ci: update homebrew tap on release

Adds a read-only contacts dedupe preview command with JSON/table output, generated command docs, README/spec docs, and changelog credit for the extracted idea from #116.\n\nCo-authored-by: Rohan Patnaik <rohan-patnaik@users.noreply.github.com>

.agents/skills/gog/SKILL.md

@@ -0,0 +1,125 @@
+---
+name: gog
+description: Use when working with the gog CLI for Google Workspace automation, especially when an agent needs JSON output, auth preflight, command guards, scoped accounts, or safe Google API reads/writes across Gmail, Calendar, Drive, Docs, Sheets, Slides, Forms, Apps Script, Contacts, Tasks, People, Groups, Keep, or Admin.
+---
+
+# gog
+
+Use `gog` when built-in Google connectors are missing a feature, when shell
+automation needs stable JSON, or when you need to inspect local Google auth
+state before acting.
+
+## Fast Path
+
+```bash
+gog --version
+gog auth list --check --json --no-input
+gog auth doctor --check --json --no-input
+gog schema --json
+```
+
+Pick the account explicitly for API work:
+
+```bash
+gog --account user@example.com gmail search 'newer_than:7d' --json
+```
+
+Prefer `--json` or `--plain` for agent parsing. Human hints and progress should
+stay on stderr; stdout is for data.
+
+## Safety Rules
+
+- Do not print access tokens, refresh tokens, OAuth client secrets, or keyring
+  passwords.
+- Do not store `GOG_KEYRING_PASSWORD` in a shell profile or plaintext project
+  file. If the file keyring cannot unlock non-interactively, stop and ask for a
+  safer setup.
+- Use `--no-input` in automation so auth/keyring prompts fail clearly.
+- Use `--dry-run` first where commands support it.
+- Destructive commands require `--force`; do not add it unless the user asked
+  for that exact mutation.
+- Use `--gmail-no-send` or `GOG_GMAIL_NO_SEND=1` unless sending mail is the
+  requested task.
+- For shared agent environments, prefer a baked readonly or agent-safe binary
+  from `docs/safety-profiles.md`.
+
+Runtime command guards:
+
+```bash
+gog --enable-commands gmail.search,gmail.get --gmail-no-send \
+  --account user@example.com gmail search 'from:example@example.com' --json
+
+gog --enable-commands drive.ls,docs.cat --disable-commands drive.delete \
+  --account user@example.com drive ls --max 10 --json
+```
+
+## Auth
+
+OAuth setup is partly interactive. An agent can inspect and diagnose it, but a
+human normally completes browser consent:
+
+```bash
+gog auth credentials list
+gog auth add user@example.com --services gmail,calendar,drive --readonly
+gog auth add user@example.com --services docs,sheets,slides
+gog auth remove user@example.com
+```
+
+Use narrow services and `--readonly` when the task only reads. Service accounts
+are Workspace-only and mainly fit Admin, Groups, Keep, and domain-wide
+delegation flows; they do not solve consumer `@gmail.com` OAuth.
+
+## Common Reads
+
+```bash
+gog --account user@example.com gmail search 'newer_than:3d' --max 10 --json
+gog --account user@example.com gmail get <messageId> --sanitize-content --json
+gog --account user@example.com gmail thread get <threadId> --sanitize-content --json
+
+gog --account user@example.com calendar events --today --json
+gog --account user@example.com drive ls --max 20 --json
+gog --account user@example.com docs cat <documentId> --json
+gog --account user@example.com sheets get <spreadsheetId> Sheet1!A1:D20 --json
+gog --account user@example.com contacts list --max 20 --json
+```
+
+For Gmail body inspection, prefer `--sanitize-content` unless the user
+explicitly needs raw payloads.
+
+## Writes
+
+Before writes, identify the account, object id, and exact mutation. Prefer
+commands that support `--dry-run`, and clean up disposable live-test objects.
+
+```bash
+gog --account user@example.com docs write <documentId> --append --text '...'
+gog --account user@example.com sheets update <spreadsheetId> Sheet1!A1 --values-json '[["hello"]]'
+gog --account user@example.com drive upload ./file.txt --parent <folderId> --json
+```
+
+When testing creation commands, name artifacts with a clear temporary prefix and
+delete or trash them after verification.
+
+## Discovery
+
+Use generated command docs and schema instead of guessing flags:
+
+```bash
+gog <service> --help
+gog <service> <command> --help
+gog schema <service> <command> --json
+```
+
+Docs:
+
+- `docs/README.md`
+- `docs/commands/README.md`
+- `docs/safety-profiles.md`
+- `README.md#security`
+
+Repo paths:
+
+- CLI entrypoint: `cmd/gog/`
+- Command implementations: `internal/cmd/`
+- OAuth/keyring: `internal/auth/`, `internal/secrets/`
+- Generated command docs: `docs/commands/`

.dockerignore

@@ -0,0 +1,11 @@
+.git
+.github
+.tools
+**/node_modules
+bin
+dist
+gog
+gog.exe
+*.test
+coverage*
+.DS_Store

.github/workflows/ci.yml

@@ -10,14 +10,14 @@ concurrency:
 
 jobs:
   test:
-    runs-on: blacksmith-16vcpu-ubuntu-2404
+    runs-on: ubuntu-latest
     steps:
-      - uses: actions/checkout@v4
-      - uses: actions/setup-go@v5
+      - uses: actions/checkout@de0fac2e4500dabe0009e67214ff5f5447ce83dd # v6.0.2
+      - uses: actions/setup-go@4a3601121dd01d1626a1e23e37211e3254c1c06c # v6.4.0
         with:
           go-version-file: go.mod
           cache: true
-      - uses: actions/cache@v4
+      - uses: actions/cache@27d5ce7f107fe9357f9df03efb73ab90386fccae # v5.0.5
         with:
           path: .tools
           key: ${{ runner.os }}-tools-${{ hashFiles('Makefile') }}
@@ -26,23 +26,21 @@ jobs:
       - name: Format check
         run: make fmt-check
       - name: Test
-        run: go test ./...
+        run: make test
       - name: Lint
         run: make lint
 
   worker:
-    runs-on: blacksmith-16vcpu-ubuntu-2404
+    runs-on: ubuntu-latest
     steps:
-      - uses: actions/checkout@v4
-      - uses: actions/setup-node@v4
+      - uses: actions/checkout@de0fac2e4500dabe0009e67214ff5f5447ce83dd # v6.0.2
+      - uses: actions/setup-node@48b55a011bda9f5d6aeb4c2d9c7362e8dae4041e # v6.4.0
         with:
-          node-version: "20"
-          cache: "pnpm"
-          cache-dependency-path: internal/tracking/worker/pnpm-lock.yaml
+          node-version: "24"
       - name: Enable Corepack (pnpm)
         run: |
           corepack enable
-          corepack prepare pnpm@10.27.0 --activate
+          corepack prepare pnpm@10.33.2 --activate
       - name: Install dependencies
         run: pnpm -C internal/tracking/worker install --frozen-lockfile
       - name: Lint
@@ -55,12 +53,12 @@ jobs:
   windows:
     runs-on: windows-latest
     steps:
-      - uses: actions/checkout@v4
-      - uses: actions/setup-go@v5
+      - uses: actions/checkout@de0fac2e4500dabe0009e67214ff5f5447ce83dd # v6.0.2
+      - uses: actions/setup-go@4a3601121dd01d1626a1e23e37211e3254c1c06c # v6.4.0
         with:
           go-version-file: go.mod
           cache: true
-      - uses: actions/cache@v4
+      - uses: actions/cache@27d5ce7f107fe9357f9df03efb73ab90386fccae # v5.0.5
         with:
           path: .tools
           key: ${{ runner.os }}-tools-${{ hashFiles('Makefile') }}
@@ -74,10 +72,11 @@ jobs:
         # Skip tests that depend on macOS Keychain / Linux keyring or Unix path semantics.
         # These are covered by ubuntu-latest and macos-latest jobs.
         # See https://github.com/steipete/gogcli/issues/395
-        run: >-
-          go test ./...
-          -skip 'TestAuth|TestListClientCredentials|TestReadClientCredentials|TestConfigExists|TestExpandPath|TestResolveKeyringBackendInfo|TestLoadSecrets_LegacyFallback'
+        run: make test
         shell: bash
+        env:
+          TEST_FLAGS: >-
+            -skip 'TestAuth|TestListClientCredentials|TestReadClientCredentials|TestConfigExists|TestExpandPath|TestResolveKeyringBackendInfo|TestLoadSecrets_LegacyFallback'
       - name: Lint
         run: make lint
         shell: bash
@@ -87,12 +86,12 @@ jobs:
   darwin-cgo-build:
     runs-on: macos-latest
     steps:
-      - uses: actions/checkout@v4
-      - uses: actions/setup-go@v5
+      - uses: actions/checkout@de0fac2e4500dabe0009e67214ff5f5447ce83dd # v6.0.2
+      - uses: actions/setup-go@4a3601121dd01d1626a1e23e37211e3254c1c06c # v6.4.0
         with:
           go-version-file: go.mod
           cache: true
       - name: Test
-        run: go test ./...
+        run: make test
       - name: Build (Keychain / cgo)
         run: CGO_ENABLED=1 go build ./cmd/gog

.github/workflows/docker.yml

@@ -0,0 +1,96 @@
+name: docker
+
+on:
+  pull_request:
+    paths:
+      - ".dockerignore"
+      - ".github/workflows/docker.yml"
+      - "Dockerfile"
+      - "cmd/**"
+      - "go.mod"
+      - "go.sum"
+      - "internal/**"
+  push:
+    tags:
+      - "v*"
+  workflow_dispatch:
+    inputs:
+      tag:
+        description: "Optional release tag to publish (e.g. v0.14.0)"
+        required: false
+        type: string
+
+permissions:
+  contents: read
+  packages: write
+
+jobs:
+  image:
+    runs-on: ubuntu-latest
+    steps:
+      - name: Validate manual tag
+        if: ${{ github.event_name == 'workflow_dispatch' && inputs.tag != '' }}
+        env:
+          RELEASE_TAG: ${{ inputs.tag }}
+        run: |
+          if ! echo "$RELEASE_TAG" | grep -qE '^v[0-9]+\.[0-9]+\.[0-9]+(-[a-zA-Z0-9.]+)?$'; then
+            echo "::error::Invalid tag format: $RELEASE_TAG"
+            exit 1
+          fi
+
+      - name: Checkout
+        uses: actions/checkout@de0fac2e4500dabe0009e67214ff5f5447ce83dd # v6.0.2
+        with:
+          fetch-depth: 0
+          ref: ${{ github.event_name == 'workflow_dispatch' && inputs.tag || github.ref }}
+
+      - name: Docker metadata
+        id: meta
+        uses: docker/metadata-action@c299e40c65443455700f0fdfc63efafe5b349051 # v5.10.0
+        with:
+          images: ghcr.io/steipete/gogcli
+          tags: |
+            type=ref,event=pr
+            type=ref,event=tag
+            type=raw,value=${{ inputs.tag }},enable=${{ github.event_name == 'workflow_dispatch' && inputs.tag != '' }}
+            type=raw,value=latest,enable=${{ (startsWith(github.ref, 'refs/tags/v') && !contains(github.ref_name, '-')) || (github.event_name == 'workflow_dispatch' && inputs.tag != '' && !contains(inputs.tag, '-')) }}
+
+      - name: Build metadata
+        id: build-meta
+        env:
+          RELEASE_TAG: ${{ inputs.tag }}
+        run: |
+          version="dev"
+          if [[ -n "$RELEASE_TAG" ]]; then
+            version="$RELEASE_TAG"
+          elif [[ "$GITHUB_REF_TYPE" == "tag" ]]; then
+            version="$GITHUB_REF_NAME"
+          fi
+          {
+            echo "version=$version"
+            echo "commit=${GITHUB_SHA::12}"
+            echo "date=$(date -u +%Y-%m-%dT%H:%M:%SZ)"
+          } >> "$GITHUB_OUTPUT"
+
+      - name: Set up Docker Buildx
+        uses: docker/setup-buildx-action@e468171a9de216ec08956ac3ada2f0791b6bd435 # v3.11.1
+
+      - name: Login to GHCR
+        if: ${{ startsWith(github.ref, 'refs/tags/v') || (github.event_name == 'workflow_dispatch' && inputs.tag != '') }}
+        uses: docker/login-action@c94ce9fb468520275223c153574b00df6fe4bcc9 # v3.7.0
+        with:
+          registry: ghcr.io
+          username: ${{ github.actor }}
+          password: ${{ secrets.GITHUB_TOKEN }}
+
+      - name: Build image
+        uses: docker/build-push-action@ee4ca427a2f43b6a16632044ca514c076267da23 # v6.19.0
+        with:
+          context: .
+          push: ${{ startsWith(github.ref, 'refs/tags/v') || (github.event_name == 'workflow_dispatch' && inputs.tag != '') }}
+          tags: ${{ steps.meta.outputs.tags }}
+          labels: ${{ steps.meta.outputs.labels }}
+          build-args: |
+            VERSION=${{ steps.build-meta.outputs.version }}
+            COMMIT=${{ steps.build-meta.outputs.commit }}
+            DATE=${{ steps.build-meta.outputs.date }}

.github/workflows/pages.yml

@@ -0,0 +1,61 @@
+name: pages
+
+on:
+  push:
+    branches:
+      - main
+    paths:
+      - "docs/**"
+      - "scripts/gen-command-reference.sh"
+      - "scripts/build-docs-site.mjs"
+      - "scripts/docs-site-assets.mjs"
+      - "Makefile"
+      - ".github/workflows/pages.yml"
+  workflow_dispatch:
+
+permissions:
+  contents: read
+  pages: write
+  id-token: write
+
+concurrency:
+  group: pages
+  cancel-in-progress: false
+
+jobs:
+  deploy:
+    name: Deploy docs
+    runs-on: ubuntu-latest
+    timeout-minutes: 10
+    environment:
+      name: github-pages
+      url: ${{ steps.deployment.outputs.page_url }}
+    steps:
+      - name: Check out
+        uses: actions/checkout@de0fac2e4500dabe0009e67214ff5f5447ce83dd # v6.0.2
+
+      - name: Set up Go
+        uses: actions/setup-go@4a3601121dd01d1626a1e23e37211e3254c1c06c # v6.4.0
+        with:
+          go-version-file: go.mod
+          cache: true
+
+      - name: Set up Node
+        uses: actions/setup-node@48b55a011bda9f5d6aeb4c2d9c7362e8dae4041e # v6.4.0
+        with:
+          node-version: "24"
+
+      - name: Build docs site
+        run: make docs-site
+
+      - name: Configure Pages
+        uses: actions/configure-pages@45bfe0192ca1faeb007ade9deae92b16b8254a0d # v6.0.0
+
+      - name: Upload artifact
+        uses: actions/upload-pages-artifact@fc324d3547104276b827a68afc52ff2a11cc49c9 # v5.0.0
+        with:
+          path: dist/docs-site
+
+      - name: Deploy
+        id: deployment
+        uses: actions/deploy-pages@cd2ce8fcbc39b97be8ca5fce6e763baed58fa128 # v5.0.0

.github/workflows/release.yml

@@ -19,12 +19,12 @@ jobs:
     runs-on: macos-latest
     steps:
       - name: Checkout
-        uses: actions/checkout@v4
+        uses: actions/checkout@de0fac2e4500dabe0009e67214ff5f5447ce83dd # v6.0.2
         with:
           fetch-depth: 0
 
       - name: Setup Go
-        uses: actions/setup-go@v5
+        uses: actions/setup-go@4a3601121dd01d1626a1e23e37211e3254c1c06c # v6.4.0
         with:
           go-version-file: go.mod
           cache: true
@@ -32,15 +32,112 @@ jobs:
       - name: Stash GoReleaser config
         run: cp .goreleaser.yaml /tmp/.goreleaser.yaml
 
+      - name: Validate release tag
+        if: ${{ github.event_name == 'workflow_dispatch' }}
+        env:
+          RELEASE_TAG: ${{ inputs.tag }}
+        run: |
+          if ! echo "$RELEASE_TAG" | grep -qE '^v[0-9]+\.[0-9]+\.[0-9]+(-[a-zA-Z0-9.]+)?$'; then
+            echo "::error::Invalid tag format: $RELEASE_TAG"
+            exit 1
+          fi
+
       - name: Checkout release tag
         if: ${{ github.event_name == 'workflow_dispatch' }}
-        run: git checkout ${{ inputs.tag }}
+        env:
+          RELEASE_TAG: ${{ inputs.tag }}
+        run: git checkout "$RELEASE_TAG"
+
+      - name: Import macOS signing certificate
+        env:
+          MACOS_SIGNING_CERT_BASE64: ${{ secrets.MACOS_SIGNING_CERT_BASE64 }}
+          MACOS_SIGNING_CERT_PASSWORD: ${{ secrets.MACOS_SIGNING_CERT_PASSWORD }}
+        run: |
+          set -euo pipefail
+          if [ -z "$MACOS_SIGNING_CERT_BASE64" ]; then
+            echo "No macOS signing certificate configured; skipping import."
+            exit 0
+          fi
+
+          KEYCHAIN="build.keychain"
+          KEYCHAIN_PASSWORD="$(uuidgen)"
+
+          echo "$MACOS_SIGNING_CERT_BASE64" | base64 --decode > /tmp/codesign.p12
+
+          security create-keychain -p "$KEYCHAIN_PASSWORD" "$KEYCHAIN"
+          security set-keychain-settings -lut 21600 "$KEYCHAIN"
+          security unlock-keychain -p "$KEYCHAIN_PASSWORD" "$KEYCHAIN"
+          security default-keychain -s "$KEYCHAIN"
+          security list-keychains -d user -s "$KEYCHAIN"
+
+          security import /tmp/codesign.p12 -k "$KEYCHAIN" -P "$MACOS_SIGNING_CERT_PASSWORD" -T /usr/bin/codesign -T /usr/bin/security
+          security set-key-partition-list -S apple-tool:,apple:,codesign: -s -k "$KEYCHAIN_PASSWORD" "$KEYCHAIN"
 
       - name: GoReleaser
-        uses: goreleaser/goreleaser-action@v6
+        uses: goreleaser/goreleaser-action@1a80836c5c9d9e5755a25cb59ec6f45a3b5f41a8 # v7.2.1
         with:
           distribution: goreleaser
           version: latest
           args: release --clean --config /tmp/.goreleaser.yaml
         env:
           GITHUB_TOKEN: ${{ secrets.GITHUB_TOKEN }}
+          GOG_CODESIGN_IDENTITY: ${{ secrets.MACOS_CODESIGN_IDENTITY }}
+
+  update-homebrew-tap:
+    runs-on: ubuntu-latest
+    needs: goreleaser
+    steps:
+      - name: Resolve release tag
+        run: |
+          if [ "${{ github.event_name }}" = "workflow_dispatch" ]; then
+            echo "RELEASE_TAG=${{ inputs.tag }}" >> "$GITHUB_ENV"
+          else
+            echo "RELEASE_TAG=${{ github.ref_name }}" >> "$GITHUB_ENV"
+          fi
+
+      - name: Dispatch tap formula update
+        env:
+          GH_TOKEN: ${{ secrets.HOMEBREW_TAP_TOKEN }}
+        run: |
+          if [ -z "$GH_TOKEN" ]; then
+            echo "::error::Set HOMEBREW_TAP_TOKEN with workflow access to steipete/homebrew-tap"
+            exit 1
+          fi
+
+          request_id="gogcli-${RELEASE_TAG}-${GITHUB_RUN_ID}-${GITHUB_RUN_ATTEMPT}"
+          expected_title="Update gogcli for ${RELEASE_TAG} (${request_id})"
+
+          gh workflow run update-formula.yml \
+            --repo steipete/homebrew-tap \
+            --ref main \
+            -f formula=gogcli \
+            -f tag="$RELEASE_TAG" \
+            -f repository=steipete/gogcli \
+            -f artifact_template="{formula}_{version}_{target}.tar.gz" \
+            -f request_id="$request_id"
+
+          run_id=""
+          for _ in {1..30}; do
+            run_id=$(gh run list \
+              --repo steipete/homebrew-tap \
+              --workflow update-formula.yml \
+              --branch main \
+              --event workflow_dispatch \
+              --limit 20 \
+              --json databaseId,displayTitle \
+              --jq ".[] | select(.displayTitle == \"$expected_title\") | .databaseId" | head -n1)
+            if [ -n "$run_id" ]; then
+              break
+            fi
+            sleep 5
+          done
+
+          if [ -z "$run_id" ]; then
+            echo "::error::Could not find tap workflow run with title: $expected_title"
+            exit 1
+          fi
+
+          gh run watch "$run_id" \
+            --repo steipete/homebrew-tap \
+            --exit-status \
+            --interval 10

.gitignore

@@ -37,6 +37,8 @@ go.work.sum
 # Local build output
 bin/
 /gog
+internal/cmd/safety_profile_baked_gen.go
 
 # Node (optional dev scripts)
 node_modules/
+dist/

.golangci.yml

@@ -120,6 +120,11 @@ linters:
           - dupl
           - wsl_v5
           - tagliatelle
+      - path: internal/safetyprofile/.*\.go
+        linters:
+          - err113
+          - wrapcheck
+          - wsl_v5
       - path: internal/googleauth/.*\.go
         linters:
           - tagliatelle

.goreleaser.yaml

@@ -34,16 +34,21 @@ builds:
     targets:
       - darwin_amd64
       - darwin_arm64
+    hooks:
+      post:
+        - ./scripts/codesign-macos.sh "{{ .Path }}"
 
 archives:
-  - builds:
+  - ids:
       - gog
       - gog_darwin
-    format: tar.gz
+    formats:
+      - tar.gz
     name_template: "{{ .ProjectName }}_{{ .Version }}_{{ .Os }}_{{ .Arch }}"
     format_overrides:
       - goos: windows
-        format: zip
+        formats:
+          - zip
 
 checksum:
   name_template: checksums.txt

AGENTS.md

@@ -40,7 +40,7 @@
 
 - **Review mode (PR link only):** read `gh pr view/diff`; do not switch branches; do not change code.
 - **Landing mode:** temp branch from `main`; bring in PR (squash default; rebase/merge when needed); fix; update `CHANGELOG.md` (PR #/issue + thanks); run `make ci`; final commit; merge to `main`; delete temp; end on `main`.
-- If we squash, add `Co-authored-by:` for the PR author when appropriate; leave a PR comment with what landed + SHAs.
+- If landing contributor work, always add `Co-authored-by:` trailers for PR authors, even when we partially rewrite, group, or manually apply their changes; leave a PR comment with what landed + SHAs.
 - New contributor: thank in `CHANGELOG.md` (and update README contributors list if present).
 
 ## Security & Configuration Tips

CHANGELOG.md

@@ -1,27 +1,224 @@
 # Changelog
 
-## 0.12.0 - Unreleased
+## 0.16.0 - Unreleased
+
+## 0.15.0 - 2026-05-05
 
 ### Added
-- Sheets: add `sheets insert` to insert rows/columns into a sheet. (#203) — thanks @andybergon.
-- Sheets: add `sheets links` (alias `hyperlinks`) to list cell links from ranges, including rich-text links. (#374) — thanks @omothm.
-- Sheets: add `sheets create --parent` to place new spreadsheets in a Drive folder. (#424) — thanks @ManManavadaria.
-- Gmail: add `watch serve --history-types` filtering (`messageAdded|messageDeleted|labelAdded|labelRemoved`) and include `deletedMessageIds` in webhook payloads. (#168) — thanks @salmonumbrella.
-- Contacts: support `--org`, `--title`, `--url`, `--note`, and `--custom` on create/update; include custom fields in get output with deterministic ordering. (#199) — thanks @phuctm97.
-- Drive: add `drive ls --all` (alias `--global`) to list across all accessible files; make `--all` and `--parent` mutually exclusive. (#107) — thanks @struong.
+- Export exact Google API JSON when the normal CLI view is too lossy: `docs raw`, `sheets raw`, `slides raw`, `drive raw`, `gmail raw`, `calendar raw`, `people raw`, `contacts raw`, `tasks raw`, and `forms raw`, with `--pretty`, safer Drive defaults, Sheets grid-data warnings, and a raw-output security audit. (#495, #496) — thanks @karbassi.
+- Audit Drive storage without changing files: `drive tree`, `drive du`, and `drive inventory` now report folder contents, sizes, and inventory data for cleanup/review workflows. (#116) — thanks @rohan-patnaik.
+- Find duplicate contacts safely: `contacts dedupe` is preview-only, matches by email/phone by default, supports opt-in name matching, and emits JSON/table merge plans without applying changes. (#116) — thanks @rohan-patnaik.
+- Read Gmail messages in agent-safe form: `gmail get --sanitize-content` / `--safe` and `gmail thread get --sanitize-content` return sanitized content without exposing raw Gmail payloads in JSON. (#238, #220) — thanks @urasmutlu.
+- Ship official container images: release tags now publish a non-root GHCR Docker image, with file-keyring docs for container automation. (#539, #444) — thanks @HuckOps and @rdehuyss.
+- Request custom Drive fields: `drive ls --fields` and `drive get --fields` pass Drive API field masks for data beyond the default JSON set. (#495) — thanks @karbassi.
+- Format Google Docs from the CLI: `docs format` and plain-text `docs write` formatting flags cover fonts, colors, bold/italic/underline/strikethrough, alignment, and line spacing. (#479) — thanks @mmaghsoodnia.
+- Manage Google Docs tabs: `docs add-tab`, `docs rename-tab`, `docs delete-tab`, plus tab-scoped Markdown append and find-replace flows. (#547, #541) — thanks @chopenhauer and @donbowman.
+- Work with structured Google Sheets tables: `sheets table` list/get/create/delete, `sheets table append`, and header-safe `sheets table clear`. (#470) — thanks @Pedrohgv.
+- Format Sheets visually: `sheets conditional-format` and `sheets banding` add rule-based formatting and alternating color banded ranges. (#378) — thanks @codBang.
+- Add Meet links to existing calendar events with `calendar update --with-meet`. (#538) — thanks @alexisperumal.
+- Move calendar events between calendars with `calendar move` / `calendar transfer`, including organizer changes. (#448) — thanks @markusbkoch.
+- Export Gmail filters as Gmail WebUI-importable Atom XML, while keeping API JSON export via `--format json`. (#174) — thanks @gwpl.
+- Build safer agent binaries with baked `agent-safe`, `readonly`, and `full` safety profiles, fail-closed command filtering, filtered help/schema output, docs, and build tooling. (#366, #239) — thanks @drewburchfield.
+- Use gog from coding agents more safely with the bundled `gog` skill for JSON-first Google Workspace automation. (#353, #451) — thanks @TimPietrusky and @sluramod.
 
 ### Fixed
-- Calendar: respond patches only attendees to avoid custom reminders validation errors. (#265) — thanks @sebasrodriguez.
-- Contacts: fix grouped parameter types in CRUD helpers to restore builds on newer Go toolchains. (#355) — thanks @laihenyi.
+- Make full-mailbox backups survive large Gmail exports by promoting completed checkpoint shards into the final manifest and byte-splitting fallback message shards before GitHub rejects oversized blobs.
+- Make backup exports more resumable and fault-tolerant by streaming decrypted shards, preserving Gmail Markdown mirrors, handling very large JSONL rows, and writing Markdown fallbacks for malformed MIME messages instead of aborting.
+- Keep agent safety profiles harder to patch by compiling baked policies into generated hash switches instead of embedding raw allow/deny YAML strings. (#540) — thanks @drewburchfield.
+- Show correct versions for `go install ...@tag` binaries by inferring module versions from Go build info when linker metadata is absent. (#545, #544) — thanks @joshavant.
+- Accept the documented `calendar events list` / `ls` selector forms, including positional calendar IDs, `--cal`, `--calendars`, and `--all`. (#546) — thanks @BCudeOpenClaw.
+- Keep `docs find-replace --dry-run` read-only while still reporting match counts, and allow empty replacement strings to delete matches safely. (#542) — thanks @chrismdp.
+
+## 0.14.0 - 2026-04-28
+
+### Added
+- Backup: add `gog backup` with age-encrypted Git shards, Gmail labels/raw message export, Calendar/Contacts/Tasks/Drive metadata adapters, manifest status, full decrypt-and-verify, shard `cat`, local plaintext export, docs, and security-focused regression coverage.
+- Backup: expand `gog backup push --services all` with Drive content export/download, Gmail settings, native Workspace Docs/Sheets/Slides/Form data, Apps Script projects, Chat, Classroom, best-effort optional service error shards, and plaintext Drive file export.
+- Backup: extend `--services all` with Drive permissions/comments/revisions, Calendar ACL/settings/colors, contact groups, Cloud Identity groups, Workspace Admin Directory users/groups/members, Keep notes, and local Gmail message caching for resumable full-mailbox fetches.
+- Backup: add `gog backup export --gmail-format markdown` for local readable Gmail mirrors with Markdown notes and extracted attachment files.
+- Gmail: add `gmail messages search --body-format html` for returning HTML message bodies when `--include-body` is used. (#520) — thanks @alexknowshtml.
+- Contacts: add `contacts export` for vCard 4.0 `.vcf` exports by resource, email/name search, or all contacts, including best-effort label categories. (#519, #500) — thanks @dinakars777.
+- Docs: add experimental `docs export --tab` / `drive download --tab` to export a single Google Docs tab as PDF, DOCX, text, Markdown, or HTML. (#535) — thanks @johnbenjaminlewis.
+- Slides: add `slides insert-text` and `slides replace-text` for editing existing slide text elements and replacing template tokens. (#521) — thanks @chrissanchez-iops.
+- Drive: add `drive search --drive` and `--parent` for scoping search to a shared drive or folder. (#525) — thanks @LeanSheng.
+- Calendar: add `--start-timezone` / `--end-timezone` to `calendar create` and `calendar update` for preserving named IANA event timezones when RFC3339 inputs only carry numeric offsets. (#422)
+- Contacts: include birthdays in `contacts list` and `contacts search` text and JSON output. (#441)
+- Auth: add `gog auth doctor` to diagnose keyring backend/password drift, unreadable file-keyring tokens, and refresh-token failures such as Workspace `invalid_rapt`. (#377, #338)
+- Backup: bound individual Drive content exports with `--drive-content-timeout` so one stuck Google export records an encrypted error row instead of blocking the full backup.
+- Backup: add Gmail message-list checkpoints, streaming shard construction, and stderr progress counters so full-mailbox backups can resume cleanly after interruption without keeping every raw message in RAM.
+- Backup: push encrypted incomplete Gmail checkpoint commits during long cached fetches so day-scale mailbox backups have offsite progress before the final manifest is committed.
+- Backup: push Gmail checkpoint commits through a single ordered background queue so cached fetches continue while GitHub uploads run.
+- Slides docs: document the Markdown structure accepted by `slides create-from-markdown`. (#497)
+- Google API: expose a reusable authenticated HTTP client for commands that need custom HTTP policies. (#534) — thanks @johnbenjaminlewis.
+
+### Fixed
+- Auth: keep `gog auth list` and `gog auth tokens list` useful when one file-keyring token cannot be decrypted; unreadable entries are now reported instead of aborting the whole listing. (#377)
+- Auth: time out Linux D-Bus keyring write operations and report when OAuth completed but saving the refresh token failed, so manual auth no longer looks like a stuck paste when token persistence is blocked. (#130)
+- Auth: store Google OIDC `sub` claims with OAuth tokens and migrate matching subject-keyed accounts when a Google email rename is reauthorized. (#504)
+- Gmail: build outbound `Date` headers with the configured timezone so replies do not inherit a wrong host-local offset. (#514, #472) — thanks @dinakars777.
+- Gmail: auto-fill draft reply subjects from the original message when `gmail drafts create --reply-to-message-id` omits `--subject`. (#488) — thanks @jbowerbir.
+- Gmail: fall back to the People profile name for primary-account `From` headers when Gmail send-as settings omit a display name. (#431) — thanks @moeedahmed.
+- Gmail: expose reply threading headers in default `gmail get --format metadata` output and fail explicit reply targets that cannot provide a `Message-ID`. (#528, #512) — thanks @solomonneas.
+- Gmail: apply Gmail system-label filters for searches like `in:spam is:unread` so thread, message, and batch message searches do not return read spam. (#449)
+- Gmail: preserve renewed watch expiration fields when a long-running `gmail watch serve` process records push delivery state after `gmail watch renew` runs separately. (#526)
+- Gmail: reuse the shared paginated list runner for thread and message search so `--all`, `--page`, text, and JSON output stay consistent.
+- Gmail: clarify that `gmail batch delete` is permanent and point default-scope workflows at `gmail trash`. (#151)
+- Drive/Docs/Sheets/Slides: treat `--out -` as stdout for downloads and exports instead of creating `-`/`-.ext` files; reject `--json --out -` to keep byte streams parseable. (#286)
+- Docs: deprecate editing-command `--tab-id` in favor of `--tab`, and resolve tab titles to canonical tab IDs before mutations. (#533) — thanks @johnbenjaminlewis.
+- Docs: convert Markdown formatting for `docs write --append --markdown` instead of appending raw Markdown syntax. (#530, #272) — thanks @eric-x-liu.
+- Docs: include available tab names when `docs cat --tab` / structure lookup cannot find the requested tab. (#532) — thanks @johnbenjaminlewis.
+- Docs: size remote Markdown images consistently for `docs write --replace --markdown` by reusing the Docs image insertion path after Drive conversion, and return a clear error for local image paths that the Docs API cannot fetch directly. (#518) — thanks @vinothd-oai.
+- Drive: print large upload progress to stderr while keeping JSON output parseable. (#529)
+- Drive: include `hasThumbnail` and `thumbnailLink` in `drive ls`, `drive search`, and `drive get` JSON responses. (#486) — thanks @gtapps.
+- Drive: include `driveId` in `drive ls`, `drive search`, and `drive get` field masks so Shared Drive files can be identified in JSON output. (#524) — thanks @LeanSheng.
+- Calendar: display `calendar events` times and JSON local fields in the calendar timezone instead of preserving arbitrary event offsets. (#493)
+- Email tracking: add versioned tracking-key rotation so new pixels use the current key while old tracking ids keep decrypting through prior keys. (#293)
+- Email tracking: deduplicate repeated pixel opens and cap recorded opens per IP per hour to reduce D1 abuse from replay or high-volume requests. (#294)
+- Email tracking: add daily Worker retention cleanup for open rows older than 90 days and cap admin `/opens` responses at 500 rows. (#292)
+- Email tracking: make `gmail track setup --deploy` reusable with existing D1 databases and valid temporary Wrangler configs.
+- Backup: split Gmail checkpoint commits by row count and plaintext byte size so large messages stay below GitHub's blob limit.
+- Secrets: time out macOS Keychain read/write/list operations with a clear recovery hint instead of hanging indefinitely when a permission prompt cannot surface. (#515, #513) — thanks @sardoru.
+- Secrets: encode file-backend key names so stored tokens work on Windows, while still reading/removing legacy raw entries. (#527, #502) — thanks @solomonneas.
+- CLI: show direct Google Cloud API enablement links and matching `auth add --services ...` hints when Google returns API-not-enabled errors.
+- Install docs: document Windows release ZIP/PATH setup and clarify that source builds require the Go version declared in `go.mod`, not Ubuntu 24.04's Go 1.22 package. (#157, #135)
+- Auth docs: clarify that consumer Gmail refresh tokens expire after 7 days when the OAuth app remains External + Testing, and that publishing the personal OAuth app is the long-lived-token path. (#121)
+- CI: pin GitHub Actions workflow dependencies to immutable commit SHAs. (#288)
+
+## 0.13.0 - 2026-04-20
+
+### Highlights
+- Gmail: safer sending and richer message workflows, with no-send guardrails, forwarding, autoreplies, full-body search output, label styling, and better MIME/body handling. (#454, #482, #447, #457, #476, #477, #511) — thanks @veteranbv, @spencer-c-reed, @GodsBoy, @iskw9973, @shashankkr9, @yeager, and @dinakars777.
+- Drive/Docs/Slides: smoother content round-trips with Markdown-to-Docs upload conversion, restored Markdown replace writes, rendered slide thumbnails, commenter sharing, and better Docs sed formatting. (#487, #501, #498, #443, #483) — thanks @johnbenjaminlewis, @twilsher, @gianpaj, @pavelzak, and @bill492.
+- Sheets: chart management lands, including list/inspect/create/update/delete and a chart-range fix for sheet ID 0. (#434) — thanks @andybergon.
+- Calendar: create secondary calendars and get more predictable timezone/day-bound behavior. (#455, #492, #509, #510) — thanks @alexknowshtml, @RaphaelRUzan, and @dinakars777.
+- Auth and agent safety: credential cleanup, Google Ads auth, keyring namespace overrides, command denylists, and safer send-operation controls. (#473, #264, #463, #218, #173, #454) — thanks @yamagucci, @ufkhan97, @mkurz, @EricYangTL, @spookyuser, and @veteranbv.
+
+### Added
+- Gmail: add `--gmail-no-send`, `GOG_GMAIL_NO_SEND`, `gmail_no_send`, and per-account `config no-send` guards for blocking send operations. (#454) — thanks @veteranbv.
+- Gmail: add `gmail forward` / `gmail fwd` to forward a message with optional note, verified send-as alias, and original attachments. (#482) — thanks @spencer-c-reed.
+- Gmail: add `gmail autoreply` to reply once to matching messages, label the thread for dedupe, and optionally archive/mark read.
+- Gmail: add `gmail messages search --full` to print complete message bodies instead of truncating text output. (#447) — thanks @GodsBoy.
+- Gmail: add `gmail labels style` to update user label colors and list/message visibility. (#457) — thanks @iskw9973.
+- Drive: convert Markdown uploads to Google Docs and strip leading YAML frontmatter by default, with `--keep-frontmatter` to opt out. (#487) — thanks @johnbenjaminlewis.
+- Drive: allow `drive share --role commenter` for comment-only sharing. (#443) — thanks @pavelzak.
+- Drive: show owner email in `drive ls` and `drive search` table output. (#458) — thanks @laihenyi.
+- Slides: add `slides thumbnail` / `slides thumb` to fetch rendered slide thumbnail URLs or download PNG/JPEG images. (#498) — thanks @gianpaj.
+- Sheets: add `sheets chart` to list, inspect, create, update, and delete embedded charts. (#434) — thanks @andybergon.
+- Sheets: add `add-sheet`, `rename-sheet`, and `delete-sheet` tab aliases plus `sheets add-tab --index`. (#442) — thanks @alexknowshtml.
+- Calendar: add `calendar create-calendar` / `new-calendar` to create secondary calendars with description, timezone, and location. (#455) — thanks @alexknowshtml.
+- Auth: add `auth credentials remove` to delete stored OAuth client credentials and associated refresh tokens. (#473) — thanks @yamagucci.
+- Auth: add `ads` as an auth service for Google Ads API tokens. (#264) — thanks @ufkhan97.
+- Secrets: allow `GOG_KEYRING_SERVICE_NAME` to override the keyring namespace. (#463) — thanks @mkurz.
+- Agent safety: allow dotted command paths in `--enable-commands` and add `--disable-commands` / `GOG_DISABLE_COMMANDS` denylist support. (#218, #173) — thanks @EricYangTL and @spookyuser.
+- Contacts: add `--gender` to `contacts create` and `contacts update`, and include gender in `contacts get` text output. (#438) — thanks @klodr.
+- Chat: make `chat spaces find` use case-insensitive substring matching by default, with `--exact` for legacy exact lookup. (#506) — thanks @mvanhorn.
+
+### Fixed
+- Calendar: avoid ambiguous timezone guessing from offset-only event times, preserve timezones for focus-time events, and use exclusive next-midnight bounds for full-day ranges. (#492, #509, #510) — thanks @RaphaelRUzan and @dinakars777.
+- Gmail: preserve sent and received body content by using quoted-printable plain text, non-`7bit` non-ASCII HTML, and safer UTF-8 charset handling. (#476, #477, #511) — thanks @shashankkr9, @yeager, and @dinakars777.
+- Docs: restore `docs write --replace --markdown` conversion and preserve sed formatting ranges, UTF-16 offsets, and `&` whole-match replacements. (#501, #483) — thanks @twilsher and @bill492.
+- Sheets: preserve valid chart ranges that target sheet ID 0 while still remapping sample-style zero IDs when the spreadsheet has no zero-ID sheet. (#434) — thanks @andybergon.
+- Auth: remove stale aliases and account-client mappings from config when `auth remove` deletes an account. (#467) — thanks @mvanhorn.
+- Contacts: reject all individual update flags when `contacts update --from-file` is used. (#439) — thanks @klodr.
+- Tasks: clear task due dates when `tasks update --due=` is provided. (#507) — thanks @dinakars777.
+- CLI: generate native zsh completions without relying on `bashcompinit`. (#481) — thanks @piiq.
+- Windows: expand `~\...` paths and run the integration live-test wrapper through PowerShell. (#452) — thanks @gagradebnath.
+- Tracking: prefer file-stored tracking secrets over stale keyring values unless keyring storage is configured. (#469) — thanks @alexuser.
+- Time parsing: accept `tues`, `thur`, and `thurs` as weekday expressions. (#440) — thanks @sjhddh.
+
+## 0.12.0 - 2026-03-09
+
+### Highlights
+- Admin: full Workspace Admin users/groups coverage for common directory operations. (#403) — thanks @dl-alexandre.
+- Auth: new headless/cloud auth paths with ADC, direct access tokens, custom callbacks, proxy-safe loopback settings, and extra-scope controls. (#357, #419, #227, #398, #421) — thanks @tengis617, @mmkal, @cyberfox, @salmonumbrella, and @peteradams2026.
+- Docs: much stronger document editing and export flow with tab targeting, richer find-replace, pageless mode, and native Markdown/HTML export. (#330, #305, #300, #282, #141) — thanks @ignacioreyna, @chparsons, @shohei-majima, @fprochazka, and @in-liberty420.
+- Sheets: spreadsheet editing/formatting expands significantly with named ranges, tab management, notes, find-replace, formatting controls, inserts, links, and format inspection. (#278, #309, #430, #341, #320, #203, #374, #284) — thanks @TheCrazyLex, @JulienMalige, @andybergon, @Shehryar, @omothm, and @nilzzzzzz.
+- Calendar: aliases, subscribe, and selector parity make multi-calendar workflows much easier. (#393, #327, #319) — thanks @salmonumbrella and @cdthompson.
+- Forms/Slides/Keep: forms management + watches, slides from templates, and first write/delete coverage for Keep. (#274, #273, #413) — thanks @alexknowshtml, @penguinco, and @jgwesterlund.
+
+### Added
+- Admin: add Workspace Admin Directory commands for users and groups, including user list/get/create/suspend and group membership list/add/remove. (#403) — thanks @dl-alexandre.
+- Auth: add Application Default Credentials mode via `GOG_AUTH_MODE=adc` for Workload Identity, Cloud Run, and local `gcloud` ADC flows without stored OAuth refresh tokens. (#357) — thanks @tengis617.
+- Auth: add `--access-token` / `GOG_ACCESS_TOKEN` for direct access-token auth in headless or CI flows, bypassing stored refresh tokens. (#419) — thanks @mmkal.
+- Auth: add `auth add|manage --listen-addr` plus `--redirect-host` for browser OAuth behind proxies or remote loopback forwarding. (#227) — thanks @cyberfox.
+- Auth: add `auth add --redirect-uri` for manual/remote OAuth flows, so custom callback hosts can be reused across the printed auth URL, state cache, and code exchange. (#398) — thanks @salmonumbrella.
+- Auth: add `--extra-scopes` to `auth add` for appending custom OAuth scope URIs beyond the built-in service scopes. (#421) — thanks @peteradams2026.
+- Docs: add `--tab-id` to editing commands so write/update/insert/delete/find-replace can target a specific Google Docs tab. (#330) — thanks @ignacioreyna.
+- Docs: extend `docs find-replace` with `--first`, `--content-file`, Markdown replacement, inline image insertion, and image sizing syntax. (#305) — thanks @chparsons.
+- Docs: add `--pageless` to `docs create`, `docs write`, and `docs update` to switch documents into pageless mode after writes. (#300) — thanks @shohei-majima.
+- Docs: add native Google Docs Markdown export via `docs export --format md`. (#282) — thanks @fprochazka.
+- Docs: add native Google Docs HTML export via `docs export --format html`. (#141) — thanks @in-liberty420.
+- Sheets: add named range management (`sheets named-ranges`) and let range-based Sheets commands accept named range names where GridRange-backed operations are needed. (#278) — thanks @TheCrazyLex.
+- Sheets: add `add-tab`, `rename-tab`, and `delete-tab` commands for managing spreadsheet tabs, with delete dry-run/confirmation guardrails. (#309) — thanks @JulienMalige.
+- Sheets: add `merge`, `unmerge`, `number-format`, `freeze`, `resize-columns`, and `resize-rows` commands for spreadsheet layout/format control. (#320) — thanks @Shehryar.
+- Sheets: add `sheets update-note` / `set-note` to write or clear cell notes across a range. (#430) — thanks @andybergon.
+- Sheets: add `sheets find-replace` to replace text across a spreadsheet or a specific tab, with exact-match, regex, and formula search options. (#341) — thanks @Shehryar.
+- Sheets: add `sheets insert` to insert rows/columns into a sheet. (#203) — thanks @andybergon.
+- Sheets: add `sheets create --parent` to place new spreadsheets in a Drive folder. (#424) — thanks @ManManavadaria.
+- Sheets: add `sheets read-format` to inspect `userEnteredFormat` / `effectiveFormat` per cell. (#284) — thanks @nilzzzzzz.
+- Sheets: add `sheets links` (alias `hyperlinks`) to list cell links from ranges, including rich-text links. (#374) — thanks @omothm.
+- Forms: add form update/question-management commands plus response watch create/list/delete/renew, with delete-question validation and confirmation guardrails. (#274) — thanks @alexknowshtml.
+- Slides: add `create-from-template` with `--replace` / `--replacements`, dry-run support, and template placeholder replacement stats. (#273) — thanks @penguinco.
+- Calendar: add `calendar alias list|set|unset`, and let calendar commands resolve configured aliases before API/name lookup. (#393) — thanks @salmonumbrella.
+- Calendar: let `calendar freebusy` / `calendar conflicts` accept `--cal`, names, indices, and `--all` like `calendar events`. (#319) — thanks @salmonumbrella.
+- Calendar: add `calendar subscribe` (aliases `sub`, `add-calendar`) to add a shared calendar to the current account’s calendar list. (#327) — thanks @cdthompson.
+- Gmail: add `gmail send --signature`, `--signature-from`, and `--signature-file` to append Gmail send-as or local signatures before sending. (#180, #183) — thanks @kesslerio and @salmonumbrella.
+- Gmail: add `watch serve --history-types` filtering (`messageAdded|messageDeleted|labelAdded|labelRemoved`) and include `deletedMessageIds` in webhook payloads. (#168) — thanks @salmonumbrella.
+- Gmail: add `gmail labels rename` to rename user labels by ID or exact name, with system-label guards and wrong-case ID safety. (#391) — thanks @adam-zethraeus.
+- Gmail: add `gmail messages modify` for single-message label changes, complementing thread- and batch-level modify flows. (#281) — thanks @zerone0x.
+- Gmail: add `gmail filters export` to dump filter definitions as JSON to stdout or a file for backup/script workflows. (#119) — thanks @Jeswang.
+- Keep: add `keep create` for text/checklist notes and `keep delete` for note removal. (#413) — thanks @jgwesterlund.
+- Contacts: support `--org`, `--title`, `--url`, `--note`, and `--custom` on create/update; include custom fields in get output with deterministic ordering. (#199) — thanks @phuctm97.
+- Contacts: add `--relation type=person` to contact create/update, include relations in text `contacts get`, and cover relation payload updates. (#351) — thanks @karbassi.
+- Contacts: add `--address` to contact create/update and include addresses in text `contacts get`. (#148) — thanks @beezly.
+- Drive: add `drive ls --all` (alias `--global`) to list across all accessible files; make `--all` and `--parent` mutually exclusive. (#107) — thanks @struong.
+- Chat: add `chat messages reactions create|list|delete` to manage emoji reactions on messages; `chat messages react <message> <emoji>` as a shorthand for creating reactions; `reaction` is an alias for `reactions`. (#426) — thanks @fernandopps.
+- Tasks: add `--recur` / `--recur-rrule` aliases for repeat materialization, including RRULE `INTERVAL` support for generated occurrences. (#408) — thanks @salmonumbrella.
+
+### Fixed
+- Google API: use transport-level response-header timeouts for API clients while keeping token exchanges bounded, so large downloads are not cut short by `http.Client.Timeout`. (#425) — thanks @laihenyi.
 - Timezone: embed the IANA timezone database so Windows builds can resolve calendar timezones correctly. (#388) — thanks @visionik.
-- Gmail: add a fetch delay in `watch serve` so History API reads don't race message indexing. (#397) — thanks @salmonumbrella.
-- Gmail: allow Workspace-managed send-as aliases with empty verification status in `send` and `drafts create`. (#407) — thanks @salmonumbrella.
-- Gmail: preserve the selected `--client` during `watch serve` push handling instead of falling back to the default client. (#411) — thanks @chrysb.
-- Secrets: respect empty `GOG_KEYRING_PASSWORD` (treat set-to-empty as intentional; avoids headless prompts). (#269) — thanks @zerone0x.
-- Calendar: reject ambiguous calendar-name selectors for `calendar events` instead of guessing. (#131) — thanks @salmonumbrella.
-- Gmail: `drafts update --quote` now picks a non-draft, non-self message from thread fallback (or errors clearly), avoiding self-quote loops and wrong reply headers. (#394) — thanks @salmonumbrella.
+- Auth: persist rotated OAuth refresh tokens returned during API calls so later commands keep working without re-auth. (#373) — thanks @joshp123.
+- Auth: allow pure service-account mode when the configured subject matches the service account itself, instead of forcing domain-wide delegation impersonation. (#399) — thanks @carrotRakko.
+- Auth: keep Keep-only service-account fallback isolated to Keep commands so other Google services do not accidentally pick it up. (#414) — thanks @jgwesterlund.
 - Auth: add `--gmail-scope full|readonly`, and disable `include_granted_scopes` for readonly/limited auth requests to avoid Drive/Gmail scope accumulation. (#113) — thanks @salmonumbrella.
+- Auth: preserve scope-shaping flags in the remote step-2 replay guidance for `auth add --remote`. (#427) — thanks @doodaaatimmy-creator.
+- Calendar: preserve full RRULE values and recurring-event timezones during updates so recurrence edits don’t lose BYDAY lists or hit missing-timezone API errors. (#392) — thanks @salmonumbrella.
+- Calendar: let recurring `calendar update --scope=future` and `calendar delete --scope=future` start from an instance event ID by resolving the parent series first. (#319) — thanks @salmonumbrella.
+- Calendar: use `Calendars.Get` for timezone lookups so service-account flows don’t 404 on `calendarList/primary`. (#325) — thanks @markwatson.
+- Calendar: hide cancelled/deleted events from `calendar events` list output by explicitly setting `showDeleted=false`. (#362) — thanks @sharukh010.
+- Calendar: reject ambiguous calendar-name selectors for `calendar events` instead of guessing. (#131) — thanks @salmonumbrella.
+- Calendar: respond patches only attendees to avoid custom reminders validation errors. (#265) — thanks @sebasrodriguez.
+- Calendar: force-send `minutes=0` for `--reminder popup:0m` so zero-minute popup reminders survive Google Calendar API JSON omission rules. (#316) — thanks @salmonumbrella.
+- Calendar: clarify that RFC3339 `--from/--to` timestamps must include a timezone while keeping date and relative-time help intact. (#409) — thanks @dbhurley.
+- Gmail: add a fetch delay in `watch serve` so History API reads don't race message indexing. (#397) — thanks @salmonumbrella.
+- Gmail: preserve the selected `--client` during `watch serve` push handling instead of falling back to the default client. (#411) — thanks @chrysb.
+- Gmail: allow Workspace-managed send-as aliases with empty verification status in `send` and `drafts create`. (#407) — thanks @salmonumbrella.
+- Gmail: fall back to `MimeType` charset hints when `Content-Type` headers are missing so GBK/GB2312 message bodies decode correctly. (#428) — thanks @WinnCook.
+- Gmail: `drafts update --quote` now picks a non-draft, non-self message from thread fallback (or errors clearly), avoiding self-quote loops and wrong reply headers. (#394) — thanks @salmonumbrella.
+- Gmail: preserve `Cc` metadata output in plain `gmail get --format metadata` even when Gmail returns uppercase `CC` headers. (#343) — thanks @salmonumbrella.
 - Gmail: `gmail archive|read|unread|trash` convenience commands now honor `--dry-run` and emit action-specific dry-run ops. (#385) — thanks @yeager.
+- Gmail: retry transient `failedPrecondition` errors during `gmail filters create` and return the existing matching filter on duplicate creates, so reruns stay idempotent.
+- Sheets: harden `sheets format` against `boarders` typo (JSON and field mask), with clearer error messages. (#284) — thanks @nilzzzzzz.
+- Sheets: force-send empty note values so `sheets update-note --note ''` reliably clears notes via the API. (#341) — thanks @Shehryar.
+- Contacts: send the required `copyMask` when deleting "other contacts", avoiding People API 400 errors. (#384) — thanks @rbansal42.
+- Groups: include required label filters in transitive group searches so `groups list` doesn’t 400 on Cloud Identity. (#315) — thanks @salmonumbrella.
+- Sheets: make `sheets metadata --plain` emit real TSV tab delimiters, with regression coverage for plain tabular sheet output. (#298) — thanks @mahsumaktas.
+- CLI: show root help instead of a parse error when `gog` is run with no arguments. (#342) — thanks @cstenglein.
+- CLI: include the current partial token in fish shell completion so `gog __complete` sees the active word under the cursor. (#123) — thanks @GiGurra.
+
+### Security & Reliability
+- Secrets: verify keyring token writes by reading them back, so macOS headless Keychain failures return an actionable error instead of silently storing 0 bytes. (#270) — thanks @zerone0x.
+- Secrets: respect empty `GOG_KEYRING_PASSWORD` (treat set-to-empty as intentional; avoids headless prompts). (#269) — thanks @zerone0x.
+- Security: require confirmation before public Drive shares, Gmail forwarding filters, and Gmail delegate grants in no-input/agent flows. (#317) — thanks @salmonumbrella.
+- Security: redact stored Gmail watch webhook bearer tokens in `gmail watch status` text and JSON output unless `--show-secrets` is set. (#136) — thanks @paveg.
+
+### Tooling & Docs
+- Docs: update install docs to use the official Homebrew core formula (`brew install gogcli`). (#361) — thanks @zeldrisho.
+- Contacts: fix grouped parameter types in CRUD helpers to restore builds on newer Go toolchains. (#355) — thanks @laihenyi.
+- CI: validate release tags and quote the checkout ref in the release workflow to block tag-script injection on manual releases. (#299) — thanks @salmonumbrella.
+- Build: refresh the dependency stack to Go 1.26.1, current Go indirects, GitHub Actions v6/v7 pins, and current Cloudflare worker dependencies.
+- Keep: request the writable Keep service-account scope now that note create/delete is supported. (#413) — thanks @jgwesterlund.
 
