAC,IAAI,EAAE,KAAK,CAAC,CAAC;IAEvB,MAAM,MAAM,GAAG,IAAI,CAAC,IAAI,EAAE,MAAM,CAAC,CAAC;IAClC,IAAI,CAAC;QACH,aAAa,CAAC,MAAM,EAAE,EAAE,EAAE,EAAE,IAAI,EAAE,IAAI,EAAE,IAAI,EAAE,KAAK,EAAE,CAAC,CAAC;IACzD,CAAC;IAAC,OAAO,KAAK,EAAE,CAAC;QACf,IAAI,SAAS,CAAC,KAAK,CAAC,KAAK,QAAQ;YAAE,MAAM,KAAK,CAAC;IACjD,CAAC;IAED,MAAM,UAAU,GAAG,SAAS,CAAC,MAAM,CAAC,CAAC;IACrC,IACE,CAAC,UAAU,CAAC,MAAM,EAAE;QACpB,UAAU,CAAC,cAAc,EAAE;QAC3B,UAAU,CAAC,IAAI,KAAK,CAAC,EACrB,CAAC;QACD,MAAM,IAAI,QAAQ,CAChB,IAAI,CAAC,YAAY,EACjB,oCAAoC,MAAM,EAAE,CAC7C,CAAC;IACJ,CAAC;IACD,SAAS,CAAC,MAAM,EAAE,KAAK,CAAC,CAAC;AAC3B,CAAC;AAED,MAAM,UAAU,oBAAoB,CAClC,IAAuB,EACvB,IAAY;IAEZ,MAAM,YAAY,GAAa,EAAE,CAAC;IAElC,KAAK,IAAI,KAAK,GAAG,CAAC,EAAE,KAAK,GAAG,IAAI,CAAC,MAAM,EAAE,KAAK,IAAI,CAAC,EAAE,CAAC;QACpD,MAAM,QAAQ,GAAG,IAAI,CAAC,KAAK,CAAC,CAAC;QAC7B,IAAI,QAAQ,KAAK,SAAS;YAAE,SAAS;QACrC,IAAI,eAAe,CAAC,GAAG,CAAC,QAAQ,CAAC,IAAI,KAAK,GAAG,CAAC,GAAG,IAAI,CAAC,MAAM,EAAE,CAAC;YAC7D,MAAM,KAAK,GAAG,IAAI,CAAC,KAAK,GAAG,CAAC,CAAC,CAAC;YAC9B,IAAI,KAAK,KAAK,SAAS,EAAE,CAAC;gBACxB,YAAY,CAAC,IAAI,CACf,QAAQ,EACR,KAAK,KAAK,GAAG,IAAI,UAAU,CAAC,KAAK,CAAC,CAAC,CAAC,CAAC,KAAK,CAAC,CAAC,CAAC,OAAO,CAAC,IAAI,EAAE,KAAK,CAAC,CAClE,CAAC;gBACF,KAAK,IAAI,CAAC,CAAC;gBACX,SAAS;YACX,CAAC;QACH,CAAC;QAED,MAAM,UAAU,GAAG,CAAC,GAAG,eAAe,CAAC,CAAC,IAAI,CAAC,CAAC,IAAI,EAAE,EAAE,CACpD,QAAQ,CAAC,UAAU,CAAC,GAAG,IAAI,GAAG,CAAC,CAChC,CAAC;QACF,IAAI,UAAU,KAAK,SAAS,EAAE,CAAC;YAC7B,MAAM,KAAK,GAAG,QAAQ,CAAC,KAAK,CAAC,UAAU,CAAC,MAAM,GAAG,CAAC,CAAC,CAAC;YACpD,YAAY,CAAC,IAAI,CACf,GAAG,UAAU,IAAI,KAAK,KAAK,GAAG,IAAI,UAAU,CAAC,KAAK,CAAC,CAAC,CAAC,CAAC,KAAK,CAAC,CAAC,CAAC,OAAO,CAAC,IAAI,EAAE,KAAK,CAAC,EAAE,CACrF,CAAC;YACF,SAAS;QACX,CAAC;QAED,YAAY,CAAC,IAAI,CAAC,QAAQ,CAAC,CAAC;IAC9B,CAAC;IAED,OAAO,YAAY,CAAC;AACtB,CAAC;AAED,MAAM,UAAU,MAAM,CAAC,EACrB,OAAO,EACP,SAAS,EACT,YAAY,EACZ,aAAa,GACF;IACX,IACE,CAAC,mBAAmB,CAAC,IAAI,CAAC,OAAO,CAAC;QAClC,OAAO,CAAC,UAAU,CAAC,GAAG,CAAC;QACvB,OAAO,CAAC,QAAQ,CAAC,IAAI,CAAC,EACtB,CAAC;QACD,MAAM,IAAI,QAAQ,CAAC,IAAI,CAAC,KAAK,EAAE,yBAAyB,OAAO,EAAE,CAAC,CAAC;IACrE,CAAC;IACD,IAAI,YAAY,CAAC,MAAM,KAAK,CAAC,EAAE,CAAC;QAC9B,MAAM,IAAI,QAAQ,CAAC,IAAI,CAAC,KAAK,EAAE,uBAAuB,CAAC,CAAC;IAC1D,CAAC;IAED,MAAM,IAAI,GAAG,OAAO,CAAC,aAAa,IAAI,OAAO,CAAC,GAAG,EAAE,CAAC,CAAC;IACrD,MAAM,SAAS,GAAG,IAAI,CAAC,IAAI,EAAE,UAAU,EAAE,OAAO,EAAE,KAAK,CAAC,CAAC;IACzD,MAAM,UAAU,GAAG,IAAI,CAAC,SAAS,EAAE,UAAU,CAAC,CAAC;IAC/C,MAAM,WAAW,GAAG,OAAO,CAAC,GAAG,CAAC,cAAc,CAAC;IAC/C,MAAM,aAAa,GAAG,OAAO,CAAC,OAAO,CAAC,6BAA6B,CAAC,CAAC;IACrE,MAAM,aAAa,GAAG,WAAW,IAAI,OAAO,CAAC,QAAQ,CAAC;IACtD,MAAM,aAAa,GAAG,WAAW,KAAK,SAAS,CAAC,CAAC,CAAC,CAAC,aAAa,CAAC,CAAC,CAAC,CAAC,EAAE,CAAC;IAEvE,IAAI,CAAC,WAAW,CAAC,SAAS,CAAC,EAAE,CAAC;QAC5B,MAAM,IAAI,QAAQ,CAChB,IAAI,CAAC,OAAO,EACZ,oBAAoB,OAAO,oDAAoD,CAChF,CAAC;IACJ,CAAC;IACD,IACE,WAAW,KAAK,SAAS;QACvB,CAAC,CAAC,CAAC,YAAY,CAAC,aAAa,CAAC;QAC9B,CAAC,CAAC,CAAC,MAAM,CAAC,aAAa,CAAC,EAC1B,CAAC;QACD,MAAM,IAAI,QAAQ,CAChB,IAAI,CAAC,WAAW,EAChB,wCAAwC,CACzC,CAAC;IACJ,CAAC;IAED,MAAM,MAAM,GAAG,kBAAkB,CAAC,YAAY,CAAC,CAAC;IAChD,IAAI,MAAM,CAAC,MAAM,KAAK,UAAU;QAC9B,MAAM,IAAI,QAAQ,CAAC,IAAI,CAAC,YAAY,EAAE,MAAM,CAAC,MAAM,CAAC,CAAC;IACvD,IAAI,MAAM,CAAC,MAAM,KAAK,SAAS,IAAI,CAAC,SAAS,EAAE,CAAC;QAC9C,MAAM,IAAI,QAAQ,CAChB,IAAI,CAAC,YAAY,EACjB,GAAG,MAAM,CAAC,MAAM,mEAAmE,CACpF,CAAC;IACJ,CAAC;IAED,sBAAsB,CAAC,UAAU,CAAC,CAAC;IACnC,MAAM,MAAM,GAAG,EAAE,GAAG,OAAO,CAAC,GAAG,EAAE,CAAC;IAClC,OAAO,MAAM,CAAC,8BAA8B,CAAC;IAC7C,OAAO,MAAM,CAAC,kCAAkC,CAAC;IACjD,OAAO,MAAM,CAAC,qCAAqC,CAAC;IAEpD,MAAM,MAAM,GAAG,SAAS,CACtB,aAAa,EACb,CAAC,GAAG,aAAa,EAAE,GAAG,oBAAoB,CAAC,YAAY,EAAE,IAAI,CAAC,CAAC,EAC/D;QACE,GAAG,EAAE,UAAU;QACf,GAAG,EAAE;YACH,GAAG,MAAM;YACT,8BAA8B,EAAE,IAAI,CAAC,UAAU,EAAE,MAAM,EAAE,QAAQ,CAAC;YAClE,+BAA+B,EAAE,SAAS;YAC1C,oCAAoC,EAAE,SAAS;YAC/C,0BAA0B,EAAE,EAAE;SAC/B;QACD,KAAK,EAAE,SAAS;KACjB,CACF,CAAC;IAEF,IAAI,MAAM,CAAC,KAAK,EAAE,CAAC;QACjB,MAAM,IAAI,QAAQ,CAChB,IAAI,CAAC,WAAW,EAChB,sBAAsB,MAAM,CAAC,KAAK,CAAC,OAAO,EAAE,CAC7C,CAAC;IACJ,CAAC;IACD,IAAI,MAAM,CAAC,MAAM,KAAK,IAAI;QAAE,OAAO,MAAM,CAAC,MAAM,CAAC;IACjD,MAAM,IAAI,QAAQ,CAChB,CAAC,EACD,4BAA4B,MAAM,CAAC,MAAM,IAAI,SAAS,EAAE,CACzD,CAAC;AACJ,CAAC"}

package/package.json

@@ -0,0 +1,56 @@
+{
+  "name": "multi-gws",
+  "version": "0.0.1",
+  "description": "Multi-account safety wrapper for the Google Workspace CLI",
+  "type": "module",
+  "bin": {
+    "mgws": "dist/cli.js"
+  },
+  "files": [
+    "dist"
+  ],
+  "scripts": {
+    "build": "tsc -p tsconfig.json",
+    "check": "npm run lint && npm run test && npm run build",
+    "format": "biome format --write .",
+    "lint": "biome check .",
+    "prepack": "npm run build",
+    "release": "node scripts/release.mjs",
+    "test": "vitest run"
+  },
+  "engines": {
+    "node": ">=22.9.0"
+  },
+  "packageManager": "npm@11.18.0",
+  "dependencies": {
+    "@googleworkspace/cli": "0.22.5",
+    "commander": "14.0.3"
+  },
+  "devDependencies": {
+    "@biomejs/biome": "2.5.5",
+    "@types/node": "26.1.1",
+    "typescript": "7.0.2",
+    "vitest": "4.1.10"
+  },
+  "allowScripts": {
+    "@googleworkspace/cli@0.22.5": true
+  },
+  "publishConfig": {
+    "access": "public"
+  },
+  "repository": {
+    "type": "git",
+    "url": "git+https://github.com/rarexlabs/mgws.git"
+  },
+  "bugs": {
+    "url": "https://github.com/rarexlabs/mgws/issues"
+  },
+  "homepage": "https://github.com/rarexlabs/mgws#readme",
+  "license": "MIT",
+  "keywords": [
+    "google-workspace",
+    "gws",
+    "multi-account",
+    "cli"
+  ]
+}