Greptile Summary

This PR adds gws (@googleworkspace/cli) as a pull-based alternative backend to gog for Gmail Pub/Sub hooks. The core feature logic is solid: the gmail-gws-bridge.ts module transforms Gmail API messages correctly, config schema changes are clean, CLI option plumbing is well-structured, and tests provide good coverage.

However, two critical bugs exist in the process-management layer that make the gws service daemon unreliable:

1. runGwsService restart loop (gmail-ops.ts, lines 416-428): The exit handler is only attached to the initial child process. After an unattended crash-and-restart, the new child has no exit listener, so auto-recovery stops. The service only survives one crash.

2. spawnGwsWatch module-level state conflict (gmail-watcher.ts, lines 175-192): The exported function has a built-in restart handler that references uninitialized module-level state (currentConfig, shuttingDown, watcherProcess) when called from the ops context. This causes spurious logs and silent restart failures after the first crash. Combined with bug fix: add @lid format support and allowFrom wildcard handling #1, the service dies after the second crash.

The gws feature cannot ship in its current form — the daemon is unreliable and will silently stop working in production after crashing twice.

Confidence Score: 2/5

• Not safe to merge as-is. The gws service daemon has two interconnected bugs that cause silent death after the second crash.
• The core feature logic (bridge transform, config resolution, CLI plumbing, schema) is solid and well tested. However, the gws process-management layer is broken: (1) runGwsService's exit handler is not re-attached after restart, (2) spawnGwsWatch's internal restart handler uses uninitialized module-level state when called from ops context. After the first crash, runGwsService creates a new child, but the new child only has spawnGwsWatch's broken handler. If this second child crashes, the service fails to recover. This makes the daemon unreliable for production use.
• src/hooks/gmail-ops.ts (restart loop), src/hooks/gmail-watcher.ts (module-level state leak)

_{Last reviewed commit: ae737c9}