 ## 0.11.0 - 2026-02-15
 

Dockerfile

@@ -0,0 +1,40 @@
+# syntax=docker/dockerfile:1.7
+
+ARG GO_VERSION=1.26.2
+ARG ALPINE_VERSION=3.22
+
+FROM golang:${GO_VERSION}-alpine AS build
+
+RUN apk add --no-cache ca-certificates git tzdata
+
+WORKDIR /src
+COPY go.mod go.sum ./
+RUN go mod download
+
+COPY . .
+
+ARG VERSION=dev
+ARG COMMIT=unknown
+ARG DATE=unknown
+
+RUN CGO_ENABLED=0 GOOS=linux go build -trimpath \
+    -ldflags="-s -w -X github.com/steipete/gogcli/internal/cmd.version=${VERSION} -X github.com/steipete/gogcli/internal/cmd.commit=${COMMIT} -X github.com/steipete/gogcli/internal/cmd.date=${DATE}" \
+    -o /out/gog ./cmd/gog
+
+FROM alpine:${ALPINE_VERSION}
+
+LABEL org.opencontainers.image.source="https://github.com/steipete/gogcli"
+LABEL org.opencontainers.image.description="Google services CLI for terminal automation"
+LABEL org.opencontainers.image.licenses="MIT"
+
+RUN apk add --no-cache ca-certificates tzdata \
+    && adduser -D -u 10001 -h /home/gog gog
+
+ENV HOME=/home/gog
+WORKDIR /home/gog
+
+COPY --from=build /out/gog /usr/local/bin/gog
+
+USER gog
+ENTRYPOINT ["gog"]
+CMD ["--help"]

LICENSE

@@ -1,6 +1,6 @@
 MIT License
 
-\g<1>2026 Peter Steinberger
+Copyright (c) 2026 Peter Steinberger
 
 Permission is hereby granted, free of charge, to any person obtaining a copy
 of this software and associated documentation files (the "Software"), to deal

Makefile

@@ -3,7 +3,7 @@ SHELL := /bin/bash
 # `make` should build the binary by default.
 .DEFAULT_GOAL := build
 
-.PHONY: build gog gogcli gog-help gogcli-help help fmt fmt-check lint test ci tools
+.PHONY: build build-safe gog gogcli gog-help gogcli-help help fmt fmt-check lint test ci tools docs-commands docs-site docs-check
 .PHONY: worker-ci
 
 BIN_DIR := $(CURDIR)/bin
@@ -14,13 +14,17 @@ VERSION := $(shell git describe --tags --always --dirty 2>/dev/null || echo dev)
 COMMIT := $(shell git rev-parse --short=12 HEAD 2>/dev/null || echo "")
 DATE := $(shell date -u +%Y-%m-%dT%H:%M:%SZ)
 LDFLAGS := -X github.com/steipete/gogcli/internal/cmd.version=$(VERSION) -X github.com/steipete/gogcli/internal/cmd.commit=$(COMMIT) -X github.com/steipete/gogcli/internal/cmd.date=$(DATE)
+# `make lint` already covers vet-equivalent checks; skip duplicate work in `make test`.
+GO_TEST_FLAGS ?= -vet=off
+TEST_FLAGS ?=
+TEST_PKGS ?= ./...
 
 TOOLS_DIR := $(CURDIR)/.tools
 GOFUMPT := $(TOOLS_DIR)/gofumpt
 GOIMPORTS := $(TOOLS_DIR)/goimports
 GOLANGCI_LINT := $(TOOLS_DIR)/golangci-lint
 TOOLS_STAMP := $(TOOLS_DIR)/.versions
-TOOLS_VERSION := gofumpt=v0.9.2;goimports=v0.42.0;golangci-lint=v2.10.1
+TOOLS_VERSION := gofumpt=v0.9.2;goimports=v0.44.0;golangci-lint=v2.11.4
 
 # Allow passing CLI args as extra "targets":
 #   make gogcli -- --help
@@ -34,6 +38,9 @@ build:
 	@mkdir -p $(BIN_DIR)
 	@go build -ldflags "$(LDFLAGS)" -o $(BIN) $(CMD)
 
+build-safe:
+	@./build-safe.sh $${PROFILE:-safety-profiles/agent-safe.yaml} -o $${OUTPUT:-$(BIN_DIR)/gog-safe}
+
 gog: build
 	@if [ -n "$(RUN_ARGS)" ]; then \
 		$(BIN) $(RUN_ARGS); \
@@ -60,14 +67,23 @@ gogcli-help: build
 
 help: gog-help
 
+docs-commands: build
+	@scripts/gen-command-reference.sh docs/commands.generated.md
+
+docs-site: docs-commands
+	@node scripts/build-docs-site.mjs
+
+docs-check: docs-site
+	@node scripts/check-docs-coverage.mjs
+
 tools:
 	@mkdir -p $(TOOLS_DIR)
 	@if [ -x "$(GOFUMPT)" ] && [ -x "$(GOIMPORTS)" ] && [ -x "$(GOLANGCI_LINT)" ] && [ "$$(cat $(TOOLS_STAMP) 2>/dev/null)" = "$(TOOLS_VERSION)" ]; then \
 		echo "tools up to date"; \
 	else \
 		GOBIN=$(TOOLS_DIR) go install mvdan.cc/gofumpt@v0.9.2; \
-		GOBIN=$(TOOLS_DIR) go install golang.org/x/tools/cmd/goimports@v0.42.0; \
-		GOBIN=$(TOOLS_DIR) go install github.com/golangci/golangci-lint/v2/cmd/golangci-lint@v2.10.1; \
+		GOBIN=$(TOOLS_DIR) go install golang.org/x/tools/cmd/goimports@v0.44.0; \
+		GOBIN=$(TOOLS_DIR) go install github.com/golangci/golangci-lint/v2/cmd/golangci-lint@v2.11.4; \
 		printf '%s\n' "$(TOOLS_VERSION)" > "$(TOOLS_STAMP)"; \
 	fi
 
@@ -91,7 +107,7 @@ pnpm-gate:
 	fi
 
 test:
-	@go test ./...
+	@go test $(GO_TEST_FLAGS) $(TEST_FLAGS) $(TEST_PKGS)
 
 ci: pnpm-gate fmt-check lint test
 

build-safe.sh

@@ -0,0 +1,79 @@
+#!/usr/bin/env bash
+set -euo pipefail
+
+cd "$(dirname "$0")"
+
+usage() {
+  cat >&2 <<'USAGE'
+Usage: ./build-safe.sh <profile.yaml> [-o output]
+
+Examples:
+  ./build-safe.sh safety-profiles/readonly.yaml
+  ./build-safe.sh safety-profiles/agent-safe.yaml -o /usr/local/bin/gog-safe
+USAGE
+}
+
+if [[ "${1:-}" == "-h" || "${1:-}" == "--help" ]]; then
+  usage
+  exit 0
+fi
+
+if [[ -z "${1:-}" || "${1:-}" == -* ]]; then
+  usage
+  exit 2
+fi
+
+PROFILE="$1"
+shift
+
+OUTPUT="bin/gog-safe"
+while [[ $# -gt 0 ]]; do
+  case "$1" in
+    -o|--output)
+      if [[ -z "${2:-}" ]]; then
+        echo "error: $1 requires a path" >&2
+        exit 2
+      fi
+      OUTPUT="$2"
+      shift 2
+      ;;
+    -h|--help)
+      usage
+      exit 0
+      ;;
+    *)
+      echo "error: unknown flag: $1" >&2
+      usage
+      exit 2
+      ;;
+  esac
+done
+
+if [[ ! -f "$PROFILE" ]]; then
+  echo "error: profile not found: $PROFILE" >&2
+  exit 1
+fi
+
+GEN_FILE="internal/cmd/safety_profile_baked_gen.go"
+cleanup() {
+  rm -f "$GEN_FILE"
+}
+trap cleanup EXIT
+
+cleanup
+go run ./cmd/bake-safety-profile "$PROFILE" "$GEN_FILE"
+
+VERSION=$(git describe --tags --always --dirty 2>/dev/null || echo dev)
+COMMIT=$(git rev-parse --short=12 HEAD 2>/dev/null || echo "")
+DATE=$(date -u +%Y-%m-%dT%H:%M:%SZ)
+LDFLAGS="-X github.com/steipete/gogcli/internal/cmd.version=${VERSION}-safe -X github.com/steipete/gogcli/internal/cmd.commit=${COMMIT} -X github.com/steipete/gogcli/internal/cmd.date=${DATE}"
+
+mkdir -p "$(dirname "$OUTPUT")"
+go build -tags safety_profile -ldflags "$LDFLAGS" -o "$OUTPUT" ./cmd/gog
+RUN_OUTPUT="$OUTPUT"
+if [[ "$RUN_OUTPUT" != */* ]]; then
+  RUN_OUTPUT="./$RUN_OUTPUT"
+fi
+"$RUN_OUTPUT" --version
+
+echo "built $OUTPUT with baked safety profile $PROFILE"

cmd/bake-safety-profile/main.go

@@ -0,0 +1,115 @@
+package main
+
+import (
+	"bytes"
+	"fmt"
+	"os"
+	"strconv"
+	"strings"
+
+	"github.com/steipete/gogcli/internal/safetyprofile"
+)
+
+const usage = `Usage: bake-safety-profile <profile.yaml> <output.go>` + "\n"
+
+func main() {
+	args := os.Args[1:]
+	if len(args) != 2 {
+		_, _ = fmt.Fprint(os.Stderr, usage)
+		os.Exit(2)
+	}
+
+	raw, err := os.ReadFile(args[0]) // #nosec G304 G703 -- build helper intentionally reads the requested profile path.
+	if err != nil {
+		_, _ = fmt.Fprintf(os.Stderr, "read profile: %v\n", err)
+		os.Exit(1)
+	}
+
+	profile, err := safetyprofile.Parse(string(raw))
+	if err != nil {
+		_, _ = fmt.Fprintf(os.Stderr, "parse profile: %v\n", err)
+		os.Exit(1)
+	}
+
+	out := generate(profile)
+	if err := os.WriteFile(args[1], out, 0o600); err != nil { // #nosec G306 G703 -- build helper intentionally writes the requested generated Go path.
+		_, _ = fmt.Fprintf(os.Stderr, "write output: %v\n", err)
+		os.Exit(1)
+	}
+}
+
+// generate emits a Go file that resolves the bakedSafety* package-level
+// functions for safety_profile builds. Allow and deny rules are encoded as
+// FNV-64a hashes in switch statements so that the rule set itself is no
+// longer a contiguous, patchable string in the binary.
+func generate(profile *safetyprofile.Profile) []byte {
+	var out bytes.Buffer
+	hasAllowRules := profile.AllowAll || len(profile.AllowRules) > 0
+
+	out.WriteString("// Code generated by cmd/bake-safety-profile; DO NOT EDIT.\n")
+	commentName := strings.ReplaceAll(strings.ReplaceAll(profile.Name, "\n", " "), "\r", " ")
+	fmt.Fprintf(&out, "// Profile: %s (%d allow, %d deny, allow-all=%t)\n", commentName, len(profile.AllowRules), len(profile.DenyRules), profile.AllowAll)
+	out.WriteString("// Hash: FNV-64a over dotted command paths.\n")
+	out.WriteString("//go:build safety_profile\n\n")
+	out.WriteString("package cmd\n\n")
+
+	out.WriteString("const bakedSafetyProfileNameConst = ")
+	out.WriteString(strconv.Quote(profile.Name))
+	out.WriteString("\n\n")
+
+	out.WriteString("func bakedSafetyEnabled() bool       { return true }\n")
+	out.WriteString("func bakedSafetyProfileName() string { return bakedSafetyProfileNameConst }\n")
+	fmt.Fprintf(&out, "func bakedSafetyHasAllowRules() bool { return %t }\n\n", hasAllowRules)
+
+	writeMatcher(&out, "bakedSafetyAllowMatch", profile.AllowRules, profile.AllowAll)
+	out.WriteString("\n")
+	writeMatcher(&out, "bakedSafetyDenyMatch", profile.DenyRules, false)
+
+	return out.Bytes()
+}
+
+func writeMatcher(out *bytes.Buffer, name string, rules []string, matchAll bool) {
+	fmt.Fprintf(out, "func %s(path []string) bool {\n", name)
+	if matchAll {
+		out.WriteString("\treturn true\n}\n")
+		return
+	}
+	if len(rules) == 0 {
+		out.WriteString("\treturn false\n}\n")
+		return
+	}
+
+	out.WriteString("\tif len(path) == 0 {\n\t\treturn false\n\t}\n")
+	out.WriteString("\tfor i := 1; i <= len(path); i++ {\n")
+	out.WriteString("\t\tswitch bakedSafetyHashPath(path[:i]) {\n")
+	out.WriteString("\t\tcase ")
+
+	cases := make([]string, 0, len(rules))
+	seen := make(map[uint64]string, len(rules))
+	for _, rule := range rules {
+		h := safetyprofile.HashRule(rule)
+		if existing, dup := seen[h]; dup {
+			fmt.Fprintf(os.Stderr, "bake-safety-profile: hash collision between %q and %q (FNV-64a=%#x); pick a different name or extend the hash\n", existing, rule, h)
+			os.Exit(1)
+		}
+		seen[h] = rule
+		cases = append(cases, fmt.Sprintf("0x%016x", h))
+	}
+
+	const perLine = 4
+	for i, c := range cases {
+		out.WriteString(c)
+		if i == len(cases)-1 {
+			break
+		}
+		out.WriteString(",")
+		if (i+1)%perLine == 0 {
+			out.WriteString("\n\t\t\t")
+		} else {
+			out.WriteString(" ")
+		}
+	}
+	out.WriteString(":\n\t\t\treturn true\n")
+	out.WriteString("\t\t}\n\t}\n")
+	out.WriteString("\treturn false\n}\n")
+}

cmd/bake-safety-profile/main_test.go

@@ -0,0 +1,138 @@
+package main
+
+import (
+	"bytes"
+	"fmt"
+	"go/parser"
+	"go/token"
+	"strings"
+	"testing"
+
+	"github.com/steipete/gogcli/internal/safetyprofile"
+)
+
+func TestGenerateProducesParseableGoWithExpectedHashes(t *testing.T) {
+	profile := &safetyprofile.Profile{
+		Name:       "test",
+		AllowAll:   false,
+		AllowRules: []string{"version", "gmail.search", "gmail.drafts.create"},
+		DenyRules:  []string{"gmail.send", "gmail.drafts.send"},
+	}
+
+	out := generate(profile)
+
+	if _, err := parser.ParseFile(token.NewFileSet(), "gen.go", out, parser.AllErrors); err != nil {
+		t.Fatalf("generated code does not parse as Go:\n%s\n\nerror: %v", out, err)
+	}
+
+	want := []string{
+		`//go:build safety_profile`,
+		`package cmd`,
+		`const bakedSafetyProfileNameConst = "test"`,
+		`func bakedSafetyEnabled() bool       { return true }`,
+		`func bakedSafetyHasAllowRules() bool { return true }`,
+	}
+	for _, line := range want {
+		if !bytes.Contains(out, []byte(line)) {
+			t.Fatalf("generated output missing %q\n\nfull output:\n%s", line, out)
+		}
+	}
+
+	for _, rule := range profile.AllowRules {
+		hex := fmt.Sprintf("0x%016x", safetyprofile.HashRule(rule))
+		if !bytes.Contains(out, []byte(hex)) {
+			t.Fatalf("expected allow hash %s for rule %q in output", hex, rule)
+		}
+	}
+	for _, rule := range profile.DenyRules {
+		hex := fmt.Sprintf("0x%016x", safetyprofile.HashRule(rule))
+		if !bytes.Contains(out, []byte(hex)) {
+			t.Fatalf("expected deny hash %s for rule %q in output", hex, rule)
+		}
+	}
+
+	for _, rule := range profile.AllowRules {
+		if bytes.Contains(out, []byte(fmt.Sprintf("%q", rule))) {
+			t.Fatalf("rule string %q must not appear in generated output", rule)
+		}
+	}
+	for _, rule := range profile.DenyRules {
+		if bytes.Contains(out, []byte(fmt.Sprintf("%q", rule))) {
+			t.Fatalf("rule string %q must not appear in generated output", rule)
+		}
+	}
+}
+
+func TestGenerateSanitizesProfileNameInComment(t *testing.T) {
+	profile := &safetyprofile.Profile{
+		Name:      "bad\nname\rwith-controls",
+		AllowAll:  true,
+		DenyRules: []string{},
+	}
+	out := generate(profile)
+
+	if _, err := parser.ParseFile(token.NewFileSet(), "gen.go", out, parser.AllErrors); err != nil {
+		t.Fatalf("generated code with control chars in name does not parse:\n%s\n\nerror: %v", out, err)
+	}
+	if bytes.Contains(out, []byte("\nname\r")) || bytes.Contains(out, []byte("\nname\n")) {
+		t.Fatalf("comment header leaked control chars from profile name:\n%s", out)
+	}
+}
+
+func TestGenerateAllowAllEmitsConstantTrue(t *testing.T) {
+	profile := &safetyprofile.Profile{
+		Name:      "full",
+		AllowAll:  true,
+		DenyRules: []string{},
+	}
+	out := string(generate(profile))
+
+	allowFn := extractFunc(t, out, "bakedSafetyAllowMatch")
+	if !strings.Contains(allowFn, "return true") || strings.Contains(allowFn, "switch ") {
+		t.Fatalf("AllowAll allow matcher should be `return true` only, got:\n%s", allowFn)
+	}
+
+	denyFn := extractFunc(t, out, "bakedSafetyDenyMatch")
+	if !strings.Contains(denyFn, "return false") {
+		t.Fatalf("empty deny matcher should `return false`, got:\n%s", denyFn)
+	}
+}
+
+func TestGenerateEmptyAllowEmitsConstantFalse(t *testing.T) {
+	profile := &safetyprofile.Profile{
+		Name:      "deny-only",
+		AllowAll:  false,
+		DenyRules: []string{"gmail.send"},
+	}
+	out := string(generate(profile))
+
+	if !strings.Contains(out, "func bakedSafetyHasAllowRules() bool { return false }") {
+		t.Fatalf("expected hasAllowRules=false for deny-only profile, got:\n%s", out)
+	}
+	allowFn := extractFunc(t, out, "bakedSafetyAllowMatch")
+	if !strings.Contains(allowFn, "return false") || strings.Contains(allowFn, "switch ") {
+		t.Fatalf("empty allow matcher should be `return false` only, got:\n%s", allowFn)
+	}
+}
+
+func extractFunc(t *testing.T, src, name string) string {
+	t.Helper()
+	start := strings.Index(src, "func "+name+"(")
+	if start < 0 {
+		t.Fatalf("function %s not found in:\n%s", name, src)
+	}
+	depth := 0
+	for i := start; i < len(src); i++ {
+		switch src[i] {
+		case '{':
+			depth++
+		case '}':
+			depth--
+			if depth == 0 {
+				return src[start : i+1]
+			}
+		}
+	}
+	t.Fatalf("function %s has unbalanced braces", name)
+	return ""
+}

docs/RELEASING.md

@@ -24,6 +24,10 @@ Assumptions:
 - Go toolchain installed (Go version comes from `go.mod`).
 - `make` works locally.
 - Access to the tap repo (e.g. `steipete/homebrew-tap`).
+- For signed macOS release binaries (recommended): GitHub Actions secrets set:
+  - `MACOS_SIGNING_CERT_BASE64` (base64-encoded `.p12`)
+  - `MACOS_SIGNING_CERT_PASSWORD`
+  - `MACOS_CODESIGN_IDENTITY` (e.g. `Developer ID Application: …`)
 
