googleworkspace · jpoehnelt · Mar 4, 2026 · Mar 4, 2026
diff --git a/.changeset/consumer-recipes.md b/.changeset/consumer-recipes.md
diff --git a/.changeset/encode-path-params.md b/.changeset/encode-path-params.md
diff --git a/.changeset/gemini-extension-update.md b/.changeset/gemini-extension-update.md
diff --git a/.changeset/harden-input-validation.md b/.changeset/harden-input-validation.md
diff --git a/.changeset/harden-security-validation.md b/.changeset/harden-security-validation.md
diff --git a/.changeset/remove-manual-urlencoded.md b/.changeset/remove-manual-urlencoded.md
diff --git a/.changeset/test-encrypted-token-storage-new.md b/.changeset/test-encrypted-token-storage-new.md
diff --git a/.changeset/testing-improvement.md b/.changeset/testing-improvement.md
diff --git a/.changeset/url-safety-helpers.md b/.changeset/url-safety-helpers.md
diff --git a/.changeset/warn-api-failures.md b/.changeset/warn-api-failures.md
diff --git a/CHANGELOG.md b/CHANGELOG.md
@@ -1,5 +1,37 @@
 # @googleworkspace/cli
 
+## 0.2.0
+
+### Minor Changes
+
+- b0d0b95: Add workflow helpers, personas, and 50 consumer-focused recipes
+
+  - Add `gws workflow` subcommand with 5 built-in helpers: `+standup-report`, `+meeting-prep`, `+email-to-task`, `+weekly-digest`, `+file-announce`
+  - Add 10 agent personas (exec-assistant, project-manager, sales-ops, etc.) with curated skill sets
+  - Add `docs/skills.md` skills index and `registry/recipes.yaml` with 50 multi-step recipes for Gmail, Drive, Docs, Calendar, and Sheets
+  - Update README with skills index link and accurate skill count
+  - Fix lefthook pre-commit to run fmt and clippy sequentially
+
+### Patch Changes
+
+- 90adcb4: fix: percent-encode path parameters to prevent path traversal
+- e71ce29: Fix Gemini extension installation issue by removing redundant authentication settings and update the documentation.
+- 90adcb4: fix: harden input validation for AI/LLM callers
+
+  - Add `src/validate.rs` with `validate_safe_output_dir`, `validate_msg_format`, and `validate_safe_dir_path` helpers
+  - Validate `--output-dir` against path traversal in `gmail +watch` and `events +subscribe`
+  - Validate `--msg-format` against allowlist (full, metadata, minimal, raw) in `gmail +watch`
+  - Validate `--dir` against path traversal in `script +push`
+  - Add clap `value_parser` constraint for `--msg-format`
+  - Document input validation patterns in `AGENTS.md`
+
+- 90adcb4: Security: Harden validate_resource_name and fix Gmail watch path traversal
+- 90adcb4: Replace manual `urlencoded()` with reqwest `.query()` builder for safer URL encoding
+- c11d3c4: Added test coverage for `EncryptedTokenStorage::new` initialization.
+- 7664357: Add test for missing error path in load_client_config
+- 90adcb4: fix: add shared URL safety helpers for path params (`encode_path_segment`, `validate_resource_name`)
+- 90adcb4: fix: warn on stderr when API calls fail silently
+
 ## 0.1.5
 
 ### Patch Changes

diff --git a/Cargo.lock b/Cargo.lock
diff --git a/Cargo.toml b/Cargo.toml
@@ -14,7 +14,7 @@
 
 [package]
 name = "gws"
-version = "0.1.5"
+version = "0.2.0"
 edition = "2021"
 description = "Google Workspace CLI — dynamic command surface from Discovery Service"
 license = "Apache-2.0"

diff --git a/package.json b/package.json
@@ -1,6 +1,6 @@
 {
   "name": "@googleworkspace/cli",
-  "version": "0.1.5",
+  "version": "0.2.0",
   "private": true,
   "description": "Google Workspace CLI — dynamic command surface from Discovery Service",
   "license": "Apache-2.0",