 ## 1) Verify build is green
 ```sh
@@ -71,7 +75,14 @@ gh workflow run release.yml -f tag=vX.Y.Z
 ## 5) Update (or add) the Homebrew formula
 In the tap repo (assumed sibling at `../homebrew-tap`), create/update `Formula/gogcli.rb`.
 
-Recommended formula shape (build-from-source, no binary assets needed):
+Recommended formula shape (download GitHub release assets; preserves macOS code signature):
+- `version "X.Y.Z"`
+- `url "https://github.com/steipete/gogcli/releases/download/vX.Y.Z/gogcli_X.Y.Z_darwin_arm64.tar.gz"` (or `darwin_amd64`)
+- `sha256 "<sha256>"`
+- Install:
+  - `bin.install "gog"`
+
+Alternative (build-from-source; macOS binary will be ad-hoc signed, which can trigger repeated Keychain prompts with `KeychainTrustApplication`):
 - `version "X.Y.Z"`
 - `url "https://github.com/steipete/gogcli/archive/refs/tags/vX.Y.Z.tar.gz"`
 - `sha256 "<sha256>"`

docs/assets/site.css

@@ -1,489 +0,0 @@
-:root {
-  --bg0: #07070b;
-  --bg1: #0b0b11;
-  --bg2: #11111a;
-  --card: rgba(17, 17, 26, 0.72);
-  --card2: rgba(12, 12, 18, 0.64);
-  --stroke: rgba(255, 255, 255, 0.08);
-  --stroke2: rgba(255, 255, 255, 0.05);
-  --text: #f3f4f6;
-  --muted: rgba(243, 244, 246, 0.7);
-  --dim: rgba(243, 244, 246, 0.46);
-
-  --b: #4285f4;
-  --r: #ea4335;
-  --y: #fbbc05;
-  --g: #34a853;
-
-  --shadow: 0 24px 60px rgba(0, 0, 0, 0.55);
-  --shadow2: 0 16px 40px rgba(0, 0, 0, 0.45);
-
-  --radius: 16px;
-  --radius2: 22px;
-
-  --serif: "Fraunces", ui-serif, Georgia, serif;
-  --sans: "DM Sans", -apple-system, BlinkMacSystemFont, "Segoe UI", sans-serif;
-  --mono: "JetBrains Mono", ui-monospace, SFMono-Regular, Menlo, monospace;
-}
-
-* {
-  box-sizing: border-box;
-}
-
-html,
-body {
-  height: 100%;
-}
-
-body {
-  margin: 0;
-  background: radial-gradient(1200px 800px at 50% -20%, rgba(66, 133, 244, 0.18), transparent 60%),
-    radial-gradient(900px 700px at 80% 18%, rgba(234, 67, 53, 0.14), transparent 55%),
-    radial-gradient(1000px 900px at 18% 62%, rgba(52, 168, 83, 0.14), transparent 55%),
-    radial-gradient(900px 900px at 65% 88%, rgba(251, 188, 5, 0.12), transparent 55%),
-    linear-gradient(180deg, var(--bg0), var(--bg1) 40%, var(--bg0));
-  color: var(--text);
-  font-family: var(--sans);
-  -webkit-font-smoothing: antialiased;
-  line-height: 1.55;
-  overflow-x: hidden;
-}
-
-a {
-  color: inherit;
-  text-decoration: none;
-}
-
-a:hover {
-  text-decoration: underline;
-}
-
-code {
-  font-family: var(--mono);
-  font-size: 0.95em;
-}
-
-.skip {
-  position: absolute;
-  left: -999px;
-  top: 10px;
-  background: var(--bg2);
-  border: 1px solid var(--stroke);
-  color: var(--text);
-  padding: 10px 12px;
-  border-radius: 10px;
-  z-index: 20;
-}
-.skip:focus {
-  left: 12px;
-}
-
-.bg {
-  position: fixed;
-  inset: 0;
-  pointer-events: none;
-  z-index: 0;
-}
-
-.bg__mesh {
-  position: absolute;
-  inset: 0;
-  background: radial-gradient(1200px 800px at 20% 20%, rgba(66, 133, 244, 0.18), transparent 60%),
-    radial-gradient(1000px 800px at 82% 30%, rgba(234, 67, 53, 0.12), transparent 55%),
-    radial-gradient(1000px 900px at 40% 85%, rgba(52, 168, 83, 0.12), transparent 55%);
-  filter: blur(4px) saturate(1.12);
-  opacity: 0.95;
-}
-
-.bg__grid {
-  position: absolute;
-  inset: -2px;
-  background-image: linear-gradient(rgba(255, 255, 255, 0.04) 1px, transparent 1px),
-    linear-gradient(90deg, rgba(255, 255, 255, 0.04) 1px, transparent 1px);
-  background-size: 72px 72px;
-  opacity: 0.055;
-  transform: perspective(900px) rotateX(58deg) translateY(-18%);
-  transform-origin: top;
-  mask-image: radial-gradient(60% 60% at 50% 30%, rgba(0, 0, 0, 1), transparent 72%);
-}
-
-.bg__grain {
-  position: absolute;
-  inset: 0;
-  opacity: 0.2;
-  background-image: url("data:image/svg+xml,%3Csvg xmlns='http://www.w3.org/2000/svg' width='240' height='240'%3E%3Cfilter id='n'%3E%3CfeTurbulence type='fractalNoise' baseFrequency='.8' numOctaves='3' stitchTiles='stitch'/%3E%3C/filter%3E%3Crect width='240' height='240' filter='url(%23n)' opacity='.45'/%3E%3C/svg%3E");
-  mix-blend-mode: overlay;
-}
-
-.wrap {
-  width: min(1100px, calc(100% - 48px));
-  margin: 0 auto;
-  position: relative;
-  z-index: 1;
-}
-
-.top {
-  position: sticky;
-  top: 0;
-  z-index: 10;
-  backdrop-filter: blur(12px);
-  -webkit-backdrop-filter: blur(12px);
-  background: rgba(7, 7, 11, 0.58);
-  border-bottom: 1px solid rgba(255, 255, 255, 0.06);
-}
-
-.top__row {
-  display: flex;
-  align-items: center;
-  justify-content: space-between;
-  padding: 14px 0;
-}
-
-.brand {
-  display: flex;
-  align-items: center;
-  gap: 10px;
-  text-decoration: none !important;
-}
-
-.brand__mark {
-  width: 26px;
-  height: 26px;
-  border-radius: 10px;
-  background: conic-gradient(from 200deg, var(--b), var(--g), var(--y), var(--r), var(--b));
-  box-shadow: 0 10px 24px rgba(66, 133, 244, 0.15), 0 10px 24px rgba(52, 168, 83, 0.12);
-}
-
-.brand__mark--small {
-  width: 18px;
-  height: 18px;
-  border-radius: 7px;
-}
-
-.brand__name {
-  font-family: var(--mono);
-  font-weight: 500;
-  letter-spacing: -0.02em;
-}
-
-.brand__tag {
-  font-size: 12px;
-  color: var(--dim);
-  border: 1px solid var(--stroke2);
-  background: rgba(17, 17, 26, 0.55);
-  padding: 3px 8px;
-  border-radius: 999px;
-}
-
-.nav {
-  display: flex;
-  align-items: center;
-  gap: 18px;
-  font-size: 14px;
-  color: var(--muted);
-}
-
-.nav a {
-  text-decoration: none;
-}
-
-.nav a:hover {
-  color: var(--text);
-  text-decoration: none;
-}
-
-.nav__cta {
-  color: var(--text) !important;
-  background: rgba(255, 255, 255, 0.06);
-  border: 1px solid rgba(255, 255, 255, 0.08);
-  padding: 8px 12px;
-  border-radius: 999px;
-}
-
-.main {
-  padding-bottom: 70px;
-}
-
-.hero {
-  padding: 56px 0 26px;
-}
-
-.hero__grid {
-  display: grid;
-  grid-template-columns: 1.05fr 0.95fr;
-  gap: 28px;
-  align-items: start;
-}
-
-.kicker {
-  display: inline-flex;
-  gap: 10px;
-  align-items: center;
-  font-size: 12px;
-  letter-spacing: 0.12em;
-  text-transform: uppercase;
-  color: rgba(243, 244, 246, 0.58);
-  margin: 0 0 14px;
-}
-
-.kicker::before {
-  content: "";
-  width: 10px;
-  height: 10px;
-  border-radius: 3px;
-  background: linear-gradient(135deg, rgba(66, 133, 244, 0.9), rgba(52, 168, 83, 0.85));
-  box-shadow: 0 0 0 4px rgba(66, 133, 244, 0.08);
-}
-
-h1 {
-  font-family: var(--serif);
-  font-weight: 700;
-  letter-spacing: -0.03em;
-  line-height: 0.95;
-  margin: 0 0 14px;
-  font-size: clamp(44px, 5.5vw, 68px);
-}
-
-.hero__word {
-  display: block;
-  opacity: 0;
-  transform: translateY(10px);
-  animation: rise 700ms cubic-bezier(0.2, 1, 0.2, 1) forwards;
-}
-
-.hero__word:nth-child(1) {
-  animation-delay: 80ms;
-}
-.hero__word:nth-child(2) {
-  animation-delay: 160ms;
-}
-.hero__word:nth-child(3) {
-  animation-delay: 260ms;
-}
-
-.hero__word--mono {
-  font-family: var(--mono);
-  font-weight: 500;
-  letter-spacing: -0.04em;
-  color: rgba(243, 244, 246, 0.92);
-}
-
-@keyframes rise {
-  to {
-    opacity: 1;
-    transform: translateY(0);
-  }
-}
-
-.lede {
-  margin: 0 0 18px;
-  font-size: 16.5px;
-  color: var(--muted);
-  max-width: 52ch;
-  opacity: 0;
-  transform: translateY(10px);
-  animation: rise 700ms cubic-bezier(0.2, 1, 0.2, 1) 320ms forwards;
-}
-
-.lede strong {
-  color: var(--text);
-  font-weight: 600;
-}
-
-.pills {
-  display: flex;
-  flex-wrap: wrap;
-  gap: 8px;
-  margin: 0 0 20px;
-  opacity: 0;
-  transform: translateY(10px);
-  animation: rise 700ms cubic-bezier(0.2, 1, 0.2, 1) 380ms forwards;
-}
-
-.pill {
-  font-size: 12px;
-  border-radius: 999px;
-  padding: 6px 10px;
-  border: 1px solid var(--stroke2);
-  background: rgba(17, 17, 26, 0.55);
-  color: rgba(243, 244, 246, 0.76);
-}
-
-.pill--b {
-  box-shadow: inset 0 0 0 1px rgba(66, 133, 244, 0.25);
-}
-.pill--r {
-  box-shadow: inset 0 0 0 1px rgba(234, 67, 53, 0.22);
-}
-.pill--y {
-  box-shadow: inset 0 0 0 1px rgba(251, 188, 5, 0.22);
-}
-.pill--g {
-  box-shadow: inset 0 0 0 1px rgba(52, 168, 83, 0.22);
-}
-
-.hero__actions {
-  display: flex;
-  gap: 12px;
-  margin: 0 0 12px;
-  opacity: 0;
-  transform: translateY(10px);
-  animation: rise 700ms cubic-bezier(0.2, 1, 0.2, 1) 440ms forwards;
-}
-
-.btn {
-  display: inline-flex;
-  align-items: center;
-  justify-content: center;
-  gap: 10px;
-  padding: 10px 14px;
-  border-radius: 999px;
-  border: 1px solid rgba(255, 255, 255, 0.08);
-  text-decoration: none !important;
-  font-weight: 600;
-  font-size: 14px;
-  box-shadow: 0 10px 24px rgba(0, 0, 0, 0.22);
-}
-
-.btn--primary {
-  background: linear-gradient(135deg, rgba(66, 133, 244, 0.92), rgba(52, 168, 83, 0.86));
-  color: #091018;
-  border-color: rgba(255, 255, 255, 0.12);
-  box-shadow: 0 18px 44px rgba(66, 133, 244, 0.18), 0 18px 44px rgba(52, 168, 83, 0.14);
-}
-
-.btn--ghost {
-  background: rgba(255, 255, 255, 0.06);
-  color: var(--text);
-}
-
-.btn:hover {
-  transform: translateY(-1px);
-}
-
-.note {
-  margin: 0;
-  color: rgba(243, 244, 246, 0.56);
-  font-size: 13px;
-  opacity: 0;
-  transform: translateY(10px);
-  animation: rise 700ms cubic-bezier(0.2, 1, 0.2, 1) 520ms forwards;
-}
-
-.note code {
-  background: rgba(255, 255, 255, 0.06);
-  border: 1px solid rgba(255, 255, 255, 0.07);
-  padding: 2px 6px;
-  border-radius: 8px;
-  color: rgba(243, 244, 246, 0.84);
-}
-
-.hero__panel {
-  display: grid;
-  gap: 14px;
-  opacity: 0;
-  transform: translateY(10px);
-  animation: rise 700ms cubic-bezier(0.2, 1, 0.2, 1) 260ms forwards;
-}
-
-.card {
-  border: 1px solid var(--stroke);
-  background: var(--card);
-  border-radius: var(--radius2);
-  box-shadow: var(--shadow);
-  overflow: hidden;
-}
-
-.term__bar {
-  display: flex;
-  align-items: center;
-  gap: 12px;
-  padding: 12px 14px;
-  background: rgba(12, 12, 18, 0.58);
-  border-bottom: 1px solid rgba(255, 255, 255, 0.06);
-}
-
-.dots {
-  display: inline-flex;
-  gap: 6px;
-}
-
-.dot {
-  width: 11px;
-  height: 11px;
-  border-radius: 999px;
-}
-
-.dot--r {
-  background: #ff5f57;
-}
-.dot--y {
-  background: #febc2e;
-}
-.dot--g {
-  background: #28c840;
-}
-
-.term__title {
-  margin-left: auto;
-  margin-right: auto;
-  font-family: var(--mono);
-  font-size: 12px;
-  color: rgba(243, 244, 246, 0.55);
-}
-
-.term__body {
-  padding: 14px 14px 16px;
-  background: rgba(11, 11, 17, 0.6);
-}
-
-.term__pre {
-  margin: 0;
-  font-family: var(--mono);
-  font-size: 12.5px;
-  color: rgba(243, 244, 246, 0.86);
-  line-height: 1.6;
-  white-space: pre-wrap;
-}
-
-.term__pre code {
-  display: block;
-}
-
-.meta {
-  padding: 14px 14px;
-  background: var(--card2);
-  border: 1px solid rgba(255, 255, 255, 0.06);
-  box-shadow: var(--shadow2);
-}
-
-.meta__item {
-  display: grid;
-  grid-template-columns: 90px 1fr;
-  gap: 12px;
-  padding: 10px 0;
-}
-
-.meta__item + .meta__item {
-  border-top: 1px solid rgba(255, 255, 255, 0.06);
-}
-
-.meta__k {
-  color: rgba(243, 244, 246, 0.55);
-  font-size: 12px;
-  letter-spacing: 0.06em;
-  text-transform: uppercase;
-}
-
-.meta__v {
-  color: rgba(243, 244, 246, 0.86);
-  font-size: 13px;
-}
-
-.meta__v code {
-  background: rgba(255, 255, 255, 0.06);
-  border: 1px solid rgba(255, 255, 255, 0.07);
-  padding: 2px 6px;
-  border-radius: 8px;
-  color: rgba(243, 244, 246, 0.9);
-}

docs/assets/site.js

@@ -1,34 +0,0 @@
-(() => {
-  const el = document.getElementById("demo");
-  if (!el) return;
-
-  const original = el.textContent || "";
-  const prefersReduced = window.matchMedia?.("(prefers-reduced-motion: reduce)")?.matches;
-  if (prefersReduced) return;
-
-  el.textContent = "";
-
-  const lines = original.split("\n");
-  const chunkDelay = 16;
-  const lineDelay = 140;
-  let i = 0;
-  let j = 0;
-
-  const tick = () => {
-    if (i >= lines.length) return;
-    const line = lines[i];
-    if (j <= line.length) {
-      el.textContent += line.slice(j, j + 1);
-      j += 1;
-      window.setTimeout(tick, chunkDelay);
-      return;
-    }
-    el.textContent += "\n";
-    i += 1;
-    j = 0;
-    window.setTimeout(tick, lineDelay);
-  };
-
-  window.setTimeout(tick, 260);
-})();
-

docs/assets/site.more.css

@@ -1,239 +0,0 @@
-.section {
-  padding: 52px 0;
-}
-
-.section__grid {
-  display: grid;
-  grid-template-columns: 0.36fr 0.64fr;
-  gap: 28px;
-  align-items: start;
-}
-
-h2 {
-  font-family: var(--serif);
-  font-weight: 700;
-  letter-spacing: -0.02em;
-  margin: 0 0 6px;
-  font-size: 28px;
-}
-
-h3 {
-  margin: 0 0 8px;
-  font-size: 16px;
-  font-weight: 700;
-}
-
-.muted {
-  margin: 0;
-  color: var(--muted);
-}
-
-.cols {
-  display: grid;
-  grid-template-columns: 1fr 1fr;
-  gap: 14px;
-}
-
-.block {
-  padding: 16px 16px;
-}
-
-.code {
-  margin: 0;
-  padding: 12px 12px;
-  border-radius: 14px;
-  background: rgba(0, 0, 0, 0.22);
-  border: 1px solid rgba(255, 255, 255, 0.08);
-  overflow: auto;
-}
-
-.code code {
-  font-family: var(--mono);
-  font-size: 12.5px;
-  color: rgba(243, 244, 246, 0.88);
-}
-
-.steps {
-  display: grid;
-  gap: 14px;
-}
-
-.step {
-  display: grid;
-  grid-template-columns: 46px 1fr;
-  gap: 14px;
-  padding: 16px;
-  border-radius: var(--radius2);
-  border: 1px solid rgba(255, 255, 255, 0.08);
-  background: rgba(12, 12, 18, 0.46);
-  box-shadow: var(--shadow2);
-}
-
-.step__n {
-  width: 40px;
-  height: 40px;
-  border-radius: 14px;
-  display: grid;
-  place-items: center;
-  font-family: var(--mono);
-  font-weight: 500;
-  color: rgba(243, 244, 246, 0.92);
-  background: linear-gradient(135deg, rgba(66, 133, 244, 0.22), rgba(52, 168, 83, 0.18));
-  border: 1px solid rgba(255, 255, 255, 0.08);
-}
-
-.step p {
-  margin: 0 0 10px;
-  color: var(--muted);
-}
-
-.callout {
-  margin-top: 14px;
-  display: grid;
-  grid-template-columns: 44px 1fr;
-  gap: 14px;
-  padding: 16px;
-  border-radius: var(--radius2);
-  border: 1px solid rgba(255, 255, 255, 0.08);
-  background: linear-gradient(135deg, rgba(66, 133, 244, 0.14), rgba(234, 67, 53, 0.08));
-  box-shadow: var(--shadow2);
-}
-
-.callout__icon {
-  width: 44px;
-  height: 44px;
-  border-radius: 16px;
-  background: rgba(0, 0, 0, 0.18);
-  border: 1px solid rgba(255, 255, 255, 0.1);
-  box-shadow: inset 0 0 0 1px rgba(66, 133, 244, 0.18);
-}
-
-.callout__body p {
-  margin: 0 0 10px;
-  color: var(--muted);
-}
-
-.callout__body code {
-  background: rgba(255, 255, 255, 0.06);
-  border: 1px solid rgba(255, 255, 255, 0.07);
-  padding: 2px 6px;
-  border-radius: 8px;
-  color: rgba(243, 244, 246, 0.92);
-}
-
-.grid {
-  display: grid;
-  grid-template-columns: repeat(3, 1fr);
-  gap: 14px;
-}
-
-.feat {
-  padding: 16px;
-  background: rgba(12, 12, 18, 0.46);
-  box-shadow: var(--shadow2);
-}
-
-.feat p {
-  margin: 0;
-  color: var(--muted);
-}
-
-.footerline {
-  display: flex;
-  gap: 12px;
-  margin-top: 18px;
-}
-
-.sitefoot {
-  padding: 36px 0 26px;
-  border-top: 1px solid rgba(255, 255, 255, 0.08);
-  background: rgba(7, 7, 11, 0.35);
-  backdrop-filter: blur(10px);
-  -webkit-backdrop-filter: blur(10px);
-}
-
-.sitefoot__row {
-  display: flex;
-  align-items: center;
-  justify-content: space-between;
-  gap: 14px;
-}
-
-.sitefoot__brand {
-  display: inline-flex;
-  align-items: center;
-  gap: 10px;
-  font-family: var(--mono);
-}
-
-.sitefoot__small {
-  margin-top: 8px;
-  color: rgba(243, 244, 246, 0.6);
-  font-size: 13px;
-}
-
-.sitefoot__small a {
-  color: rgba(243, 244, 246, 0.75);
-}
-
-.sep {
-  margin: 0 8px;
-  color: rgba(243, 244, 246, 0.28);
-}
-
-.sitefoot__right {
-  display: flex;
-  gap: 14px;
-  color: rgba(243, 244, 246, 0.7);
-  font-size: 14px;
-}
-
-.sitefoot__fineprint {
-  margin-top: 18px;
-  color: rgba(243, 244, 246, 0.46);
-  font-size: 12px;
-}
-
-@media (max-width: 980px) {
-  .hero__grid {
-    grid-template-columns: 1fr;
-  }
-  .section__grid {
-    grid-template-columns: 1fr;
-  }
-  .grid {
-    grid-template-columns: 1fr 1fr;
-  }
-}
-
-@media (max-width: 640px) {
-  .wrap {
-    width: min(1100px, calc(100% - 28px));
-  }
-  .nav {
-    display: none;
-  }
-  .cols {
-    grid-template-columns: 1fr;
-  }
-  .grid {
-    grid-template-columns: 1fr;
-  }
-  .footerline {
-    flex-direction: column;
-    align-items: flex-start;
-  }
-  .sitefoot__row {
-    flex-direction: column;
-    align-items: flex-start;
-  }
-}
-
-@media (prefers-reduced-motion: reduce) {
-  * {
-    animation: none !important;
-    transition: none !important;
-    scroll-behavior: auto !important;
-  }
-}
-

docs/backup.md

@@ -0,0 +1,345 @@
+---
+summary: "Encrypted Google account backups"
+read_when:
+  - Adding a new gog backup service adapter
+  - Changing encrypted backup layout, manifest fields, or age identity handling
+  - Debugging backup-gog push, status, or verify
+---
+
+# Encrypted Backups
+
+`gog backup` writes Google account data into a Git repository as age-encrypted
+JSONL gzip shards. The intended repository is private, for example
+`https://github.com/steipete/backup-gog`, but service payloads are encrypted
+before Git sees them.
+
+## Commands
+
+Initialize local config, create an age identity if needed, seed the backup repo,
+and print the public recipient:
+
+```bash
+gog backup init \
+  --repo ~/Projects/backup-gog \
+  --remote https://github.com/steipete/backup-gog.git
+```
+
+Back up all supported services:
+
+```bash
+gog backup push --services all --account steipete@gmail.com
+```
+
+Back up only Gmail:
+
+```bash
+gog backup push --services gmail --account steipete@gmail.com
+```
+
+For a bounded smoke run:
+
+```bash
+gog backup push --services gmail --account steipete@gmail.com --query 'newer_than:7d' --max 25
+```
+
+Inspect cleartext manifest metadata:
+
+```bash
+gog backup status
+```
+
+Decrypt every shard and verify hashes and row counts:
+
+```bash
+gog backup verify
+```
+
+Decrypt one shard to stdout:
+
+```bash
+gog backup cat data/gmail/<account-hash>/labels.jsonl.gz.age --pretty
+```
+
+Write an unencrypted local copy for easy reading on the Mac:
+
+```bash
+gog backup export --out ~/Documents/gog-backup-export
+gog backup export --no-pull --out ~/Library/CloudStorage/Dropbox/backup/gog --gmail-format markdown
+```
+
+Use `--no-push` on `init` or `push` to commit locally without pushing to the
+remote.
+
+Supported services:
+
+- `gmail`: labels and raw MIME messages. Fetched raw messages are cached under
+  the local user cache by default so interrupted full-mailbox runs can resume
+  the expensive message download phase. Cached runs also write encrypted
+  incomplete checkpoint commits during long fetches; use `--no-gmail-cache`,
+  `--gmail-refresh-cache`, or `--no-gmail-checkpoints` to bypass those layers.
+- `gmail-settings`: filters, forwarding addresses, auto-forwarding, send-as
+  aliases, vacation responder, delegate visibility, POP, IMAP, and language
+  settings.
+- `calendar`: calendar list entries, ACL rules, Calendar settings/colors, and
+  all events, including deleted events.
+- `contacts`: People API contacts, other contacts, and contact groups.
+- `tasks`: task lists and tasks, including completed, deleted, hidden, and
+  assigned tasks.
+- `drive`: shared drives, Drive file metadata, permissions, comments, revision
+  metadata, and downloaded/exported file content. Google Docs export as `.docx`
+  and Markdown, Sheets as `.xlsx`, Slides as `.pptx` and PDF, Drawings as PNG
+  and PDF, and binary files as metadata-only unless `--drive-binary-contents`
+  is set.
+- `workspace`: Docs/Sheets/Slides inventory plus Forms and form responses
+  discovered through Drive. Add `--workspace-native` to fetch full native
+  Docs/Sheets/Slides API JSON.
+- `appscript`: Apps Script projects and source content discovered through
+  Drive.
+- `chat`: Chat spaces and messages, when the authenticated account/API allows
+  access.
+- `classroom`: courses, topics, announcements, coursework, materials, and
+  submissions visible to the authenticated account.
+- `groups`: Cloud Identity groups the account belongs to, plus member lists
+  when the API permits them.
+- `admin`: Workspace Admin Directory users, groups, and group members. This is
+  Workspace-only and requires the existing Admin SDK/domain-wide delegation
+  setup.
+- `keep`: Google Keep notes. This is Workspace-only and requires the existing
+  Keep service-account setup.
+
+`all` expands to every supported service. Pushing a subset updates that subset
+and preserves existing shards for services that were not selected, as long as
+the age recipients are unchanged.
+
+`gog backup push` enables `--drive-contents`, `--drive-collaboration`,
+`--gmail-cache`, and `--best-effort` by default. Use `--no-drive-contents` for
+metadata-only Drive runs, `--no-drive-collaboration` to skip per-file Drive
+permissions/comments/revisions, or
+`--drive-content-max-bytes <bytes>` to skip individual large Drive downloads.
+`--drive-content-timeout` bounds each individual Drive export/download; timed
+out files are represented as encrypted error rows so one stuck Google export
+does not wedge the whole run.
+Drive content exports Google-native files by default; set
+`--drive-binary-contents` only when you intentionally want non-Google binary
+file bytes in Git shards. Use `--workspace-native` only when you want the
+heavier native API JSON in addition to readable Drive exports;
+`--workspace-max-files` bounds that native fetch per file type for smoke tests.
+Best-effort optional services record encrypted `errors` shards and let the rest
+of the backup finish. The Gmail cache is only a local acceleration/resume cache;
+encrypted backup shards remain the source of truth once a push completes.
+
+## Files
+
+Local config:
+
+```text
+~/.gog/backup.json
+~/.gog/age.key
+```
+
+Backup repo:
+
+```text
+README.md
+manifest.json
+data/gmail/<account-hash>/labels.jsonl.gz.age
+data/gmail/<account-hash>/messages/YYYY/MM/part-0001.jsonl.gz.age
+data/calendar/<account-hash>/...
+data/contacts/<account-hash>/...
+data/drive/<account-hash>/...
+data/groups/<account-hash>/...
+data/admin/<account-hash>/...
+data/keep/<account-hash>/...
+data/tasks/<account-hash>/...
+```
+
+`manifest.json` is intentionally cleartext. It contains format version, export
+time, public age recipients, service names, account hashes, shard paths, row
+counts, encrypted byte sizes, and plaintext hashes used for verification. It
+does not contain email subjects, senders, recipients, bodies, raw message IDs,
+or labels.
+
+Plaintext export directory:
+
+```text
+README.md
+manifest.json
+gmail/<account-hash>/labels.json
+gmail/<account-hash>/messages/index.jsonl
+gmail/<account-hash>/messages/YYYY/MM/<timestamp>-<message-id>.eml
+gmail/<account-hash>/messages/YYYY/MM/<timestamp>-<subject>-<message-id>/message.md
+gmail/<account-hash>/messages/YYYY/MM/<timestamp>-<subject>-<message-id>/attachments/<filename>
+drive/<account-hash>/files/index.jsonl
+drive/<account-hash>/files/<file-id>/<exported-file>
+raw/<service>/...
+```
+
+`gog backup export` decrypts and verifies the manifest-backed shards before
+writing files. Gmail messages become `.eml` files by default. Use
+`--gmail-format markdown` for `message.md` files with YAML metadata and
+extracted `attachments/` folders, or `--gmail-format both` to write Markdown and
+`.eml` side by side. `--gmail-attachments none` keeps Markdown notes but skips
+attachment files. Drive content shards become normal files plus an index. Other
+services are written as verified JSONL under `raw/`. The export is not
+encrypted; do not place it inside the backup Git repository, and keep it out of
+synced/shared folders unless that is intentional.
+Use `--no-pull` when exporting from a local backup repository that another
+process is already updating.
+
+## Encryption
+
+Backups use the Go `filippo.io/age` library with X25519 age identities. There
+is no backup password. The private identity is stored locally:
+
+```text
+~/.gog/age.key
+```
+
+The matching public recipient starts with `age1...` and is safe to store in
+`~/.gog/backup.json` and `manifest.json`. The private `AGE-SECRET-KEY-...`
+value must stay local or in a password manager.
+
+For each shard, `gog backup push`:
+
+1. Exports deterministic JSONL rows.
+2. Gzip-compresses the JSONL with a fixed gzip timestamp.
+3. Encrypts the compressed bytes with age for every configured recipient.
+4. Writes only encrypted `*.jsonl.gz.age` files to Git.
+5. Writes `manifest.json` with cleartext metadata for status and verification.
+
+`gog backup verify` decrypts each shard with the local age identity, gunzips it,
+checks the plaintext SHA-256 hash from the manifest, and verifies row counts.
+`gog backup cat` and `gog backup export` use the same verification path before
+returning plaintext.
+
+## Security Boundary
+
+The encrypted shards protect Google content from GitHub and anyone else without
+the local age identity. That includes email bodies, subjects, senders,
+recipients, raw MIME payloads, labels, Drive filenames, contacts, event titles,
+and similar service data.
+
+The manifest is not secret. It leaks operational metadata by design:
+
+- Export time.
+- Public age recipients.
+- Service names.
+- Account hashes.
+- Shard paths and month buckets.
+- Row counts.
+- Encrypted byte sizes.
+- Plaintext shard hashes used by `verify`.
+- Backup cadence and which shards changed in Git history.
+
+The account hash is not anonymity. It is useful to avoid putting the literal
+email address in paths, but someone who can guess the address can compute and
+compare the same hash.
+
+Current trust model:
+
+- Confidentiality: good for a private GitHub backup repo as long as
+  `~/.gog/age.key` stays private.
+- Integrity against random corruption: `age` authentication, gzip decoding,
+  plaintext SHA-256, and row-count verification catch damaged shards.
+- Integrity against repository writers: limited. Anyone with push access can
+  replace encrypted backup data with different data encrypted to the public
+  recipient. Keep repo write access restricted and review unexpected commits.
+- Key compromise: if `AGE-SECRET-KEY-...` leaks, historical shards in Git
+  history may be readable. Rotate recipients, re-encrypt, and treat old Git
+  history as exposed unless it is rewritten and all copies are removed.
+
+Future hardening ideas:
+
+- Store only ciphertext hashes in the public manifest and move plaintext hashes
+  into encrypted shard metadata.
+- Sign manifests or commits with a local signing key so `verify` can prove who
+  created the backup, not just that the files are internally consistent.
+- Add optional shard padding or disable gzip for deployments that care more
+  about size side channels than repository size.
+
+## Service Adapters
+
+The Gmail adapter backs up:
+
+- Gmail labels.
+- Raw Gmail messages from `users.messages.get(format=raw)`.
+
+Raw message payloads stay base64url encoded inside encrypted JSONL. This
+preserves the RFC 2822 message content while keeping the shard format text
+friendly.
+
+By default, Gmail backup state is cached locally under the OS user cache
+directory (`gogcli/backup/gmail/<account-hash>/`). Message-list page checkpoints
+live under `list-v1/`, and fetched raw messages live under `raw-v1/`. Raw-message
+cache files store the same row that will be encrypted into shards and are keyed
+by a SHA-256 of the Gmail message ID, so rerunning after an interruption can
+reuse already fetched messages. The encrypted message shards are streamed from
+that cache in temporary per-shard files, so a full mailbox run does not retain
+every raw message in RAM. Long Gmail runs report list, fetch, and shard-build
+counters to stderr while stdout stays parseable. `--gmail-refresh-cache` forces
+a refetch. The cache is plaintext local data; clear it if the machine should not
+retain local mail copies outside the encrypted backup/export locations.
+
+Cached Gmail runs also push incomplete encrypted checkpoint snapshots to the
+backup Git repo. Checkpoint shards and manifests live under
+`checkpoints/gmail/<account-hash>/<run-id>/`, are encrypted with the same age
+recipients as normal backup shards, and are committed with messages like
+`checkpoint: gmail backup 20000/359635`. The checkpoint manifest has
+`"incomplete": true`; `gog backup status`, `verify`, `cat`, and `export` continue
+to use the root `manifest.json` as the authoritative completed backup. This
+keeps long runs crash-tolerant without pretending partial data is a finished
+snapshot. A checkpoint commit can cover many messages, but its encrypted files
+are split by both row count and a conservative plaintext byte ceiling so large
+messages do not create GitHub-rejected blobs. Checkpoint commits push through a
+single ordered background queue: `gog` records the exact commit SHA, continues
+cached Gmail fetching, and pushes queued SHAs to the current branch one at a
+time. Transient push failures are retried; GitHub hard rejections stop later
+checkpoints because descendants would inherit the rejected object. The final
+completed backup waits for the queue to drain, then promotes the completed
+checkpoint message shards into the root manifest instead of re-encrypting the
+same mailbox into a second multi-GB final push. If no complete matching
+checkpoint exists, final Gmail message shards still split by row count and the
+same conservative plaintext byte ceiling. Tune the commit cadence with
+`--gmail-checkpoint-rows` /
+`--gmail-checkpoint-interval` on `gog backup push`, or `--checkpoint-rows` /
+`--checkpoint-interval` on `gog backup gmail push`; set the interval or rows to
+`0` to disable that trigger, or use `--no-gmail-checkpoints` /
+`--no-checkpoints` to disable checkpoint pushes entirely.
+
+`--include-spam-trash` defaults to true. Use `--query` and `--max` for bounded
+test exports; omit them for a full mailbox scan.
+
+The Gmail settings adapter backs up account configuration through read-only
+settings endpoints. Some settings, such as delegates, can be forbidden for
+consumer accounts; those errors are kept inside the encrypted settings shard.
+
+The Calendar adapter backs up calendar list entries, ACLs, settings, colors,
+and all events from each calendar. The Contacts adapter backs up contacts, other
+contacts, and contact groups. The Tasks adapter backs up task lists and tasks.
+The Drive adapter backs up shared drives, file metadata, permissions, comments,
+revision metadata, and Google-native file exports by default. Content rows store
+base64 bytes inside encrypted JSONL so Git only sees ciphertext; plaintext
+export decodes them back into regular files. Non-Google binary Drive bytes are
+opt-in because personal Drives can easily contain tens of gigabytes.
+
+The Workspace adapter discovers Google Docs, Sheets, Slides, and Forms via
+Drive. Docs/Sheets/Slides are already recoverable through the Drive content
+exports; `--workspace-native` adds heavier native API JSON for machine-readable
+recovery. The Apps Script adapter discovers script projects through Drive and
+stores project metadata plus source content. Chat and Classroom adapters
+enumerate data visible to the authenticated account; personal/permission-limited
+accounts may produce encrypted error shards under `--best-effort`.
+
+## Adding Services
+
+Keep one backup engine and add service adapters. A service adapter should:
+
+1. Resolve the authenticated account through normal `gog` auth.
+2. Export stable rows without writing Google data.
+3. Store sensitive identifiers, titles, names, and content inside encrypted
+   shards only.
+4. Add cleartext manifest counts and account hashes only.
+5. Support bounded smoke flags when the service can be huge.
+
+Good next adapters: Drive file content export, Docs/Sheets/Slides native
+exports, Chat, Forms, Classroom, and Apps Script.

docs/commands.generated.md

@@ -0,0 +1,474 @@
+# Command Reference
+
+Generated from `gog schema --json`.
+
+- [`gog <command> [flags]`](commands/gog.md) - Google CLI for Gmail/Calendar/Chat/Classroom/Drive/Contacts/Tasks/Sheets/Docs/Slides/People/Forms/App Script/Ads/Groups/Admin/Keep
+  - [`gog admin <command> [flags]`](commands/gog-admin.md) - Google Workspace Admin (Directory API) - requires domain-wide delegation
+    - [`gog admin groups <command>`](commands/gog-admin-groups.md) - Manage Workspace groups
+      - [`gog admin groups list (ls) [flags]`](commands/gog-admin-groups-list.md) - List groups in a domain
+      - [`gog admin groups members <command>`](commands/gog-admin-groups-members.md) - Manage group members
+        - [`gog admin groups members add (invite) <groupEmail> <memberEmail> [flags]`](commands/gog-admin-groups-members-add.md) - Add a member to a group
+        - [`gog admin groups members list (ls) <groupEmail> [flags]`](commands/gog-admin-groups-members-list.md) - List group members
+        - [`gog admin groups members remove (rm,del,delete) <groupEmail> <memberEmail>`](commands/gog-admin-groups-members-remove.md) - Remove a member from a group
+    - [`gog admin users <command>`](commands/gog-admin-users.md) - Manage Workspace users
+      - [`gog admin users create (add,new) <email> [flags]`](commands/gog-admin-users-create.md) - Create a new user
+      - [`gog admin users get (info,show) <userEmail>`](commands/gog-admin-users-get.md) - Get user details
+      - [`gog admin users list (ls) [flags]`](commands/gog-admin-users-list.md) - List users in a domain
+      - [`gog admin users suspend <userEmail>`](commands/gog-admin-users-suspend.md) - Suspend a user account
+  - [`gog agent <command> [flags]`](commands/gog-agent.md) - Agent-friendly helpers
+    - [`gog agent exit-codes (exitcodes,exit-code)`](commands/gog-agent-exit-codes.md) - Print stable exit codes for automation
+  - [`gog appscript (script,apps-script) <command> [flags]`](commands/gog-appscript.md) - Google Apps Script
+    - [`gog appscript (script,apps-script) content (cat) <scriptId>`](commands/gog-appscript-content.md) - Get Apps Script project content
+    - [`gog appscript (script,apps-script) create (new) --title=STRING [flags]`](commands/gog-appscript-create.md) - Create an Apps Script project
+    - [`gog appscript (script,apps-script) get (info,show) <scriptId>`](commands/gog-appscript-get.md) - Get Apps Script project metadata
+    - [`gog appscript (script,apps-script) run <scriptId> <function> [flags]`](commands/gog-appscript-run.md) - Run a deployed Apps Script function
+  - [`gog auth <command> [flags]`](commands/gog-auth.md) - Auth and credentials
+    - [`gog auth add <email> [flags]`](commands/gog-auth-add.md) - Authorize and store a refresh token
+    - [`gog auth alias <command>`](commands/gog-auth-alias.md) - Manage account aliases
+      - [`gog auth alias list`](commands/gog-auth-alias-list.md) - List account aliases
+      - [`gog auth alias set <alias> <email>`](commands/gog-auth-alias-set.md) - Set an account alias
+      - [`gog auth alias unset <alias>`](commands/gog-auth-alias-unset.md) - Remove an account alias
+    - [`gog auth credentials <command>`](commands/gog-auth-credentials.md) - Manage OAuth client credentials
+      - [`gog auth credentials list`](commands/gog-auth-credentials-list.md) - List stored OAuth client credentials
+      - [`gog auth credentials remove [<client>]`](commands/gog-auth-credentials-remove.md) - Remove stored OAuth client credentials
+      - [`gog auth credentials set <credentials> [flags]`](commands/gog-auth-credentials-set.md) - Store OAuth client credentials
+    - [`gog auth doctor [flags]`](commands/gog-auth-doctor.md) - Diagnose auth, keyring, and refresh-token issues
+    - [`gog auth keep --key=STRING <email>`](commands/gog-auth-keep.md) - Configure service account for Google Keep (Workspace only)
+    - [`gog auth keyring [<backend> [<backend2>]]`](commands/gog-auth-keyring.md) - Configure keyring backend
+    - [`gog auth list [flags]`](commands/gog-auth-list.md) - List stored accounts
+    - [`gog auth manage (login) [flags]`](commands/gog-auth-manage.md) - Open accounts manager in browser
+    - [`gog auth remove <email>`](commands/gog-auth-remove.md) - Remove a stored refresh token
+    - [`gog auth service-account <command>`](commands/gog-auth-service-account.md) - Configure service account (Workspace only; domain-wide delegation)
+      - [`gog auth service-account set --key=STRING <email>`](commands/gog-auth-service-account-set.md) - Store a service account key for impersonation
+      - [`gog auth service-account status <email>`](commands/gog-auth-service-account-status.md) - Show stored service account key status
+      - [`gog auth service-account unset <email>`](commands/gog-auth-service-account-unset.md) - Remove stored service account key
+    - [`gog auth services [flags]`](commands/gog-auth-services.md) - List supported auth services and scopes
+    - [`gog auth status`](commands/gog-auth-status.md) - Show auth configuration and keyring backend
+    - [`gog auth tokens <command>`](commands/gog-auth-tokens.md) - Manage stored refresh tokens
+      - [`gog auth tokens delete <email>`](commands/gog-auth-tokens-delete.md) - Delete a stored refresh token
+      - [`gog auth tokens export <email> [flags]`](commands/gog-auth-tokens-export.md) - Export a refresh token to a file (contains secrets)
+      - [`gog auth tokens import <inPath>`](commands/gog-auth-tokens-import.md) - Import a refresh token file into keyring (contains secrets)
+      - [`gog auth tokens list`](commands/gog-auth-tokens-list.md) - List stored tokens (by key only)
+  - [`gog backup <command> [flags]`](commands/gog-backup.md) - Encrypted Google account backups
+    - [`gog backup cat <shard> [flags]`](commands/gog-backup-cat.md) - Decrypt one backup shard to stdout
+    - [`gog backup export [flags]`](commands/gog-backup-export.md) - Write a local plaintext export
+    - [`gog backup gmail <command>`](commands/gog-backup-gmail.md) - Gmail backup operations
+      - [`gog backup gmail push [flags]`](commands/gog-backup-gmail-push.md) - Export Gmail into encrypted backup shards
+    - [`gog backup init [flags]`](commands/gog-backup-init.md) - Initialize encrypted backup config and repository
+    - [`gog backup push [flags]`](commands/gog-backup-push.md) - Export services into encrypted backup shards
+    - [`gog backup status [flags]`](commands/gog-backup-status.md) - Inspect backup manifest without decrypting shards
+    - [`gog backup verify [flags]`](commands/gog-backup-verify.md) - Decrypt and verify all backup shards
+  - [`gog calendar (cal) <command> [flags]`](commands/gog-calendar.md) - Google Calendar
+    - [`gog calendar (cal) acl (permissions,perms) <calendarId> [flags]`](commands/gog-calendar-acl.md) - List calendar ACL
+    - [`gog calendar (cal) alias <command>`](commands/gog-calendar-alias.md) - Manage calendar aliases
+      - [`gog calendar (cal) alias list`](commands/gog-calendar-alias-list.md) - List calendar aliases
+      - [`gog calendar (cal) alias set <alias> <calendarId>`](commands/gog-calendar-alias-set.md) - Set a calendar alias
+      - [`gog calendar (cal) alias unset <alias>`](commands/gog-calendar-alias-unset.md) - Remove a calendar alias
+    - [`gog calendar (cal) calendars [flags]`](commands/gog-calendar-calendars.md) - List calendars
+    - [`gog calendar (cal) colors`](commands/gog-calendar-colors.md) - Show calendar colors
+    - [`gog calendar (cal) conflicts [flags]`](commands/gog-calendar-conflicts.md) - Find conflicts
+    - [`gog calendar (cal) create (add,new) <calendarId> [flags]`](commands/gog-calendar-create.md) - Create an event
+    - [`gog calendar (cal) create-calendar (new-calendar) <summary> [flags]`](commands/gog-calendar-create-calendar.md) - Create a new secondary calendar
+    - [`gog calendar (cal) delete (rm,del,remove) <calendarId> <eventId> [flags]`](commands/gog-calendar-delete.md) - Delete an event
+    - [`gog calendar (cal) event (get,info,show) <calendarId> <eventId>`](commands/gog-calendar-event.md) - Get event
+    - [`gog calendar (cal) events (list,ls) [<calendarId> ...] [flags]`](commands/gog-calendar-events.md) - List events from a calendar or all calendars
+    - [`gog calendar (cal) focus-time (focus) --from=STRING --to=STRING [<calendarId>] [flags]`](commands/gog-calendar-focus-time.md) - Create a Focus Time block
+    - [`gog calendar (cal) freebusy [<calendarIds>] [flags]`](commands/gog-calendar-freebusy.md) - Get free/busy
+    - [`gog calendar (cal) move (transfer) <calendarId> <eventId> <destinationCalendarId> [flags]`](commands/gog-calendar-move.md) - Move an event to another calendar
+    - [`gog calendar (cal) out-of-office (ooo) --from=STRING --to=STRING [<calendarId>] [flags]`](commands/gog-calendar-out-of-office.md) - Create an Out of Office event
+    - [`gog calendar (cal) propose-time <calendarId> <eventId> [flags]`](commands/gog-calendar-propose-time.md) - Generate URL to propose a new meeting time (browser-only feature)
+    - [`gog calendar (cal) raw <calendarId> <eventId> [flags]`](commands/gog-calendar-raw.md) - Dump raw Google Calendar API response as JSON (Events.Get; lossless; for scripting and LLM consumption)
+    - [`gog calendar (cal) respond (rsvp,reply) <calendarId> <eventId> [flags]`](commands/gog-calendar-respond.md) - Respond to an event invitation
+    - [`gog calendar (cal) search (find,query) <query> [flags]`](commands/gog-calendar-search.md) - Search events
+    - [`gog calendar (cal) subscribe (sub,add-calendar) <calendarId> [flags]`](commands/gog-calendar-subscribe.md) - Add a calendar to your calendar list
+    - [`gog calendar (cal) team <group-email> [flags]`](commands/gog-calendar-team.md) - Show events for all members of a Google Group
+    - [`gog calendar (cal) time [flags]`](commands/gog-calendar-time.md) - Show server time
+    - [`gog calendar (cal) update (edit,set) <calendarId> <eventId> [flags]`](commands/gog-calendar-update.md) - Update an event
+    - [`gog calendar (cal) users [flags]`](commands/gog-calendar-users.md) - List workspace users (use their email as calendar ID)
+    - [`gog calendar (cal) working-location (wl) --from=STRING --to=STRING --type=STRING [<calendarId>] [flags]`](commands/gog-calendar-working-location.md) - Set working location (home/office/custom)
+  - [`gog chat <command> [flags]`](commands/gog-chat.md) - Google Chat
+    - [`gog chat dm <command>`](commands/gog-chat-dm.md) - Direct messages
+      - [`gog chat dm send (create,post) <email> [flags]`](commands/gog-chat-dm-send.md) - Send a direct message
+      - [`gog chat dm space (find,setup) <email>`](commands/gog-chat-dm-space.md) - Find or create a DM space
+    - [`gog chat messages <command>`](commands/gog-chat-messages.md) - Chat messages
+      - [`gog chat messages list (ls) <space> [flags]`](commands/gog-chat-messages-list.md) - List messages
+      - [`gog chat messages react <message> <emoji> [flags]`](commands/gog-chat-messages-react.md) - Add an emoji reaction to a message
+      - [`gog chat messages reactions (reaction) <command>`](commands/gog-chat-messages-reactions.md) - Manage emoji reactions on a message
+        - [`gog chat messages reactions (reaction) create (add) <message> <emoji> [flags]`](commands/gog-chat-messages-reactions-create.md) - Add an emoji reaction to a message
+        - [`gog chat messages reactions (reaction) delete (remove,rm) <reaction>`](commands/gog-chat-messages-reactions-delete.md) - Delete a reaction
+        - [`gog chat messages reactions (reaction) list (ls) <message> [flags]`](commands/gog-chat-messages-reactions-list.md) - List reactions on a message
+      - [`gog chat messages send (create,post) <space> [flags]`](commands/gog-chat-messages-send.md) - Send a message
+    - [`gog chat spaces <command>`](commands/gog-chat-spaces.md) - Chat spaces
+      - [`gog chat spaces create (add,new) <displayName> [flags]`](commands/gog-chat-spaces-create.md) - Create a space
+      - [`gog chat spaces find (search,query) <displayName> [flags]`](commands/gog-chat-spaces-find.md) - Find spaces by display name
+      - [`gog chat spaces list (ls) [flags]`](commands/gog-chat-spaces-list.md) - List spaces
+    - [`gog chat threads <command>`](commands/gog-chat-threads.md) - Chat threads
+      - [`gog chat threads list <space> [flags]`](commands/gog-chat-threads-list.md) - List threads in a space
+  - [`gog classroom (class) <command> [flags]`](commands/gog-classroom.md) - Google Classroom
+    - [`gog classroom (class) announcements (announcement,ann) <command>`](commands/gog-classroom-announcements.md) - Announcements
+      - [`gog classroom (class) announcements (announcement,ann) assignees (assign) <courseId> <announcementId> [flags]`](commands/gog-classroom-announcements-assignees.md) - Modify announcement assignees
+      - [`gog classroom (class) announcements (announcement,ann) create (add,new) --text=STRING <courseId> [flags]`](commands/gog-classroom-announcements-create.md) - Create an announcement
+      - [`gog classroom (class) announcements (announcement,ann) delete (rm,del,remove) <courseId> <announcementId>`](commands/gog-classroom-announcements-delete.md) - Delete an announcement
+      - [`gog classroom (class) announcements (announcement,ann) get (info,show) <courseId> <announcementId>`](commands/gog-classroom-announcements-get.md) - Get an announcement
+      - [`gog classroom (class) announcements (announcement,ann) list (ls) <courseId> [flags]`](commands/gog-classroom-announcements-list.md) - List announcements
+      - [`gog classroom (class) announcements (announcement,ann) update (edit,set) <courseId> <announcementId> [flags]`](commands/gog-classroom-announcements-update.md) - Update an announcement
+    - [`gog classroom (class) courses (course) <command>`](commands/gog-classroom-courses.md) - Courses
+      - [`gog classroom (class) courses (course) archive (arch) <courseId>`](commands/gog-classroom-courses-archive.md) - Archive a course
+      - [`gog classroom (class) courses (course) create (add,new) --name=STRING [flags]`](commands/gog-classroom-courses-create.md) - Create a course
+      - [`gog classroom (class) courses (course) delete (rm,del,remove) <courseId>`](commands/gog-classroom-courses-delete.md) - Delete a course
+      - [`gog classroom (class) courses (course) get (info,show) <courseId>`](commands/gog-classroom-courses-get.md) - Get a course
+      - [`gog classroom (class) courses (course) join (enroll) <courseId> [flags]`](commands/gog-classroom-courses-join.md) - Join a course
+      - [`gog classroom (class) courses (course) leave (unenroll) <courseId> [flags]`](commands/gog-classroom-courses-leave.md) - Leave a course
+      - [`gog classroom (class) courses (course) list (ls) [flags]`](commands/gog-classroom-courses-list.md) - List courses
+      - [`gog classroom (class) courses (course) unarchive (unarch,restore) <courseId>`](commands/gog-classroom-courses-unarchive.md) - Unarchive a course
+      - [`gog classroom (class) courses (course) update (edit,set) <courseId> [flags]`](commands/gog-classroom-courses-update.md) - Update a course
+      - [`gog classroom (class) courses (course) url (link) <courseId> ...`](commands/gog-classroom-courses-url.md) - Print Classroom web URLs for courses
+    - [`gog classroom (class) coursework (work) <command>`](commands/gog-classroom-coursework.md) - Coursework
+      - [`gog classroom (class) coursework (work) assignees (assign) <courseId> <courseworkId> [flags]`](commands/gog-classroom-coursework-assignees.md) - Modify coursework assignees
+      - [`gog classroom (class) coursework (work) create (add,new) --title=STRING <courseId> [flags]`](commands/gog-classroom-coursework-create.md) - Create coursework
+      - [`gog classroom (class) coursework (work) delete (rm,del,remove) <courseId> <courseworkId>`](commands/gog-classroom-coursework-delete.md) - Delete coursework
+      - [`gog classroom (class) coursework (work) get (info,show) <courseId> <courseworkId>`](commands/gog-classroom-coursework-get.md) - Get coursework
+      - [`gog classroom (class) coursework (work) list (ls) <courseId> [flags]`](commands/gog-classroom-coursework-list.md) - List coursework
+      - [`gog classroom (class) coursework (work) update (edit,set) <courseId> <courseworkId> [flags]`](commands/gog-classroom-coursework-update.md) - Update coursework
+    - [`gog classroom (class) guardian-invitations (guardian-invites) <command>`](commands/gog-classroom-guardian-invitations.md) - Guardian invitations
+      - [`gog classroom (class) guardian-invitations (guardian-invites) create (add,new) --email=STRING <studentId>`](commands/gog-classroom-guardian-invitations-create.md) - Create a guardian invitation
+      - [`gog classroom (class) guardian-invitations (guardian-invites) get (info,show) <studentId> <invitationId>`](commands/gog-classroom-guardian-invitations-get.md) - Get a guardian invitation
+      - [`gog classroom (class) guardian-invitations (guardian-invites) list (ls) <studentId> [flags]`](commands/gog-classroom-guardian-invitations-list.md) - List guardian invitations
+    - [`gog classroom (class) guardians (guardian) <command>`](commands/gog-classroom-guardians.md) - Guardians
+      - [`gog classroom (class) guardians (guardian) delete (rm,del,remove) <studentId> <guardianId>`](commands/gog-classroom-guardians-delete.md) - Delete a guardian
+      - [`gog classroom (class) guardians (guardian) get (info,show) <studentId> <guardianId>`](commands/gog-classroom-guardians-get.md) - Get a guardian
+      - [`gog classroom (class) guardians (guardian) list (ls) <studentId> [flags]`](commands/gog-classroom-guardians-list.md) - List guardians
+    - [`gog classroom (class) invitations (invitation,invites) <command>`](commands/gog-classroom-invitations.md) - Invitations
+      - [`gog classroom (class) invitations (invitation,invites) accept (join) <invitationId>`](commands/gog-classroom-invitations-accept.md) - Accept an invitation
+      - [`gog classroom (class) invitations (invitation,invites) create (add,new) --role=STRING <courseId> <userId>`](commands/gog-classroom-invitations-create.md) - Create an invitation
+      - [`gog classroom (class) invitations (invitation,invites) delete (rm,del,remove) <invitationId>`](commands/gog-classroom-invitations-delete.md) - Delete an invitation
+      - [`gog classroom (class) invitations (invitation,invites) get (info,show) <invitationId>`](commands/gog-classroom-invitations-get.md) - Get an invitation
+      - [`gog classroom (class) invitations (invitation,invites) list (ls) [flags]`](commands/gog-classroom-invitations-list.md) - List invitations
+    - [`gog classroom (class) materials (material) <command>`](commands/gog-classroom-materials.md) - Coursework materials
+      - [`gog classroom (class) materials (material) create (add,new) --title=STRING <courseId> [flags]`](commands/gog-classroom-materials-create.md) - Create coursework material
+      - [`gog classroom (class) materials (material) delete (rm,del,remove) <courseId> <materialId>`](commands/gog-classroom-materials-delete.md) - Delete coursework material
+      - [`gog classroom (class) materials (material) get (info,show) <courseId> <materialId>`](commands/gog-classroom-materials-get.md) - Get coursework material
+      - [`gog classroom (class) materials (material) list (ls) <courseId> [flags]`](commands/gog-classroom-materials-list.md) - List coursework materials
+      - [`gog classroom (class) materials (material) update (edit,set) <courseId> <materialId> [flags]`](commands/gog-classroom-materials-update.md) - Update coursework material
+    - [`gog classroom (class) profile (me) <command>`](commands/gog-classroom-profile.md) - User profiles
+      - [`gog classroom (class) profile (me) get [<userId>]`](commands/gog-classroom-profile-get.md) - Get a user profile
+    - [`gog classroom (class) roster (members) <courseId> [flags]`](commands/gog-classroom-roster.md) - Course roster (students + teachers)
+    - [`gog classroom (class) students (student) <command>`](commands/gog-classroom-students.md) - Course students
+      - [`gog classroom (class) students (student) add (create,new) <courseId> <userId> [flags]`](commands/gog-classroom-students-add.md) - Add a student
+      - [`gog classroom (class) students (student) get (info,show) <courseId> <userId>`](commands/gog-classroom-students-get.md) - Get a student
+      - [`gog classroom (class) students (student) list (ls) <courseId> [flags]`](commands/gog-classroom-students-list.md) - List students
+      - [`gog classroom (class) students (student) remove (delete,rm,del,remove) <courseId> <userId>`](commands/gog-classroom-students-remove.md) - Remove a student
+    - [`gog classroom (class) submissions (submission) <command>`](commands/gog-classroom-submissions.md) - Student submissions
+      - [`gog classroom (class) submissions (submission) get (info,show) <courseId> <courseworkId> <submissionId>`](commands/gog-classroom-submissions-get.md) - Get a student submission
+      - [`gog classroom (class) submissions (submission) grade (set,edit) <courseId> <courseworkId> <submissionId> [flags]`](commands/gog-classroom-submissions-grade.md) - Set draft/assigned grades
+      - [`gog classroom (class) submissions (submission) list (ls) <courseId> <courseworkId> [flags]`](commands/gog-classroom-submissions-list.md) - List student submissions
+      - [`gog classroom (class) submissions (submission) reclaim (undo) <courseId> <courseworkId> <submissionId>`](commands/gog-classroom-submissions-reclaim.md) - Reclaim a submission
+      - [`gog classroom (class) submissions (submission) return (send) <courseId> <courseworkId> <submissionId>`](commands/gog-classroom-submissions-return.md) - Return a submission
+      - [`gog classroom (class) submissions (submission) turn-in (turnin) <courseId> <courseworkId> <submissionId>`](commands/gog-classroom-submissions-turn-in.md) - Turn in a submission
+    - [`gog classroom (class) teachers (teacher) <command>`](commands/gog-classroom-teachers.md) - Course teachers
+      - [`gog classroom (class) teachers (teacher) add (create,new) <courseId> <userId>`](commands/gog-classroom-teachers-add.md) - Add a teacher
+      - [`gog classroom (class) teachers (teacher) get (info,show) <courseId> <userId>`](commands/gog-classroom-teachers-get.md) - Get a teacher
+      - [`gog classroom (class) teachers (teacher) list (ls) <courseId> [flags]`](commands/gog-classroom-teachers-list.md) - List teachers
+      - [`gog classroom (class) teachers (teacher) remove (delete,rm,del,remove) <courseId> <userId>`](commands/gog-classroom-teachers-remove.md) - Remove a teacher
+    - [`gog classroom (class) topics (topic) <command>`](commands/gog-classroom-topics.md) - Topics
+      - [`gog classroom (class) topics (topic) create (add,new) --name=STRING <courseId>`](commands/gog-classroom-topics-create.md) - Create a topic
+      - [`gog classroom (class) topics (topic) delete (rm,del,remove) <courseId> <topicId>`](commands/gog-classroom-topics-delete.md) - Delete a topic
+      - [`gog classroom (class) topics (topic) get (info,show) <courseId> <topicId>`](commands/gog-classroom-topics-get.md) - Get a topic
+      - [`gog classroom (class) topics (topic) list (ls) <courseId> [flags]`](commands/gog-classroom-topics-list.md) - List topics
+      - [`gog classroom (class) topics (topic) update (edit,set) --name=STRING <courseId> <topicId>`](commands/gog-classroom-topics-update.md) - Update a topic
+  - [`gog completion <shell> [flags]`](commands/gog-completion.md) - Generate shell completion scripts
+  - [`gog config <command> [flags]`](commands/gog-config.md) - Manage configuration
+    - [`gog config get (show) <key>`](commands/gog-config-get.md) - Get a config value
+    - [`gog config keys (list-keys,names)`](commands/gog-config-keys.md) - List available config keys
+    - [`gog config list (ls,all)`](commands/gog-config-list.md) - List all config values
+    - [`gog config no-send (nosend) <command>`](commands/gog-config-no-send.md) - Manage per-account Gmail no-send guards
+      - [`gog config no-send (nosend) list (ls)`](commands/gog-config-no-send-list.md) - List accounts with no-send guards
+      - [`gog config no-send (nosend) remove (rm,del,delete,unset,disable) <account>`](commands/gog-config-no-send-remove.md) - Remove an account no-send guard
+      - [`gog config no-send (nosend) set (add,enable) <account>`](commands/gog-config-no-send-set.md) - Block Gmail send operations for an account
+    - [`gog config path (where)`](commands/gog-config-path.md) - Print config file path
+    - [`gog config set (add,update) <key> <value>`](commands/gog-config-set.md) - Set a config value
+    - [`gog config unset (rm,del,remove) <key>`](commands/gog-config-unset.md) - Unset a config value
+  - [`gog contacts (contact) <command> [flags]`](commands/gog-contacts.md) - Google Contacts
+    - [`gog contacts (contact) create (add,new) [flags]`](commands/gog-contacts-create.md) - Create a contact
+    - [`gog contacts (contact) dedupe [flags]`](commands/gog-contacts-dedupe.md) - Find likely duplicate contacts (preview only)
+    - [`gog contacts (contact) delete (rm,del,remove) <resourceName>`](commands/gog-contacts-delete.md) - Delete a contact
+    - [`gog contacts (contact) directory <command>`](commands/gog-contacts-directory.md) - Directory contacts
+      - [`gog contacts (contact) directory list [flags]`](commands/gog-contacts-directory-list.md) - List people from the Workspace directory
+      - [`gog contacts (contact) directory search <query> ... [flags]`](commands/gog-contacts-directory-search.md) - Search people in the Workspace directory
+    - [`gog contacts (contact) export [<selector>] [flags]`](commands/gog-contacts-export.md) - Export contacts as vCard (.vcf)
+    - [`gog contacts (contact) get (info,show) <resourceName>`](commands/gog-contacts-get.md) - Get a contact
+    - [`gog contacts (contact) list (ls) [flags]`](commands/gog-contacts-list.md) - List contacts
+    - [`gog contacts (contact) other <command>`](commands/gog-contacts-other.md) - Other contacts
+      - [`gog contacts (contact) other delete <resourceName>`](commands/gog-contacts-other-delete.md) - Delete an other contact
+      - [`gog contacts (contact) other list [flags]`](commands/gog-contacts-other-list.md) - List other contacts
+      - [`gog contacts (contact) other search <query> ... [flags]`](commands/gog-contacts-other-search.md) - Search other contacts
+    - [`gog contacts (contact) raw <identifier> [flags]`](commands/gog-contacts-raw.md) - Dump raw People API response as JSON (People.Get; lossless; for scripting and LLM consumption)
+    - [`gog contacts (contact) search <query> ... [flags]`](commands/gog-contacts-search.md) - Search contacts by name/email/phone
+    - [`gog contacts (contact) update (edit,set) <resourceName> [flags]`](commands/gog-contacts-update.md) - Update a contact
+  - [`gog docs (doc) <command> [flags]`](commands/gog-docs.md) - Google Docs (export via Drive)
+    - [`gog docs (doc) add-tab <docId> [flags]`](commands/gog-docs-add-tab.md) - Add a tab to a Google Doc
+    - [`gog docs (doc) cat (text,read) <docId> [flags]`](commands/gog-docs-cat.md) - Print a Google Doc as plain text
+    - [`gog docs (doc) clear <docId>`](commands/gog-docs-clear.md) - Clear all content from a Google Doc
+    - [`gog docs (doc) comments <command>`](commands/gog-docs-comments.md) - Manage comments on files
+      - [`gog docs (doc) comments add (create,new) <docId> <content> [flags]`](commands/gog-docs-comments-add.md) - Add a comment to a Google Doc
+      - [`gog docs (doc) comments delete (rm,del,remove) <docId> <commentId>`](commands/gog-docs-comments-delete.md) - Delete a comment
+      - [`gog docs (doc) comments get (info,show) <docId> <commentId>`](commands/gog-docs-comments-get.md) - Get a comment by ID
+      - [`gog docs (doc) comments list (ls) <docId> [flags]`](commands/gog-docs-comments-list.md) - List comments on a Google Doc
+      - [`gog docs (doc) comments reply (respond) <docId> <commentId> <content>`](commands/gog-docs-comments-reply.md) - Reply to a comment
+      - [`gog docs (doc) comments resolve <docId> <commentId> [flags]`](commands/gog-docs-comments-resolve.md) - Resolve a comment (mark as done)
+    - [`gog docs (doc) copy (cp,duplicate) <docId> <title> [flags]`](commands/gog-docs-copy.md) - Copy a Google Doc
+    - [`gog docs (doc) create (add,new) <title> [flags]`](commands/gog-docs-create.md) - Create a Google Doc
+    - [`gog docs (doc) delete --start=INT-64 --end=INT-64 <docId> [flags]`](commands/gog-docs-delete.md) - Delete text range from document
+    - [`gog docs (doc) delete-tab <docId> [flags]`](commands/gog-docs-delete-tab.md) - Delete a tab from a Google Doc
+    - [`gog docs (doc) edit <docId> <find> <replace> [flags]`](commands/gog-docs-edit.md) - Find and replace text in a Google Doc
+    - [`gog docs (doc) export (download,dl) <docId> [flags]`](commands/gog-docs-export.md) - Export a Google Doc (pdf|docx|txt|md|html)
+    - [`gog docs (doc) find-replace <docId> <find> [<replace>] [flags]`](commands/gog-docs-find-replace.md) - Find and replace text. Supports plain text or markdown with images; use --first for a single occurrence.
+    - [`gog docs (doc) format <docId> [flags]`](commands/gog-docs-format.md) - Apply text or paragraph formatting to a Google Doc
+    - [`gog docs (doc) info (get,show) <docId>`](commands/gog-docs-info.md) - Get Google Doc metadata
+    - [`gog docs (doc) insert <docId> [<content>] [flags]`](commands/gog-docs-insert.md) - Insert text at a specific position
+    - [`gog docs (doc) list-tabs <docId>`](commands/gog-docs-list-tabs.md) - List all tabs in a Google Doc
+    - [`gog docs (doc) raw <docId> [flags]`](commands/gog-docs-raw.md) - Dump raw Google Docs API response as JSON (Documents.Get; lossless; for scripting and LLM consumption)
+    - [`gog docs (doc) rename-tab <docId> [flags]`](commands/gog-docs-rename-tab.md) - Rename a tab in a Google Doc
+    - [`gog docs (doc) sed <docId> [<expression>] [flags]`](commands/gog-docs-sed.md) - Regex find/replace (sed-style: s/pattern/replacement/g)
+    - [`gog docs (doc) structure (struct) <docId> [flags]`](commands/gog-docs-structure.md) - Show document structure with numbered paragraphs
+    - [`gog docs (doc) update <docId> [flags]`](commands/gog-docs-update.md) - Insert text at a specific index in a Google Doc
+    - [`gog docs (doc) write <docId> [flags]`](commands/gog-docs-write.md) - Write content to a Google Doc
+  - [`gog download (dl) <fileId> [flags]`](commands/gog-download.md) - Download a Drive file (alias for 'drive download')
+  - [`gog drive (drv) <command> [flags]`](commands/gog-drive.md) - Google Drive
+    - [`gog drive (drv) comments <command>`](commands/gog-drive-comments.md) - Manage comments on files
+      - [`gog drive (drv) comments create (add,new) <fileId> <content> [flags]`](commands/gog-drive-comments-create.md) - Create a comment on a file
+      - [`gog drive (drv) comments delete (rm,del,remove) <fileId> <commentId>`](commands/gog-drive-comments-delete.md) - Delete a comment
+      - [`gog drive (drv) comments get (info,show) <fileId> <commentId>`](commands/gog-drive-comments-get.md) - Get a comment by ID
+      - [`gog drive (drv) comments list (ls) <fileId> [flags]`](commands/gog-drive-comments-list.md) - List comments on a file
+      - [`gog drive (drv) comments reply (respond) <fileId> <commentId> <content>`](commands/gog-drive-comments-reply.md) - Reply to a comment
+      - [`gog drive (drv) comments update (edit,set) <fileId> <commentId> <content>`](commands/gog-drive-comments-update.md) - Update a comment
+    - [`gog drive (drv) copy <fileId> <name> [flags]`](commands/gog-drive-copy.md) - Copy a file
+    - [`gog drive (drv) delete (rm,del) <fileId> [flags]`](commands/gog-drive-delete.md) - Move a file to trash (use --permanent to delete forever)
+    - [`gog drive (drv) download <fileId> [flags]`](commands/gog-drive-download.md) - Download a file (exports Google Docs formats)
+    - [`gog drive (drv) drives [flags]`](commands/gog-drive-drives.md) - List shared drives (Team Drives)
+    - [`gog drive (drv) du [flags]`](commands/gog-drive-du.md) - Summarize Drive folder sizes
+    - [`gog drive (drv) get <fileId> [flags]`](commands/gog-drive-get.md) - Get file metadata
+    - [`gog drive (drv) inventory [flags]`](commands/gog-drive-inventory.md) - Export a read-only Drive inventory
+    - [`gog drive (drv) ls [flags]`](commands/gog-drive-ls.md) - List files in a folder (default: root)
+    - [`gog drive (drv) mkdir <name> [flags]`](commands/gog-drive-mkdir.md) - Create a folder
+    - [`gog drive (drv) move <fileId> [flags]`](commands/gog-drive-move.md) - Move a file to a different folder
+    - [`gog drive (drv) permissions <fileId> [flags]`](commands/gog-drive-permissions.md) - List permissions on a file
+    - [`gog drive (drv) raw <fileId> [flags]`](commands/gog-drive-raw.md) - Dump raw Google Drive API response as JSON (Files.Get; lossless; for scripting and LLM consumption)
+    - [`gog drive (drv) rename <fileId> <newName>`](commands/gog-drive-rename.md) - Rename a file or folder
+    - [`gog drive (drv) search <query> ... [flags]`](commands/gog-drive-search.md) - Full-text search across Drive
+    - [`gog drive (drv) share <fileId> [flags]`](commands/gog-drive-share.md) - Share a file or folder
+    - [`gog drive (drv) tree [flags]`](commands/gog-drive-tree.md) - Print a read-only folder tree
+    - [`gog drive (drv) unshare <fileId> <permissionId>`](commands/gog-drive-unshare.md) - Remove a permission from a file
+    - [`gog drive (drv) upload <localPath> [flags]`](commands/gog-drive-upload.md) - Upload a file
+    - [`gog drive (drv) url <fileId> ...`](commands/gog-drive-url.md) - Print web URLs for files
+  - [`gog exit-codes (exitcodes) [flags]`](commands/gog-exit-codes.md) - Print stable exit codes (alias for 'agent exit-codes')
+  - [`gog forms (form) <command> [flags]`](commands/gog-forms.md) - Google Forms
+    - [`gog forms (form) add-question (add-q,aq) --title=STRING <formId> [flags]`](commands/gog-forms-add-question.md) - Add a question to a form
+    - [`gog forms (form) create (new) --title=STRING [flags]`](commands/gog-forms-create.md) - Create a form
+    - [`gog forms (form) delete-question (delete-q,dq,rm-q) <formId> <index>`](commands/gog-forms-delete-question.md) - Delete a question by index
+    - [`gog forms (form) get (info,show) <formId>`](commands/gog-forms-get.md) - Get a form
+    - [`gog forms (form) move-question (move-q,mq) <formId> <oldIndex> <newIndex>`](commands/gog-forms-move-question.md) - Move a question to a new position
+    - [`gog forms (form) raw <formId> [flags]`](commands/gog-forms-raw.md) - Dump raw Google Forms API response as JSON (Forms.Get; lossless; for scripting and LLM consumption)
+    - [`gog forms (form) responses <command>`](commands/gog-forms-responses.md) - Form responses
+      - [`gog forms (form) responses get (info,show) <formId> <responseId>`](commands/gog-forms-responses-get.md) - Get a form response
+      - [`gog forms (form) responses list (ls) <formId> [flags]`](commands/gog-forms-responses-list.md) - List form responses
+    - [`gog forms (form) update (edit) <formId> [flags]`](commands/gog-forms-update.md) - Update form title, description, or settings
+    - [`gog forms (form) watch (watches) <command>`](commands/gog-forms-watch.md) - Response watches (push notifications)
+      - [`gog forms (form) watch (watches) create (new,add) --topic=STRING <formId> [flags]`](commands/gog-forms-watch-create.md) - Create a watch for new responses
+      - [`gog forms (form) watch (watches) delete (rm,remove) <formId> <watchId>`](commands/gog-forms-watch-delete.md) - Delete a watch
+      - [`gog forms (form) watch (watches) list (ls) <formId>`](commands/gog-forms-watch-list.md) - List active watches
+      - [`gog forms (form) watch (watches) renew (refresh) <formId> <watchId>`](commands/gog-forms-watch-renew.md) - Renew a watch (extends 7 days)
+  - [`gog gmail (mail,email) <command> [flags]`](commands/gog-gmail.md) - Gmail
+    - [`gog gmail (mail,email) archive [<messageId> ...] [flags]`](commands/gog-gmail-archive.md) - Archive messages (remove from inbox)
+    - [`gog gmail (mail,email) attachment <messageId> <attachmentId> [flags]`](commands/gog-gmail-attachment.md) - Download a single attachment
+    - [`gog gmail (mail,email) autoreply <query> ... [flags]`](commands/gog-gmail-autoreply.md) - Reply once to matching messages
+    - [`gog gmail (mail,email) batch <command>`](commands/gog-gmail-batch.md) - Batch operations (permanent delete requires broader Gmail scope; use gmail trash for normal trashing)
+      - [`gog gmail (mail,email) batch delete (rm,del,remove) <messageId> ...`](commands/gog-gmail-batch-delete.md) - Permanently delete multiple messages; use 'gmail trash' to move messages to trash with the default gmail.modify scope
+      - [`gog gmail (mail,email) batch modify (update,edit,set) <messageId> ... [flags]`](commands/gog-gmail-batch-modify.md) - Modify labels on multiple messages
+    - [`gog gmail (mail,email) drafts (draft) <command>`](commands/gog-gmail-drafts.md) - Draft operations
+      - [`gog gmail (mail,email) drafts (draft) create (add,new) [flags]`](commands/gog-gmail-drafts-create.md) - Create a draft
+      - [`gog gmail (mail,email) drafts (draft) delete (rm,del,remove) <draftId>`](commands/gog-gmail-drafts-delete.md) - Delete a draft
+      - [`gog gmail (mail,email) drafts (draft) get (info,show) <draftId> [flags]`](commands/gog-gmail-drafts-get.md) - Get draft details
+      - [`gog gmail (mail,email) drafts (draft) list (ls) [flags]`](commands/gog-gmail-drafts-list.md) - List drafts
+      - [`gog gmail (mail,email) drafts (draft) send (post) <draftId>`](commands/gog-gmail-drafts-send.md) - Send a draft
+      - [`gog gmail (mail,email) drafts (draft) update (edit,set) <draftId> [flags]`](commands/gog-gmail-drafts-update.md) - Update a draft
+    - [`gog gmail (mail,email) forward (fwd) --to=STRING <messageId> [flags]`](commands/gog-gmail-forward.md) - Forward a message to new recipients
+    - [`gog gmail (mail,email) get (info,show) <messageId> [flags]`](commands/gog-gmail-get.md) - Get a message (full|metadata|raw)
+    - [`gog gmail (mail,email) history [flags]`](commands/gog-gmail-history.md) - Gmail history
+    - [`gog gmail (mail,email) labels (label) <command>`](commands/gog-gmail-labels.md) - Label operations
+      - [`gog gmail (mail,email) labels (label) create (add,new) <name>`](commands/gog-gmail-labels-create.md) - Create a new label
+      - [`gog gmail (mail,email) labels (label) delete (rm,del) <labelIdOrName>`](commands/gog-gmail-labels-delete.md) - Delete a label
+      - [`gog gmail (mail,email) labels (label) get (info,show) <labelIdOrName>`](commands/gog-gmail-labels-get.md) - Get label details (including counts)
+      - [`gog gmail (mail,email) labels (label) list (ls)`](commands/gog-gmail-labels-list.md) - List labels
+      - [`gog gmail (mail,email) labels (label) modify (update,edit,set) <threadId> ... [flags]`](commands/gog-gmail-labels-modify.md) - Modify labels on threads
+      - [`gog gmail (mail,email) labels (label) rename (mv) <labelIdOrName> <newName>`](commands/gog-gmail-labels-rename.md) - Rename a label
+      - [`gog gmail (mail,email) labels (label) style (color,colour) <labelIdOrName> [flags]`](commands/gog-gmail-labels-style.md) - Change a user label color or visibility
+    - [`gog gmail (mail,email) mark-read (read-messages) [<messageId> ...] [flags]`](commands/gog-gmail-mark-read.md) - Mark messages as read
+    - [`gog gmail (mail,email) messages (message,msg,msgs) <command>`](commands/gog-gmail-messages.md) - Message operations
+      - [`gog gmail (mail,email) messages (message,msg,msgs) modify (update,edit,set) <messageId> [flags]`](commands/gog-gmail-messages-modify.md) - Modify labels on a single message
+      - [`gog gmail (mail,email) messages (message,msg,msgs) search (find,query,ls,list) <query> ... [flags]`](commands/gog-gmail-messages-search.md) - Search messages using Gmail query syntax
+    - [`gog gmail (mail,email) raw <messageId> [flags]`](commands/gog-gmail-raw.md) - Dump raw Gmail API response as JSON (Users.Messages.Get; lossless; for scripting and LLM consumption)
+    - [`gog gmail (mail,email) search (find,query,ls,list) <query> ... [flags]`](commands/gog-gmail-search.md) - Search threads using Gmail query syntax
+    - [`gog gmail (mail,email) send [flags]`](commands/gog-gmail-send.md) - Send an email
+    - [`gog gmail (mail,email) settings <command>`](commands/gog-gmail-settings.md) - Settings and admin
+      - [`gog gmail (mail,email) settings autoforward <command>`](commands/gog-gmail-settings-autoforward.md) - Auto-forwarding settings
+        - [`gog gmail (mail,email) settings autoforward get (info,show)`](commands/gog-gmail-settings-autoforward-get.md) - Get current auto-forwarding settings
+        - [`gog gmail (mail,email) settings autoforward update (edit,set) [flags]`](commands/gog-gmail-settings-autoforward-update.md) - Update auto-forwarding settings
+      - [`gog gmail (mail,email) settings delegates <command>`](commands/gog-gmail-settings-delegates.md) - Delegate operations
+        - [`gog gmail (mail,email) settings delegates add (create,new) <delegateEmail>`](commands/gog-gmail-settings-delegates-add.md) - Add a delegate
+        - [`gog gmail (mail,email) settings delegates get (info,show) <delegateEmail>`](commands/gog-gmail-settings-delegates-get.md) - Get a specific delegate's information
+        - [`gog gmail (mail,email) settings delegates list (ls)`](commands/gog-gmail-settings-delegates-list.md) - List all delegates
+        - [`gog gmail (mail,email) settings delegates remove (delete,rm,del) <delegateEmail>`](commands/gog-gmail-settings-delegates-remove.md) - Remove a delegate
+      - [`gog gmail (mail,email) settings filters <command>`](commands/gog-gmail-settings-filters.md) - Filter operations
+        - [`gog gmail (mail,email) settings filters create (add,new) [flags]`](commands/gog-gmail-settings-filters-create.md) - Create a new email filter
+        - [`gog gmail (mail,email) settings filters delete (rm,del,remove) <filterId>`](commands/gog-gmail-settings-filters-delete.md) - Delete a filter
+        - [`gog gmail (mail,email) settings filters export [flags]`](commands/gog-gmail-settings-filters-export.md) - Export filters as Gmail WebUI-compatible XML
+        - [`gog gmail (mail,email) settings filters get (info,show) <filterId>`](commands/gog-gmail-settings-filters-get.md) - Get a specific filter
+        - [`gog gmail (mail,email) settings filters list (ls)`](commands/gog-gmail-settings-filters-list.md) - List all email filters
+      - [`gog gmail (mail,email) settings forwarding <command>`](commands/gog-gmail-settings-forwarding.md) - Forwarding addresses
+        - [`gog gmail (mail,email) settings forwarding create (add,new) <forwardingEmail>`](commands/gog-gmail-settings-forwarding-create.md) - Create/add a forwarding address
+        - [`gog gmail (mail,email) settings forwarding delete (rm,del,remove) <forwardingEmail>`](commands/gog-gmail-settings-forwarding-delete.md) - Delete a forwarding address
+        - [`gog gmail (mail,email) settings forwarding get (info,show) <forwardingEmail>`](commands/gog-gmail-settings-forwarding-get.md) - Get a specific forwarding address
+        - [`gog gmail (mail,email) settings forwarding list (ls)`](commands/gog-gmail-settings-forwarding-list.md) - List all forwarding addresses
+      - [`gog gmail (mail,email) settings sendas <command>`](commands/gog-gmail-settings-sendas.md) - Send-as settings
+        - [`gog gmail (mail,email) settings sendas create (add,new) <email> [flags]`](commands/gog-gmail-settings-sendas-create.md) - Create a new send-as alias
+        - [`gog gmail (mail,email) settings sendas delete (rm,del,remove) <email>`](commands/gog-gmail-settings-sendas-delete.md) - Delete a send-as alias
+        - [`gog gmail (mail,email) settings sendas get (info,show) <email>`](commands/gog-gmail-settings-sendas-get.md) - Get details of a send-as alias
+        - [`gog gmail (mail,email) settings sendas list (ls)`](commands/gog-gmail-settings-sendas-list.md) - List send-as aliases
+        - [`gog gmail (mail,email) settings sendas update (edit,set) <email> [flags]`](commands/gog-gmail-settings-sendas-update.md) - Update a send-as alias
+        - [`gog gmail (mail,email) settings sendas verify (resend) <email>`](commands/gog-gmail-settings-sendas-verify.md) - Resend verification email for a send-as alias
+      - [`gog gmail (mail,email) settings vacation <command>`](commands/gog-gmail-settings-vacation.md) - Vacation responder
+        - [`gog gmail (mail,email) settings vacation get (info,show)`](commands/gog-gmail-settings-vacation-get.md) - Get current vacation responder settings
+        - [`gog gmail (mail,email) settings vacation update (edit,set) [flags]`](commands/gog-gmail-settings-vacation-update.md) - Update vacation responder settings
+      - [`gog gmail (mail,email) settings watch <command>`](commands/gog-gmail-settings-watch.md) - Manage Gmail watch
+        - [`gog gmail (mail,email) settings watch renew (update) [flags]`](commands/gog-gmail-settings-watch-renew.md) - Renew Gmail watch using stored config
+        - [`gog gmail (mail,email) settings watch serve [flags]`](commands/gog-gmail-settings-watch-serve.md) - Run Pub/Sub push handler
+        - [`gog gmail (mail,email) settings watch start (begin) [flags]`](commands/gog-gmail-settings-watch-start.md) - Start Gmail watch for Pub/Sub
+        - [`gog gmail (mail,email) settings watch status (ls) [flags]`](commands/gog-gmail-settings-watch-status.md) - Show stored watch state
+        - [`gog gmail (mail,email) settings watch stop (rm,delete)`](commands/gog-gmail-settings-watch-stop.md) - Stop Gmail watch and clear stored state
+    - [`gog gmail (mail,email) thread (threads,read) <command>`](commands/gog-gmail-thread.md) - Thread operations (get, modify)
+      - [`gog gmail (mail,email) thread (threads,read) attachments (files) <threadId> [flags]`](commands/gog-gmail-thread-attachments.md) - List all attachments in a thread
+      - [`gog gmail (mail,email) thread (threads,read) get (info,show) <threadId> [flags]`](commands/gog-gmail-thread-get.md) - Get a thread with all messages (optionally download attachments)
+      - [`gog gmail (mail,email) thread (threads,read) modify (update,edit,set) <threadId> [flags]`](commands/gog-gmail-thread-modify.md) - Modify labels on all messages in a thread
+    - [`gog gmail (mail,email) track <command>`](commands/gog-gmail-track.md) - Email open tracking
+      - [`gog gmail (mail,email) track key <command>`](commands/gog-gmail-track-key.md) - Manage tracking encryption keys
+        - [`gog gmail (mail,email) track key rotate [flags]`](commands/gog-gmail-track-key-rotate.md) - Rotate tracking encryption key
+      - [`gog gmail (mail,email) track opens [<tracking-id>] [flags]`](commands/gog-gmail-track-opens.md) - Query email opens
+      - [`gog gmail (mail,email) track setup [flags]`](commands/gog-gmail-track-setup.md) - Set up email tracking (deploy Cloudflare Worker)
+      - [`gog gmail (mail,email) track status`](commands/gog-gmail-track-status.md) - Show tracking configuration status
+    - [`gog gmail (mail,email) trash [<messageId> ...] [flags]`](commands/gog-gmail-trash.md) - Move messages to trash
+    - [`gog gmail (mail,email) unread (mark-unread) [<messageId> ...] [flags]`](commands/gog-gmail-unread.md) - Mark messages as unread
+    - [`gog gmail (mail,email) url <threadId> ...`](commands/gog-gmail-url.md) - Print Gmail web URLs for threads
+  - [`gog groups (group) <command> [flags]`](commands/gog-groups.md) - Google Groups
+    - [`gog groups (group) list (ls) [flags]`](commands/gog-groups-list.md) - List groups you belong to
+    - [`gog groups (group) members <groupEmail> [flags]`](commands/gog-groups-members.md) - List members of a group
+  - [`gog keep <command> [flags]`](commands/gog-keep.md) - Google Keep (Workspace only)
+    - [`gog keep attachment <attachmentName> [flags]`](commands/gog-keep-attachment.md) - Download an attachment
+    - [`gog keep create [flags]`](commands/gog-keep-create.md) - Create a new note
+    - [`gog keep delete <noteId> [flags]`](commands/gog-keep-delete.md) - Delete a note
+    - [`gog keep get <noteId> [flags]`](commands/gog-keep-get.md) - Get a note
+    - [`gog keep list [flags]`](commands/gog-keep-list.md) - List notes
+    - [`gog keep search <query> [flags]`](commands/gog-keep-search.md) - Search notes by text (client-side)
+  - [`gog login <email> [flags]`](commands/gog-login.md) - Authorize and store a refresh token (alias for 'auth add')
+  - [`gog logout <email> [flags]`](commands/gog-logout.md) - Remove a stored refresh token (alias for 'auth remove')
+  - [`gog ls (list) [flags]`](commands/gog-ls.md) - List Drive files (alias for 'drive ls')
+  - [`gog me [flags]`](commands/gog-me.md) - Show your profile (alias for 'people me')
+  - [`gog open (browse) <target> [flags]`](commands/gog-open.md) - Print a best-effort web URL for a Google URL/ID (offline)
+  - [`gog people (person) <command> [flags]`](commands/gog-people.md) - Google People
+    - [`gog people (person) get (info,show) <userId>`](commands/gog-people-get.md) - Get a user profile by ID
+    - [`gog people (person) me`](commands/gog-people-me.md) - Show your profile (people/me)
+    - [`gog people (person) raw <userId> [flags]`](commands/gog-people-raw.md) - Dump raw People API response as JSON (People.Get; lossless; for scripting and LLM consumption)
+    - [`gog people (person) relations [<userId>] [flags]`](commands/gog-people-relations.md) - Get user relations
+    - [`gog people (person) search (find,query) <query> ... [flags]`](commands/gog-people-search.md) - Search the Workspace directory
+  - [`gog schema (help-json,helpjson) [<command> ...] [flags]`](commands/gog-schema.md) - Machine-readable command/flag schema
+  - [`gog search (find) <query> ... [flags]`](commands/gog-search.md) - Search Drive files (alias for 'drive search')
+  - [`gog send [flags]`](commands/gog-send.md) - Send an email (alias for 'gmail send')
+  - [`gog sheets (sheet) <command> [flags]`](commands/gog-sheets.md) - Google Sheets
+    - [`gog sheets (sheet) add-tab (add-sheet) <spreadsheetId> <tabName> [flags]`](commands/gog-sheets-add-tab.md) - Add a new tab/sheet to a spreadsheet
+    - [`gog sheets (sheet) append (add) <spreadsheetId> <range> [<values> ...] [flags]`](commands/gog-sheets-append.md) - Append values to a range
+    - [`gog sheets (sheet) banding (banded-ranges) <command>`](commands/gog-sheets-banding.md) - Manage alternating color banding
+      - [`gog sheets (sheet) banding (banded-ranges) clear (delete,rm,remove) <spreadsheetId> [flags]`](commands/gog-sheets-banding-clear.md) - Remove alternating color banding
+      - [`gog sheets (sheet) banding (banded-ranges) list <spreadsheetId> [flags]`](commands/gog-sheets-banding-list.md) - List alternating color banded ranges
+      - [`gog sheets (sheet) banding (banded-ranges) set (add,create) <spreadsheetId> <range> [flags]`](commands/gog-sheets-banding-set.md) - Apply alternating colors to a range
+    - [`gog sheets (sheet) chart (charts) <command>`](commands/gog-sheets-chart.md) - Manage spreadsheet charts
+      - [`gog sheets (sheet) chart (charts) create (add,new) --spec-json=STRING <spreadsheetId> [flags]`](commands/gog-sheets-chart-create.md) - Create a chart from a JSON spec
+      - [`gog sheets (sheet) chart (charts) delete (rm,remove,del) <spreadsheetId> <chartId>`](commands/gog-sheets-chart-delete.md) - Delete a chart
+      - [`gog sheets (sheet) chart (charts) get (show,info) <spreadsheetId> <chartId>`](commands/gog-sheets-chart-get.md) - Get full chart definition (spec + position)
+      - [`gog sheets (sheet) chart (charts) list <spreadsheetId>`](commands/gog-sheets-chart-list.md) - List charts in a spreadsheet
+      - [`gog sheets (sheet) chart (charts) update (edit,set) --spec-json=STRING <spreadsheetId> <chartId>`](commands/gog-sheets-chart-update.md) - Update a chart spec
+    - [`gog sheets (sheet) clear <spreadsheetId> <range>`](commands/gog-sheets-clear.md) - Clear values in a range
+    - [`gog sheets (sheet) conditional-format (cf,conditional-formats) <command>`](commands/gog-sheets-conditional-format.md) - Manage conditional formatting rules
+      - [`gog sheets (sheet) conditional-format (cf,conditional-formats) add (create,new) --type=STRING --format-json=STRING <spreadsheetId> <range> [flags]`](commands/gog-sheets-conditional-format-add.md) - Add a conditional formatting rule
+      - [`gog sheets (sheet) conditional-format (cf,conditional-formats) clear (delete,rm,remove) --sheet=STRING <spreadsheetId> [flags]`](commands/gog-sheets-conditional-format-clear.md) - Remove conditional formatting rules
+      - [`gog sheets (sheet) conditional-format (cf,conditional-formats) list <spreadsheetId> [flags]`](commands/gog-sheets-conditional-format-list.md) - List conditional formatting rules
+    - [`gog sheets (sheet) copy (cp,duplicate) <spreadsheetId> <title> [flags]`](commands/gog-sheets-copy.md) - Copy a Google Sheet
+    - [`gog sheets (sheet) create (new) <title> [flags]`](commands/gog-sheets-create.md) - Create a new spreadsheet
+    - [`gog sheets (sheet) delete-tab (delete-sheet) <spreadsheetId> <tabName>`](commands/gog-sheets-delete-tab.md) - Delete a tab/sheet from a spreadsheet (use --force to skip confirmation)
+    - [`gog sheets (sheet) export (download,dl) <spreadsheetId> [flags]`](commands/gog-sheets-export.md) - Export a Google Sheet (pdf|xlsx|csv) via Drive
+    - [`gog sheets (sheet) find-replace <spreadsheetId> <find> <replace> [flags]`](commands/gog-sheets-find-replace.md) - Find and replace text across a spreadsheet
+    - [`gog sheets (sheet) format <spreadsheetId> <range> [flags]`](commands/gog-sheets-format.md) - Apply cell formatting to a range
+    - [`gog sheets (sheet) freeze <spreadsheetId> [flags]`](commands/gog-sheets-freeze.md) - Freeze rows and columns on a sheet
+    - [`gog sheets (sheet) get (read,show) <spreadsheetId> <range> [flags]`](commands/gog-sheets-get.md) - Get values from a range
+    - [`gog sheets (sheet) insert <spreadsheetId> <sheet> <dimension> <start> [flags]`](commands/gog-sheets-insert.md) - Insert empty rows or columns into a sheet
+    - [`gog sheets (sheet) links (hyperlinks) <spreadsheetId> <range>`](commands/gog-sheets-links.md) - Get cell hyperlinks from a range
+    - [`gog sheets (sheet) merge <spreadsheetId> <range> [flags]`](commands/gog-sheets-merge.md) - Merge cells in a range
+    - [`gog sheets (sheet) metadata (info) <spreadsheetId>`](commands/gog-sheets-metadata.md) - Get spreadsheet metadata
+    - [`gog sheets (sheet) named-ranges (namedranges,nr) <command>`](commands/gog-sheets-named-ranges.md) - Manage named ranges
+      - [`gog sheets (sheet) named-ranges (namedranges,nr) add (create,new) <spreadsheetId> <name> <range>`](commands/gog-sheets-named-ranges-add.md) - Add a named range
+      - [`gog sheets (sheet) named-ranges (namedranges,nr) delete (rm,remove,del) <spreadsheetId> <nameOrId>`](commands/gog-sheets-named-ranges-delete.md) - Delete a named range
+      - [`gog sheets (sheet) named-ranges (namedranges,nr) get (show,info) <spreadsheetId> <nameOrId>`](commands/gog-sheets-named-ranges-get.md) - Get a named range
+      - [`gog sheets (sheet) named-ranges (namedranges,nr) list <spreadsheetId>`](commands/gog-sheets-named-ranges-list.md) - List named ranges
+      - [`gog sheets (sheet) named-ranges (namedranges,nr) update (edit,set) <spreadsheetId> <nameOrId> [flags]`](commands/gog-sheets-named-ranges-update.md) - Update a named range
+    - [`gog sheets (sheet) notes <spreadsheetId> <range>`](commands/gog-sheets-notes.md) - Get cell notes from a range
+    - [`gog sheets (sheet) number-format <spreadsheetId> <range> [flags]`](commands/gog-sheets-number-format.md) - Apply number format to a range
+    - [`gog sheets (sheet) raw <spreadsheetId> [flags]`](commands/gog-sheets-raw.md) - Dump raw Google Sheets API response as JSON (Spreadsheets.Get; lossless; for scripting and LLM consumption)
+    - [`gog sheets (sheet) read-format (get-format,format-read) <spreadsheetId> <range> [flags]`](commands/gog-sheets-read-format.md) - Read cell formatting from a range
+    - [`gog sheets (sheet) rename-tab (rename-sheet) <spreadsheetId> <oldName> <newName>`](commands/gog-sheets-rename-tab.md) - Rename a tab/sheet in a spreadsheet
+    - [`gog sheets (sheet) resize-columns <spreadsheetId> <columns> [flags]`](commands/gog-sheets-resize-columns.md) - Resize sheet columns
+    - [`gog sheets (sheet) resize-rows <spreadsheetId> <rows> [flags]`](commands/gog-sheets-resize-rows.md) - Resize sheet rows
+    - [`gog sheets (sheet) table (tables) <command>`](commands/gog-sheets-table.md) - Manage Google Sheets tables
+      - [`gog sheets (sheet) table (tables) append (add-row,add-rows) <spreadsheetId> <tableId> [<values> ...] [flags]`](commands/gog-sheets-table-append.md) - Append rows to a table
+      - [`gog sheets (sheet) table (tables) clear (clear-rows) <spreadsheetId> <tableId>`](commands/gog-sheets-table-clear.md) - Clear table data rows
+      - [`gog sheets (sheet) table (tables) create (add,new) --name=STRING --columns-json=STRING <spreadsheetId> <range>`](commands/gog-sheets-table-create.md) - Create a table
+      - [`gog sheets (sheet) table (tables) delete (rm,remove,del) <spreadsheetId> <tableId>`](commands/gog-sheets-table-delete.md) - Delete a table
+      - [`gog sheets (sheet) table (tables) get (show,info) <spreadsheetId> <tableId>`](commands/gog-sheets-table-get.md) - Get a table
+      - [`gog sheets (sheet) table (tables) list <spreadsheetId>`](commands/gog-sheets-table-list.md) - List tables in a spreadsheet
+    - [`gog sheets (sheet) unmerge <spreadsheetId> <range>`](commands/gog-sheets-unmerge.md) - Unmerge cells in a range
+    - [`gog sheets (sheet) update (edit,set) <spreadsheetId> <range> [<values> ...] [flags]`](commands/gog-sheets-update.md) - Update values in a range
+    - [`gog sheets (sheet) update-note (set-note) <spreadsheetId> <range> [flags]`](commands/gog-sheets-update-note.md) - Set or clear a cell note
+  - [`gog slides (slide) <command> [flags]`](commands/gog-slides.md) - Google Slides
+    - [`gog slides (slide) add-slide <presentationId> <image> [flags]`](commands/gog-slides-add-slide.md) - Add a slide with a full-bleed image and optional speaker notes
+    - [`gog slides (slide) copy (cp,duplicate) <presentationId> <title> [flags]`](commands/gog-slides-copy.md) - Copy a Google Slides presentation
+    - [`gog slides (slide) create (add,new) <title> [flags]`](commands/gog-slides-create.md) - Create a Google Slides presentation
+    - [`gog slides (slide) create-from-markdown <title> [flags]`](commands/gog-slides-create-from-markdown.md) - Create a Google Slides presentation from markdown
+    - [`gog slides (slide) create-from-template <templateId> <title> [flags]`](commands/gog-slides-create-from-template.md) - Create a presentation from template with text replacements
+    - [`gog slides (slide) delete-slide <presentationId> <slideId>`](commands/gog-slides-delete-slide.md) - Delete a slide by object ID
+    - [`gog slides (slide) export (download,dl) <presentationId> [flags]`](commands/gog-slides-export.md) - Export a Google Slides deck (pdf|pptx)
+    - [`gog slides (slide) info (get,show) <presentationId>`](commands/gog-slides-info.md) - Get Google Slides presentation metadata
+    - [`gog slides (slide) insert-text <presentationId> <objectId> <text> [flags]`](commands/gog-slides-insert-text.md) - Insert text into an existing page element (shape or table) by objectId
+    - [`gog slides (slide) list-slides <presentationId>`](commands/gog-slides-list-slides.md) - List all slides with their object IDs
+    - [`gog slides (slide) raw <presentationId> [flags]`](commands/gog-slides-raw.md) - Dump raw Google Slides API response as JSON (Presentations.Get; lossless; for scripting and LLM consumption)
+    - [`gog slides (slide) read-slide <presentationId> <slideId>`](commands/gog-slides-read-slide.md) - Read slide content: speaker notes, text elements, and images
+    - [`gog slides (slide) replace-slide <presentationId> <slideId> <image> [flags]`](commands/gog-slides-replace-slide.md) - Replace the image on an existing slide in-place
+    - [`gog slides (slide) replace-text <presentationId> <find> <replacement> [flags]`](commands/gog-slides-replace-text.md) - Find-and-replace text across a presentation
+    - [`gog slides (slide) thumbnail (thumb) <presentationId> <slideId> [flags]`](commands/gog-slides-thumbnail.md) - Get or download a rendered thumbnail for a slide
+    - [`gog slides (slide) update-notes <presentationId> <slideId> [flags]`](commands/gog-slides-update-notes.md) - Update speaker notes on an existing slide
+  - [`gog status (st) [flags]`](commands/gog-status.md) - Show auth/config status (alias for 'auth status')
+  - [`gog tasks (task) <command> [flags]`](commands/gog-tasks.md) - Google Tasks
+    - [`gog tasks (task) add (create) <tasklistId> [flags]`](commands/gog-tasks-add.md) - Add a task
+    - [`gog tasks (task) clear <tasklistId>`](commands/gog-tasks-clear.md) - Clear completed tasks
+    - [`gog tasks (task) delete (rm,del,remove) <tasklistId> <taskId>`](commands/gog-tasks-delete.md) - Delete a task
+    - [`gog tasks (task) done (complete) <tasklistId> <taskId>`](commands/gog-tasks-done.md) - Mark task completed
+    - [`gog tasks (task) get (info,show) <tasklistId> <taskId>`](commands/gog-tasks-get.md) - Get a task
+    - [`gog tasks (task) list (ls) <tasklistId> [flags]`](commands/gog-tasks-list.md) - List tasks
+    - [`gog tasks (task) lists <command>`](commands/gog-tasks-lists.md) - List task lists
+      - [`gog tasks (task) lists create (add,new) <title> ...`](commands/gog-tasks-lists-create.md) - Create a task list
+      - [`gog tasks (task) lists list [flags]`](commands/gog-tasks-lists-list.md) - List task lists
+    - [`gog tasks (task) raw <tasklistId> <taskId> [flags]`](commands/gog-tasks-raw.md) - Dump raw Google Tasks API response as JSON (Tasks.Get; lossless; for scripting and LLM consumption)
+    - [`gog tasks (task) undo (uncomplete,undone) <tasklistId> <taskId>`](commands/gog-tasks-undo.md) - Mark task needs action
+    - [`gog tasks (task) update (edit,set) <tasklistId> <taskId> [flags]`](commands/gog-tasks-update.md) - Update a task
+  - [`gog time <command> [flags]`](commands/gog-time.md) - Local time utilities
+    - [`gog time now [flags]`](commands/gog-time-now.md) - Show current time
+  - [`gog upload (up,put) <localPath> [flags]`](commands/gog-upload.md) - Upload a file to Drive (alias for 'drive upload')
+  - [`gog version [flags]`](commands/gog-version.md) - Print version
+  - [`gog whoami (who-am-i) [flags]`](commands/gog-whoami.md) - Show your profile (alias for 'people me')

docs/commands/README.md

@@ -0,0 +1,517 @@
+# Commands
+
+Every `gog` command has a generated docs page. The source of truth is the live CLI schema; run `make docs-commands` after changing command names, flags, help text, aliases, or arguments.
+
+Generated pages: 470.
+
+## Top-level Commands
+
+- [gog admin](gog-admin.md) - Google Workspace Admin (Directory API) - requires domain-wide delegation
+- [gog agent](gog-agent.md) - Agent-friendly helpers
+- [gog appscript](gog-appscript.md) - Google Apps Script
+- [gog auth](gog-auth.md) - Auth and credentials
+- [gog backup](gog-backup.md) - Encrypted Google account backups
+- [gog calendar](gog-calendar.md) - Google Calendar
+- [gog chat](gog-chat.md) - Google Chat
+- [gog classroom](gog-classroom.md) - Google Classroom
+- [gog completion](gog-completion.md) - Generate shell completion scripts
+- [gog config](gog-config.md) - Manage configuration
+- [gog contacts](gog-contacts.md) - Google Contacts
+- [gog docs](gog-docs.md) - Google Docs (export via Drive)
+- [gog download](gog-download.md) - Download a Drive file (alias for 'drive download')
+- [gog drive](gog-drive.md) - Google Drive
+- [gog exit-codes](gog-exit-codes.md) - Print stable exit codes (alias for 'agent exit-codes')
+- [gog forms](gog-forms.md) - Google Forms
+- [gog gmail](gog-gmail.md) - Gmail
+- [gog groups](gog-groups.md) - Google Groups
+- [gog keep](gog-keep.md) - Google Keep (Workspace only)
+- [gog login](gog-login.md) - Authorize and store a refresh token (alias for 'auth add')
+- [gog logout](gog-logout.md) - Remove a stored refresh token (alias for 'auth remove')
+- [gog ls](gog-ls.md) - List Drive files (alias for 'drive ls')
+- [gog me](gog-me.md) - Show your profile (alias for 'people me')
+- [gog open](gog-open.md) - Print a best-effort web URL for a Google URL/ID (offline)
+- [gog people](gog-people.md) - Google People
+- [gog schema](gog-schema.md) - Machine-readable command/flag schema
+- [gog search](gog-search.md) - Search Drive files (alias for 'drive search')
+- [gog send](gog-send.md) - Send an email (alias for 'gmail send')
+- [gog sheets](gog-sheets.md) - Google Sheets
+- [gog slides](gog-slides.md) - Google Slides
+- [gog status](gog-status.md) - Show auth/config status (alias for 'auth status')
+- [gog tasks](gog-tasks.md) - Google Tasks
+- [gog time](gog-time.md) - Local time utilities
+- [gog upload](gog-upload.md) - Upload a file to Drive (alias for 'drive upload')
+- [gog version](gog-version.md) - Print version
+- [gog whoami](gog-whoami.md) - Show your profile (alias for 'people me')
+
+## All Commands
+
+- [gog](gog.md) - Google CLI for Gmail/Calendar/Chat/Classroom/Drive/Contacts/Tasks/Sheets/Docs/Slides/People/Forms/App Script/Ads/Groups/Admin/Keep
+  - [gog admin](gog-admin.md) - Google Workspace Admin (Directory API) - requires domain-wide delegation
+    - [gog admin groups](gog-admin-groups.md) - Manage Workspace groups
+      - [gog admin groups list](gog-admin-groups-list.md) - List groups in a domain
+      - [gog admin groups members](gog-admin-groups-members.md) - Manage group members
+        - [gog admin groups members add](gog-admin-groups-members-add.md) - Add a member to a group
+        - [gog admin groups members list](gog-admin-groups-members-list.md) - List group members
+        - [gog admin groups members remove](gog-admin-groups-members-remove.md) - Remove a member from a group
+    - [gog admin users](gog-admin-users.md) - Manage Workspace users
+      - [gog admin users create](gog-admin-users-create.md) - Create a new user
+      - [gog admin users get](gog-admin-users-get.md) - Get user details
+      - [gog admin users list](gog-admin-users-list.md) - List users in a domain
+      - [gog admin users suspend](gog-admin-users-suspend.md) - Suspend a user account
+  - [gog agent](gog-agent.md) - Agent-friendly helpers
+    - [gog agent exit-codes](gog-agent-exit-codes.md) - Print stable exit codes for automation
+  - [gog appscript](gog-appscript.md) - Google Apps Script
+    - [gog appscript content](gog-appscript-content.md) - Get Apps Script project content
+    - [gog appscript create](gog-appscript-create.md) - Create an Apps Script project
+    - [gog appscript get](gog-appscript-get.md) - Get Apps Script project metadata
+    - [gog appscript run](gog-appscript-run.md) - Run a deployed Apps Script function
+  - [gog auth](gog-auth.md) - Auth and credentials
+    - [gog auth add](gog-auth-add.md) - Authorize and store a refresh token
+    - [gog auth alias](gog-auth-alias.md) - Manage account aliases
+      - [gog auth alias list](gog-auth-alias-list.md) - List account aliases
+      - [gog auth alias set](gog-auth-alias-set.md) - Set an account alias
+      - [gog auth alias unset](gog-auth-alias-unset.md) - Remove an account alias
+    - [gog auth credentials](gog-auth-credentials.md) - Manage OAuth client credentials
+      - [gog auth credentials list](gog-auth-credentials-list.md) - List stored OAuth client credentials
+      - [gog auth credentials remove](gog-auth-credentials-remove.md) - Remove stored OAuth client credentials
+      - [gog auth credentials set](gog-auth-credentials-set.md) - Store OAuth client credentials
+    - [gog auth doctor](gog-auth-doctor.md) - Diagnose auth, keyring, and refresh-token issues
+    - [gog auth keep](gog-auth-keep.md) - Configure service account for Google Keep (Workspace only)
+    - [gog auth keyring](gog-auth-keyring.md) - Configure keyring backend
+    - [gog auth list](gog-auth-list.md) - List stored accounts
+    - [gog auth manage](gog-auth-manage.md) - Open accounts manager in browser
+    - [gog auth remove](gog-auth-remove.md) - Remove a stored refresh token
+    - [gog auth service-account](gog-auth-service-account.md) - Configure service account (Workspace only; domain-wide delegation)
+      - [gog auth service-account set](gog-auth-service-account-set.md) - Store a service account key for impersonation
+      - [gog auth service-account status](gog-auth-service-account-status.md) - Show stored service account key status
+      - [gog auth service-account unset](gog-auth-service-account-unset.md) - Remove stored service account key
+    - [gog auth services](gog-auth-services.md) - List supported auth services and scopes
+    - [gog auth status](gog-auth-status.md) - Show auth configuration and keyring backend
+    - [gog auth tokens](gog-auth-tokens.md) - Manage stored refresh tokens
+      - [gog auth tokens delete](gog-auth-tokens-delete.md) - Delete a stored refresh token
+      - [gog auth tokens export](gog-auth-tokens-export.md) - Export a refresh token to a file (contains secrets)
+      - [gog auth tokens import](gog-auth-tokens-import.md) - Import a refresh token file into keyring (contains secrets)
+      - [gog auth tokens list](gog-auth-tokens-list.md) - List stored tokens (by key only)
+  - [gog backup](gog-backup.md) - Encrypted Google account backups
+    - [gog backup cat](gog-backup-cat.md) - Decrypt one backup shard to stdout
+    - [gog backup export](gog-backup-export.md) - Write a local plaintext export
+    - [gog backup gmail](gog-backup-gmail.md) - Gmail backup operations
+      - [gog backup gmail push](gog-backup-gmail-push.md) - Export Gmail into encrypted backup shards
+    - [gog backup init](gog-backup-init.md) - Initialize encrypted backup config and repository
+    - [gog backup push](gog-backup-push.md) - Export services into encrypted backup shards
+    - [gog backup status](gog-backup-status.md) - Inspect backup manifest without decrypting shards
+    - [gog backup verify](gog-backup-verify.md) - Decrypt and verify all backup shards
+  - [gog calendar](gog-calendar.md) - Google Calendar
+    - [gog calendar acl](gog-calendar-acl.md) - List calendar ACL
+    - [gog calendar alias](gog-calendar-alias.md) - Manage calendar aliases
+      - [gog calendar alias list](gog-calendar-alias-list.md) - List calendar aliases
+      - [gog calendar alias set](gog-calendar-alias-set.md) - Set a calendar alias
+      - [gog calendar alias unset](gog-calendar-alias-unset.md) - Remove a calendar alias
+    - [gog calendar calendars](gog-calendar-calendars.md) - List calendars
+    - [gog calendar colors](gog-calendar-colors.md) - Show calendar colors
+    - [gog calendar conflicts](gog-calendar-conflicts.md) - Find conflicts
+    - [gog calendar create](gog-calendar-create.md) - Create an event
+    - [gog calendar create-calendar](gog-calendar-create-calendar.md) - Create a new secondary calendar
+    - [gog calendar delete](gog-calendar-delete.md) - Delete an event
+    - [gog calendar event](gog-calendar-event.md) - Get event
+    - [gog calendar events](gog-calendar-events.md) - List events from a calendar or all calendars
+    - [gog calendar focus-time](gog-calendar-focus-time.md) - Create a Focus Time block
+    - [gog calendar freebusy](gog-calendar-freebusy.md) - Get free/busy
+    - [gog calendar move](gog-calendar-move.md) - Move an event to another calendar
+    - [gog calendar out-of-office](gog-calendar-out-of-office.md) - Create an Out of Office event
+    - [gog calendar propose-time](gog-calendar-propose-time.md) - Generate URL to propose a new meeting time (browser-only feature)
+    - [gog calendar raw](gog-calendar-raw.md) - Dump raw Google Calendar API response as JSON (Events.Get; lossless; for scripting and LLM consumption)
+    - [gog calendar respond](gog-calendar-respond.md) - Respond to an event invitation
+    - [gog calendar search](gog-calendar-search.md) - Search events
+    - [gog calendar subscribe](gog-calendar-subscribe.md) - Add a calendar to your calendar list
+    - [gog calendar team](gog-calendar-team.md) - Show events for all members of a Google Group
+    - [gog calendar time](gog-calendar-time.md) - Show server time
+    - [gog calendar update](gog-calendar-update.md) - Update an event
+    - [gog calendar users](gog-calendar-users.md) - List workspace users (use their email as calendar ID)
+    - [gog calendar working-location](gog-calendar-working-location.md) - Set working location (home/office/custom)
+  - [gog chat](gog-chat.md) - Google Chat
+    - [gog chat dm](gog-chat-dm.md) - Direct messages
+      - [gog chat dm send](gog-chat-dm-send.md) - Send a direct message
+      - [gog chat dm space](gog-chat-dm-space.md) - Find or create a DM space
+    - [gog chat messages](gog-chat-messages.md) - Chat messages
+      - [gog chat messages list](gog-chat-messages-list.md) - List messages
+      - [gog chat messages react](gog-chat-messages-react.md) - Add an emoji reaction to a message
+      - [gog chat messages reactions](gog-chat-messages-reactions.md) - Manage emoji reactions on a message
+        - [gog chat messages reactions create](gog-chat-messages-reactions-create.md) - Add an emoji reaction to a message
+        - [gog chat messages reactions delete](gog-chat-messages-reactions-delete.md) - Delete a reaction
+        - [gog chat messages reactions list](gog-chat-messages-reactions-list.md) - List reactions on a message
+      - [gog chat messages send](gog-chat-messages-send.md) - Send a message
+    - [gog chat spaces](gog-chat-spaces.md) - Chat spaces
+      - [gog chat spaces create](gog-chat-spaces-create.md) - Create a space
+      - [gog chat spaces find](gog-chat-spaces-find.md) - Find spaces by display name
+      - [gog chat spaces list](gog-chat-spaces-list.md) - List spaces
+    - [gog chat threads](gog-chat-threads.md) - Chat threads
+      - [gog chat threads list](gog-chat-threads-list.md) - List threads in a space
+  - [gog classroom](gog-classroom.md) - Google Classroom
+    - [gog classroom announcements](gog-classroom-announcements.md) - Announcements
+      - [gog classroom announcements assignees](gog-classroom-announcements-assignees.md) - Modify announcement assignees
+      - [gog classroom announcements create](gog-classroom-announcements-create.md) - Create an announcement
+      - [gog classroom announcements delete](gog-classroom-announcements-delete.md) - Delete an announcement
+      - [gog classroom announcements get](gog-classroom-announcements-get.md) - Get an announcement
+      - [gog classroom announcements list](gog-classroom-announcements-list.md) - List announcements
+      - [gog classroom announcements update](gog-classroom-announcements-update.md) - Update an announcement
+    - [gog classroom courses](gog-classroom-courses.md) - Courses
+      - [gog classroom courses archive](gog-classroom-courses-archive.md) - Archive a course
+      - [gog classroom courses create](gog-classroom-courses-create.md) - Create a course
+      - [gog classroom courses delete](gog-classroom-courses-delete.md) - Delete a course
+      - [gog classroom courses get](gog-classroom-courses-get.md) - Get a course
+      - [gog classroom courses join](gog-classroom-courses-join.md) - Join a course
+      - [gog classroom courses leave](gog-classroom-courses-leave.md) - Leave a course
+      - [gog classroom courses list](gog-classroom-courses-list.md) - List courses
+      - [gog classroom courses unarchive](gog-classroom-courses-unarchive.md) - Unarchive a course
+      - [gog classroom courses update](gog-classroom-courses-update.md) - Update a course
+      - [gog classroom courses url](gog-classroom-courses-url.md) - Print Classroom web URLs for courses
+    - [gog classroom coursework](gog-classroom-coursework.md) - Coursework
+      - [gog classroom coursework assignees](gog-classroom-coursework-assignees.md) - Modify coursework assignees
+      - [gog classroom coursework create](gog-classroom-coursework-create.md) - Create coursework
+      - [gog classroom coursework delete](gog-classroom-coursework-delete.md) - Delete coursework
+      - [gog classroom coursework get](gog-classroom-coursework-get.md) - Get coursework
+      - [gog classroom coursework list](gog-classroom-coursework-list.md) - List coursework
+      - [gog classroom coursework update](gog-classroom-coursework-update.md) - Update coursework
+    - [gog classroom guardian-invitations](gog-classroom-guardian-invitations.md) - Guardian invitations
+      - [gog classroom guardian-invitations create](gog-classroom-guardian-invitations-create.md) - Create a guardian invitation
+      - [gog classroom guardian-invitations get](gog-classroom-guardian-invitations-get.md) - Get a guardian invitation
+      - [gog classroom guardian-invitations list](gog-classroom-guardian-invitations-list.md) - List guardian invitations
+    - [gog classroom guardians](gog-classroom-guardians.md) - Guardians
+      - [gog classroom guardians delete](gog-classroom-guardians-delete.md) - Delete a guardian
+      - [gog classroom guardians get](gog-classroom-guardians-get.md) - Get a guardian
+      - [gog classroom guardians list](gog-classroom-guardians-list.md) - List guardians
+    - [gog classroom invitations](gog-classroom-invitations.md) - Invitations
+      - [gog classroom invitations accept](gog-classroom-invitations-accept.md) - Accept an invitation
+      - [gog classroom invitations create](gog-classroom-invitations-create.md) - Create an invitation
+      - [gog classroom invitations delete](gog-classroom-invitations-delete.md) - Delete an invitation
+      - [gog classroom invitations get](gog-classroom-invitations-get.md) - Get an invitation
+      - [gog classroom invitations list](gog-classroom-invitations-list.md) - List invitations
+    - [gog classroom materials](gog-classroom-materials.md) - Coursework materials
+      - [gog classroom materials create](gog-classroom-materials-create.md) - Create coursework material
+      - [gog classroom materials delete](gog-classroom-materials-delete.md) - Delete coursework material
+      - [gog classroom materials get](gog-classroom-materials-get.md) - Get coursework material
+      - [gog classroom materials list](gog-classroom-materials-list.md) - List coursework materials
+      - [gog classroom materials update](gog-classroom-materials-update.md) - Update coursework material
+    - [gog classroom profile](gog-classroom-profile.md) - User profiles
+      - [gog classroom profile get](gog-classroom-profile-get.md) - Get a user profile
+    - [gog classroom roster](gog-classroom-roster.md) - Course roster (students + teachers)
+    - [gog classroom students](gog-classroom-students.md) - Course students
+      - [gog classroom students add](gog-classroom-students-add.md) - Add a student
+      - [gog classroom students get](gog-classroom-students-get.md) - Get a student
+      - [gog classroom students list](gog-classroom-students-list.md) - List students
+      - [gog classroom students remove](gog-classroom-students-remove.md) - Remove a student
+    - [gog classroom submissions](gog-classroom-submissions.md) - Student submissions
+      - [gog classroom submissions get](gog-classroom-submissions-get.md) - Get a student submission
+      - [gog classroom submissions grade](gog-classroom-submissions-grade.md) - Set draft/assigned grades
+      - [gog classroom submissions list](gog-classroom-submissions-list.md) - List student submissions
+      - [gog classroom submissions reclaim](gog-classroom-submissions-reclaim.md) - Reclaim a submission
+      - [gog classroom submissions return](gog-classroom-submissions-return.md) - Return a submission
+      - [gog classroom submissions turn-in](gog-classroom-submissions-turn-in.md) - Turn in a submission
+    - [gog classroom teachers](gog-classroom-teachers.md) - Course teachers
+      - [gog classroom teachers add](gog-classroom-teachers-add.md) - Add a teacher
+      - [gog classroom teachers get](gog-classroom-teachers-get.md) - Get a teacher
+      - [gog classroom teachers list](gog-classroom-teachers-list.md) - List teachers
+      - [gog classroom teachers remove](gog-classroom-teachers-remove.md) - Remove a teacher
+    - [gog classroom topics](gog-classroom-topics.md) - Topics
+      - [gog classroom topics create](gog-classroom-topics-create.md) - Create a topic
+      - [gog classroom topics delete](gog-classroom-topics-delete.md) - Delete a topic
+      - [gog classroom topics get](gog-classroom-topics-get.md) - Get a topic
+      - [gog classroom topics list](gog-classroom-topics-list.md) - List topics
+      - [gog classroom topics update](gog-classroom-topics-update.md) - Update a topic
+  - [gog completion](gog-completion.md) - Generate shell completion scripts
+  - [gog config](gog-config.md) - Manage configuration
+    - [gog config get](gog-config-get.md) - Get a config value
+    - [gog config keys](gog-config-keys.md) - List available config keys
+    - [gog config list](gog-config-list.md) - List all config values
+    - [gog config no-send](gog-config-no-send.md) - Manage per-account Gmail no-send guards
+      - [gog config no-send list](gog-config-no-send-list.md) - List accounts with no-send guards
+      - [gog config no-send remove](gog-config-no-send-remove.md) - Remove an account no-send guard
+      - [gog config no-send set](gog-config-no-send-set.md) - Block Gmail send operations for an account
+    - [gog config path](gog-config-path.md) - Print config file path
+    - [gog config set](gog-config-set.md) - Set a config value
+    - [gog config unset](gog-config-unset.md) - Unset a config value
+  - [gog contacts](gog-contacts.md) - Google Contacts
+    - [gog contacts create](gog-contacts-create.md) - Create a contact
+    - [gog contacts dedupe](gog-contacts-dedupe.md) - Find likely duplicate contacts (preview only)
+    - [gog contacts delete](gog-contacts-delete.md) - Delete a contact
+    - [gog contacts directory](gog-contacts-directory.md) - Directory contacts
+      - [gog contacts directory list](gog-contacts-directory-list.md) - List people from the Workspace directory
+      - [gog contacts directory search](gog-contacts-directory-search.md) - Search people in the Workspace directory
+    - [gog contacts export](gog-contacts-export.md) - Export contacts as vCard (.vcf)
+    - [gog contacts get](gog-contacts-get.md) - Get a contact
+    - [gog contacts list](gog-contacts-list.md) - List contacts
+    - [gog contacts other](gog-contacts-other.md) - Other contacts
+      - [gog contacts other delete](gog-contacts-other-delete.md) - Delete an other contact
+      - [gog contacts other list](gog-contacts-other-list.md) - List other contacts
+      - [gog contacts other search](gog-contacts-other-search.md) - Search other contacts
+    - [gog contacts raw](gog-contacts-raw.md) - Dump raw People API response as JSON (People.Get; lossless; for scripting and LLM consumption)
+    - [gog contacts search](gog-contacts-search.md) - Search contacts by name/email/phone
+    - [gog contacts update](gog-contacts-update.md) - Update a contact
+  - [gog docs](gog-docs.md) - Google Docs (export via Drive)
+    - [gog docs add-tab](gog-docs-add-tab.md) - Add a tab to a Google Doc
+    - [gog docs cat](gog-docs-cat.md) - Print a Google Doc as plain text
+    - [gog docs clear](gog-docs-clear.md) - Clear all content from a Google Doc
+    - [gog docs comments](gog-docs-comments.md) - Manage comments on files
+      - [gog docs comments add](gog-docs-comments-add.md) - Add a comment to a Google Doc
+      - [gog docs comments delete](gog-docs-comments-delete.md) - Delete a comment
+      - [gog docs comments get](gog-docs-comments-get.md) - Get a comment by ID
+      - [gog docs comments list](gog-docs-comments-list.md) - List comments on a Google Doc
+      - [gog docs comments reply](gog-docs-comments-reply.md) - Reply to a comment
+      - [gog docs comments resolve](gog-docs-comments-resolve.md) - Resolve a comment (mark as done)
+    - [gog docs copy](gog-docs-copy.md) - Copy a Google Doc
+    - [gog docs create](gog-docs-create.md) - Create a Google Doc
+    - [gog docs delete](gog-docs-delete.md) - Delete text range from document
+    - [gog docs delete-tab](gog-docs-delete-tab.md) - Delete a tab from a Google Doc
+    - [gog docs edit](gog-docs-edit.md) - Find and replace text in a Google Doc
+    - [gog docs export](gog-docs-export.md) - Export a Google Doc (pdf|docx|txt|md|html)
+    - [gog docs find-replace](gog-docs-find-replace.md) - Find and replace text. Supports plain text or markdown with images; use --first for a single occurrence.
+    - [gog docs format](gog-docs-format.md) - Apply text or paragraph formatting to a Google Doc
+    - [gog docs info](gog-docs-info.md) - Get Google Doc metadata
+    - [gog docs insert](gog-docs-insert.md) - Insert text at a specific position
+    - [gog docs list-tabs](gog-docs-list-tabs.md) - List all tabs in a Google Doc
+    - [gog docs raw](gog-docs-raw.md) - Dump raw Google Docs API response as JSON (Documents.Get; lossless; for scripting and LLM consumption)
+    - [gog docs rename-tab](gog-docs-rename-tab.md) - Rename a tab in a Google Doc
+    - [gog docs sed](gog-docs-sed.md) - Regex find/replace (sed-style: s/pattern/replacement/g)
+    - [gog docs structure](gog-docs-structure.md) - Show document structure with numbered paragraphs
+    - [gog docs update](gog-docs-update.md) - Insert text at a specific index in a Google Doc
+    - [gog docs write](gog-docs-write.md) - Write content to a Google Doc
+  - [gog download](gog-download.md) - Download a Drive file (alias for 'drive download')
+  - [gog drive](gog-drive.md) - Google Drive
+    - [gog drive comments](gog-drive-comments.md) - Manage comments on files
+      - [gog drive comments create](gog-drive-comments-create.md) - Create a comment on a file
+      - [gog drive comments delete](gog-drive-comments-delete.md) - Delete a comment
+      - [gog drive comments get](gog-drive-comments-get.md) - Get a comment by ID
+      - [gog drive comments list](gog-drive-comments-list.md) - List comments on a file
+      - [gog drive comments reply](gog-drive-comments-reply.md) - Reply to a comment
+      - [gog drive comments update](gog-drive-comments-update.md) - Update a comment
+    - [gog drive copy](gog-drive-copy.md) - Copy a file
+    - [gog drive delete](gog-drive-delete.md) - Move a file to trash (use --permanent to delete forever)
+    - [gog drive download](gog-drive-download.md) - Download a file (exports Google Docs formats)
+    - [gog drive drives](gog-drive-drives.md) - List shared drives (Team Drives)
+    - [gog drive du](gog-drive-du.md) - Summarize Drive folder sizes
+    - [gog drive get](gog-drive-get.md) - Get file metadata
+    - [gog drive inventory](gog-drive-inventory.md) - Export a read-only Drive inventory
+    - [gog drive ls](gog-drive-ls.md) - List files in a folder (default: root)
+    - [gog drive mkdir](gog-drive-mkdir.md) - Create a folder
+    - [gog drive move](gog-drive-move.md) - Move a file to a different folder
+    - [gog drive permissions](gog-drive-permissions.md) - List permissions on a file
+    - [gog drive raw](gog-drive-raw.md) - Dump raw Google Drive API response as JSON (Files.Get; lossless; for scripting and LLM consumption)
+    - [gog drive rename](gog-drive-rename.md) - Rename a file or folder
+    - [gog drive search](gog-drive-search.md) - Full-text search across Drive
+    - [gog drive share](gog-drive-share.md) - Share a file or folder
+    - [gog drive tree](gog-drive-tree.md) - Print a read-only folder tree
+    - [gog drive unshare](gog-drive-unshare.md) - Remove a permission from a file
+    - [gog drive upload](gog-drive-upload.md) - Upload a file
+    - [gog drive url](gog-drive-url.md) - Print web URLs for files
+  - [gog exit-codes](gog-exit-codes.md) - Print stable exit codes (alias for 'agent exit-codes')
+  - [gog forms](gog-forms.md) - Google Forms
+    - [gog forms add-question](gog-forms-add-question.md) - Add a question to a form
+    - [gog forms create](gog-forms-create.md) - Create a form
+    - [gog forms delete-question](gog-forms-delete-question.md) - Delete a question by index
+    - [gog forms get](gog-forms-get.md) - Get a form
+    - [gog forms move-question](gog-forms-move-question.md) - Move a question to a new position
+    - [gog forms raw](gog-forms-raw.md) - Dump raw Google Forms API response as JSON (Forms.Get; lossless; for scripting and LLM consumption)
+    - [gog forms responses](gog-forms-responses.md) - Form responses
+      - [gog forms responses get](gog-forms-responses-get.md) - Get a form response
+      - [gog forms responses list](gog-forms-responses-list.md) - List form responses
+    - [gog forms update](gog-forms-update.md) - Update form title, description, or settings
+    - [gog forms watch](gog-forms-watch.md) - Response watches (push notifications)
+      - [gog forms watch create](gog-forms-watch-create.md) - Create a watch for new responses
+      - [gog forms watch delete](gog-forms-watch-delete.md) - Delete a watch
+      - [gog forms watch list](gog-forms-watch-list.md) - List active watches
+      - [gog forms watch renew](gog-forms-watch-renew.md) - Renew a watch (extends 7 days)
+  - [gog gmail](gog-gmail.md) - Gmail
+    - [gog gmail archive](gog-gmail-archive.md) - Archive messages (remove from inbox)
+    - [gog gmail attachment](gog-gmail-attachment.md) - Download a single attachment
+    - [gog gmail autoreply](gog-gmail-autoreply.md) - Reply once to matching messages
+    - [gog gmail batch](gog-gmail-batch.md) - Batch operations (permanent delete requires broader Gmail scope; use gmail trash for normal trashing)
+      - [gog gmail batch delete](gog-gmail-batch-delete.md) - Permanently delete multiple messages; use 'gmail trash' to move messages to trash with the default gmail.modify scope
+      - [gog gmail batch modify](gog-gmail-batch-modify.md) - Modify labels on multiple messages
+    - [gog gmail drafts](gog-gmail-drafts.md) - Draft operations
+      - [gog gmail drafts create](gog-gmail-drafts-create.md) - Create a draft
+      - [gog gmail drafts delete](gog-gmail-drafts-delete.md) - Delete a draft
+      - [gog gmail drafts get](gog-gmail-drafts-get.md) - Get draft details
+      - [gog gmail drafts list](gog-gmail-drafts-list.md) - List drafts
+      - [gog gmail drafts send](gog-gmail-drafts-send.md) - Send a draft
+      - [gog gmail drafts update](gog-gmail-drafts-update.md) - Update a draft
+    - [gog gmail forward](gog-gmail-forward.md) - Forward a message to new recipients
+    - [gog gmail get](gog-gmail-get.md) - Get a message (full|metadata|raw)
+    - [gog gmail history](gog-gmail-history.md) - Gmail history
+    - [gog gmail labels](gog-gmail-labels.md) - Label operations
+      - [gog gmail labels create](gog-gmail-labels-create.md) - Create a new label
+      - [gog gmail labels delete](gog-gmail-labels-delete.md) - Delete a label
+      - [gog gmail labels get](gog-gmail-labels-get.md) - Get label details (including counts)
+      - [gog gmail labels list](gog-gmail-labels-list.md) - List labels
+      - [gog gmail labels modify](gog-gmail-labels-modify.md) - Modify labels on threads
+      - [gog gmail labels rename](gog-gmail-labels-rename.md) - Rename a label
+      - [gog gmail labels style](gog-gmail-labels-style.md) - Change a user label color or visibility
+    - [gog gmail mark-read](gog-gmail-mark-read.md) - Mark messages as read
+    - [gog gmail messages](gog-gmail-messages.md) - Message operations
+      - [gog gmail messages modify](gog-gmail-messages-modify.md) - Modify labels on a single message
+      - [gog gmail messages search](gog-gmail-messages-search.md) - Search messages using Gmail query syntax
+    - [gog gmail raw](gog-gmail-raw.md) - Dump raw Gmail API response as JSON (Users.Messages.Get; lossless; for scripting and LLM consumption)
+    - [gog gmail search](gog-gmail-search.md) - Search threads using Gmail query syntax
+    - [gog gmail send](gog-gmail-send.md) - Send an email
+    - [gog gmail settings](gog-gmail-settings.md) - Settings and admin
+      - [gog gmail settings autoforward](gog-gmail-settings-autoforward.md) - Auto-forwarding settings
+        - [gog gmail settings autoforward get](gog-gmail-settings-autoforward-get.md) - Get current auto-forwarding settings
+        - [gog gmail settings autoforward update](gog-gmail-settings-autoforward-update.md) - Update auto-forwarding settings
+      - [gog gmail settings delegates](gog-gmail-settings-delegates.md) - Delegate operations
+        - [gog gmail settings delegates add](gog-gmail-settings-delegates-add.md) - Add a delegate
+        - [gog gmail settings delegates get](gog-gmail-settings-delegates-get.md) - Get a specific delegate's information
+        - [gog gmail settings delegates list](gog-gmail-settings-delegates-list.md) - List all delegates
+        - [gog gmail settings delegates remove](gog-gmail-settings-delegates-remove.md) - Remove a delegate
+      - [gog gmail settings filters](gog-gmail-settings-filters.md) - Filter operations
+        - [gog gmail settings filters create](gog-gmail-settings-filters-create.md) - Create a new email filter
+        - [gog gmail settings filters delete](gog-gmail-settings-filters-delete.md) - Delete a filter
+        - [gog gmail settings filters export](gog-gmail-settings-filters-export.md) - Export filters as Gmail WebUI-compatible XML
+        - [gog gmail settings filters get](gog-gmail-settings-filters-get.md) - Get a specific filter
+        - [gog gmail settings filters list](gog-gmail-settings-filters-list.md) - List all email filters
+      - [gog gmail settings forwarding](gog-gmail-settings-forwarding.md) - Forwarding addresses
+        - [gog gmail settings forwarding create](gog-gmail-settings-forwarding-create.md) - Create/add a forwarding address
+        - [gog gmail settings forwarding delete](gog-gmail-settings-forwarding-delete.md) - Delete a forwarding address
+        - [gog gmail settings forwarding get](gog-gmail-settings-forwarding-get.md) - Get a specific forwarding address
+        - [gog gmail settings forwarding list](gog-gmail-settings-forwarding-list.md) - List all forwarding addresses
+      - [gog gmail settings sendas](gog-gmail-settings-sendas.md) - Send-as settings
+        - [gog gmail settings sendas create](gog-gmail-settings-sendas-create.md) - Create a new send-as alias
+        - [gog gmail settings sendas delete](gog-gmail-settings-sendas-delete.md) - Delete a send-as alias
+        - [gog gmail settings sendas get](gog-gmail-settings-sendas-get.md) - Get details of a send-as alias
+        - [gog gmail settings sendas list](gog-gmail-settings-sendas-list.md) - List send-as aliases
+        - [gog gmail settings sendas update](gog-gmail-settings-sendas-update.md) - Update a send-as alias
+        - [gog gmail settings sendas verify](gog-gmail-settings-sendas-verify.md) - Resend verification email for a send-as alias
+      - [gog gmail settings vacation](gog-gmail-settings-vacation.md) - Vacation responder
+        - [gog gmail settings vacation get](gog-gmail-settings-vacation-get.md) - Get current vacation responder settings
+        - [gog gmail settings vacation update](gog-gmail-settings-vacation-update.md) - Update vacation responder settings
+      - [gog gmail settings watch](gog-gmail-settings-watch.md) - Manage Gmail watch
+        - [gog gmail settings watch renew](gog-gmail-settings-watch-renew.md) - Renew Gmail watch using stored config
+        - [gog gmail settings watch serve](gog-gmail-settings-watch-serve.md) - Run Pub/Sub push handler
+        - [gog gmail settings watch start](gog-gmail-settings-watch-start.md) - Start Gmail watch for Pub/Sub
+        - [gog gmail settings watch status](gog-gmail-settings-watch-status.md) - Show stored watch state
+        - [gog gmail settings watch stop](gog-gmail-settings-watch-stop.md) - Stop Gmail watch and clear stored state
+    - [gog gmail thread](gog-gmail-thread.md) - Thread operations (get, modify)
+      - [gog gmail thread attachments](gog-gmail-thread-attachments.md) - List all attachments in a thread
+      - [gog gmail thread get](gog-gmail-thread-get.md) - Get a thread with all messages (optionally download attachments)
+      - [gog gmail thread modify](gog-gmail-thread-modify.md) - Modify labels on all messages in a thread
+    - [gog gmail track](gog-gmail-track.md) - Email open tracking
+      - [gog gmail track key](gog-gmail-track-key.md) - Manage tracking encryption keys
+        - [gog gmail track key rotate](gog-gmail-track-key-rotate.md) - Rotate tracking encryption key
+      - [gog gmail track opens](gog-gmail-track-opens.md) - Query email opens
+      - [gog gmail track setup](gog-gmail-track-setup.md) - Set up email tracking (deploy Cloudflare Worker)
+      - [gog gmail track status](gog-gmail-track-status.md) - Show tracking configuration status
+    - [gog gmail trash](gog-gmail-trash.md) - Move messages to trash
+    - [gog gmail unread](gog-gmail-unread.md) - Mark messages as unread
+    - [gog gmail url](gog-gmail-url.md) - Print Gmail web URLs for threads
+  - [gog groups](gog-groups.md) - Google Groups
+    - [gog groups list](gog-groups-list.md) - List groups you belong to
+    - [gog groups members](gog-groups-members.md) - List members of a group
+  - [gog keep](gog-keep.md) - Google Keep (Workspace only)
+    - [gog keep attachment](gog-keep-attachment.md) - Download an attachment
+    - [gog keep create](gog-keep-create.md) - Create a new note
+    - [gog keep delete](gog-keep-delete.md) - Delete a note
+    - [gog keep get](gog-keep-get.md) - Get a note
+    - [gog keep list](gog-keep-list.md) - List notes
+    - [gog keep search](gog-keep-search.md) - Search notes by text (client-side)
+  - [gog login](gog-login.md) - Authorize and store a refresh token (alias for 'auth add')
+  - [gog logout](gog-logout.md) - Remove a stored refresh token (alias for 'auth remove')
+  - [gog ls](gog-ls.md) - List Drive files (alias for 'drive ls')
+  - [gog me](gog-me.md) - Show your profile (alias for 'people me')
+  - [gog open](gog-open.md) - Print a best-effort web URL for a Google URL/ID (offline)
+  - [gog people](gog-people.md) - Google People
+    - [gog people get](gog-people-get.md) - Get a user profile by ID
+    - [gog people me](gog-people-me.md) - Show your profile (people/me)
+    - [gog people raw](gog-people-raw.md) - Dump raw People API response as JSON (People.Get; lossless; for scripting and LLM consumption)
+    - [gog people relations](gog-people-relations.md) - Get user relations
+    - [gog people search](gog-people-search.md) - Search the Workspace directory
+  - [gog schema](gog-schema.md) - Machine-readable command/flag schema
+  - [gog search](gog-search.md) - Search Drive files (alias for 'drive search')
+  - [gog send](gog-send.md) - Send an email (alias for 'gmail send')
+  - [gog sheets](gog-sheets.md) - Google Sheets
+    - [gog sheets add-tab](gog-sheets-add-tab.md) - Add a new tab/sheet to a spreadsheet
+    - [gog sheets append](gog-sheets-append.md) - Append values to a range
+    - [gog sheets banding](gog-sheets-banding.md) - Manage alternating color banding
+      - [gog sheets banding clear](gog-sheets-banding-clear.md) - Remove alternating color banding
+      - [gog sheets banding list](gog-sheets-banding-list.md) - List alternating color banded ranges
+      - [gog sheets banding set](gog-sheets-banding-set.md) - Apply alternating colors to a range
+    - [gog sheets chart](gog-sheets-chart.md) - Manage spreadsheet charts
+      - [gog sheets chart create](gog-sheets-chart-create.md) - Create a chart from a JSON spec
+      - [gog sheets chart delete](gog-sheets-chart-delete.md) - Delete a chart
+      - [gog sheets chart get](gog-sheets-chart-get.md) - Get full chart definition (spec + position)
+      - [gog sheets chart list](gog-sheets-chart-list.md) - List charts in a spreadsheet
+      - [gog sheets chart update](gog-sheets-chart-update.md) - Update a chart spec
+    - [gog sheets clear](gog-sheets-clear.md) - Clear values in a range
+    - [gog sheets conditional-format](gog-sheets-conditional-format.md) - Manage conditional formatting rules
+      - [gog sheets conditional-format add](gog-sheets-conditional-format-add.md) - Add a conditional formatting rule
+      - [gog sheets conditional-format clear](gog-sheets-conditional-format-clear.md) - Remove conditional formatting rules
+      - [gog sheets conditional-format list](gog-sheets-conditional-format-list.md) - List conditional formatting rules
+    - [gog sheets copy](gog-sheets-copy.md) - Copy a Google Sheet
+    - [gog sheets create](gog-sheets-create.md) - Create a new spreadsheet
+    - [gog sheets delete-tab](gog-sheets-delete-tab.md) - Delete a tab/sheet from a spreadsheet (use --force to skip confirmation)
+    - [gog sheets export](gog-sheets-export.md) - Export a Google Sheet (pdf|xlsx|csv) via Drive
+    - [gog sheets find-replace](gog-sheets-find-replace.md) - Find and replace text across a spreadsheet
+    - [gog sheets format](gog-sheets-format.md) - Apply cell formatting to a range
+    - [gog sheets freeze](gog-sheets-freeze.md) - Freeze rows and columns on a sheet
+    - [gog sheets get](gog-sheets-get.md) - Get values from a range
+    - [gog sheets insert](gog-sheets-insert.md) - Insert empty rows or columns into a sheet
+    - [gog sheets links](gog-sheets-links.md) - Get cell hyperlinks from a range
+    - [gog sheets merge](gog-sheets-merge.md) - Merge cells in a range
+    - [gog sheets metadata](gog-sheets-metadata.md) - Get spreadsheet metadata
+    - [gog sheets named-ranges](gog-sheets-named-ranges.md) - Manage named ranges
+      - [gog sheets named-ranges add](gog-sheets-named-ranges-add.md) - Add a named range
+      - [gog sheets named-ranges delete](gog-sheets-named-ranges-delete.md) - Delete a named range
+      - [gog sheets named-ranges get](gog-sheets-named-ranges-get.md) - Get a named range
+      - [gog sheets named-ranges list](gog-sheets-named-ranges-list.md) - List named ranges
+      - [gog sheets named-ranges update](gog-sheets-named-ranges-update.md) - Update a named range
+    - [gog sheets notes](gog-sheets-notes.md) - Get cell notes from a range
+    - [gog sheets number-format](gog-sheets-number-format.md) - Apply number format to a range
+    - [gog sheets raw](gog-sheets-raw.md) - Dump raw Google Sheets API response as JSON (Spreadsheets.Get; lossless; for scripting and LLM consumption)
+    - [gog sheets read-format](gog-sheets-read-format.md) - Read cell formatting from a range
+    - [gog sheets rename-tab](gog-sheets-rename-tab.md) - Rename a tab/sheet in a spreadsheet
+    - [gog sheets resize-columns](gog-sheets-resize-columns.md) - Resize sheet columns
+    - [gog sheets resize-rows](gog-sheets-resize-rows.md) - Resize sheet rows
+    - [gog sheets table](gog-sheets-table.md) - Manage Google Sheets tables
+      - [gog sheets table append](gog-sheets-table-append.md) - Append rows to a table
+      - [gog sheets table clear](gog-sheets-table-clear.md) - Clear table data rows
+      - [gog sheets table create](gog-sheets-table-create.md) - Create a table
+      - [gog sheets table delete](gog-sheets-table-delete.md) - Delete a table
+      - [gog sheets table get](gog-sheets-table-get.md) - Get a table
+      - [gog sheets table list](gog-sheets-table-list.md) - List tables in a spreadsheet
+    - [gog sheets unmerge](gog-sheets-unmerge.md) - Unmerge cells in a range
+    - [gog sheets update](gog-sheets-update.md) - Update values in a range
+    - [gog sheets update-note](gog-sheets-update-note.md) - Set or clear a cell note
+  - [gog slides](gog-slides.md) - Google Slides
+    - [gog slides add-slide](gog-slides-add-slide.md) - Add a slide with a full-bleed image and optional speaker notes
+    - [gog slides copy](gog-slides-copy.md) - Copy a Google Slides presentation
+    - [gog slides create](gog-slides-create.md) - Create a Google Slides presentation
+    - [gog slides create-from-markdown](gog-slides-create-from-markdown.md) - Create a Google Slides presentation from markdown
+    - [gog slides create-from-template](gog-slides-create-from-template.md) - Create a presentation from template with text replacements
+    - [gog slides delete-slide](gog-slides-delete-slide.md) - Delete a slide by object ID
+    - [gog slides export](gog-slides-export.md) - Export a Google Slides deck (pdf|pptx)
+    - [gog slides info](gog-slides-info.md) - Get Google Slides presentation metadata
+    - [gog slides insert-text](gog-slides-insert-text.md) - Insert text into an existing page element (shape or table) by objectId
+    - [gog slides list-slides](gog-slides-list-slides.md) - List all slides with their object IDs
+    - [gog slides raw](gog-slides-raw.md) - Dump raw Google Slides API response as JSON (Presentations.Get; lossless; for scripting and LLM consumption)
+    - [gog slides read-slide](gog-slides-read-slide.md) - Read slide content: speaker notes, text elements, and images
+    - [gog slides replace-slide](gog-slides-replace-slide.md) - Replace the image on an existing slide in-place
+    - [gog slides replace-text](gog-slides-replace-text.md) - Find-and-replace text across a presentation
+    - [gog slides thumbnail](gog-slides-thumbnail.md) - Get or download a rendered thumbnail for a slide
+    - [gog slides update-notes](gog-slides-update-notes.md) - Update speaker notes on an existing slide
+  - [gog status](gog-status.md) - Show auth/config status (alias for 'auth status')
+  - [gog tasks](gog-tasks.md) - Google Tasks
+    - [gog tasks add](gog-tasks-add.md) - Add a task
+    - [gog tasks clear](gog-tasks-clear.md) - Clear completed tasks
+    - [gog tasks delete](gog-tasks-delete.md) - Delete a task
+    - [gog tasks done](gog-tasks-done.md) - Mark task completed
+    - [gog tasks get](gog-tasks-get.md) - Get a task
+    - [gog tasks list](gog-tasks-list.md) - List tasks
+    - [gog tasks lists](gog-tasks-lists.md) - List task lists
+      - [gog tasks lists create](gog-tasks-lists-create.md) - Create a task list
+      - [gog tasks lists list](gog-tasks-lists-list.md) - List task lists
+    - [gog tasks raw](gog-tasks-raw.md) - Dump raw Google Tasks API response as JSON (Tasks.Get; lossless; for scripting and LLM consumption)
+    - [gog tasks undo](gog-tasks-undo.md) - Mark task needs action
+    - [gog tasks update](gog-tasks-update.md) - Update a task
+  - [gog time](gog-time.md) - Local time utilities
+    - [gog time now](gog-time-now.md) - Show current time
+  - [gog upload](gog-upload.md) - Upload a file to Drive (alias for 'drive upload')
+  - [gog version](gog-version.md) - Print version
+  - [gog whoami](gog-whoami.md) - Show your profile (alias for 'people me')

docs/commands/gog-admin-groups-list.md

@@ -0,0 +1,47 @@
+# `gog admin groups list`
+
+> Generated from `gog schema --json`. Do not edit this page by hand; run `make docs-commands`.
+
+List groups in a domain
+
+## Usage
+
+```bash
+gog admin groups list (ls) [flags]
+```
+
+## Parent
+
+- [gog admin groups](gog-admin-groups.md)
+
+## Flags
+
+| Flag | Type | Default | Help |
+| --- | --- | --- | --- |
+| `--access-token` | `string` |  | Use provided access token directly (bypasses stored refresh tokens; token expires in ~1h) |
+| `-a`<br>`--account`<br>`--acct` | `string` |  | Account email for API commands (gmail/calendar/chat/classroom/drive/docs/slides/contacts/tasks/people/sheets/forms/appscript/ads) |
+| `--all`<br>`--all-pages`<br>`--allpages` | `bool` |  | Fetch all pages |
+| `--client` | `string` |  | OAuth client name (selects stored credentials + token bucket) |
+| `--color` | `string` | auto | Color output: auto\|always\|never |
+| `--disable-commands` | `string` |  | Comma-separated list of disabled commands; dot paths allowed |
+| `--domain` | `string` |  | Domain to list groups from (e.g., example.com) |
+| `-n`<br>`--dry-run`<br>`--dryrun`<br>`--noop`<br>`--preview` | `bool` |  | Do not make changes; print intended actions and exit successfully |
+| `--enable-commands` | `string` |  | Comma-separated list of enabled commands; dot paths allowed (restricts CLI) |
+| `--fail-empty`<br>`--non-empty`<br>`--require-results` | `bool` |  | Exit with code 3 if no results |
+| `-y`<br>`--force`<br>`--assume-yes`<br>`--yes` | `bool` |  | Skip confirmations for destructive commands |
+| `--gmail-no-send` | `bool` | false | Block Gmail send operations (agent safety) |
+| `-h`<br>`--help` | `kong.helpFlag` |  | Show context-sensitive help. |
+| `-j`<br>`--json`<br>`--machine` | `bool` | false | Output JSON to stdout (best for scripting) |
+| `--max`<br>`--limit` | `int64` | 100 | Max results |
+| `--no-input`<br>`--non-interactive`<br>`--noninteractive` | `bool` |  | Never prompt; fail instead (useful for CI) |
+| `--page`<br>`--cursor` | `string` |  | Page token |
+| `-p`<br>`--plain`<br>`--tsv` | `bool` | false | Output stable, parseable text to stdout (TSV; no colors) |
+| `--results-only` | `bool` |  | In JSON mode, emit only the primary result (drops envelope fields like nextPageToken) |
+| `--select`<br>`--pick`<br>`--project` | `string` |  | In JSON mode, select comma-separated fields (best-effort; supports dot paths). Desire path: use --fields for most commands. |
+| `-v`<br>`--verbose` | `bool` |  | Enable verbose logging |
+| `--version` | `kong.VersionFlag` |  | Print version and exit |
+
+## See Also
+
+- [gog admin groups](gog-admin-groups.md)
+- [Command index](README.md)

docs/commands/gog-admin-groups-members-add.md

@@ -0,0 +1,43 @@
+# `gog admin groups members add`
+
+> Generated from `gog schema --json`. Do not edit this page by hand; run `make docs-commands`.
+
+Add a member to a group
+
+## Usage
+
+```bash
+gog admin groups members add (invite) <groupEmail> <memberEmail> [flags]
+```
+
+## Parent
+
+- [gog admin groups members](gog-admin-groups-members.md)
+
+## Flags
+
+| Flag | Type | Default | Help |
+| --- | --- | --- | --- |
+| `--access-token` | `string` |  | Use provided access token directly (bypasses stored refresh tokens; token expires in ~1h) |
+| `-a`<br>`--account`<br>`--acct` | `string` |  | Account email for API commands (gmail/calendar/chat/classroom/drive/docs/slides/contacts/tasks/people/sheets/forms/appscript/ads) |
+| `--client` | `string` |  | OAuth client name (selects stored credentials + token bucket) |
+| `--color` | `string` | auto | Color output: auto\|always\|never |
+| `--disable-commands` | `string` |  | Comma-separated list of disabled commands; dot paths allowed |
+| `-n`<br>`--dry-run`<br>`--dryrun`<br>`--noop`<br>`--preview` | `bool` |  | Do not make changes; print intended actions and exit successfully |
+| `--enable-commands` | `string` |  | Comma-separated list of enabled commands; dot paths allowed (restricts CLI) |
+| `-y`<br>`--force`<br>`--assume-yes`<br>`--yes` | `bool` |  | Skip confirmations for destructive commands |
+| `--gmail-no-send` | `bool` | false | Block Gmail send operations (agent safety) |
+| `-h`<br>`--help` | `kong.helpFlag` |  | Show context-sensitive help. |
+| `-j`<br>`--json`<br>`--machine` | `bool` | false | Output JSON to stdout (best for scripting) |
+| `--no-input`<br>`--non-interactive`<br>`--noninteractive` | `bool` |  | Never prompt; fail instead (useful for CI) |
+| `-p`<br>`--plain`<br>`--tsv` | `bool` | false | Output stable, parseable text to stdout (TSV; no colors) |
+| `--results-only` | `bool` |  | In JSON mode, emit only the primary result (drops envelope fields like nextPageToken) |
+| `--role` | `string` | MEMBER | Member role (MEMBER, MANAGER, OWNER) |
+| `--select`<br>`--pick`<br>`--project` | `string` |  | In JSON mode, select comma-separated fields (best-effort; supports dot paths). Desire path: use --fields for most commands. |
+| `-v`<br>`--verbose` | `bool` |  | Enable verbose logging |
+| `--version` | `kong.VersionFlag` |  | Print version and exit |
+
+## See Also
+
+- [gog admin groups members](gog-admin-groups-members.md)
+- [Command index](README.md)

docs/commands/gog-admin-groups-members-list.md

@@ -0,0 +1,46 @@
+# `gog admin groups members list`
+
+> Generated from `gog schema --json`. Do not edit this page by hand; run `make docs-commands`.
+
+List group members
+
+## Usage
+
+```bash
+gog admin groups members list (ls) <groupEmail> [flags]
+```
+
+## Parent
+
+- [gog admin groups members](gog-admin-groups-members.md)
+
+## Flags
+
+| Flag | Type | Default | Help |
+| --- | --- | --- | --- |
+| `--access-token` | `string` |  | Use provided access token directly (bypasses stored refresh tokens; token expires in ~1h) |
+| `-a`<br>`--account`<br>`--acct` | `string` |  | Account email for API commands (gmail/calendar/chat/classroom/drive/docs/slides/contacts/tasks/people/sheets/forms/appscript/ads) |
+| `--all`<br>`--all-pages`<br>`--allpages` | `bool` |  | Fetch all pages |
+| `--client` | `string` |  | OAuth client name (selects stored credentials + token bucket) |
+| `--color` | `string` | auto | Color output: auto\|always\|never |
+| `--disable-commands` | `string` |  | Comma-separated list of disabled commands; dot paths allowed |
+| `-n`<br>`--dry-run`<br>`--dryrun`<br>`--noop`<br>`--preview` | `bool` |  | Do not make changes; print intended actions and exit successfully |
+| `--enable-commands` | `string` |  | Comma-separated list of enabled commands; dot paths allowed (restricts CLI) |
+| `--fail-empty`<br>`--non-empty`<br>`--require-results` | `bool` |  | Exit with code 3 if no results |
+| `-y`<br>`--force`<br>`--assume-yes`<br>`--yes` | `bool` |  | Skip confirmations for destructive commands |
+| `--gmail-no-send` | `bool` | false | Block Gmail send operations (agent safety) |
+| `-h`<br>`--help` | `kong.helpFlag` |  | Show context-sensitive help. |
+| `-j`<br>`--json`<br>`--machine` | `bool` | false | Output JSON to stdout (best for scripting) |
+| `--max`<br>`--limit` | `int64` | 100 | Max results |
+| `--no-input`<br>`--non-interactive`<br>`--noninteractive` | `bool` |  | Never prompt; fail instead (useful for CI) |
+| `--page`<br>`--cursor` | `string` |  | Page token |
+| `-p`<br>`--plain`<br>`--tsv` | `bool` | false | Output stable, parseable text to stdout (TSV; no colors) |
+| `--results-only` | `bool` |  | In JSON mode, emit only the primary result (drops envelope fields like nextPageToken) |
+| `--select`<br>`--pick`<br>`--project` | `string` |  | In JSON mode, select comma-separated fields (best-effort; supports dot paths). Desire path: use --fields for most commands. |
+| `-v`<br>`--verbose` | `bool` |  | Enable verbose logging |
+| `--version` | `kong.VersionFlag` |  | Print version and exit |
+
+## See Also
+
+- [gog admin groups members](gog-admin-groups-members.md)
+- [Command index](README.md)

docs/commands/gog-admin-groups-members-remove.md

@@ -0,0 +1,42 @@
+# `gog admin groups members remove`
+
+> Generated from `gog schema --json`. Do not edit this page by hand; run `make docs-commands`.
+
+Remove a member from a group
+
+## Usage
+
+```bash
+gog admin groups members remove (rm,del,delete) <groupEmail> <memberEmail>
+```
+
+## Parent
+
+- [gog admin groups members](gog-admin-groups-members.md)
+
+## Flags
+
+| Flag | Type | Default | Help |
+| --- | --- | --- | --- |
+| `--access-token` | `string` |  | Use provided access token directly (bypasses stored refresh tokens; token expires in ~1h) |
+| `-a`<br>`--account`<br>`--acct` | `string` |  | Account email for API commands (gmail/calendar/chat/classroom/drive/docs/slides/contacts/tasks/people/sheets/forms/appscript/ads) |
+| `--client` | `string` |  | OAuth client name (selects stored credentials + token bucket) |
+| `--color` | `string` | auto | Color output: auto\|always\|never |
+| `--disable-commands` | `string` |  | Comma-separated list of disabled commands; dot paths allowed |
+| `-n`<br>`--dry-run`<br>`--dryrun`<br>`--noop`<br>`--preview` | `bool` |  | Do not make changes; print intended actions and exit successfully |
+| `--enable-commands` | `string` |  | Comma-separated list of enabled commands; dot paths allowed (restricts CLI) |
+| `-y`<br>`--force`<br>`--assume-yes`<br>`--yes` | `bool` |  | Skip confirmations for destructive commands |
+| `--gmail-no-send` | `bool` | false | Block Gmail send operations (agent safety) |
+| `-h`<br>`--help` | `kong.helpFlag` |  | Show context-sensitive help. |
+| `-j`<br>`--json`<br>`--machine` | `bool` | false | Output JSON to stdout (best for scripting) |
+| `--no-input`<br>`--non-interactive`<br>`--noninteractive` | `bool` |  | Never prompt; fail instead (useful for CI) |
+| `-p`<br>`--plain`<br>`--tsv` | `bool` | false | Output stable, parseable text to stdout (TSV; no colors) |
+| `--results-only` | `bool` |  | In JSON mode, emit only the primary result (drops envelope fields like nextPageToken) |
+| `--select`<br>`--pick`<br>`--project` | `string` |  | In JSON mode, select comma-separated fields (best-effort; supports dot paths). Desire path: use --fields for most commands. |
+| `-v`<br>`--verbose` | `bool` |  | Enable verbose logging |
+| `--version` | `kong.VersionFlag` |  | Print version and exit |
+
+## See Also
+
+- [gog admin groups members](gog-admin-groups-members.md)
+- [Command index](README.md)

docs/commands/gog-admin-groups-members.md

@@ -0,0 +1,48 @@
+# `gog admin groups members`
+
+> Generated from `gog schema --json`. Do not edit this page by hand; run `make docs-commands`.
+
+Manage group members
+
+## Usage
+
+```bash
+gog admin groups members <command>
+```
+
+## Parent
+
+- [gog admin groups](gog-admin-groups.md)
+
+## Subcommands
+
+- [gog admin groups members add](gog-admin-groups-members-add.md) - Add a member to a group
+- [gog admin groups members list](gog-admin-groups-members-list.md) - List group members
+- [gog admin groups members remove](gog-admin-groups-members-remove.md) - Remove a member from a group
+
+## Flags
+
+| Flag | Type | Default | Help |
+| --- | --- | --- | --- |
+| `--access-token` | `string` |  | Use provided access token directly (bypasses stored refresh tokens; token expires in ~1h) |
+| `-a`<br>`--account`<br>`--acct` | `string` |  | Account email for API commands (gmail/calendar/chat/classroom/drive/docs/slides/contacts/tasks/people/sheets/forms/appscript/ads) |
+| `--client` | `string` |  | OAuth client name (selects stored credentials + token bucket) |
+| `--color` | `string` | auto | Color output: auto\|always\|never |
+| `--disable-commands` | `string` |  | Comma-separated list of disabled commands; dot paths allowed |
+| `-n`<br>`--dry-run`<br>`--dryrun`<br>`--noop`<br>`--preview` | `bool` |  | Do not make changes; print intended actions and exit successfully |
+| `--enable-commands` | `string` |  | Comma-separated list of enabled commands; dot paths allowed (restricts CLI) |
+| `-y`<br>`--force`<br>`--assume-yes`<br>`--yes` | `bool` |  | Skip confirmations for destructive commands |
+| `--gmail-no-send` | `bool` | false | Block Gmail send operations (agent safety) |
+| `-h`<br>`--help` | `kong.helpFlag` |  | Show context-sensitive help. |
+| `-j`<br>`--json`<br>`--machine` | `bool` | false | Output JSON to stdout (best for scripting) |
+| `--no-input`<br>`--non-interactive`<br>`--noninteractive` | `bool` |  | Never prompt; fail instead (useful for CI) |
+| `-p`<br>`--plain`<br>`--tsv` | `bool` | false | Output stable, parseable text to stdout (TSV; no colors) |
+| `--results-only` | `bool` |  | In JSON mode, emit only the primary result (drops envelope fields like nextPageToken) |
+| `--select`<br>`--pick`<br>`--project` | `string` |  | In JSON mode, select comma-separated fields (best-effort; supports dot paths). Desire path: use --fields for most commands. |
+| `-v`<br>`--verbose` | `bool` |  | Enable verbose logging |
+| `--version` | `kong.VersionFlag` |  | Print version and exit |
+
+## See Also
+
+- [gog admin groups](gog-admin-groups.md)
+- [Command index](README.md)

docs/commands/gog-admin-groups.md

@@ -0,0 +1,47 @@
+# `gog admin groups`
+
+> Generated from `gog schema --json`. Do not edit this page by hand; run `make docs-commands`.
+
+Manage Workspace groups
+
+## Usage
+
+```bash
+gog admin groups <command>
+```
+
+## Parent
+
+- [gog admin](gog-admin.md)
+
+## Subcommands
+
+- [gog admin groups list](gog-admin-groups-list.md) - List groups in a domain
+- [gog admin groups members](gog-admin-groups-members.md) - Manage group members
+
+## Flags
+
+| Flag | Type | Default | Help |
+| --- | --- | --- | --- |
+| `--access-token` | `string` |  | Use provided access token directly (bypasses stored refresh tokens; token expires in ~1h) |
+| `-a`<br>`--account`<br>`--acct` | `string` |  | Account email for API commands (gmail/calendar/chat/classroom/drive/docs/slides/contacts/tasks/people/sheets/forms/appscript/ads) |
+| `--client` | `string` |  | OAuth client name (selects stored credentials + token bucket) |
+| `--color` | `string` | auto | Color output: auto\|always\|never |
+| `--disable-commands` | `string` |  | Comma-separated list of disabled commands; dot paths allowed |
+| `-n`<br>`--dry-run`<br>`--dryrun`<br>`--noop`<br>`--preview` | `bool` |  | Do not make changes; print intended actions and exit successfully |
+| `--enable-commands` | `string` |  | Comma-separated list of enabled commands; dot paths allowed (restricts CLI) |
+| `-y`<br>`--force`<br>`--assume-yes`<br>`--yes` | `bool` |  | Skip confirmations for destructive commands |
+| `--gmail-no-send` | `bool` | false | Block Gmail send operations (agent safety) |
+| `-h`<br>`--help` | `kong.helpFlag` |  | Show context-sensitive help. |
+| `-j`<br>`--json`<br>`--machine` | `bool` | false | Output JSON to stdout (best for scripting) |
+| `--no-input`<br>`--non-interactive`<br>`--noninteractive` | `bool` |  | Never prompt; fail instead (useful for CI) |
+| `-p`<br>`--plain`<br>`--tsv` | `bool` | false | Output stable, parseable text to stdout (TSV; no colors) |
+| `--results-only` | `bool` |  | In JSON mode, emit only the primary result (drops envelope fields like nextPageToken) |
+| `--select`<br>`--pick`<br>`--project` | `string` |  | In JSON mode, select comma-separated fields (best-effort; supports dot paths). Desire path: use --fields for most commands. |
+| `-v`<br>`--verbose` | `bool` |  | Enable verbose logging |
+| `--version` | `kong.VersionFlag` |  | Print version and exit |
+
+## See Also
+
+- [gog admin](gog-admin.md)
+- [Command index](README.md)

docs/commands/gog-admin-users-create.md

@@ -0,0 +1,48 @@
+# `gog admin users create`
+
+> Generated from `gog schema --json`. Do not edit this page by hand; run `make docs-commands`.
+
+Create a new user
+
+## Usage
+
+```bash
+gog admin users create (add,new) <email> [flags]
+```
+
+## Parent
+
+- [gog admin users](gog-admin-users.md)
+
+## Flags
+
+| Flag | Type | Default | Help |
+| --- | --- | --- | --- |
+| `--access-token` | `string` |  | Use provided access token directly (bypasses stored refresh tokens; token expires in ~1h) |
+| `-a`<br>`--account`<br>`--acct` | `string` |  | Account email for API commands (gmail/calendar/chat/classroom/drive/docs/slides/contacts/tasks/people/sheets/forms/appscript/ads) |
+| `--admin` | `bool` |  | Not supported; assign admin roles separately after user creation |
+| `--change-password` | `bool` |  | Require password change on first login |
+| `--client` | `string` |  | OAuth client name (selects stored credentials + token bucket) |
+| `--color` | `string` | auto | Color output: auto\|always\|never |
+| `--disable-commands` | `string` |  | Comma-separated list of disabled commands; dot paths allowed |
+| `-n`<br>`--dry-run`<br>`--dryrun`<br>`--noop`<br>`--preview` | `bool` |  | Do not make changes; print intended actions and exit successfully |
+| `--enable-commands` | `string` |  | Comma-separated list of enabled commands; dot paths allowed (restricts CLI) |
+| `--family` | `string` |  | Family (last) name |
+| `-y`<br>`--force`<br>`--assume-yes`<br>`--yes` | `bool` |  | Skip confirmations for destructive commands |
+| `--given` | `string` |  | Given (first) name |
+| `--gmail-no-send` | `bool` | false | Block Gmail send operations (agent safety) |
+| `-h`<br>`--help` | `kong.helpFlag` |  | Show context-sensitive help. |
+| `-j`<br>`--json`<br>`--machine` | `bool` | false | Output JSON to stdout (best for scripting) |
+| `--no-input`<br>`--non-interactive`<br>`--noninteractive` | `bool` |  | Never prompt; fail instead (useful for CI) |
+| `--org-unit` | `string` |  | Organization unit path |
+| `--password` | `string` |  | Initial password |
+| `-p`<br>`--plain`<br>`--tsv` | `bool` | false | Output stable, parseable text to stdout (TSV; no colors) |
+| `--results-only` | `bool` |  | In JSON mode, emit only the primary result (drops envelope fields like nextPageToken) |
+| `--select`<br>`--pick`<br>`--project` | `string` |  | In JSON mode, select comma-separated fields (best-effort; supports dot paths). Desire path: use --fields for most commands. |
+| `-v`<br>`--verbose` | `bool` |  | Enable verbose logging |
+| `--version` | `kong.VersionFlag` |  | Print version and exit |
+
+## See Also
+
+- [gog admin users](gog-admin-users.md)
+- [Command index](README.md)

docs/commands/gog-admin-users-get.md

@@ -0,0 +1,42 @@
+# `gog admin users get`
+
+> Generated from `gog schema --json`. Do not edit this page by hand; run `make docs-commands`.
+
+Get user details
+
+## Usage
+
+```bash
+gog admin users get (info,show) <userEmail>
+```
+
+## Parent
+
+- [gog admin users](gog-admin-users.md)
+
+## Flags
+
+| Flag | Type | Default | Help |
+| --- | --- | --- | --- |
+| `--access-token` | `string` |  | Use provided access token directly (bypasses stored refresh tokens; token expires in ~1h) |
+| `-a`<br>`--account`<br>`--acct` | `string` |  | Account email for API commands (gmail/calendar/chat/classroom/drive/docs/slides/contacts/tasks/people/sheets/forms/appscript/ads) |
+| `--client` | `string` |  | OAuth client name (selects stored credentials + token bucket) |
+| `--color` | `string` | auto | Color output: auto\|always\|never |
+| `--disable-commands` | `string` |  | Comma-separated list of disabled commands; dot paths allowed |
+| `-n`<br>`--dry-run`<br>`--dryrun`<br>`--noop`<br>`--preview` | `bool` |  | Do not make changes; print intended actions and exit successfully |
+| `--enable-commands` | `string` |  | Comma-separated list of enabled commands; dot paths allowed (restricts CLI) |
+| `-y`<br>`--force`<br>`--assume-yes`<br>`--yes` | `bool` |  | Skip confirmations for destructive commands |
+| `--gmail-no-send` | `bool` | false | Block Gmail send operations (agent safety) |
+| `-h`<br>`--help` | `kong.helpFlag` |  | Show context-sensitive help. |
+| `-j`<br>`--json`<br>`--machine` | `bool` | false | Output JSON to stdout (best for scripting) |
+| `--no-input`<br>`--non-interactive`<br>`--noninteractive` | `bool` |  | Never prompt; fail instead (useful for CI) |
+| `-p`<br>`--plain`<br>`--tsv` | `bool` | false | Output stable, parseable text to stdout (TSV; no colors) |
+| `--results-only` | `bool` |  | In JSON mode, emit only the primary result (drops envelope fields like nextPageToken) |
+| `--select`<br>`--pick`<br>`--project` | `string` |  | In JSON mode, select comma-separated fields (best-effort; supports dot paths). Desire path: use --fields for most commands. |
+| `-v`<br>`--verbose` | `bool` |  | Enable verbose logging |
+| `--version` | `kong.VersionFlag` |  | Print version and exit |
+
+## See Also
+
+- [gog admin users](gog-admin-users.md)
+- [Command index](README.md)

docs/commands/gog-admin-users-list.md

@@ -0,0 +1,47 @@
+# `gog admin users list`
+
+> Generated from `gog schema --json`. Do not edit this page by hand; run `make docs-commands`.
+
+List users in a domain
+
+## Usage
+
+```bash
+gog admin users list (ls) [flags]
+```
+
+## Parent
+
+- [gog admin users](gog-admin-users.md)
+
+## Flags
+
+| Flag | Type | Default | Help |
+| --- | --- | --- | --- |
+| `--access-token` | `string` |  | Use provided access token directly (bypasses stored refresh tokens; token expires in ~1h) |
+| `-a`<br>`--account`<br>`--acct` | `string` |  | Account email for API commands (gmail/calendar/chat/classroom/drive/docs/slides/contacts/tasks/people/sheets/forms/appscript/ads) |
+| `--all`<br>`--all-pages`<br>`--allpages` | `bool` |  | Fetch all pages |
+| `--client` | `string` |  | OAuth client name (selects stored credentials + token bucket) |
+| `--color` | `string` | auto | Color output: auto\|always\|never |
+| `--disable-commands` | `string` |  | Comma-separated list of disabled commands; dot paths allowed |
+| `--domain` | `string` |  | Domain to list users from (e.g., example.com) |
+| `-n`<br>`--dry-run`<br>`--dryrun`<br>`--noop`<br>`--preview` | `bool` |  | Do not make changes; print intended actions and exit successfully |
+| `--enable-commands` | `string` |  | Comma-separated list of enabled commands; dot paths allowed (restricts CLI) |
+| `--fail-empty`<br>`--non-empty`<br>`--require-results` | `bool` |  | Exit with code 3 if no results |
+| `-y`<br>`--force`<br>`--assume-yes`<br>`--yes` | `bool` |  | Skip confirmations for destructive commands |
+| `--gmail-no-send` | `bool` | false | Block Gmail send operations (agent safety) |
+| `-h`<br>`--help` | `kong.helpFlag` |  | Show context-sensitive help. |
+| `-j`<br>`--json`<br>`--machine` | `bool` | false | Output JSON to stdout (best for scripting) |
+| `--max`<br>`--limit` | `int64` | 100 | Max results |
+| `--no-input`<br>`--non-interactive`<br>`--noninteractive` | `bool` |  | Never prompt; fail instead (useful for CI) |
+| `--page`<br>`--cursor` | `string` |  | Page token |
+| `-p`<br>`--plain`<br>`--tsv` | `bool` | false | Output stable, parseable text to stdout (TSV; no colors) |
+| `--results-only` | `bool` |  | In JSON mode, emit only the primary result (drops envelope fields like nextPageToken) |
+| `--select`<br>`--pick`<br>`--project` | `string` |  | In JSON mode, select comma-separated fields (best-effort; supports dot paths). Desire path: use --fields for most commands. |
+| `-v`<br>`--verbose` | `bool` |  | Enable verbose logging |
+| `--version` | `kong.VersionFlag` |  | Print version and exit |
+
+## See Also
+
+- [gog admin users](gog-admin-users.md)
+- [Command index](README.md)

docs/commands/gog-admin-users-suspend.md

@@ -0,0 +1,42 @@
+# `gog admin users suspend`
+
+> Generated from `gog schema --json`. Do not edit this page by hand; run `make docs-commands`.
+
+Suspend a user account
+
+## Usage
+
+```bash
+gog admin users suspend <userEmail>
+```
+
+## Parent
+
+- [gog admin users](gog-admin-users.md)
+
+## Flags
+
+| Flag | Type | Default | Help |
+| --- | --- | --- | --- |
+| `--access-token` | `string` |  | Use provided access token directly (bypasses stored refresh tokens; token expires in ~1h) |
+| `-a`<br>`--account`<br>`--acct` | `string` |  | Account email for API commands (gmail/calendar/chat/classroom/drive/docs/slides/contacts/tasks/people/sheets/forms/appscript/ads) |
+| `--client` | `string` |  | OAuth client name (selects stored credentials + token bucket) |
+| `--color` | `string` | auto | Color output: auto\|always\|never |
+| `--disable-commands` | `string` |  | Comma-separated list of disabled commands; dot paths allowed |
+| `-n`<br>`--dry-run`<br>`--dryrun`<br>`--noop`<br>`--preview` | `bool` |  | Do not make changes; print intended actions and exit successfully |
+| `--enable-commands` | `string` |  | Comma-separated list of enabled commands; dot paths allowed (restricts CLI) |
+| `-y`<br>`--force`<br>`--assume-yes`<br>`--yes` | `bool` |  | Skip confirmations for destructive commands |
+| `--gmail-no-send` | `bool` | false | Block Gmail send operations (agent safety) |
+| `-h`<br>`--help` | `kong.helpFlag` |  | Show context-sensitive help. |
+| `-j`<br>`--json`<br>`--machine` | `bool` | false | Output JSON to stdout (best for scripting) |
+| `--no-input`<br>`--non-interactive`<br>`--noninteractive` | `bool` |  | Never prompt; fail instead (useful for CI) |
+| `-p`<br>`--plain`<br>`--tsv` | `bool` | false | Output stable, parseable text to stdout (TSV; no colors) |
+| `--results-only` | `bool` |  | In JSON mode, emit only the primary result (drops envelope fields like nextPageToken) |
+| `--select`<br>`--pick`<br>`--project` | `string` |  | In JSON mode, select comma-separated fields (best-effort; supports dot paths). Desire path: use --fields for most commands. |
+| `-v`<br>`--verbose` | `bool` |  | Enable verbose logging |
+| `--version` | `kong.VersionFlag` |  | Print version and exit |
+
+## See Also
+
+- [gog admin users](gog-admin-users.md)
+- [Command index](README.md)

docs/commands/gog-admin-users.md

@@ -0,0 +1,49 @@
+# `gog admin users`
+
+> Generated from `gog schema --json`. Do not edit this page by hand; run `make docs-commands`.
+
+Manage Workspace users
+
+## Usage
+
+```bash
+gog admin users <command>
+```
+
+## Parent
+
+- [gog admin](gog-admin.md)
+
+## Subcommands
+
+- [gog admin users create](gog-admin-users-create.md) - Create a new user
+- [gog admin users get](gog-admin-users-get.md) - Get user details
+- [gog admin users list](gog-admin-users-list.md) - List users in a domain
+- [gog admin users suspend](gog-admin-users-suspend.md) - Suspend a user account
+
+## Flags
+
+| Flag | Type | Default | Help |
+| --- | --- | --- | --- |
+| `--access-token` | `string` |  | Use provided access token directly (bypasses stored refresh tokens; token expires in ~1h) |
+| `-a`<br>`--account`<br>`--acct` | `string` |  | Account email for API commands (gmail/calendar/chat/classroom/drive/docs/slides/contacts/tasks/people/sheets/forms/appscript/ads) |
+| `--client` | `string` |  | OAuth client name (selects stored credentials + token bucket) |
+| `--color` | `string` | auto | Color output: auto\|always\|never |
+| `--disable-commands` | `string` |  | Comma-separated list of disabled commands; dot paths allowed |
+| `-n`<br>`--dry-run`<br>`--dryrun`<br>`--noop`<br>`--preview` | `bool` |  | Do not make changes; print intended actions and exit successfully |
+| `--enable-commands` | `string` |  | Comma-separated list of enabled commands; dot paths allowed (restricts CLI) |
+| `-y`<br>`--force`<br>`--assume-yes`<br>`--yes` | `bool` |  | Skip confirmations for destructive commands |
+| `--gmail-no-send` | `bool` | false | Block Gmail send operations (agent safety) |
+| `-h`<br>`--help` | `kong.helpFlag` |  | Show context-sensitive help. |
+| `-j`<br>`--json`<br>`--machine` | `bool` | false | Output JSON to stdout (best for scripting) |
+| `--no-input`<br>`--non-interactive`<br>`--noninteractive` | `bool` |  | Never prompt; fail instead (useful for CI) |
+| `-p`<br>`--plain`<br>`--tsv` | `bool` | false | Output stable, parseable text to stdout (TSV; no colors) |
+| `--results-only` | `bool` |  | In JSON mode, emit only the primary result (drops envelope fields like nextPageToken) |
+| `--select`<br>`--pick`<br>`--project` | `string` |  | In JSON mode, select comma-separated fields (best-effort; supports dot paths). Desire path: use --fields for most commands. |
+| `-v`<br>`--verbose` | `bool` |  | Enable verbose logging |
+| `--version` | `kong.VersionFlag` |  | Print version and exit |
+
+## See Also
+
+- [gog admin](gog-admin.md)
+- [Command index](README.md)

docs/commands/gog-admin.md

@@ -0,0 +1,47 @@
+# `gog admin`
+
+> Generated from `gog schema --json`. Do not edit this page by hand; run `make docs-commands`.
+
+Google Workspace Admin (Directory API) - requires domain-wide delegation
+
+## Usage
+
+```bash
+gog admin <command> [flags]
+```
+
+## Parent
+
+- [gog](gog.md)
+
+## Subcommands
+
+- [gog admin groups](gog-admin-groups.md) - Manage Workspace groups
+- [gog admin users](gog-admin-users.md) - Manage Workspace users
+
+## Flags
+
+| Flag | Type | Default | Help |
+| --- | --- | --- | --- |
+| `--access-token` | `string` |  | Use provided access token directly (bypasses stored refresh tokens; token expires in ~1h) |
+| `-a`<br>`--account`<br>`--acct` | `string` |  | Account email for API commands (gmail/calendar/chat/classroom/drive/docs/slides/contacts/tasks/people/sheets/forms/appscript/ads) |
+| `--client` | `string` |  | OAuth client name (selects stored credentials + token bucket) |
+| `--color` | `string` | auto | Color output: auto\|always\|never |
+| `--disable-commands` | `string` |  | Comma-separated list of disabled commands; dot paths allowed |
+| `-n`<br>`--dry-run`<br>`--dryrun`<br>`--noop`<br>`--preview` | `bool` |  | Do not make changes; print intended actions and exit successfully |
+| `--enable-commands` | `string` |  | Comma-separated list of enabled commands; dot paths allowed (restricts CLI) |
+| `-y`<br>`--force`<br>`--assume-yes`<br>`--yes` | `bool` |  | Skip confirmations for destructive commands |
+| `--gmail-no-send` | `bool` | false | Block Gmail send operations (agent safety) |
+| `-h`<br>`--help` | `kong.helpFlag` |  | Show context-sensitive help. |
+| `-j`<br>`--json`<br>`--machine` | `bool` | false | Output JSON to stdout (best for scripting) |
+| `--no-input`<br>`--non-interactive`<br>`--noninteractive` | `bool` |  | Never prompt; fail instead (useful for CI) |
+| `-p`<br>`--plain`<br>`--tsv` | `bool` | false | Output stable, parseable text to stdout (TSV; no colors) |
+| `--results-only` | `bool` |  | In JSON mode, emit only the primary result (drops envelope fields like nextPageToken) |
+| `--select`<br>`--pick`<br>`--project` | `string` |  | In JSON mode, select comma-separated fields (best-effort; supports dot paths). Desire path: use --fields for most commands. |
+| `-v`<br>`--verbose` | `bool` |  | Enable verbose logging |
+| `--version` | `kong.VersionFlag` |  | Print version and exit |
+
+## See Also
+
+- [gog](gog.md)
+- [Command index](README.md)

docs/commands/gog-agent-exit-codes.md

@@ -0,0 +1,42 @@
+# `gog agent exit-codes`
+
+> Generated from `gog schema --json`. Do not edit this page by hand; run `make docs-commands`.
+
+Print stable exit codes for automation
+
+## Usage
+
+```bash
+gog agent exit-codes (exitcodes,exit-code)
+```
+
+## Parent
+
+- [gog agent](gog-agent.md)
+
+## Flags
+
+| Flag | Type | Default | Help |
+| --- | --- | --- | --- |
+| `--access-token` | `string` |  | Use provided access token directly (bypasses stored refresh tokens; token expires in ~1h) |
+| `-a`<br>`--account`<br>`--acct` | `string` |  | Account email for API commands (gmail/calendar/chat/classroom/drive/docs/slides/contacts/tasks/people/sheets/forms/appscript/ads) |
+| `--client` | `string` |  | OAuth client name (selects stored credentials + token bucket) |
+| `--color` | `string` | auto | Color output: auto\|always\|never |
+| `--disable-commands` | `string` |  | Comma-separated list of disabled commands; dot paths allowed |
+| `-n`<br>`--dry-run`<br>`--dryrun`<br>`--noop`<br>`--preview` | `bool` |  | Do not make changes; print intended actions and exit successfully |
+| `--enable-commands` | `string` |  | Comma-separated list of enabled commands; dot paths allowed (restricts CLI) |
+| `-y`<br>`--force`<br>`--assume-yes`<br>`--yes` | `bool` |  | Skip confirmations for destructive commands |
+| `--gmail-no-send` | `bool` | false | Block Gmail send operations (agent safety) |
+| `-h`<br>`--help` | `kong.helpFlag` |  | Show context-sensitive help. |
+| `-j`<br>`--json`<br>`--machine` | `bool` | false | Output JSON to stdout (best for scripting) |
+| `--no-input`<br>`--non-interactive`<br>`--noninteractive` | `bool` |  | Never prompt; fail instead (useful for CI) |
+| `-p`<br>`--plain`<br>`--tsv` | `bool` | false | Output stable, parseable text to stdout (TSV; no colors) |
+| `--results-only` | `bool` |  | In JSON mode, emit only the primary result (drops envelope fields like nextPageToken) |
+| `--select`<br>`--pick`<br>`--project` | `string` |  | In JSON mode, select comma-separated fields (best-effort; supports dot paths). Desire path: use --fields for most commands. |
+| `-v`<br>`--verbose` | `bool` |  | Enable verbose logging |
+| `--version` | `kong.VersionFlag` |  | Print version and exit |
+
+## See Also
+
+- [gog agent](gog-agent.md)
+- [Command index](README.md)

docs/commands/gog-agent.md

@@ -0,0 +1,46 @@
+# `gog agent`
+
+> Generated from `gog schema --json`. Do not edit this page by hand; run `make docs-commands`.
+
+Agent-friendly helpers
+
+## Usage
+
+```bash
+gog agent <command> [flags]
+```
+
+## Parent
+
+- [gog](gog.md)
+
+## Subcommands
+
+- [gog agent exit-codes](gog-agent-exit-codes.md) - Print stable exit codes for automation
+
+## Flags
+
+| Flag | Type | Default | Help |
+| --- | --- | --- | --- |
+| `--access-token` | `string` |  | Use provided access token directly (bypasses stored refresh tokens; token expires in ~1h) |
+| `-a`<br>`--account`<br>`--acct` | `string` |  | Account email for API commands (gmail/calendar/chat/classroom/drive/docs/slides/contacts/tasks/people/sheets/forms/appscript/ads) |
+| `--client` | `string` |  | OAuth client name (selects stored credentials + token bucket) |
+| `--color` | `string` | auto | Color output: auto\|always\|never |
+| `--disable-commands` | `string` |  | Comma-separated list of disabled commands; dot paths allowed |
+| `-n`<br>`--dry-run`<br>`--dryrun`<br>`--noop`<br>`--preview` | `bool` |  | Do not make changes; print intended actions and exit successfully |
+| `--enable-commands` | `string` |  | Comma-separated list of enabled commands; dot paths allowed (restricts CLI) |
+| `-y`<br>`--force`<br>`--assume-yes`<br>`--yes` | `bool` |  | Skip confirmations for destructive commands |
+| `--gmail-no-send` | `bool` | false | Block Gmail send operations (agent safety) |
+| `-h`<br>`--help` | `kong.helpFlag` |  | Show context-sensitive help. |
+| `-j`<br>`--json`<br>`--machine` | `bool` | false | Output JSON to stdout (best for scripting) |
+| `--no-input`<br>`--non-interactive`<br>`--noninteractive` | `bool` |  | Never prompt; fail instead (useful for CI) |
+| `-p`<br>`--plain`<br>`--tsv` | `bool` | false | Output stable, parseable text to stdout (TSV; no colors) |
+| `--results-only` | `bool` |  | In JSON mode, emit only the primary result (drops envelope fields like nextPageToken) |
+| `--select`<br>`--pick`<br>`--project` | `string` |  | In JSON mode, select comma-separated fields (best-effort; supports dot paths). Desire path: use --fields for most commands. |
+| `-v`<br>`--verbose` | `bool` |  | Enable verbose logging |
+| `--version` | `kong.VersionFlag` |  | Print version and exit |
+
+## See Also
+
+- [gog](gog.md)
+- [Command index](README.md)

docs/commands/gog-appscript-content.md

@@ -0,0 +1,42 @@
+# `gog appscript content`
+
+> Generated from `gog schema --json`. Do not edit this page by hand; run `make docs-commands`.
+
+Get Apps Script project content
+
+## Usage
+
+```bash
+gog appscript (script,apps-script) content (cat) <scriptId>
+```
+
+## Parent
+
+- [gog appscript](gog-appscript.md)
+
+## Flags
+
+| Flag | Type | Default | Help |
+| --- | --- | --- | --- |
+| `--access-token` | `string` |  | Use provided access token directly (bypasses stored refresh tokens; token expires in ~1h) |
+| `-a`<br>`--account`<br>`--acct` | `string` |  | Account email for API commands (gmail/calendar/chat/classroom/drive/docs/slides/contacts/tasks/people/sheets/forms/appscript/ads) |
+| `--client` | `string` |  | OAuth client name (selects stored credentials + token bucket) |
+| `--color` | `string` | auto | Color output: auto\|always\|never |
+| `--disable-commands` | `string` |  | Comma-separated list of disabled commands; dot paths allowed |
+| `-n`<br>`--dry-run`<br>`--dryrun`<br>`--noop`<br>`--preview` | `bool` |  | Do not make changes; print intended actions and exit successfully |
+| `--enable-commands` | `string` |  | Comma-separated list of enabled commands; dot paths allowed (restricts CLI) |
+| `-y`<br>`--force`<br>`--assume-yes`<br>`--yes` | `bool` |  | Skip confirmations for destructive commands |
+| `--gmail-no-send` | `bool` | false | Block Gmail send operations (agent safety) |
+| `-h`<br>`--help` | `kong.helpFlag` |  | Show context-sensitive help. |
+| `-j`<br>`--json`<br>`--machine` | `bool` | false | Output JSON to stdout (best for scripting) |
+| `--no-input`<br>`--non-interactive`<br>`--noninteractive` | `bool` |  | Never prompt; fail instead (useful for CI) |
+| `-p`<br>`--plain`<br>`--tsv` | `bool` | false | Output stable, parseable text to stdout (TSV; no colors) |
+| `--results-only` | `bool` |  | In JSON mode, emit only the primary result (drops envelope fields like nextPageToken) |
+| `--select`<br>`--pick`<br>`--project` | `string` |  | In JSON mode, select comma-separated fields (best-effort; supports dot paths). Desire path: use --fields for most commands. |
+| `-v`<br>`--verbose` | `bool` |  | Enable verbose logging |
+| `--version` | `kong.VersionFlag` |  | Print version and exit |
+
+## See Also
+
+- [gog appscript](gog-appscript.md)
+- [Command index](README.md)

docs/commands/gog-appscript-create.md

@@ -0,0 +1,44 @@
+# `gog appscript create`
+
+> Generated from `gog schema --json`. Do not edit this page by hand; run `make docs-commands`.
+
+Create an Apps Script project
+
+## Usage
+
+```bash
+gog appscript (script,apps-script) create (new) --title=STRING [flags]
+```
+
+## Parent
+
+- [gog appscript](gog-appscript.md)
+
+## Flags
+
+| Flag | Type | Default | Help |
+| --- | --- | --- | --- |
+| `--access-token` | `string` |  | Use provided access token directly (bypasses stored refresh tokens; token expires in ~1h) |
+| `-a`<br>`--account`<br>`--acct` | `string` |  | Account email for API commands (gmail/calendar/chat/classroom/drive/docs/slides/contacts/tasks/people/sheets/forms/appscript/ads) |
+| `--client` | `string` |  | OAuth client name (selects stored credentials + token bucket) |
+| `--color` | `string` | auto | Color output: auto\|always\|never |
+| `--disable-commands` | `string` |  | Comma-separated list of disabled commands; dot paths allowed |
+| `-n`<br>`--dry-run`<br>`--dryrun`<br>`--noop`<br>`--preview` | `bool` |  | Do not make changes; print intended actions and exit successfully |
+| `--enable-commands` | `string` |  | Comma-separated list of enabled commands; dot paths allowed (restricts CLI) |
+| `-y`<br>`--force`<br>`--assume-yes`<br>`--yes` | `bool` |  | Skip confirmations for destructive commands |
+| `--gmail-no-send` | `bool` | false | Block Gmail send operations (agent safety) |
+| `-h`<br>`--help` | `kong.helpFlag` |  | Show context-sensitive help. |
+| `-j`<br>`--json`<br>`--machine` | `bool` | false | Output JSON to stdout (best for scripting) |
+| `--no-input`<br>`--non-interactive`<br>`--noninteractive` | `bool` |  | Never prompt; fail instead (useful for CI) |
+| `--parent-id` | `string` |  | Optional Drive file ID to bind to |
+| `-p`<br>`--plain`<br>`--tsv` | `bool` | false | Output stable, parseable text to stdout (TSV; no colors) |
+| `--results-only` | `bool` |  | In JSON mode, emit only the primary result (drops envelope fields like nextPageToken) |
+| `--select`<br>`--pick`<br>`--project` | `string` |  | In JSON mode, select comma-separated fields (best-effort; supports dot paths). Desire path: use --fields for most commands. |
+| `--title` | `string` |  | Project title |
+| `-v`<br>`--verbose` | `bool` |  | Enable verbose logging |
+| `--version` | `kong.VersionFlag` |  | Print version and exit |
+
+## See Also
+
+- [gog appscript](gog-appscript.md)
+- [Command index](README.md)

docs/commands/gog-appscript-get.md

@@ -0,0 +1,42 @@
+# `gog appscript get`
+
+> Generated from `gog schema --json`. Do not edit this page by hand; run `make docs-commands`.
+
+Get Apps Script project metadata
+
+## Usage
+
+```bash
+gog appscript (script,apps-script) get (info,show) <scriptId>
+```
+
+## Parent
+
+- [gog appscript](gog-appscript.md)
+
+## Flags
+
+| Flag | Type | Default | Help |
+| --- | --- | --- | --- |
+| `--access-token` | `string` |  | Use provided access token directly (bypasses stored refresh tokens; token expires in ~1h) |
+| `-a`<br>`--account`<br>`--acct` | `string` |  | Account email for API commands (gmail/calendar/chat/classroom/drive/docs/slides/contacts/tasks/people/sheets/forms/appscript/ads) |
+| `--client` | `string` |  | OAuth client name (selects stored credentials + token bucket) |
+| `--color` | `string` | auto | Color output: auto\|always\|never |
+| `--disable-commands` | `string` |  | Comma-separated list of disabled commands; dot paths allowed |
+| `-n`<br>`--dry-run`<br>`--dryrun`<br>`--noop`<br>`--preview` | `bool` |  | Do not make changes; print intended actions and exit successfully |
+| `--enable-commands` | `string` |  | Comma-separated list of enabled commands; dot paths allowed (restricts CLI) |
+| `-y`<br>`--force`<br>`--assume-yes`<br>`--yes` | `bool` |  | Skip confirmations for destructive commands |
+| `--gmail-no-send` | `bool` | false | Block Gmail send operations (agent safety) |
+| `-h`<br>`--help` | `kong.helpFlag` |  | Show context-sensitive help. |
+| `-j`<br>`--json`<br>`--machine` | `bool` | false | Output JSON to stdout (best for scripting) |
+| `--no-input`<br>`--non-interactive`<br>`--noninteractive` | `bool` |  | Never prompt; fail instead (useful for CI) |
+| `-p`<br>`--plain`<br>`--tsv` | `bool` | false | Output stable, parseable text to stdout (TSV; no colors) |
+| `--results-only` | `bool` |  | In JSON mode, emit only the primary result (drops envelope fields like nextPageToken) |
+| `--select`<br>`--pick`<br>`--project` | `string` |  | In JSON mode, select comma-separated fields (best-effort; supports dot paths). Desire path: use --fields for most commands. |
+| `-v`<br>`--verbose` | `bool` |  | Enable verbose logging |
+| `--version` | `kong.VersionFlag` |  | Print version and exit |
+
+## See Also
+
+- [gog appscript](gog-appscript.md)
+- [Command index](README.md)

docs/commands/gog-appscript-run.md

@@ -0,0 +1,44 @@
+# `gog appscript run`
+
+> Generated from `gog schema --json`. Do not edit this page by hand; run `make docs-commands`.
+
+Run a deployed Apps Script function
+
+## Usage
+
+```bash
+gog appscript (script,apps-script) run <scriptId> <function> [flags]
+```
+
+## Parent
+
+- [gog appscript](gog-appscript.md)
+
+## Flags
+
+| Flag | Type | Default | Help |
+| --- | --- | --- | --- |
+| `--access-token` | `string` |  | Use provided access token directly (bypasses stored refresh tokens; token expires in ~1h) |
+| `-a`<br>`--account`<br>`--acct` | `string` |  | Account email for API commands (gmail/calendar/chat/classroom/drive/docs/slides/contacts/tasks/people/sheets/forms/appscript/ads) |
+| `--client` | `string` |  | OAuth client name (selects stored credentials + token bucket) |
+| `--color` | `string` | auto | Color output: auto\|always\|never |
+| `--dev-mode` | `bool` |  | Run latest saved code if you own the script |
+| `--disable-commands` | `string` |  | Comma-separated list of disabled commands; dot paths allowed |
+| `-n`<br>`--dry-run`<br>`--dryrun`<br>`--noop`<br>`--preview` | `bool` |  | Do not make changes; print intended actions and exit successfully |
+| `--enable-commands` | `string` |  | Comma-separated list of enabled commands; dot paths allowed (restricts CLI) |
+| `-y`<br>`--force`<br>`--assume-yes`<br>`--yes` | `bool` |  | Skip confirmations for destructive commands |
+| `--gmail-no-send` | `bool` | false | Block Gmail send operations (agent safety) |
+| `-h`<br>`--help` | `kong.helpFlag` |  | Show context-sensitive help. |
+| `-j`<br>`--json`<br>`--machine` | `bool` | false | Output JSON to stdout (best for scripting) |
+| `--no-input`<br>`--non-interactive`<br>`--noninteractive` | `bool` |  | Never prompt; fail instead (useful for CI) |
+| `--params` | `string` | [] | JSON array of function parameters |
+| `-p`<br>`--plain`<br>`--tsv` | `bool` | false | Output stable, parseable text to stdout (TSV; no colors) |
+| `--results-only` | `bool` |  | In JSON mode, emit only the primary result (drops envelope fields like nextPageToken) |
+| `--select`<br>`--pick`<br>`--project` | `string` |  | In JSON mode, select comma-separated fields (best-effort; supports dot paths). Desire path: use --fields for most commands. |
+| `-v`<br>`--verbose` | `bool` |  | Enable verbose logging |
+| `--version` | `kong.VersionFlag` |  | Print version and exit |
+
+## See Also
+
+- [gog appscript](gog-appscript.md)
+- [Command index](README.md)

docs/commands/gog-appscript.md

@@ -0,0 +1,49 @@
+# `gog appscript`
+
+> Generated from `gog schema --json`. Do not edit this page by hand; run `make docs-commands`.
+
+Google Apps Script
+
+## Usage
+
+```bash
+gog appscript (script,apps-script) <command> [flags]
+```
+
+## Parent
+
+- [gog](gog.md)
+
+## Subcommands
+
+- [gog appscript content](gog-appscript-content.md) - Get Apps Script project content
+- [gog appscript create](gog-appscript-create.md) - Create an Apps Script project
+- [gog appscript get](gog-appscript-get.md) - Get Apps Script project metadata
+- [gog appscript run](gog-appscript-run.md) - Run a deployed Apps Script function
+
+## Flags
+
+| Flag | Type | Default | Help |
+| --- | --- | --- | --- |
+| `--access-token` | `string` |  | Use provided access token directly (bypasses stored refresh tokens; token expires in ~1h) |
+| `-a`<br>`--account`<br>`--acct` | `string` |  | Account email for API commands (gmail/calendar/chat/classroom/drive/docs/slides/contacts/tasks/people/sheets/forms/appscript/ads) |
+| `--client` | `string` |  | OAuth client name (selects stored credentials + token bucket) |
+| `--color` | `string` | auto | Color output: auto\|always\|never |
+| `--disable-commands` | `string` |  | Comma-separated list of disabled commands; dot paths allowed |
+| `-n`<br>`--dry-run`<br>`--dryrun`<br>`--noop`<br>`--preview` | `bool` |  | Do not make changes; print intended actions and exit successfully |
+| `--enable-commands` | `string` |  | Comma-separated list of enabled commands; dot paths allowed (restricts CLI) |
+| `-y`<br>`--force`<br>`--assume-yes`<br>`--yes` | `bool` |  | Skip confirmations for destructive commands |
+| `--gmail-no-send` | `bool` | false | Block Gmail send operations (agent safety) |
+| `-h`<br>`--help` | `kong.helpFlag` |  | Show context-sensitive help. |
+| `-j`<br>`--json`<br>`--machine` | `bool` | false | Output JSON to stdout (best for scripting) |
+| `--no-input`<br>`--non-interactive`<br>`--noninteractive` | `bool` |  | Never prompt; fail instead (useful for CI) |
+| `-p`<br>`--plain`<br>`--tsv` | `bool` | false | Output stable, parseable text to stdout (TSV; no colors) |
+| `--results-only` | `bool` |  | In JSON mode, emit only the primary result (drops envelope fields like nextPageToken) |
+| `--select`<br>`--pick`<br>`--project` | `string` |  | In JSON mode, select comma-separated fields (best-effort; supports dot paths). Desire path: use --fields for most commands. |
+| `-v`<br>`--verbose` | `bool` |  | Enable verbose logging |
+| `--version` | `kong.VersionFlag` |  | Print version and exit |
+
+## See Also
+
+- [gog](gog.md)
+- [Command index](README.md)

docs/commands/gog-auth-add.md

@@ -0,0 +1,56 @@
+# `gog auth add`
+
+> Generated from `gog schema --json`. Do not edit this page by hand; run `make docs-commands`.
+
+Authorize and store a refresh token
+
+## Usage
+
+```bash
+gog auth add <email> [flags]
+```
+
+## Parent
+
+- [gog auth](gog-auth.md)
+
+## Flags
+
+| Flag | Type | Default | Help |
+| --- | --- | --- | --- |
+| `--access-token` | `string` |  | Use provided access token directly (bypasses stored refresh tokens; token expires in ~1h) |
+| `-a`<br>`--account`<br>`--acct` | `string` |  | Account email for API commands (gmail/calendar/chat/classroom/drive/docs/slides/contacts/tasks/people/sheets/forms/appscript/ads) |
+| `--auth-url` | `string` |  | Redirect URL from browser (manual flow; required for --remote --step 2) |
+| `--client` | `string` |  | OAuth client name (selects stored credentials + token bucket) |
+| `--color` | `string` | auto | Color output: auto\|always\|never |
+| `--disable-commands` | `string` |  | Comma-separated list of disabled commands; dot paths allowed |
+| `--drive-scope` | `string` | full | Drive scope mode: full\|readonly\|file |
+| `-n`<br>`--dry-run`<br>`--dryrun`<br>`--noop`<br>`--preview` | `bool` |  | Do not make changes; print intended actions and exit successfully |
+| `--enable-commands` | `string` |  | Comma-separated list of enabled commands; dot paths allowed (restricts CLI) |
+| `--extra-scopes` | `string` |  | Comma-separated list of additional OAuth scope URIs to request (appended after service scopes) |
+| `-y`<br>`--force`<br>`--assume-yes`<br>`--yes` | `bool` |  | Skip confirmations for destructive commands |
+| `--force-consent` | `bool` |  | Force consent screen to obtain a refresh token |
+| `--gmail-no-send` | `bool` | false | Block Gmail send operations (agent safety) |
+| `--gmail-scope` | `string` | full | Gmail scope mode: full\|readonly |
+| `-h`<br>`--help` | `kong.helpFlag` |  | Show context-sensitive help. |
+| `-j`<br>`--json`<br>`--machine` | `bool` | false | Output JSON to stdout (best for scripting) |
+| `--listen-addr` | `string` |  | Address to listen on for OAuth callback (for example 0.0.0.0 or 0.0.0.0:8080) |
+| `--manual` | `bool` |  | Browserless auth flow (paste redirect URL) |
+| `--no-input`<br>`--non-interactive`<br>`--noninteractive` | `bool` |  | Never prompt; fail instead (useful for CI) |
+| `-p`<br>`--plain`<br>`--tsv` | `bool` | false | Output stable, parseable text to stdout (TSV; no colors) |
+| `--readonly` | `bool` |  | Use read-only scopes where available (still includes OIDC identity scopes) |
+| `--redirect-host` | `string` |  | Hostname for OAuth callback in browser flows; builds https://{host}/oauth2/callback |
+| `--redirect-uri` | `string` |  | Override OAuth redirect URI for manual/remote flows (for example https://host.example/oauth2/callback) |
+| `--remote` | `bool` |  | Remote/server-friendly manual flow (print URL, then exchange code) |
+| `--results-only` | `bool` |  | In JSON mode, emit only the primary result (drops envelope fields like nextPageToken) |
+| `--select`<br>`--pick`<br>`--project` | `string` |  | In JSON mode, select comma-separated fields (best-effort; supports dot paths). Desire path: use --fields for most commands. |
+| `--services` | `string` | user | Services to authorize: user\|all or comma-separated gmail,calendar,chat,classroom,drive,docs,slides,contacts,tasks,sheets,people,forms,appscript,ads (Keep uses service account: gog auth service-account set) |
+| `--step` | `int` |  | Remote auth step: 1=print URL, 2=exchange code |
+| `--timeout` | `time.Duration` |  | Authorization timeout (manual flows default to 5m) |
+| `-v`<br>`--verbose` | `bool` |  | Enable verbose logging |
+| `--version` | `kong.VersionFlag` |  | Print version and exit |
+
+## See Also
+
+- [gog auth](gog-auth.md)
+- [Command index](README.md)

docs/commands/gog-auth-alias-list.md

@@ -0,0 +1,42 @@
+# `gog auth alias list`
+
+> Generated from `gog schema --json`. Do not edit this page by hand; run `make docs-commands`.
+
+List account aliases
+
+## Usage
+
+```bash
+gog auth alias list
+```
+
+## Parent
+
+- [gog auth alias](gog-auth-alias.md)
+
+## Flags
+
+| Flag | Type | Default | Help |
+| --- | --- | --- | --- |
+| `--access-token` | `string` |  | Use provided access token directly (bypasses stored refresh tokens; token expires in ~1h) |
+| `-a`<br>`--account`<br>`--acct` | `string` |  | Account email for API commands (gmail/calendar/chat/classroom/drive/docs/slides/contacts/tasks/people/sheets/forms/appscript/ads) |
+| `--client` | `string` |  | OAuth client name (selects stored credentials + token bucket) |
+| `--color` | `string` | auto | Color output: auto\|always\|never |
+| `--disable-commands` | `string` |  | Comma-separated list of disabled commands; dot paths allowed |
+| `-n`<br>`--dry-run`<br>`--dryrun`<br>`--noop`<br>`--preview` | `bool` |  | Do not make changes; print intended actions and exit successfully |
+| `--enable-commands` | `string` |  | Comma-separated list of enabled commands; dot paths allowed (restricts CLI) |
+| `-y`<br>`--force`<br>`--assume-yes`<br>`--yes` | `bool` |  | Skip confirmations for destructive commands |
+| `--gmail-no-send` | `bool` | false | Block Gmail send operations (agent safety) |
+| `-h`<br>`--help` | `kong.helpFlag` |  | Show context-sensitive help. |
+| `-j`<br>`--json`<br>`--machine` | `bool` | false | Output JSON to stdout (best for scripting) |
+| `--no-input`<br>`--non-interactive`<br>`--noninteractive` | `bool` |  | Never prompt; fail instead (useful for CI) |
+| `-p`<br>`--plain`<br>`--tsv` | `bool` | false | Output stable, parseable text to stdout (TSV; no colors) |
+| `--results-only` | `bool` |  | In JSON mode, emit only the primary result (drops envelope fields like nextPageToken) |
+| `--select`<br>`--pick`<br>`--project` | `string` |  | In JSON mode, select comma-separated fields (best-effort; supports dot paths). Desire path: use --fields for most commands. |
+| `-v`<br>`--verbose` | `bool` |  | Enable verbose logging |
+| `--version` | `kong.VersionFlag` |  | Print version and exit |
+
+## See Also
+
+- [gog auth alias](gog-auth-alias.md)
+- [Command index](README.md)

docs/commands/gog-auth-alias-set.md

@@ -0,0 +1,42 @@
+# `gog auth alias set`
+
+> Generated from `gog schema --json`. Do not edit this page by hand; run `make docs-commands`.
+
+Set an account alias
+
+## Usage
+
+```bash
+gog auth alias set <alias> <email>
+```
+
+## Parent
+
+- [gog auth alias](gog-auth-alias.md)
+
+## Flags
+
+| Flag | Type | Default | Help |
+| --- | --- | --- | --- |
+| `--access-token` | `string` |  | Use provided access token directly (bypasses stored refresh tokens; token expires in ~1h) |
+| `-a`<br>`--account`<br>`--acct` | `string` |  | Account email for API commands (gmail/calendar/chat/classroom/drive/docs/slides/contacts/tasks/people/sheets/forms/appscript/ads) |
+| `--client` | `string` |  | OAuth client name (selects stored credentials + token bucket) |
+| `--color` | `string` | auto | Color output: auto\|always\|never |
+| `--disable-commands` | `string` |  | Comma-separated list of disabled commands; dot paths allowed |
+| `-n`<br>`--dry-run`<br>`--dryrun`<br>`--noop`<br>`--preview` | `bool` |  | Do not make changes; print intended actions and exit successfully |
+| `--enable-commands` | `string` |  | Comma-separated list of enabled commands; dot paths allowed (restricts CLI) |
+| `-y`<br>`--force`<br>`--assume-yes`<br>`--yes` | `bool` |  | Skip confirmations for destructive commands |
+| `--gmail-no-send` | `bool` | false | Block Gmail send operations (agent safety) |
+| `-h`<br>`--help` | `kong.helpFlag` |  | Show context-sensitive help. |
+| `-j`<br>`--json`<br>`--machine` | `bool` | false | Output JSON to stdout (best for scripting) |
+| `--no-input`<br>`--non-interactive`<br>`--noninteractive` | `bool` |  | Never prompt; fail instead (useful for CI) |
+| `-p`<br>`--plain`<br>`--tsv` | `bool` | false | Output stable, parseable text to stdout (TSV; no colors) |
+| `--results-only` | `bool` |  | In JSON mode, emit only the primary result (drops envelope fields like nextPageToken) |
+| `--select`<br>`--pick`<br>`--project` | `string` |  | In JSON mode, select comma-separated fields (best-effort; supports dot paths). Desire path: use --fields for most commands. |
+| `-v`<br>`--verbose` | `bool` |  | Enable verbose logging |
+| `--version` | `kong.VersionFlag` |  | Print version and exit |
+
+## See Also
+
+- [gog auth alias](gog-auth-alias.md)
+- [Command index](README.md)

docs/commands/gog-auth-alias-unset.md

@@ -0,0 +1,42 @@
+# `gog auth alias unset`
+
+> Generated from `gog schema --json`. Do not edit this page by hand; run `make docs-commands`.
+
+Remove an account alias
+
+## Usage
+
+```bash
+gog auth alias unset <alias>
+```
+
+## Parent
+
+- [gog auth alias](gog-auth-alias.md)
+
+## Flags
+
+| Flag | Type | Default | Help |
+| --- | --- | --- | --- |
+| `--access-token` | `string` |  | Use provided access token directly (bypasses stored refresh tokens; token expires in ~1h) |
+| `-a`<br>`--account`<br>`--acct` | `string` |  | Account email for API commands (gmail/calendar/chat/classroom/drive/docs/slides/contacts/tasks/people/sheets/forms/appscript/ads) |
+| `--client` | `string` |  | OAuth client name (selects stored credentials + token bucket) |
+| `--color` | `string` | auto | Color output: auto\|always\|never |
+| `--disable-commands` | `string` |  | Comma-separated list of disabled commands; dot paths allowed |
+| `-n`<br>`--dry-run`<br>`--dryrun`<br>`--noop`<br>`--preview` | `bool` |  | Do not make changes; print intended actions and exit successfully |
+| `--enable-commands` | `string` |  | Comma-separated list of enabled commands; dot paths allowed (restricts CLI) |
+| `-y`<br>`--force`<br>`--assume-yes`<br>`--yes` | `bool` |  | Skip confirmations for destructive commands |
+| `--gmail-no-send` | `bool` | false | Block Gmail send operations (agent safety) |
+| `-h`<br>`--help` | `kong.helpFlag` |  | Show context-sensitive help. |
+| `-j`<br>`--json`<br>`--machine` | `bool` | false | Output JSON to stdout (best for scripting) |
+| `--no-input`<br>`--non-interactive`<br>`--noninteractive` | `bool` |  | Never prompt; fail instead (useful for CI) |
+| `-p`<br>`--plain`<br>`--tsv` | `bool` | false | Output stable, parseable text to stdout (TSV; no colors) |
+| `--results-only` | `bool` |  | In JSON mode, emit only the primary result (drops envelope fields like nextPageToken) |
+| `--select`<br>`--pick`<br>`--project` | `string` |  | In JSON mode, select comma-separated fields (best-effort; supports dot paths). Desire path: use --fields for most commands. |
+| `-v`<br>`--verbose` | `bool` |  | Enable verbose logging |
+| `--version` | `kong.VersionFlag` |  | Print version and exit |
+
+## See Also
+
+- [gog auth alias](gog-auth-alias.md)
+- [Command index](README.md)

docs/commands/gog-auth-alias.md

@@ -0,0 +1,48 @@
+# `gog auth alias`
+
+> Generated from `gog schema --json`. Do not edit this page by hand; run `make docs-commands`.
+
+Manage account aliases
+
+## Usage
+
+```bash
+gog auth alias <command>
+```
+
+## Parent
+
+- [gog auth](gog-auth.md)
+
+## Subcommands
+
+- [gog auth alias list](gog-auth-alias-list.md) - List account aliases
+- [gog auth alias set](gog-auth-alias-set.md) - Set an account alias
+- [gog auth alias unset](gog-auth-alias-unset.md) - Remove an account alias
+
+## Flags
+
+| Flag | Type | Default | Help |
+| --- | --- | --- | --- |
+| `--access-token` | `string` |  | Use provided access token directly (bypasses stored refresh tokens; token expires in ~1h) |
+| `-a`<br>`--account`<br>`--acct` | `string` |  | Account email for API commands (gmail/calendar/chat/classroom/drive/docs/slides/contacts/tasks/people/sheets/forms/appscript/ads) |
+| `--client` | `string` |  | OAuth client name (selects stored credentials + token bucket) |
+| `--color` | `string` | auto | Color output: auto\|always\|never |
+| `--disable-commands` | `string` |  | Comma-separated list of disabled commands; dot paths allowed |
+| `-n`<br>`--dry-run`<br>`--dryrun`<br>`--noop`<br>`--preview` | `bool` |  | Do not make changes; print intended actions and exit successfully |
+| `--enable-commands` | `string` |  | Comma-separated list of enabled commands; dot paths allowed (restricts CLI) |
+| `-y`<br>`--force`<br>`--assume-yes`<br>`--yes` | `bool` |  | Skip confirmations for destructive commands |
+| `--gmail-no-send` | `bool` | false | Block Gmail send operations (agent safety) |
+| `-h`<br>`--help` | `kong.helpFlag` |  | Show context-sensitive help. |
+| `-j`<br>`--json`<br>`--machine` | `bool` | false | Output JSON to stdout (best for scripting) |
+| `--no-input`<br>`--non-interactive`<br>`--noninteractive` | `bool` |  | Never prompt; fail instead (useful for CI) |
+| `-p`<br>`--plain`<br>`--tsv` | `bool` | false | Output stable, parseable text to stdout (TSV; no colors) |
+| `--results-only` | `bool` |  | In JSON mode, emit only the primary result (drops envelope fields like nextPageToken) |
+| `--select`<br>`--pick`<br>`--project` | `string` |  | In JSON mode, select comma-separated fields (best-effort; supports dot paths). Desire path: use --fields for most commands. |
+| `-v`<br>`--verbose` | `bool` |  | Enable verbose logging |
+| `--version` | `kong.VersionFlag` |  | Print version and exit |
+
+## See Also
+
+- [gog auth](gog-auth.md)
+- [Command index](README.md)

docs/commands/gog-auth-credentials-list.md

@@ -0,0 +1,42 @@
+# `gog auth credentials list`
+
+> Generated from `gog schema --json`. Do not edit this page by hand; run `make docs-commands`.
+
+List stored OAuth client credentials
+
+## Usage
+
+```bash
+gog auth credentials list
+```
+
+## Parent
+
+- [gog auth credentials](gog-auth-credentials.md)
+
+## Flags
+
+| Flag | Type | Default | Help |
+| --- | --- | --- | --- |
+| `--access-token` | `string` |  | Use provided access token directly (bypasses stored refresh tokens; token expires in ~1h) |
+| `-a`<br>`--account`<br>`--acct` | `string` |  | Account email for API commands (gmail/calendar/chat/classroom/drive/docs/slides/contacts/tasks/people/sheets/forms/appscript/ads) |
+| `--client` | `string` |  | OAuth client name (selects stored credentials + token bucket) |
+| `--color` | `string` | auto | Color output: auto\|always\|never |
+| `--disable-commands` | `string` |  | Comma-separated list of disabled commands; dot paths allowed |
+| `-n`<br>`--dry-run`<br>`--dryrun`<br>`--noop`<br>`--preview` | `bool` |  | Do not make changes; print intended actions and exit successfully |
+| `--enable-commands` | `string` |  | Comma-separated list of enabled commands; dot paths allowed (restricts CLI) |
+| `-y`<br>`--force`<br>`--assume-yes`<br>`--yes` | `bool` |  | Skip confirmations for destructive commands |
+| `--gmail-no-send` | `bool` | false | Block Gmail send operations (agent safety) |
+| `-h`<br>`--help` | `kong.helpFlag` |  | Show context-sensitive help. |
+| `-j`<br>`--json`<br>`--machine` | `bool` | false | Output JSON to stdout (best for scripting) |
+| `--no-input`<br>`--non-interactive`<br>`--noninteractive` | `bool` |  | Never prompt; fail instead (useful for CI) |
+| `-p`<br>`--plain`<br>`--tsv` | `bool` | false | Output stable, parseable text to stdout (TSV; no colors) |
+| `--results-only` | `bool` |  | In JSON mode, emit only the primary result (drops envelope fields like nextPageToken) |
+| `--select`<br>`--pick`<br>`--project` | `string` |  | In JSON mode, select comma-separated fields (best-effort; supports dot paths). Desire path: use --fields for most commands. |
+| `-v`<br>`--verbose` | `bool` |  | Enable verbose logging |
+| `--version` | `kong.VersionFlag` |  | Print version and exit |
+
+## See Also
+
+- [gog auth credentials](gog-auth-credentials.md)
+- [Command index](README.md)

docs/commands/gog-auth-credentials-remove.md

@@ -0,0 +1,42 @@
+# `gog auth credentials remove`
+
+> Generated from `gog schema --json`. Do not edit this page by hand; run `make docs-commands`.
+
+Remove stored OAuth client credentials
+
+## Usage
+
+```bash
+gog auth credentials remove [<client>]
+```
+
+## Parent
+
+- [gog auth credentials](gog-auth-credentials.md)
+
+## Flags
+
+| Flag | Type | Default | Help |
+| --- | --- | --- | --- |
+| `--access-token` | `string` |  | Use provided access token directly (bypasses stored refresh tokens; token expires in ~1h) |
+| `-a`<br>`--account`<br>`--acct` | `string` |  | Account email for API commands (gmail/calendar/chat/classroom/drive/docs/slides/contacts/tasks/people/sheets/forms/appscript/ads) |
+| `--client` | `string` |  | OAuth client name (selects stored credentials + token bucket) |
+| `--color` | `string` | auto | Color output: auto\|always\|never |
+| `--disable-commands` | `string` |  | Comma-separated list of disabled commands; dot paths allowed |
+| `-n`<br>`--dry-run`<br>`--dryrun`<br>`--noop`<br>`--preview` | `bool` |  | Do not make changes; print intended actions and exit successfully |
+| `--enable-commands` | `string` |  | Comma-separated list of enabled commands; dot paths allowed (restricts CLI) |
+| `-y`<br>`--force`<br>`--assume-yes`<br>`--yes` | `bool` |  | Skip confirmations for destructive commands |
+| `--gmail-no-send` | `bool` | false | Block Gmail send operations (agent safety) |
+| `-h`<br>`--help` | `kong.helpFlag` |  | Show context-sensitive help. |
+| `-j`<br>`--json`<br>`--machine` | `bool` | false | Output JSON to stdout (best for scripting) |
+| `--no-input`<br>`--non-interactive`<br>`--noninteractive` | `bool` |  | Never prompt; fail instead (useful for CI) |
+| `-p`<br>`--plain`<br>`--tsv` | `bool` | false | Output stable, parseable text to stdout (TSV; no colors) |
+| `--results-only` | `bool` |  | In JSON mode, emit only the primary result (drops envelope fields like nextPageToken) |
+| `--select`<br>`--pick`<br>`--project` | `string` |  | In JSON mode, select comma-separated fields (best-effort; supports dot paths). Desire path: use --fields for most commands. |
+| `-v`<br>`--verbose` | `bool` |  | Enable verbose logging |
+| `--version` | `kong.VersionFlag` |  | Print version and exit |
+
+## See Also
+
+- [gog auth credentials](gog-auth-credentials.md)
+- [Command index](README.md)

docs/commands/gog-auth-credentials-set.md

@@ -0,0 +1,43 @@
+# `gog auth credentials set`
+
+> Generated from `gog schema --json`. Do not edit this page by hand; run `make docs-commands`.
+
+Store OAuth client credentials
+
+## Usage
+
+```bash
+gog auth credentials set <credentials> [flags]
+```
+
+## Parent
+
+- [gog auth credentials](gog-auth-credentials.md)
+
+## Flags
+
+| Flag | Type | Default | Help |
+| --- | --- | --- | --- |
+| `--access-token` | `string` |  | Use provided access token directly (bypasses stored refresh tokens; token expires in ~1h) |
+| `-a`<br>`--account`<br>`--acct` | `string` |  | Account email for API commands (gmail/calendar/chat/classroom/drive/docs/slides/contacts/tasks/people/sheets/forms/appscript/ads) |
+| `--client` | `string` |  | OAuth client name (selects stored credentials + token bucket) |
+| `--color` | `string` | auto | Color output: auto\|always\|never |
+| `--disable-commands` | `string` |  | Comma-separated list of disabled commands; dot paths allowed |
+| `--domain` | `string` |  | Comma-separated domains to map to this client (e.g. example.com) |
+| `-n`<br>`--dry-run`<br>`--dryrun`<br>`--noop`<br>`--preview` | `bool` |  | Do not make changes; print intended actions and exit successfully |
+| `--enable-commands` | `string` |  | Comma-separated list of enabled commands; dot paths allowed (restricts CLI) |
+| `-y`<br>`--force`<br>`--assume-yes`<br>`--yes` | `bool` |  | Skip confirmations for destructive commands |
+| `--gmail-no-send` | `bool` | false | Block Gmail send operations (agent safety) |
+| `-h`<br>`--help` | `kong.helpFlag` |  | Show context-sensitive help. |
+| `-j`<br>`--json`<br>`--machine` | `bool` | false | Output JSON to stdout (best for scripting) |
+| `--no-input`<br>`--non-interactive`<br>`--noninteractive` | `bool` |  | Never prompt; fail instead (useful for CI) |
+| `-p`<br>`--plain`<br>`--tsv` | `bool` | false | Output stable, parseable text to stdout (TSV; no colors) |
+| `--results-only` | `bool` |  | In JSON mode, emit only the primary result (drops envelope fields like nextPageToken) |
+| `--select`<br>`--pick`<br>`--project` | `string` |  | In JSON mode, select comma-separated fields (best-effort; supports dot paths). Desire path: use --fields for most commands. |
+| `-v`<br>`--verbose` | `bool` |  | Enable verbose logging |
+| `--version` | `kong.VersionFlag` |  | Print version and exit |
+
+## See Also
+
+- [gog auth credentials](gog-auth-credentials.md)
+- [Command index](README.md)

docs/commands/gog-auth-credentials.md

@@ -0,0 +1,48 @@
+# `gog auth credentials`
+
+> Generated from `gog schema --json`. Do not edit this page by hand; run `make docs-commands`.
+
+Manage OAuth client credentials
+
+## Usage
+
+```bash
+gog auth credentials <command>
+```
+
+## Parent
+
+- [gog auth](gog-auth.md)
+
+## Subcommands
+
+- [gog auth credentials list](gog-auth-credentials-list.md) - List stored OAuth client credentials
+- [gog auth credentials remove](gog-auth-credentials-remove.md) - Remove stored OAuth client credentials
+- [gog auth credentials set](gog-auth-credentials-set.md) - Store OAuth client credentials
+
+## Flags
+
+| Flag | Type | Default | Help |
+| --- | --- | --- | --- |
+| `--access-token` | `string` |  | Use provided access token directly (bypasses stored refresh tokens; token expires in ~1h) |
+| `-a`<br>`--account`<br>`--acct` | `string` |  | Account email for API commands (gmail/calendar/chat/classroom/drive/docs/slides/contacts/tasks/people/sheets/forms/appscript/ads) |
+| `--client` | `string` |  | OAuth client name (selects stored credentials + token bucket) |
+| `--color` | `string` | auto | Color output: auto\|always\|never |
+| `--disable-commands` | `string` |  | Comma-separated list of disabled commands; dot paths allowed |
+| `-n`<br>`--dry-run`<br>`--dryrun`<br>`--noop`<br>`--preview` | `bool` |  | Do not make changes; print intended actions and exit successfully |
+| `--enable-commands` | `string` |  | Comma-separated list of enabled commands; dot paths allowed (restricts CLI) |
+| `-y`<br>`--force`<br>`--assume-yes`<br>`--yes` | `bool` |  | Skip confirmations for destructive commands |
+| `--gmail-no-send` | `bool` | false | Block Gmail send operations (agent safety) |
+| `-h`<br>`--help` | `kong.helpFlag` |  | Show context-sensitive help. |
+| `-j`<br>`--json`<br>`--machine` | `bool` | false | Output JSON to stdout (best for scripting) |
+| `--no-input`<br>`--non-interactive`<br>`--noninteractive` | `bool` |  | Never prompt; fail instead (useful for CI) |
+| `-p`<br>`--plain`<br>`--tsv` | `bool` | false | Output stable, parseable text to stdout (TSV; no colors) |
+| `--results-only` | `bool` |  | In JSON mode, emit only the primary result (drops envelope fields like nextPageToken) |
+| `--select`<br>`--pick`<br>`--project` | `string` |  | In JSON mode, select comma-separated fields (best-effort; supports dot paths). Desire path: use --fields for most commands. |
+| `-v`<br>`--verbose` | `bool` |  | Enable verbose logging |
+| `--version` | `kong.VersionFlag` |  | Print version and exit |
+
+## See Also
+
+- [gog auth](gog-auth.md)
+- [Command index](README.md)

docs/commands/gog-auth-doctor.md

@@ -0,0 +1,44 @@
+# `gog auth doctor`
+
+> Generated from `gog schema --json`. Do not edit this page by hand; run `make docs-commands`.
+
+Diagnose auth, keyring, and refresh-token issues
+
+## Usage
+
+```bash
+gog auth doctor [flags]
+```
+
+## Parent
+
+- [gog auth](gog-auth.md)
+
+## Flags
+
+| Flag | Type | Default | Help |
+| --- | --- | --- | --- |
+| `--access-token` | `string` |  | Use provided access token directly (bypasses stored refresh tokens; token expires in ~1h) |
+| `-a`<br>`--account`<br>`--acct` | `string` |  | Account email for API commands (gmail/calendar/chat/classroom/drive/docs/slides/contacts/tasks/people/sheets/forms/appscript/ads) |
+| `--check` | `bool` |  | Verify refresh tokens by exchanging for access tokens |
+| `--client` | `string` |  | OAuth client name (selects stored credentials + token bucket) |
+| `--color` | `string` | auto | Color output: auto\|always\|never |
+| `--disable-commands` | `string` |  | Comma-separated list of disabled commands; dot paths allowed |
+| `-n`<br>`--dry-run`<br>`--dryrun`<br>`--noop`<br>`--preview` | `bool` |  | Do not make changes; print intended actions and exit successfully |
+| `--enable-commands` | `string` |  | Comma-separated list of enabled commands; dot paths allowed (restricts CLI) |
+| `-y`<br>`--force`<br>`--assume-yes`<br>`--yes` | `bool` |  | Skip confirmations for destructive commands |
+| `--gmail-no-send` | `bool` | false | Block Gmail send operations (agent safety) |
+| `-h`<br>`--help` | `kong.helpFlag` |  | Show context-sensitive help. |
+| `-j`<br>`--json`<br>`--machine` | `bool` | false | Output JSON to stdout (best for scripting) |
+| `--no-input`<br>`--non-interactive`<br>`--noninteractive` | `bool` |  | Never prompt; fail instead (useful for CI) |
+| `-p`<br>`--plain`<br>`--tsv` | `bool` | false | Output stable, parseable text to stdout (TSV; no colors) |
+| `--results-only` | `bool` |  | In JSON mode, emit only the primary result (drops envelope fields like nextPageToken) |
+| `--select`<br>`--pick`<br>`--project` | `string` |  | In JSON mode, select comma-separated fields (best-effort; supports dot paths). Desire path: use --fields for most commands. |
+| `--timeout` | `time.Duration` | 15s | Per-token check timeout |
+| `-v`<br>`--verbose` | `bool` |  | Enable verbose logging |
+| `--version` | `kong.VersionFlag` |  | Print version and exit |
+
+## See Also
+
+- [gog auth](gog-auth.md)
+- [Command index](README.md)

docs/commands/gog-auth-keep.md

@@ -0,0 +1,43 @@
+# `gog auth keep`
+
+> Generated from `gog schema --json`. Do not edit this page by hand; run `make docs-commands`.
+
+Configure service account for Google Keep (Workspace only)
+
+## Usage
+
+```bash
+gog auth keep --key=STRING <email>
+```
+
+## Parent
+
+- [gog auth](gog-auth.md)
+
+## Flags
+
+| Flag | Type | Default | Help |
+| --- | --- | --- | --- |
+| `--access-token` | `string` |  | Use provided access token directly (bypasses stored refresh tokens; token expires in ~1h) |
+| `-a`<br>`--account`<br>`--acct` | `string` |  | Account email for API commands (gmail/calendar/chat/classroom/drive/docs/slides/contacts/tasks/people/sheets/forms/appscript/ads) |
+| `--client` | `string` |  | OAuth client name (selects stored credentials + token bucket) |
+| `--color` | `string` | auto | Color output: auto\|always\|never |
+| `--disable-commands` | `string` |  | Comma-separated list of disabled commands; dot paths allowed |
+| `-n`<br>`--dry-run`<br>`--dryrun`<br>`--noop`<br>`--preview` | `bool` |  | Do not make changes; print intended actions and exit successfully |
+| `--enable-commands` | `string` |  | Comma-separated list of enabled commands; dot paths allowed (restricts CLI) |
+| `-y`<br>`--force`<br>`--assume-yes`<br>`--yes` | `bool` |  | Skip confirmations for destructive commands |
+| `--gmail-no-send` | `bool` | false | Block Gmail send operations (agent safety) |
+| `-h`<br>`--help` | `kong.helpFlag` |  | Show context-sensitive help. |
+| `-j`<br>`--json`<br>`--machine` | `bool` | false | Output JSON to stdout (best for scripting) |
+| `--key` | `string` |  | Path to service account JSON key file |
+| `--no-input`<br>`--non-interactive`<br>`--noninteractive` | `bool` |  | Never prompt; fail instead (useful for CI) |
+| `-p`<br>`--plain`<br>`--tsv` | `bool` | false | Output stable, parseable text to stdout (TSV; no colors) |
+| `--results-only` | `bool` |  | In JSON mode, emit only the primary result (drops envelope fields like nextPageToken) |
+| `--select`<br>`--pick`<br>`--project` | `string` |  | In JSON mode, select comma-separated fields (best-effort; supports dot paths). Desire path: use --fields for most commands. |
+| `-v`<br>`--verbose` | `bool` |  | Enable verbose logging |
+| `--version` | `kong.VersionFlag` |  | Print version and exit |
+
+## See Also
+
+- [gog auth](gog-auth.md)
+- [Command index](README.md)

docs/commands/gog-auth-keyring.md

@@ -0,0 +1,42 @@
+# `gog auth keyring`
+
+> Generated from `gog schema --json`. Do not edit this page by hand; run `make docs-commands`.
+
+Configure keyring backend
+
+## Usage
+
+```bash
+gog auth keyring [<backend> [<backend2>]]
+```
+
+## Parent
+
+- [gog auth](gog-auth.md)
+
+## Flags
+
+| Flag | Type | Default | Help |
+| --- | --- | --- | --- |
+| `--access-token` | `string` |  | Use provided access token directly (bypasses stored refresh tokens; token expires in ~1h) |
+| `-a`<br>`--account`<br>`--acct` | `string` |  | Account email for API commands (gmail/calendar/chat/classroom/drive/docs/slides/contacts/tasks/people/sheets/forms/appscript/ads) |
+| `--client` | `string` |  | OAuth client name (selects stored credentials + token bucket) |
+| `--color` | `string` | auto | Color output: auto\|always\|never |
+| `--disable-commands` | `string` |  | Comma-separated list of disabled commands; dot paths allowed |
+| `-n`<br>`--dry-run`<br>`--dryrun`<br>`--noop`<br>`--preview` | `bool` |  | Do not make changes; print intended actions and exit successfully |
+| `--enable-commands` | `string` |  | Comma-separated list of enabled commands; dot paths allowed (restricts CLI) |
+| `-y`<br>`--force`<br>`--assume-yes`<br>`--yes` | `bool` |  | Skip confirmations for destructive commands |
+| `--gmail-no-send` | `bool` | false | Block Gmail send operations (agent safety) |
+| `-h`<br>`--help` | `kong.helpFlag` |  | Show context-sensitive help. |
+| `-j`<br>`--json`<br>`--machine` | `bool` | false | Output JSON to stdout (best for scripting) |
+| `--no-input`<br>`--non-interactive`<br>`--noninteractive` | `bool` |  | Never prompt; fail instead (useful for CI) |
+| `-p`<br>`--plain`<br>`--tsv` | `bool` | false | Output stable, parseable text to stdout (TSV; no colors) |
+| `--results-only` | `bool` |  | In JSON mode, emit only the primary result (drops envelope fields like nextPageToken) |
+| `--select`<br>`--pick`<br>`--project` | `string` |  | In JSON mode, select comma-separated fields (best-effort; supports dot paths). Desire path: use --fields for most commands. |
+| `-v`<br>`--verbose` | `bool` |  | Enable verbose logging |
+| `--version` | `kong.VersionFlag` |  | Print version and exit |
+
+## See Also
+
+- [gog auth](gog-auth.md)
+- [Command index](README.md)

docs/commands/gog-auth-list.md

@@ -0,0 +1,44 @@
+# `gog auth list`
+
+> Generated from `gog schema --json`. Do not edit this page by hand; run `make docs-commands`.
+
+List stored accounts
+
+## Usage
+
+```bash
+gog auth list [flags]
+```
+
+## Parent
+
+- [gog auth](gog-auth.md)
+
+## Flags
+
+| Flag | Type | Default | Help |
+| --- | --- | --- | --- |
+| `--access-token` | `string` |  | Use provided access token directly (bypasses stored refresh tokens; token expires in ~1h) |
+| `-a`<br>`--account`<br>`--acct` | `string` |  | Account email for API commands (gmail/calendar/chat/classroom/drive/docs/slides/contacts/tasks/people/sheets/forms/appscript/ads) |
+| `--check` | `bool` |  | Verify refresh tokens by exchanging for an access token (requires credentials.json) |
+| `--client` | `string` |  | OAuth client name (selects stored credentials + token bucket) |
+| `--color` | `string` | auto | Color output: auto\|always\|never |
+| `--disable-commands` | `string` |  | Comma-separated list of disabled commands; dot paths allowed |
+| `-n`<br>`--dry-run`<br>`--dryrun`<br>`--noop`<br>`--preview` | `bool` |  | Do not make changes; print intended actions and exit successfully |
+| `--enable-commands` | `string` |  | Comma-separated list of enabled commands; dot paths allowed (restricts CLI) |
+| `-y`<br>`--force`<br>`--assume-yes`<br>`--yes` | `bool` |  | Skip confirmations for destructive commands |
+| `--gmail-no-send` | `bool` | false | Block Gmail send operations (agent safety) |
+| `-h`<br>`--help` | `kong.helpFlag` |  | Show context-sensitive help. |
+| `-j`<br>`--json`<br>`--machine` | `bool` | false | Output JSON to stdout (best for scripting) |
+| `--no-input`<br>`--non-interactive`<br>`--noninteractive` | `bool` |  | Never prompt; fail instead (useful for CI) |
+| `-p`<br>`--plain`<br>`--tsv` | `bool` | false | Output stable, parseable text to stdout (TSV; no colors) |
+| `--results-only` | `bool` |  | In JSON mode, emit only the primary result (drops envelope fields like nextPageToken) |
+| `--select`<br>`--pick`<br>`--project` | `string` |  | In JSON mode, select comma-separated fields (best-effort; supports dot paths). Desire path: use --fields for most commands. |
+| `--timeout` | `time.Duration` | 15s | Per-token check timeout |
+| `-v`<br>`--verbose` | `bool` |  | Enable verbose logging |
+| `--version` | `kong.VersionFlag` |  | Print version and exit |
+
+## See Also
+
+- [gog auth](gog-auth.md)
+- [Command index](README.md)

docs/commands/gog-auth-manage.md

@@ -0,0 +1,47 @@
+# `gog auth manage`
+
+> Generated from `gog schema --json`. Do not edit this page by hand; run `make docs-commands`.
+
+Open accounts manager in browser
+
+## Usage
+
+```bash
+gog auth manage (login) [flags]
+```
+
+## Parent
+
+- [gog auth](gog-auth.md)
+
+## Flags
+
+| Flag | Type | Default | Help |
+| --- | --- | --- | --- |
+| `--access-token` | `string` |  | Use provided access token directly (bypasses stored refresh tokens; token expires in ~1h) |
+| `-a`<br>`--account`<br>`--acct` | `string` |  | Account email for API commands (gmail/calendar/chat/classroom/drive/docs/slides/contacts/tasks/people/sheets/forms/appscript/ads) |
+| `--client` | `string` |  | OAuth client name (selects stored credentials + token bucket) |
+| `--color` | `string` | auto | Color output: auto\|always\|never |
+| `--disable-commands` | `string` |  | Comma-separated list of disabled commands; dot paths allowed |
+| `-n`<br>`--dry-run`<br>`--dryrun`<br>`--noop`<br>`--preview` | `bool` |  | Do not make changes; print intended actions and exit successfully |
+| `--enable-commands` | `string` |  | Comma-separated list of enabled commands; dot paths allowed (restricts CLI) |
+| `-y`<br>`--force`<br>`--assume-yes`<br>`--yes` | `bool` |  | Skip confirmations for destructive commands |
+| `--force-consent` | `bool` |  | Force consent screen when adding accounts |
+| `--gmail-no-send` | `bool` | false | Block Gmail send operations (agent safety) |
+| `-h`<br>`--help` | `kong.helpFlag` |  | Show context-sensitive help. |
+| `-j`<br>`--json`<br>`--machine` | `bool` | false | Output JSON to stdout (best for scripting) |
+| `--listen-addr` | `string` |  | Address to listen on for OAuth callback (for example 0.0.0.0 or 0.0.0.0:8080) |
+| `--no-input`<br>`--non-interactive`<br>`--noninteractive` | `bool` |  | Never prompt; fail instead (useful for CI) |
+| `-p`<br>`--plain`<br>`--tsv` | `bool` | false | Output stable, parseable text to stdout (TSV; no colors) |
+| `--redirect-host` | `string` |  | Hostname for OAuth callback; builds https://{host}/oauth2/callback |
+| `--results-only` | `bool` |  | In JSON mode, emit only the primary result (drops envelope fields like nextPageToken) |
+| `--select`<br>`--pick`<br>`--project` | `string` |  | In JSON mode, select comma-separated fields (best-effort; supports dot paths). Desire path: use --fields for most commands. |
+| `--services` | `string` | user | Services to authorize: user\|all or comma-separated gmail,calendar,chat,classroom,drive,docs,slides,contacts,tasks,sheets,people,forms,appscript,ads (Keep uses service account: gog auth service-account set) |
+| `--timeout` | `time.Duration` | 10m | Server timeout duration |
+| `-v`<br>`--verbose` | `bool` |  | Enable verbose logging |
+| `--version` | `kong.VersionFlag` |  | Print version and exit |
+
+## See Also
+
+- [gog auth](gog-auth.md)
+- [Command index](README.md)

docs/commands/gog-auth-remove.md

@@ -0,0 +1,42 @@
+# `gog auth remove`
+
+> Generated from `gog schema --json`. Do not edit this page by hand; run `make docs-commands`.
+
+Remove a stored refresh token
+
+## Usage
+
+```bash
+gog auth remove <email>
+```
+
+## Parent
+
+- [gog auth](gog-auth.md)
+
+## Flags
+
+| Flag | Type | Default | Help |
+| --- | --- | --- | --- |
+| `--access-token` | `string` |  | Use provided access token directly (bypasses stored refresh tokens; token expires in ~1h) |
+| `-a`<br>`--account`<br>`--acct` | `string` |  | Account email for API commands (gmail/calendar/chat/classroom/drive/docs/slides/contacts/tasks/people/sheets/forms/appscript/ads) |
+| `--client` | `string` |  | OAuth client name (selects stored credentials + token bucket) |
+| `--color` | `string` | auto | Color output: auto\|always\|never |
+| `--disable-commands` | `string` |  | Comma-separated list of disabled commands; dot paths allowed |
+| `-n`<br>`--dry-run`<br>`--dryrun`<br>`--noop`<br>`--preview` | `bool` |  | Do not make changes; print intended actions and exit successfully |
+| `--enable-commands` | `string` |  | Comma-separated list of enabled commands; dot paths allowed (restricts CLI) |
+| `-y`<br>`--force`<br>`--assume-yes`<br>`--yes` | `bool` |  | Skip confirmations for destructive commands |
+| `--gmail-no-send` | `bool` | false | Block Gmail send operations (agent safety) |
+| `-h`<br>`--help` | `kong.helpFlag` |  | Show context-sensitive help. |
+| `-j`<br>`--json`<br>`--machine` | `bool` | false | Output JSON to stdout (best for scripting) |
+| `--no-input`<br>`--non-interactive`<br>`--noninteractive` | `bool` |  | Never prompt; fail instead (useful for CI) |
+| `-p`<br>`--plain`<br>`--tsv` | `bool` | false | Output stable, parseable text to stdout (TSV; no colors) |
+| `--results-only` | `bool` |  | In JSON mode, emit only the primary result (drops envelope fields like nextPageToken) |
+| `--select`<br>`--pick`<br>`--project` | `string` |  | In JSON mode, select comma-separated fields (best-effort; supports dot paths). Desire path: use --fields for most commands. |
+| `-v`<br>`--verbose` | `bool` |  | Enable verbose logging |
+| `--version` | `kong.VersionFlag` |  | Print version and exit |
+
+## See Also
+
+- [gog auth](gog-auth.md)
+- [Command index](README.md)

docs/commands/gog-auth-service-account-set.md

@@ -0,0 +1,43 @@
+# `gog auth service-account set`
+
+> Generated from `gog schema --json`. Do not edit this page by hand; run `make docs-commands`.
+
+Store a service account key for impersonation
+
+## Usage
+
+```bash
+gog auth service-account set --key=STRING <email>
+```
+
+## Parent
+
+- [gog auth service-account](gog-auth-service-account.md)
+
+## Flags
+
+| Flag | Type | Default | Help |
+| --- | --- | --- | --- |
+| `--access-token` | `string` |  | Use provided access token directly (bypasses stored refresh tokens; token expires in ~1h) |
+| `-a`<br>`--account`<br>`--acct` | `string` |  | Account email for API commands (gmail/calendar/chat/classroom/drive/docs/slides/contacts/tasks/people/sheets/forms/appscript/ads) |
+| `--client` | `string` |  | OAuth client name (selects stored credentials + token bucket) |
+| `--color` | `string` | auto | Color output: auto\|always\|never |
+| `--disable-commands` | `string` |  | Comma-separated list of disabled commands; dot paths allowed |
+| `-n`<br>`--dry-run`<br>`--dryrun`<br>`--noop`<br>`--preview` | `bool` |  | Do not make changes; print intended actions and exit successfully |
+| `--enable-commands` | `string` |  | Comma-separated list of enabled commands; dot paths allowed (restricts CLI) |
+| `-y`<br>`--force`<br>`--assume-yes`<br>`--yes` | `bool` |  | Skip confirmations for destructive commands |
+| `--gmail-no-send` | `bool` | false | Block Gmail send operations (agent safety) |
+| `-h`<br>`--help` | `kong.helpFlag` |  | Show context-sensitive help. |
+| `-j`<br>`--json`<br>`--machine` | `bool` | false | Output JSON to stdout (best for scripting) |
+| `--key` | `string` |  | Path to service account JSON key file |
+| `--no-input`<br>`--non-interactive`<br>`--noninteractive` | `bool` |  | Never prompt; fail instead (useful for CI) |
+| `-p`<br>`--plain`<br>`--tsv` | `bool` | false | Output stable, parseable text to stdout (TSV; no colors) |
+| `--results-only` | `bool` |  | In JSON mode, emit only the primary result (drops envelope fields like nextPageToken) |
+| `--select`<br>`--pick`<br>`--project` | `string` |  | In JSON mode, select comma-separated fields (best-effort; supports dot paths). Desire path: use --fields for most commands. |
+| `-v`<br>`--verbose` | `bool` |  | Enable verbose logging |
+| `--version` | `kong.VersionFlag` |  | Print version and exit |
+
+## See Also
+
+- [gog auth service-account](gog-auth-service-account.md)
+- [Command index](README.md)

docs/commands/gog-auth-service-account-status.md

@@ -0,0 +1,42 @@
+# `gog auth service-account status`
+
+> Generated from `gog schema --json`. Do not edit this page by hand; run `make docs-commands`.
+
+Show stored service account key status
+
+## Usage
+
+```bash
+gog auth service-account status <email>
+```
+
+## Parent
+
+- [gog auth service-account](gog-auth-service-account.md)
+
+## Flags
+
+| Flag | Type | Default | Help |
+| --- | --- | --- | --- |
+| `--access-token` | `string` |  | Use provided access token directly (bypasses stored refresh tokens; token expires in ~1h) |
+| `-a`<br>`--account`<br>`--acct` | `string` |  | Account email for API commands (gmail/calendar/chat/classroom/drive/docs/slides/contacts/tasks/people/sheets/forms/appscript/ads) |
+| `--client` | `string` |  | OAuth client name (selects stored credentials + token bucket) |
+| `--color` | `string` | auto | Color output: auto\|always\|never |
+| `--disable-commands` | `string` |  | Comma-separated list of disabled commands; dot paths allowed |
+| `-n`<br>`--dry-run`<br>`--dryrun`<br>`--noop`<br>`--preview` | `bool` |  | Do not make changes; print intended actions and exit successfully |
+| `--enable-commands` | `string` |  | Comma-separated list of enabled commands; dot paths allowed (restricts CLI) |
+| `-y`<br>`--force`<br>`--assume-yes`<br>`--yes` | `bool` |  | Skip confirmations for destructive commands |
+| `--gmail-no-send` | `bool` | false | Block Gmail send operations (agent safety) |
+| `-h`<br>`--help` | `kong.helpFlag` |  | Show context-sensitive help. |
+| `-j`<br>`--json`<br>`--machine` | `bool` | false | Output JSON to stdout (best for scripting) |
+| `--no-input`<br>`--non-interactive`<br>`--noninteractive` | `bool` |  | Never prompt; fail instead (useful for CI) |
+| `-p`<br>`--plain`<br>`--tsv` | `bool` | false | Output stable, parseable text to stdout (TSV; no colors) |
+| `--results-only` | `bool` |  | In JSON mode, emit only the primary result (drops envelope fields like nextPageToken) |
+| `--select`<br>`--pick`<br>`--project` | `string` |  | In JSON mode, select comma-separated fields (best-effort; supports dot paths). Desire path: use --fields for most commands. |
+| `-v`<br>`--verbose` | `bool` |  | Enable verbose logging |
+| `--version` | `kong.VersionFlag` |  | Print version and exit |
+
+## See Also
+
+- [gog auth service-account](gog-auth-service-account.md)
+- [Command index](README.md)

docs/commands/gog-auth-service-account-unset.md

@@ -0,0 +1,42 @@
+# `gog auth service-account unset`
+
+> Generated from `gog schema --json`. Do not edit this page by hand; run `make docs-commands`.
+
+Remove stored service account key
+
+## Usage
+
+```bash
+gog auth service-account unset <email>
+```
+
+## Parent
+
+- [gog auth service-account](gog-auth-service-account.md)
+
+## Flags
+
+| Flag | Type | Default | Help |
+| --- | --- | --- | --- |
+| `--access-token` | `string` |  | Use provided access token directly (bypasses stored refresh tokens; token expires in ~1h) |
+| `-a`<br>`--account`<br>`--acct` | `string` |  | Account email for API commands (gmail/calendar/chat/classroom/drive/docs/slides/contacts/tasks/people/sheets/forms/appscript/ads) |
+| `--client` | `string` |  | OAuth client name (selects stored credentials + token bucket) |
+| `--color` | `string` | auto | Color output: auto\|always\|never |
+| `--disable-commands` | `string` |  | Comma-separated list of disabled commands; dot paths allowed |
+| `-n`<br>`--dry-run`<br>`--dryrun`<br>`--noop`<br>`--preview` | `bool` |  | Do not make changes; print intended actions and exit successfully |
+| `--enable-commands` | `string` |  | Comma-separated list of enabled commands; dot paths allowed (restricts CLI) |
+| `-y`<br>`--force`<br>`--assume-yes`<br>`--yes` | `bool` |  | Skip confirmations for destructive commands |
+| `--gmail-no-send` | `bool` | false | Block Gmail send operations (agent safety) |
+| `-h`<br>`--help` | `kong.helpFlag` |  | Show context-sensitive help. |
+| `-j`<br>`--json`<br>`--machine` | `bool` | false | Output JSON to stdout (best for scripting) |
+| `--no-input`<br>`--non-interactive`<br>`--noninteractive` | `bool` |  | Never prompt; fail instead (useful for CI) |
+| `-p`<br>`--plain`<br>`--tsv` | `bool` | false | Output stable, parseable text to stdout (TSV; no colors) |
+| `--results-only` | `bool` |  | In JSON mode, emit only the primary result (drops envelope fields like nextPageToken) |
+| `--select`<br>`--pick`<br>`--project` | `string` |  | In JSON mode, select comma-separated fields (best-effort; supports dot paths). Desire path: use --fields for most commands. |
+| `-v`<br>`--verbose` | `bool` |  | Enable verbose logging |
+| `--version` | `kong.VersionFlag` |  | Print version and exit |
+
+## See Also
+
+- [gog auth service-account](gog-auth-service-account.md)
+- [Command index](README.md)

docs/commands/gog-auth-service-account.md

@@ -0,0 +1,48 @@
+# `gog auth service-account`
+
+> Generated from `gog schema --json`. Do not edit this page by hand; run `make docs-commands`.
+
+Configure service account (Workspace only; domain-wide delegation)
+
+## Usage
+
+```bash
+gog auth service-account <command>
+```
+
+## Parent
+
+- [gog auth](gog-auth.md)
+
+## Subcommands
+
+- [gog auth service-account set](gog-auth-service-account-set.md) - Store a service account key for impersonation
+- [gog auth service-account status](gog-auth-service-account-status.md) - Show stored service account key status
+- [gog auth service-account unset](gog-auth-service-account-unset.md) - Remove stored service account key
+
+## Flags
+
+| Flag | Type | Default | Help |
+| --- | --- | --- | --- |
+| `--access-token` | `string` |  | Use provided access token directly (bypasses stored refresh tokens; token expires in ~1h) |
+| `-a`<br>`--account`<br>`--acct` | `string` |  | Account email for API commands (gmail/calendar/chat/classroom/drive/docs/slides/contacts/tasks/people/sheets/forms/appscript/ads) |
+| `--client` | `string` |  | OAuth client name (selects stored credentials + token bucket) |
+| `--color` | `string` | auto | Color output: auto\|always\|never |
+| `--disable-commands` | `string` |  | Comma-separated list of disabled commands; dot paths allowed |
+| `-n`<br>`--dry-run`<br>`--dryrun`<br>`--noop`<br>`--preview` | `bool` |  | Do not make changes; print intended actions and exit successfully |
+| `--enable-commands` | `string` |  | Comma-separated list of enabled commands; dot paths allowed (restricts CLI) |
+| `-y`<br>`--force`<br>`--assume-yes`<br>`--yes` | `bool` |  | Skip confirmations for destructive commands |
+| `--gmail-no-send` | `bool` | false | Block Gmail send operations (agent safety) |
+| `-h`<br>`--help` | `kong.helpFlag` |  | Show context-sensitive help. |
+| `-j`<br>`--json`<br>`--machine` | `bool` | false | Output JSON to stdout (best for scripting) |
+| `--no-input`<br>`--non-interactive`<br>`--noninteractive` | `bool` |  | Never prompt; fail instead (useful for CI) |
+| `-p`<br>`--plain`<br>`--tsv` | `bool` | false | Output stable, parseable text to stdout (TSV; no colors) |
+| `--results-only` | `bool` |  | In JSON mode, emit only the primary result (drops envelope fields like nextPageToken) |
+| `--select`<br>`--pick`<br>`--project` | `string` |  | In JSON mode, select comma-separated fields (best-effort; supports dot paths). Desire path: use --fields for most commands. |
+| `-v`<br>`--verbose` | `bool` |  | Enable verbose logging |
+| `--version` | `kong.VersionFlag` |  | Print version and exit |
+
+## See Also
+
+- [gog auth](gog-auth.md)
+- [Command index](README.md)

docs/commands/gog-auth-services.md

@@ -0,0 +1,43 @@
+# `gog auth services`
+
+> Generated from `gog schema --json`. Do not edit this page by hand; run `make docs-commands`.
+
+List supported auth services and scopes
+
+## Usage
+
+```bash
+gog auth services [flags]
+```
+
+## Parent
+
+- [gog auth](gog-auth.md)
+
+## Flags
+
+| Flag | Type | Default | Help |
+| --- | --- | --- | --- |
+| `--access-token` | `string` |  | Use provided access token directly (bypasses stored refresh tokens; token expires in ~1h) |
+| `-a`<br>`--account`<br>`--acct` | `string` |  | Account email for API commands (gmail/calendar/chat/classroom/drive/docs/slides/contacts/tasks/people/sheets/forms/appscript/ads) |
+| `--client` | `string` |  | OAuth client name (selects stored credentials + token bucket) |
+| `--color` | `string` | auto | Color output: auto\|always\|never |
+| `--disable-commands` | `string` |  | Comma-separated list of disabled commands; dot paths allowed |
+| `-n`<br>`--dry-run`<br>`--dryrun`<br>`--noop`<br>`--preview` | `bool` |  | Do not make changes; print intended actions and exit successfully |
+| `--enable-commands` | `string` |  | Comma-separated list of enabled commands; dot paths allowed (restricts CLI) |
+| `-y`<br>`--force`<br>`--assume-yes`<br>`--yes` | `bool` |  | Skip confirmations for destructive commands |
+| `--gmail-no-send` | `bool` | false | Block Gmail send operations (agent safety) |
+| `-h`<br>`--help` | `kong.helpFlag` |  | Show context-sensitive help. |
+| `-j`<br>`--json`<br>`--machine` | `bool` | false | Output JSON to stdout (best for scripting) |
+| `--markdown` | `bool` |  | Output Markdown table |
+| `--no-input`<br>`--non-interactive`<br>`--noninteractive` | `bool` |  | Never prompt; fail instead (useful for CI) |
+| `-p`<br>`--plain`<br>`--tsv` | `bool` | false | Output stable, parseable text to stdout (TSV; no colors) |
+| `--results-only` | `bool` |  | In JSON mode, emit only the primary result (drops envelope fields like nextPageToken) |
+| `--select`<br>`--pick`<br>`--project` | `string` |  | In JSON mode, select comma-separated fields (best-effort; supports dot paths). Desire path: use --fields for most commands. |
+| `-v`<br>`--verbose` | `bool` |  | Enable verbose logging |
+| `--version` | `kong.VersionFlag` |  | Print version and exit |
+
+## See Also
+
+- [gog auth](gog-auth.md)
+- [Command index](README.md)

docs/commands/gog-auth-status.md

@@ -0,0 +1,42 @@
+# `gog auth status`
+
+> Generated from `gog schema --json`. Do not edit this page by hand; run `make docs-commands`.
+
+Show auth configuration and keyring backend
+
+## Usage
+
+```bash
+gog auth status
+```
+
+## Parent
+
+- [gog auth](gog-auth.md)
+
+## Flags
+
+| Flag | Type | Default | Help |
+| --- | --- | --- | --- |
+| `--access-token` | `string` |  | Use provided access token directly (bypasses stored refresh tokens; token expires in ~1h) |
+| `-a`<br>`--account`<br>`--acct` | `string` |  | Account email for API commands (gmail/calendar/chat/classroom/drive/docs/slides/contacts/tasks/people/sheets/forms/appscript/ads) |
+| `--client` | `string` |  | OAuth client name (selects stored credentials + token bucket) |
+| `--color` | `string` | auto | Color output: auto\|always\|never |
+| `--disable-commands` | `string` |  | Comma-separated list of disabled commands; dot paths allowed |
+| `-n`<br>`--dry-run`<br>`--dryrun`<br>`--noop`<br>`--preview` | `bool` |  | Do not make changes; print intended actions and exit successfully |
+| `--enable-commands` | `string` |  | Comma-separated list of enabled commands; dot paths allowed (restricts CLI) |
+| `-y`<br>`--force`<br>`--assume-yes`<br>`--yes` | `bool` |  | Skip confirmations for destructive commands |
+| `--gmail-no-send` | `bool` | false | Block Gmail send operations (agent safety) |
+| `-h`<br>`--help` | `kong.helpFlag` |  | Show context-sensitive help. |
+| `-j`<br>`--json`<br>`--machine` | `bool` | false | Output JSON to stdout (best for scripting) |
+| `--no-input`<br>`--non-interactive`<br>`--noninteractive` | `bool` |  | Never prompt; fail instead (useful for CI) |
+| `-p`<br>`--plain`<br>`--tsv` | `bool` | false | Output stable, parseable text to stdout (TSV; no colors) |
+| `--results-only` | `bool` |  | In JSON mode, emit only the primary result (drops envelope fields like nextPageToken) |
+| `--select`<br>`--pick`<br>`--project` | `string` |  | In JSON mode, select comma-separated fields (best-effort; supports dot paths). Desire path: use --fields for most commands. |
+| `-v`<br>`--verbose` | `bool` |  | Enable verbose logging |
+| `--version` | `kong.VersionFlag` |  | Print version and exit |
+
+## See Also
+
+- [gog auth](gog-auth.md)
+- [Command index](README.md)

docs/commands/gog-auth-tokens-delete.md

@@ -0,0 +1,42 @@
+# `gog auth tokens delete`
+
+> Generated from `gog schema --json`. Do not edit this page by hand; run `make docs-commands`.
+
+Delete a stored refresh token
+
+## Usage
+
+```bash
+gog auth tokens delete <email>
+```
+
+## Parent
+
+- [gog auth tokens](gog-auth-tokens.md)
+
+## Flags
+
+| Flag | Type | Default | Help |
+| --- | --- | --- | --- |
+| `--access-token` | `string` |  | Use provided access token directly (bypasses stored refresh tokens; token expires in ~1h) |
+| `-a`<br>`--account`<br>`--acct` | `string` |  | Account email for API commands (gmail/calendar/chat/classroom/drive/docs/slides/contacts/tasks/people/sheets/forms/appscript/ads) |
+| `--client` | `string` |  | OAuth client name (selects stored credentials + token bucket) |
+| `--color` | `string` | auto | Color output: auto\|always\|never |
+| `--disable-commands` | `string` |  | Comma-separated list of disabled commands; dot paths allowed |
+| `-n`<br>`--dry-run`<br>`--dryrun`<br>`--noop`<br>`--preview` | `bool` |  | Do not make changes; print intended actions and exit successfully |
+| `--enable-commands` | `string` |  | Comma-separated list of enabled commands; dot paths allowed (restricts CLI) |
+| `-y`<br>`--force`<br>`--assume-yes`<br>`--yes` | `bool` |  | Skip confirmations for destructive commands |
+| `--gmail-no-send` | `bool` | false | Block Gmail send operations (agent safety) |
+| `-h`<br>`--help` | `kong.helpFlag` |  | Show context-sensitive help. |
+| `-j`<br>`--json`<br>`--machine` | `bool` | false | Output JSON to stdout (best for scripting) |
+| `--no-input`<br>`--non-interactive`<br>`--noninteractive` | `bool` |  | Never prompt; fail instead (useful for CI) |
+| `-p`<br>`--plain`<br>`--tsv` | `bool` | false | Output stable, parseable text to stdout (TSV; no colors) |
+| `--results-only` | `bool` |  | In JSON mode, emit only the primary result (drops envelope fields like nextPageToken) |
+| `--select`<br>`--pick`<br>`--project` | `string` |  | In JSON mode, select comma-separated fields (best-effort; supports dot paths). Desire path: use --fields for most commands. |
+| `-v`<br>`--verbose` | `bool` |  | Enable verbose logging |
+| `--version` | `kong.VersionFlag` |  | Print version and exit |
+
+## See Also
+
+- [gog auth tokens](gog-auth-tokens.md)
+- [Command index](README.md)

docs/commands/gog-auth-tokens-export.md

@@ -0,0 +1,44 @@
+# `gog auth tokens export`
+
+> Generated from `gog schema --json`. Do not edit this page by hand; run `make docs-commands`.
+
+Export a refresh token to a file (contains secrets)
+
+## Usage
+
+```bash
+gog auth tokens export <email> [flags]
+```
+
+## Parent
+
+- [gog auth tokens](gog-auth-tokens.md)
+
+## Flags
+
+| Flag | Type | Default | Help |
+| --- | --- | --- | --- |
+| `--access-token` | `string` |  | Use provided access token directly (bypasses stored refresh tokens; token expires in ~1h) |
+| `-a`<br>`--account`<br>`--acct` | `string` |  | Account email for API commands (gmail/calendar/chat/classroom/drive/docs/slides/contacts/tasks/people/sheets/forms/appscript/ads) |
+| `--client` | `string` |  | OAuth client name (selects stored credentials + token bucket) |
+| `--color` | `string` | auto | Color output: auto\|always\|never |
+| `--disable-commands` | `string` |  | Comma-separated list of disabled commands; dot paths allowed |
+| `-n`<br>`--dry-run`<br>`--dryrun`<br>`--noop`<br>`--preview` | `bool` |  | Do not make changes; print intended actions and exit successfully |
+| `--enable-commands` | `string` |  | Comma-separated list of enabled commands; dot paths allowed (restricts CLI) |
+| `-y`<br>`--force`<br>`--assume-yes`<br>`--yes` | `bool` |  | Skip confirmations for destructive commands |
+| `--gmail-no-send` | `bool` | false | Block Gmail send operations (agent safety) |
+| `-h`<br>`--help` | `kong.helpFlag` |  | Show context-sensitive help. |
+| `-j`<br>`--json`<br>`--machine` | `bool` | false | Output JSON to stdout (best for scripting) |
+| `--no-input`<br>`--non-interactive`<br>`--noninteractive` | `bool` |  | Never prompt; fail instead (useful for CI) |
+| `--out`<br>`--output` | `string` |  | Output file path (required) |
+| `--overwrite` | `bool` |  | Overwrite output file if it exists |
+| `-p`<br>`--plain`<br>`--tsv` | `bool` | false | Output stable, parseable text to stdout (TSV; no colors) |
+| `--results-only` | `bool` |  | In JSON mode, emit only the primary result (drops envelope fields like nextPageToken) |
+| `--select`<br>`--pick`<br>`--project` | `string` |  | In JSON mode, select comma-separated fields (best-effort; supports dot paths). Desire path: use --fields for most commands. |
+| `-v`<br>`--verbose` | `bool` |  | Enable verbose logging |
+| `--version` | `kong.VersionFlag` |  | Print version and exit |
+
+## See Also
+
+- [gog auth tokens](gog-auth-tokens.md)
+- [Command index](README.md)

docs/commands/gog-auth-tokens-import.md

@@ -0,0 +1,42 @@
+# `gog auth tokens import`
+
+> Generated from `gog schema --json`. Do not edit this page by hand; run `make docs-commands`.
+
+Import a refresh token file into keyring (contains secrets)
+
+## Usage
+
+```bash
+gog auth tokens import <inPath>
+```
+
+## Parent
+
+- [gog auth tokens](gog-auth-tokens.md)
+
+## Flags
+
+| Flag | Type | Default | Help |
+| --- | --- | --- | --- |
+| `--access-token` | `string` |  | Use provided access token directly (bypasses stored refresh tokens; token expires in ~1h) |
+| `-a`<br>`--account`<br>`--acct` | `string` |  | Account email for API commands (gmail/calendar/chat/classroom/drive/docs/slides/contacts/tasks/people/sheets/forms/appscript/ads) |
+| `--client` | `string` |  | OAuth client name (selects stored credentials + token bucket) |
+| `--color` | `string` | auto | Color output: auto\|always\|never |
+| `--disable-commands` | `string` |  | Comma-separated list of disabled commands; dot paths allowed |
+| `-n`<br>`--dry-run`<br>`--dryrun`<br>`--noop`<br>`--preview` | `bool` |  | Do not make changes; print intended actions and exit successfully |
+| `--enable-commands` | `string` |  | Comma-separated list of enabled commands; dot paths allowed (restricts CLI) |
+| `-y`<br>`--force`<br>`--assume-yes`<br>`--yes` | `bool` |  | Skip confirmations for destructive commands |
+| `--gmail-no-send` | `bool` | false | Block Gmail send operations (agent safety) |
+| `-h`<br>`--help` | `kong.helpFlag` |  | Show context-sensitive help. |
+| `-j`<br>`--json`<br>`--machine` | `bool` | false | Output JSON to stdout (best for scripting) |
+| `--no-input`<br>`--non-interactive`<br>`--noninteractive` | `bool` |  | Never prompt; fail instead (useful for CI) |
+| `-p`<br>`--plain`<br>`--tsv` | `bool` | false | Output stable, parseable text to stdout (TSV; no colors) |
+| `--results-only` | `bool` |  | In JSON mode, emit only the primary result (drops envelope fields like nextPageToken) |
+| `--select`<br>`--pick`<br>`--project` | `string` |  | In JSON mode, select comma-separated fields (best-effort; supports dot paths). Desire path: use --fields for most commands. |
+| `-v`<br>`--verbose` | `bool` |  | Enable verbose logging |
+| `--version` | `kong.VersionFlag` |  | Print version and exit |
+
+## See Also
+
+- [gog auth tokens](gog-auth-tokens.md)
+- [Command index](README.md)

docs/commands/gog-auth-tokens-list.md

@@ -0,0 +1,42 @@
+# `gog auth tokens list`
+
+> Generated from `gog schema --json`. Do not edit this page by hand; run `make docs-commands`.
+
+List stored tokens (by key only)
+
+## Usage
+
+```bash
+gog auth tokens list
+```
+
+## Parent
+
+- [gog auth tokens](gog-auth-tokens.md)
+
+## Flags
+
+| Flag | Type | Default | Help |
+| --- | --- | --- | --- |
+| `--access-token` | `string` |  | Use provided access token directly (bypasses stored refresh tokens; token expires in ~1h) |
+| `-a`<br>`--account`<br>`--acct` | `string` |  | Account email for API commands (gmail/calendar/chat/classroom/drive/docs/slides/contacts/tasks/people/sheets/forms/appscript/ads) |
+| `--client` | `string` |  | OAuth client name (selects stored credentials + token bucket) |
+| `--color` | `string` | auto | Color output: auto\|always\|never |
+| `--disable-commands` | `string` |  | Comma-separated list of disabled commands; dot paths allowed |
+| `-n`<br>`--dry-run`<br>`--dryrun`<br>`--noop`<br>`--preview` | `bool` |  | Do not make changes; print intended actions and exit successfully |
+| `--enable-commands` | `string` |  | Comma-separated list of enabled commands; dot paths allowed (restricts CLI) |
+| `-y`<br>`--force`<br>`--assume-yes`<br>`--yes` | `bool` |  | Skip confirmations for destructive commands |
+| `--gmail-no-send` | `bool` | false | Block Gmail send operations (agent safety) |
+| `-h`<br>`--help` | `kong.helpFlag` |  | Show context-sensitive help. |
+| `-j`<br>`--json`<br>`--machine` | `bool` | false | Output JSON to stdout (best for scripting) |
+| `--no-input`<br>`--non-interactive`<br>`--noninteractive` | `bool` |  | Never prompt; fail instead (useful for CI) |
+| `-p`<br>`--plain`<br>`--tsv` | `bool` | false | Output stable, parseable text to stdout (TSV; no colors) |
+| `--results-only` | `bool` |  | In JSON mode, emit only the primary result (drops envelope fields like nextPageToken) |
+| `--select`<br>`--pick`<br>`--project` | `string` |  | In JSON mode, select comma-separated fields (best-effort; supports dot paths). Desire path: use --fields for most commands. |
+| `-v`<br>`--verbose` | `bool` |  | Enable verbose logging |
+| `--version` | `kong.VersionFlag` |  | Print version and exit |
+
+## See Also
+
+- [gog auth tokens](gog-auth-tokens.md)
+- [Command index](README.md)

docs/commands/gog-auth-tokens.md

@@ -0,0 +1,49 @@
+# `gog auth tokens`
+
+> Generated from `gog schema --json`. Do not edit this page by hand; run `make docs-commands`.
+
+Manage stored refresh tokens
+
+## Usage
+
+```bash
+gog auth tokens <command>
+```
+
+## Parent
+
+- [gog auth](gog-auth.md)
+
+## Subcommands
+
+- [gog auth tokens delete](gog-auth-tokens-delete.md) - Delete a stored refresh token
+- [gog auth tokens export](gog-auth-tokens-export.md) - Export a refresh token to a file (contains secrets)
+- [gog auth tokens import](gog-auth-tokens-import.md) - Import a refresh token file into keyring (contains secrets)
+- [gog auth tokens list](gog-auth-tokens-list.md) - List stored tokens (by key only)
+
+## Flags
+
+| Flag | Type | Default | Help |
+| --- | --- | --- | --- |
+| `--access-token` | `string` |  | Use provided access token directly (bypasses stored refresh tokens; token expires in ~1h) |
+| `-a`<br>`--account`<br>`--acct` | `string` |  | Account email for API commands (gmail/calendar/chat/classroom/drive/docs/slides/contacts/tasks/people/sheets/forms/appscript/ads) |
+| `--client` | `string` |  | OAuth client name (selects stored credentials + token bucket) |
+| `--color` | `string` | auto | Color output: auto\|always\|never |
+| `--disable-commands` | `string` |  | Comma-separated list of disabled commands; dot paths allowed |
+| `-n`<br>`--dry-run`<br>`--dryrun`<br>`--noop`<br>`--preview` | `bool` |  | Do not make changes; print intended actions and exit successfully |
+| `--enable-commands` | `string` |  | Comma-separated list of enabled commands; dot paths allowed (restricts CLI) |
+| `-y`<br>`--force`<br>`--assume-yes`<br>`--yes` | `bool` |  | Skip confirmations for destructive commands |
+| `--gmail-no-send` | `bool` | false | Block Gmail send operations (agent safety) |
+| `-h`<br>`--help` | `kong.helpFlag` |  | Show context-sensitive help. |
+| `-j`<br>`--json`<br>`--machine` | `bool` | false | Output JSON to stdout (best for scripting) |
+| `--no-input`<br>`--non-interactive`<br>`--noninteractive` | `bool` |  | Never prompt; fail instead (useful for CI) |
+| `-p`<br>`--plain`<br>`--tsv` | `bool` | false | Output stable, parseable text to stdout (TSV; no colors) |
+| `--results-only` | `bool` |  | In JSON mode, emit only the primary result (drops envelope fields like nextPageToken) |
+| `--select`<br>`--pick`<br>`--project` | `string` |  | In JSON mode, select comma-separated fields (best-effort; supports dot paths). Desire path: use --fields for most commands. |
+| `-v`<br>`--verbose` | `bool` |  | Enable verbose logging |
+| `--version` | `kong.VersionFlag` |  | Print version and exit |
+
+## See Also
+
+- [gog auth](gog-auth.md)
+- [Command index](README.md)

docs/commands/gog-auth.md

@@ -0,0 +1,58 @@
+# `gog auth`
+
+> Generated from `gog schema --json`. Do not edit this page by hand; run `make docs-commands`.
+
+Auth and credentials
+
+## Usage
+
+```bash
+gog auth <command> [flags]
+```
+
+## Parent
+
+- [gog](gog.md)
+
+## Subcommands
+
+- [gog auth add](gog-auth-add.md) - Authorize and store a refresh token
+- [gog auth alias](gog-auth-alias.md) - Manage account aliases
+- [gog auth credentials](gog-auth-credentials.md) - Manage OAuth client credentials
+- [gog auth doctor](gog-auth-doctor.md) - Diagnose auth, keyring, and refresh-token issues
+- [gog auth keep](gog-auth-keep.md) - Configure service account for Google Keep (Workspace only)
+- [gog auth keyring](gog-auth-keyring.md) - Configure keyring backend
+- [gog auth list](gog-auth-list.md) - List stored accounts
+- [gog auth manage](gog-auth-manage.md) - Open accounts manager in browser
+- [gog auth remove](gog-auth-remove.md) - Remove a stored refresh token
+- [gog auth service-account](gog-auth-service-account.md) - Configure service account (Workspace only; domain-wide delegation)
+- [gog auth services](gog-auth-services.md) - List supported auth services and scopes
+- [gog auth status](gog-auth-status.md) - Show auth configuration and keyring backend
+- [gog auth tokens](gog-auth-tokens.md) - Manage stored refresh tokens
+
+## Flags
+
+| Flag | Type | Default | Help |
+| --- | --- | --- | --- |
+| `--access-token` | `string` |  | Use provided access token directly (bypasses stored refresh tokens; token expires in ~1h) |
+| `-a`<br>`--account`<br>`--acct` | `string` |  | Account email for API commands (gmail/calendar/chat/classroom/drive/docs/slides/contacts/tasks/people/sheets/forms/appscript/ads) |
+| `--client` | `string` |  | OAuth client name (selects stored credentials + token bucket) |
+| `--color` | `string` | auto | Color output: auto\|always\|never |
+| `--disable-commands` | `string` |  | Comma-separated list of disabled commands; dot paths allowed |
+| `-n`<br>`--dry-run`<br>`--dryrun`<br>`--noop`<br>`--preview` | `bool` |  | Do not make changes; print intended actions and exit successfully |
+| `--enable-commands` | `string` |  | Comma-separated list of enabled commands; dot paths allowed (restricts CLI) |
+| `-y`<br>`--force`<br>`--assume-yes`<br>`--yes` | `bool` |  | Skip confirmations for destructive commands |
+| `--gmail-no-send` | `bool` | false | Block Gmail send operations (agent safety) |
+| `-h`<br>`--help` | `kong.helpFlag` |  | Show context-sensitive help. |
+| `-j`<br>`--json`<br>`--machine` | `bool` | false | Output JSON to stdout (best for scripting) |
+| `--no-input`<br>`--non-interactive`<br>`--noninteractive` | `bool` |  | Never prompt; fail instead (useful for CI) |
+| `-p`<br>`--plain`<br>`--tsv` | `bool` | false | Output stable, parseable text to stdout (TSV; no colors) |
+| `--results-only` | `bool` |  | In JSON mode, emit only the primary result (drops envelope fields like nextPageToken) |
+| `--select`<br>`--pick`<br>`--project` | `string` |  | In JSON mode, select comma-separated fields (best-effort; supports dot paths). Desire path: use --fields for most commands. |
+| `-v`<br>`--verbose` | `bool` |  | Enable verbose logging |
+| `--version` | `kong.VersionFlag` |  | Print version and exit |
+
+## See Also
+
+- [gog](gog.md)
+- [Command index](README.md)

docs/commands/gog-backup-cat.md

@@ -0,0 +1,49 @@
+# `gog backup cat`
+
+> Generated from `gog schema --json`. Do not edit this page by hand; run `make docs-commands`.
+
+Decrypt one backup shard to stdout
+
+## Usage
+
+```bash
+gog backup cat <shard> [flags]
+```
+
+## Parent
+
+- [gog backup](gog-backup.md)
+
+## Flags
+
+| Flag | Type | Default | Help |
+| --- | --- | --- | --- |
+| `--access-token` | `string` |  | Use provided access token directly (bypasses stored refresh tokens; token expires in ~1h) |
+| `-a`<br>`--account`<br>`--acct` | `string` |  | Account email for API commands (gmail/calendar/chat/classroom/drive/docs/slides/contacts/tasks/people/sheets/forms/appscript/ads) |
+| `--client` | `string` |  | OAuth client name (selects stored credentials + token bucket) |
+| `--color` | `string` | auto | Color output: auto\|always\|never |
+| `--config` | `string` |  | Backup config path |
+| `--disable-commands` | `string` |  | Comma-separated list of disabled commands; dot paths allowed |
+| `-n`<br>`--dry-run`<br>`--dryrun`<br>`--noop`<br>`--preview` | `bool` |  | Do not make changes; print intended actions and exit successfully |
+| `--enable-commands` | `string` |  | Comma-separated list of enabled commands; dot paths allowed (restricts CLI) |
+| `-y`<br>`--force`<br>`--assume-yes`<br>`--yes` | `bool` |  | Skip confirmations for destructive commands |
+| `--gmail-no-send` | `bool` | false | Block Gmail send operations (agent safety) |
+| `-h`<br>`--help` | `kong.helpFlag` |  | Show context-sensitive help. |
+| `--identity` | `string` |  | Local age identity path |
+| `-j`<br>`--json`<br>`--machine` | `bool` | false | Output JSON to stdout (best for scripting) |
+| `--no-input`<br>`--non-interactive`<br>`--noninteractive` | `bool` |  | Never prompt; fail instead (useful for CI) |
+| `--no-pull` | `bool` |  | Use local backup repository state without pulling first |
+| `--out` | `string` |  | Write decrypted JSONL to this file instead of stdout |
+| `-p`<br>`--plain`<br>`--tsv` | `bool` | false | Output stable, parseable text to stdout (TSV; no colors) |
+| `--pretty` | `bool` |  | Pretty-print each JSONL row |
+| `--remote` | `string` |  | Backup Git remote URL |
+| `--repo` | `string` |  | Local backup repository path |
+| `--results-only` | `bool` |  | In JSON mode, emit only the primary result (drops envelope fields like nextPageToken) |
+| `--select`<br>`--pick`<br>`--project` | `string` |  | In JSON mode, select comma-separated fields (best-effort; supports dot paths). Desire path: use --fields for most commands. |
+| `-v`<br>`--verbose` | `bool` |  | Enable verbose logging |
+| `--version` | `kong.VersionFlag` |  | Print version and exit |
+
+## See Also
+
+- [gog backup](gog-backup.md)
+- [Command index](README.md)

docs/commands/gog-backup-export.md

@@ -0,0 +1,50 @@
+# `gog backup export`
+
+> Generated from `gog schema --json`. Do not edit this page by hand; run `make docs-commands`.
+
+Write a local plaintext export
+
+## Usage
+
+```bash
+gog backup export [flags]
+```
+
+## Parent
+
+- [gog backup](gog-backup.md)
+
+## Flags
+
+| Flag | Type | Default | Help |
+| --- | --- | --- | --- |
+| `--access-token` | `string` |  | Use provided access token directly (bypasses stored refresh tokens; token expires in ~1h) |
+| `-a`<br>`--account`<br>`--acct` | `string` |  | Account email for API commands (gmail/calendar/chat/classroom/drive/docs/slides/contacts/tasks/people/sheets/forms/appscript/ads) |
+| `--client` | `string` |  | OAuth client name (selects stored credentials + token bucket) |
+| `--color` | `string` | auto | Color output: auto\|always\|never |
+| `--config` | `string` |  | Backup config path |
+| `--disable-commands` | `string` |  | Comma-separated list of disabled commands; dot paths allowed |
+| `-n`<br>`--dry-run`<br>`--dryrun`<br>`--noop`<br>`--preview` | `bool` |  | Do not make changes; print intended actions and exit successfully |
+| `--enable-commands` | `string` |  | Comma-separated list of enabled commands; dot paths allowed (restricts CLI) |
+| `-y`<br>`--force`<br>`--assume-yes`<br>`--yes` | `bool` |  | Skip confirmations for destructive commands |
+| `--gmail-attachments` | `string` | extract | Gmail attachment export mode for markdown/both: extract or none |
+| `--gmail-format` | `string` | eml | Gmail message export format: eml, markdown, or both |
+| `--gmail-no-send` | `bool` | false | Block Gmail send operations (agent safety) |
+| `-h`<br>`--help` | `kong.helpFlag` |  | Show context-sensitive help. |
+| `--identity` | `string` |  | Local age identity path |
+| `-j`<br>`--json`<br>`--machine` | `bool` | false | Output JSON to stdout (best for scripting) |
+| `--no-input`<br>`--non-interactive`<br>`--noninteractive` | `bool` |  | Never prompt; fail instead (useful for CI) |
+| `--no-pull` | `bool` |  | Use local backup repository state without pulling first |
+| `--out` | `string` | ~/Documents/gog-backup-export | Plaintext export directory |
+| `-p`<br>`--plain`<br>`--tsv` | `bool` | false | Output stable, parseable text to stdout (TSV; no colors) |
+| `--remote` | `string` |  | Backup Git remote URL |
+| `--repo` | `string` |  | Local backup repository path |
+| `--results-only` | `bool` |  | In JSON mode, emit only the primary result (drops envelope fields like nextPageToken) |
+| `--select`<br>`--pick`<br>`--project` | `string` |  | In JSON mode, select comma-separated fields (best-effort; supports dot paths). Desire path: use --fields for most commands. |
+| `-v`<br>`--verbose` | `bool` |  | Enable verbose logging |
+| `--version` | `kong.VersionFlag` |  | Print version and exit |
+
+## See Also
+
+- [gog backup](gog-backup.md)
+- [Command index](README.md)

docs/commands/gog-backup-gmail-push.md

@@ -0,0 +1,57 @@
+# `gog backup gmail push`
+
+> Generated from `gog schema --json`. Do not edit this page by hand; run `make docs-commands`.
+
+Export Gmail into encrypted backup shards
+
+## Usage
+
+```bash
+gog backup gmail push [flags]
+```
+
+## Parent
+
+- [gog backup gmail](gog-backup-gmail.md)
+
+## Flags
+
+| Flag | Type | Default | Help |
+| --- | --- | --- | --- |
+| `--access-token` | `string` |  | Use provided access token directly (bypasses stored refresh tokens; token expires in ~1h) |
+| `-a`<br>`--account`<br>`--acct` | `string` |  | Account email for API commands (gmail/calendar/chat/classroom/drive/docs/slides/contacts/tasks/people/sheets/forms/appscript/ads) |
+| `--checkpoint-interval` | `time.Duration` | 30m | Max time between checkpoint pushes during fetch; 0 disables time-triggered checkpoints |
+| `--checkpoint-rows` | `int` | 10000 | Gmail messages per encrypted checkpoint chunk; 0 disables row-triggered checkpoints |
+| `--checkpoints` | `bool` | true | Commit and push incomplete encrypted checkpoints during long cached fetches |
+| `--client` | `string` |  | OAuth client name (selects stored credentials + token bucket) |
+| `--color` | `string` | auto | Color output: auto\|always\|never |
+| `--config` | `string` |  | Backup config path |
+| `--disable-commands` | `string` |  | Comma-separated list of disabled commands; dot paths allowed |
+| `-n`<br>`--dry-run`<br>`--dryrun`<br>`--noop`<br>`--preview` | `bool` |  | Do not make changes; print intended actions and exit successfully |
+| `--enable-commands` | `string` |  | Comma-separated list of enabled commands; dot paths allowed (restricts CLI) |
+| `-y`<br>`--force`<br>`--assume-yes`<br>`--yes` | `bool` |  | Skip confirmations for destructive commands |
+| `--gmail-cache` | `bool` | true | Cache fetched raw messages locally so interrupted full backups can resume |
+| `--gmail-no-send` | `bool` | false | Block Gmail send operations (agent safety) |
+| `--gmail-refresh-cache` | `bool` |  | Refetch messages even when a local backup cache entry exists |
+| `-h`<br>`--help` | `kong.helpFlag` |  | Show context-sensitive help. |
+| `--identity` | `string` |  | Local age identity path |
+| `--include-spam-trash` | `bool` | true | Include spam and trash |
+| `-j`<br>`--json`<br>`--machine` | `bool` | false | Output JSON to stdout (best for scripting) |
+| `--max`<br>`--limit` | `int64` | 0 | Max Gmail messages to export; 0 means all |
+| `--no-input`<br>`--non-interactive`<br>`--noninteractive` | `bool` |  | Never prompt; fail instead (useful for CI) |
+| `--no-push` | `bool` |  | Commit locally but do not push to the remote |
+| `-p`<br>`--plain`<br>`--tsv` | `bool` | false | Output stable, parseable text to stdout (TSV; no colors) |
+| `--query` | `string` |  | Gmail query for bounded/test backups |
+| `--recipient` | `[]string` |  | Public age recipient (repeatable) |
+| `--remote` | `string` |  | Backup Git remote URL |
+| `--repo` | `string` |  | Local backup repository path |
+| `--results-only` | `bool` |  | In JSON mode, emit only the primary result (drops envelope fields like nextPageToken) |
+| `--select`<br>`--pick`<br>`--project` | `string` |  | In JSON mode, select comma-separated fields (best-effort; supports dot paths). Desire path: use --fields for most commands. |
+| `--shard-max-rows` | `int` | 1000 | Max messages per encrypted shard |
+| `-v`<br>`--verbose` | `bool` |  | Enable verbose logging |
+| `--version` | `kong.VersionFlag` |  | Print version and exit |
+
+## See Also
+
+- [gog backup gmail](gog-backup-gmail.md)
+- [Command index](README.md)

docs/commands/gog-backup-gmail.md

@@ -0,0 +1,46 @@
+# `gog backup gmail`
+
+> Generated from `gog schema --json`. Do not edit this page by hand; run `make docs-commands`.
+
+Gmail backup operations
+
+## Usage
+
+```bash
+gog backup gmail <command>
+```
+
+## Parent
+
+- [gog backup](gog-backup.md)
+
+## Subcommands
+
+- [gog backup gmail push](gog-backup-gmail-push.md) - Export Gmail into encrypted backup shards
+
+## Flags
+
+| Flag | Type | Default | Help |
+| --- | --- | --- | --- |
+| `--access-token` | `string` |  | Use provided access token directly (bypasses stored refresh tokens; token expires in ~1h) |
+| `-a`<br>`--account`<br>`--acct` | `string` |  | Account email for API commands (gmail/calendar/chat/classroom/drive/docs/slides/contacts/tasks/people/sheets/forms/appscript/ads) |
+| `--client` | `string` |  | OAuth client name (selects stored credentials + token bucket) |
+| `--color` | `string` | auto | Color output: auto\|always\|never |
+| `--disable-commands` | `string` |  | Comma-separated list of disabled commands; dot paths allowed |
+| `-n`<br>`--dry-run`<br>`--dryrun`<br>`--noop`<br>`--preview` | `bool` |  | Do not make changes; print intended actions and exit successfully |
+| `--enable-commands` | `string` |  | Comma-separated list of enabled commands; dot paths allowed (restricts CLI) |
+| `-y`<br>`--force`<br>`--assume-yes`<br>`--yes` | `bool` |  | Skip confirmations for destructive commands |
+| `--gmail-no-send` | `bool` | false | Block Gmail send operations (agent safety) |
+| `-h`<br>`--help` | `kong.helpFlag` |  | Show context-sensitive help. |
+| `-j`<br>`--json`<br>`--machine` | `bool` | false | Output JSON to stdout (best for scripting) |
+| `--no-input`<br>`--non-interactive`<br>`--noninteractive` | `bool` |  | Never prompt; fail instead (useful for CI) |
+| `-p`<br>`--plain`<br>`--tsv` | `bool` | false | Output stable, parseable text to stdout (TSV; no colors) |
+| `--results-only` | `bool` |  | In JSON mode, emit only the primary result (drops envelope fields like nextPageToken) |
+| `--select`<br>`--pick`<br>`--project` | `string` |  | In JSON mode, select comma-separated fields (best-effort; supports dot paths). Desire path: use --fields for most commands. |
+| `-v`<br>`--verbose` | `bool` |  | Enable verbose logging |
+| `--version` | `kong.VersionFlag` |  | Print version and exit |
+
+## See Also
+
+- [gog backup](gog-backup.md)
+- [Command index](README.md)

docs/commands/gog-backup-init.md

@@ -0,0 +1,48 @@
+# `gog backup init`
+
+> Generated from `gog schema --json`. Do not edit this page by hand; run `make docs-commands`.
+
+Initialize encrypted backup config and repository
+
+## Usage
+
+```bash
+gog backup init [flags]
+```
+
+## Parent
+
+- [gog backup](gog-backup.md)
+
+## Flags
+
+| Flag | Type | Default | Help |
+| --- | --- | --- | --- |
+| `--access-token` | `string` |  | Use provided access token directly (bypasses stored refresh tokens; token expires in ~1h) |
+| `-a`<br>`--account`<br>`--acct` | `string` |  | Account email for API commands (gmail/calendar/chat/classroom/drive/docs/slides/contacts/tasks/people/sheets/forms/appscript/ads) |
+| `--client` | `string` |  | OAuth client name (selects stored credentials + token bucket) |
+| `--color` | `string` | auto | Color output: auto\|always\|never |
+| `--config` | `string` |  | Backup config path |
+| `--disable-commands` | `string` |  | Comma-separated list of disabled commands; dot paths allowed |
+| `-n`<br>`--dry-run`<br>`--dryrun`<br>`--noop`<br>`--preview` | `bool` |  | Do not make changes; print intended actions and exit successfully |
+| `--enable-commands` | `string` |  | Comma-separated list of enabled commands; dot paths allowed (restricts CLI) |
+| `-y`<br>`--force`<br>`--assume-yes`<br>`--yes` | `bool` |  | Skip confirmations for destructive commands |
+| `--gmail-no-send` | `bool` | false | Block Gmail send operations (agent safety) |
+| `-h`<br>`--help` | `kong.helpFlag` |  | Show context-sensitive help. |
+| `--identity` | `string` |  | Local age identity path |
+| `-j`<br>`--json`<br>`--machine` | `bool` | false | Output JSON to stdout (best for scripting) |
+| `--no-input`<br>`--non-interactive`<br>`--noninteractive` | `bool` |  | Never prompt; fail instead (useful for CI) |
+| `--no-push` | `bool` |  | Commit locally but do not push to the remote |
+| `-p`<br>`--plain`<br>`--tsv` | `bool` | false | Output stable, parseable text to stdout (TSV; no colors) |
+| `--recipient` | `[]string` |  | Public age recipient (repeatable) |
+| `--remote` | `string` |  | Backup Git remote URL |
+| `--repo` | `string` |  | Local backup repository path |
+| `--results-only` | `bool` |  | In JSON mode, emit only the primary result (drops envelope fields like nextPageToken) |
+| `--select`<br>`--pick`<br>`--project` | `string` |  | In JSON mode, select comma-separated fields (best-effort; supports dot paths). Desire path: use --fields for most commands. |
+| `-v`<br>`--verbose` | `bool` |  | Enable verbose logging |
+| `--version` | `kong.VersionFlag` |  | Print version and exit |
+
+## See Also
+
+- [gog backup](gog-backup.md)
+- [Command index](README.md)

docs/commands/gog-backup-push.md

@@ -0,0 +1,66 @@
+# `gog backup push`
+
+> Generated from `gog schema --json`. Do not edit this page by hand; run `make docs-commands`.
+
+Export services into encrypted backup shards
+
+## Usage
+
+```bash
+gog backup push [flags]
+```
+
+## Parent
+
+- [gog backup](gog-backup.md)
+
+## Flags
+
+| Flag | Type | Default | Help |
+| --- | --- | --- | --- |
+| `--access-token` | `string` |  | Use provided access token directly (bypasses stored refresh tokens; token expires in ~1h) |
+| `-a`<br>`--account`<br>`--acct` | `string` |  | Account email for API commands (gmail/calendar/chat/classroom/drive/docs/slides/contacts/tasks/people/sheets/forms/appscript/ads) |
+| `--best-effort` | `bool` | true | Record optional service errors as backup rows and continue |
+| `--client` | `string` |  | OAuth client name (selects stored credentials + token bucket) |
+| `--color` | `string` | auto | Color output: auto\|always\|never |
+| `--config` | `string` |  | Backup config path |
+| `--disable-commands` | `string` |  | Comma-separated list of disabled commands; dot paths allowed |
+| `--drive-binary-contents` | `bool` |  | Include non-Google Drive binary file bytes in encrypted shards |
+| `--drive-collaboration` | `bool` | true | Back up Drive permissions, comments, and revision metadata |
+| `--drive-content-max-bytes` | `int64` | 0 | Skip individual Drive content exports larger than this many bytes; 0 means unlimited |
+| `--drive-content-timeout` | `time.Duration` | 2m | Per-file Drive content export/download timeout |
+| `--drive-contents` | `bool` | true | Download/export Drive file contents into encrypted shards |
+| `-n`<br>`--dry-run`<br>`--dryrun`<br>`--noop`<br>`--preview` | `bool` |  | Do not make changes; print intended actions and exit successfully |
+| `--enable-commands` | `string` |  | Comma-separated list of enabled commands; dot paths allowed (restricts CLI) |
+| `-y`<br>`--force`<br>`--assume-yes`<br>`--yes` | `bool` |  | Skip confirmations for destructive commands |
+| `--gmail-cache` | `bool` | true | Cache fetched Gmail raw messages locally so interrupted full backups can resume |
+| `--gmail-checkpoint-interval` | `time.Duration` | 30m | Max time between Gmail checkpoint pushes during fetch; 0 disables time-triggered checkpoints |
+| `--gmail-checkpoint-rows` | `int` | 10000 | Gmail messages per encrypted checkpoint chunk; 0 disables row-triggered checkpoints |
+| `--gmail-checkpoints` | `bool` | true | Commit and push incomplete encrypted Gmail checkpoints during long cached fetches |
+| `--gmail-no-send` | `bool` | false | Block Gmail send operations (agent safety) |
+| `--gmail-refresh-cache` | `bool` |  | Refetch Gmail messages even when a local backup cache entry exists |
+| `-h`<br>`--help` | `kong.helpFlag` |  | Show context-sensitive help. |
+| `--identity` | `string` |  | Local age identity path |
+| `--include-spam-trash` | `bool` | true | Include Gmail spam and trash |
+| `-j`<br>`--json`<br>`--machine` | `bool` | false | Output JSON to stdout (best for scripting) |
+| `--max`<br>`--limit` | `int64` | 0 | Max Gmail messages to export; 0 means all |
+| `--no-input`<br>`--non-interactive`<br>`--noninteractive` | `bool` |  | Never prompt; fail instead (useful for CI) |
+| `--no-push` | `bool` |  | Commit locally but do not push to the remote |
+| `-p`<br>`--plain`<br>`--tsv` | `bool` | false | Output stable, parseable text to stdout (TSV; no colors) |
+| `--query` | `string` |  | Gmail query for bounded/test backups |
+| `--recipient` | `[]string` |  | Public age recipient (repeatable) |
+| `--remote` | `string` |  | Backup Git remote URL |
+| `--repo` | `string` |  | Local backup repository path |
+| `--results-only` | `bool` |  | In JSON mode, emit only the primary result (drops envelope fields like nextPageToken) |
+| `--select`<br>`--pick`<br>`--project` | `string` |  | In JSON mode, select comma-separated fields (best-effort; supports dot paths). Desire path: use --fields for most commands. |
+| `--services` | `string` | gmail | Comma-separated services to back up |
+| `--shard-max-rows` | `int` | 1000 | Max rows per encrypted shard |
+| `-v`<br>`--verbose` | `bool` |  | Enable verbose logging |
+| `--version` | `kong.VersionFlag` |  | Print version and exit |
+| `--workspace-max-files` | `int` | 0 | Max Docs/Sheets/Slides files per type for native Workspace metadata; 0 means all |
+| `--workspace-native` | `bool` |  | Fetch full native Docs/Sheets/Slides API JSON in addition to Drive exports |
+
+## See Also
+
+- [gog backup](gog-backup.md)
+- [Command index](README.md)

docs/commands/gog-backup-status.md

@@ -0,0 +1,48 @@
+# `gog backup status`
+
+> Generated from `gog schema --json`. Do not edit this page by hand; run `make docs-commands`.
+
+Inspect backup manifest without decrypting shards
+
+## Usage
+
+```bash
+gog backup status [flags]
+```
+
+## Parent
+
+- [gog backup](gog-backup.md)
+
+## Flags
+
+| Flag | Type | Default | Help |
+| --- | --- | --- | --- |
+| `--access-token` | `string` |  | Use provided access token directly (bypasses stored refresh tokens; token expires in ~1h) |
+| `-a`<br>`--account`<br>`--acct` | `string` |  | Account email for API commands (gmail/calendar/chat/classroom/drive/docs/slides/contacts/tasks/people/sheets/forms/appscript/ads) |
+| `--client` | `string` |  | OAuth client name (selects stored credentials + token bucket) |
+| `--color` | `string` | auto | Color output: auto\|always\|never |
+| `--config` | `string` |  | Backup config path |
+| `--disable-commands` | `string` |  | Comma-separated list of disabled commands; dot paths allowed |
+| `-n`<br>`--dry-run`<br>`--dryrun`<br>`--noop`<br>`--preview` | `bool` |  | Do not make changes; print intended actions and exit successfully |
+| `--enable-commands` | `string` |  | Comma-separated list of enabled commands; dot paths allowed (restricts CLI) |
+| `-y`<br>`--force`<br>`--assume-yes`<br>`--yes` | `bool` |  | Skip confirmations for destructive commands |
+| `--gmail-no-send` | `bool` | false | Block Gmail send operations (agent safety) |
+| `-h`<br>`--help` | `kong.helpFlag` |  | Show context-sensitive help. |
+| `--identity` | `string` |  | Local age identity path |
+| `-j`<br>`--json`<br>`--machine` | `bool` | false | Output JSON to stdout (best for scripting) |
+| `--no-input`<br>`--non-interactive`<br>`--noninteractive` | `bool` |  | Never prompt; fail instead (useful for CI) |
+| `--no-push` | `bool` |  | Commit locally but do not push to the remote |
+| `-p`<br>`--plain`<br>`--tsv` | `bool` | false | Output stable, parseable text to stdout (TSV; no colors) |
+| `--recipient` | `[]string` |  | Public age recipient (repeatable) |
+| `--remote` | `string` |  | Backup Git remote URL |
+| `--repo` | `string` |  | Local backup repository path |
+| `--results-only` | `bool` |  | In JSON mode, emit only the primary result (drops envelope fields like nextPageToken) |
+| `--select`<br>`--pick`<br>`--project` | `string` |  | In JSON mode, select comma-separated fields (best-effort; supports dot paths). Desire path: use --fields for most commands. |
+| `-v`<br>`--verbose` | `bool` |  | Enable verbose logging |
+| `--version` | `kong.VersionFlag` |  | Print version and exit |
+
+## See Also
+
+- [gog backup](gog-backup.md)
+- [Command index](README.md)

docs/commands/gog-backup-verify.md

@@ -0,0 +1,48 @@
+# `gog backup verify`
+
+> Generated from `gog schema --json`. Do not edit this page by hand; run `make docs-commands`.
+
+Decrypt and verify all backup shards
+
+## Usage
+
+```bash
+gog backup verify [flags]
+```
+
+## Parent
+
+- [gog backup](gog-backup.md)
+
+## Flags
+
+| Flag | Type | Default | Help |
+| --- | --- | --- | --- |
+| `--access-token` | `string` |  | Use provided access token directly (bypasses stored refresh tokens; token expires in ~1h) |
+| `-a`<br>`--account`<br>`--acct` | `string` |  | Account email for API commands (gmail/calendar/chat/classroom/drive/docs/slides/contacts/tasks/people/sheets/forms/appscript/ads) |
+| `--client` | `string` |  | OAuth client name (selects stored credentials + token bucket) |
+| `--color` | `string` | auto | Color output: auto\|always\|never |
+| `--config` | `string` |  | Backup config path |
+| `--disable-commands` | `string` |  | Comma-separated list of disabled commands; dot paths allowed |
+| `-n`<br>`--dry-run`<br>`--dryrun`<br>`--noop`<br>`--preview` | `bool` |  | Do not make changes; print intended actions and exit successfully |
+| `--enable-commands` | `string` |  | Comma-separated list of enabled commands; dot paths allowed (restricts CLI) |
+| `-y`<br>`--force`<br>`--assume-yes`<br>`--yes` | `bool` |  | Skip confirmations for destructive commands |
+| `--gmail-no-send` | `bool` | false | Block Gmail send operations (agent safety) |
+| `-h`<br>`--help` | `kong.helpFlag` |  | Show context-sensitive help. |
+| `--identity` | `string` |  | Local age identity path |
+| `-j`<br>`--json`<br>`--machine` | `bool` | false | Output JSON to stdout (best for scripting) |
+| `--no-input`<br>`--non-interactive`<br>`--noninteractive` | `bool` |  | Never prompt; fail instead (useful for CI) |
+| `--no-push` | `bool` |  | Commit locally but do not push to the remote |
+| `-p`<br>`--plain`<br>`--tsv` | `bool` | false | Output stable, parseable text to stdout (TSV; no colors) |
+| `--recipient` | `[]string` |  | Public age recipient (repeatable) |
+| `--remote` | `string` |  | Backup Git remote URL |
+| `--repo` | `string` |  | Local backup repository path |
+| `--results-only` | `bool` |  | In JSON mode, emit only the primary result (drops envelope fields like nextPageToken) |
+| `--select`<br>`--pick`<br>`--project` | `string` |  | In JSON mode, select comma-separated fields (best-effort; supports dot paths). Desire path: use --fields for most commands. |
+| `-v`<br>`--verbose` | `bool` |  | Enable verbose logging |
+| `--version` | `kong.VersionFlag` |  | Print version and exit |
+
+## See Also
+
+- [gog backup](gog-backup.md)
+- [Command index](README.md)

docs/commands/gog-backup.md

@@ -0,0 +1,52 @@
+# `gog backup`
+
+> Generated from `gog schema --json`. Do not edit this page by hand; run `make docs-commands`.
+
+Encrypted Google account backups
+
+## Usage
+
+```bash
+gog backup <command> [flags]
+```
+
+## Parent
+
+- [gog](gog.md)
+
+## Subcommands
+
+- [gog backup cat](gog-backup-cat.md) - Decrypt one backup shard to stdout
+- [gog backup export](gog-backup-export.md) - Write a local plaintext export
+- [gog backup gmail](gog-backup-gmail.md) - Gmail backup operations
+- [gog backup init](gog-backup-init.md) - Initialize encrypted backup config and repository
+- [gog backup push](gog-backup-push.md) - Export services into encrypted backup shards
+- [gog backup status](gog-backup-status.md) - Inspect backup manifest without decrypting shards
+- [gog backup verify](gog-backup-verify.md) - Decrypt and verify all backup shards
+
+## Flags
+
+| Flag | Type | Default | Help |
+| --- | --- | --- | --- |
+| `--access-token` | `string` |  | Use provided access token directly (bypasses stored refresh tokens; token expires in ~1h) |
+| `-a`<br>`--account`<br>`--acct` | `string` |  | Account email for API commands (gmail/calendar/chat/classroom/drive/docs/slides/contacts/tasks/people/sheets/forms/appscript/ads) |
+| `--client` | `string` |  | OAuth client name (selects stored credentials + token bucket) |
+| `--color` | `string` | auto | Color output: auto\|always\|never |
+| `--disable-commands` | `string` |  | Comma-separated list of disabled commands; dot paths allowed |
+| `-n`<br>`--dry-run`<br>`--dryrun`<br>`--noop`<br>`--preview` | `bool` |  | Do not make changes; print intended actions and exit successfully |
+| `--enable-commands` | `string` |  | Comma-separated list of enabled commands; dot paths allowed (restricts CLI) |
+| `-y`<br>`--force`<br>`--assume-yes`<br>`--yes` | `bool` |  | Skip confirmations for destructive commands |
+| `--gmail-no-send` | `bool` | false | Block Gmail send operations (agent safety) |
+| `-h`<br>`--help` | `kong.helpFlag` |  | Show context-sensitive help. |
+| `-j`<br>`--json`<br>`--machine` | `bool` | false | Output JSON to stdout (best for scripting) |
+| `--no-input`<br>`--non-interactive`<br>`--noninteractive` | `bool` |  | Never prompt; fail instead (useful for CI) |
+| `-p`<br>`--plain`<br>`--tsv` | `bool` | false | Output stable, parseable text to stdout (TSV; no colors) |
+| `--results-only` | `bool` |  | In JSON mode, emit only the primary result (drops envelope fields like nextPageToken) |
+| `--select`<br>`--pick`<br>`--project` | `string` |  | In JSON mode, select comma-separated fields (best-effort; supports dot paths). Desire path: use --fields for most commands. |
+| `-v`<br>`--verbose` | `bool` |  | Enable verbose logging |
+| `--version` | `kong.VersionFlag` |  | Print version and exit |
+
+## See Also
+
+- [gog](gog.md)
+- [Command index](README.md)

docs/commands/gog-calendar-acl.md

@@ -0,0 +1,46 @@
+# `gog calendar acl`
+
+> Generated from `gog schema --json`. Do not edit this page by hand; run `make docs-commands`.
+
+List calendar ACL
+
+## Usage
+
+```bash
+gog calendar (cal) acl (permissions,perms) <calendarId> [flags]
+```
+
+## Parent
+
+- [gog calendar](gog-calendar.md)
+
+## Flags
+
+| Flag | Type | Default | Help |
+| --- | --- | --- | --- |
+| `--access-token` | `string` |  | Use provided access token directly (bypasses stored refresh tokens; token expires in ~1h) |
+| `-a`<br>`--account`<br>`--acct` | `string` |  | Account email for API commands (gmail/calendar/chat/classroom/drive/docs/slides/contacts/tasks/people/sheets/forms/appscript/ads) |
+| `--all`<br>`--all-pages`<br>`--allpages` | `bool` |  | Fetch all pages |
+| `--client` | `string` |  | OAuth client name (selects stored credentials + token bucket) |
+| `--color` | `string` | auto | Color output: auto\|always\|never |
+| `--disable-commands` | `string` |  | Comma-separated list of disabled commands; dot paths allowed |
+| `-n`<br>`--dry-run`<br>`--dryrun`<br>`--noop`<br>`--preview` | `bool` |  | Do not make changes; print intended actions and exit successfully |
+| `--enable-commands` | `string` |  | Comma-separated list of enabled commands; dot paths allowed (restricts CLI) |
+| `--fail-empty`<br>`--non-empty`<br>`--require-results` | `bool` |  | Exit with code 3 if no results |
+| `-y`<br>`--force`<br>`--assume-yes`<br>`--yes` | `bool` |  | Skip confirmations for destructive commands |
+| `--gmail-no-send` | `bool` | false | Block Gmail send operations (agent safety) |
+| `-h`<br>`--help` | `kong.helpFlag` |  | Show context-sensitive help. |
+| `-j`<br>`--json`<br>`--machine` | `bool` | false | Output JSON to stdout (best for scripting) |
+| `--max`<br>`--limit` | `int64` | 100 | Max results |
+| `--no-input`<br>`--non-interactive`<br>`--noninteractive` | `bool` |  | Never prompt; fail instead (useful for CI) |
+| `--page`<br>`--cursor` | `string` |  | Page token |
+| `-p`<br>`--plain`<br>`--tsv` | `bool` | false | Output stable, parseable text to stdout (TSV; no colors) |
+| `--results-only` | `bool` |  | In JSON mode, emit only the primary result (drops envelope fields like nextPageToken) |
+| `--select`<br>`--pick`<br>`--project` | `string` |  | In JSON mode, select comma-separated fields (best-effort; supports dot paths). Desire path: use --fields for most commands. |
+| `-v`<br>`--verbose` | `bool` |  | Enable verbose logging |
+| `--version` | `kong.VersionFlag` |  | Print version and exit |
+
+## See Also
+
+- [gog calendar](gog-calendar.md)
+- [Command index](README.md)

docs/commands/gog-calendar-alias-list.md

@@ -0,0 +1,42 @@
+# `gog calendar alias list`
+
+> Generated from `gog schema --json`. Do not edit this page by hand; run `make docs-commands`.
+
+List calendar aliases
+
+## Usage
+
+```bash
+gog calendar (cal) alias list
+```
+
+## Parent
+
+- [gog calendar alias](gog-calendar-alias.md)
+
+## Flags
+
+| Flag | Type | Default | Help |
+| --- | --- | --- | --- |
+| `--access-token` | `string` |  | Use provided access token directly (bypasses stored refresh tokens; token expires in ~1h) |
+| `-a`<br>`--account`<br>`--acct` | `string` |  | Account email for API commands (gmail/calendar/chat/classroom/drive/docs/slides/contacts/tasks/people/sheets/forms/appscript/ads) |
+| `--client` | `string` |  | OAuth client name (selects stored credentials + token bucket) |
+| `--color` | `string` | auto | Color output: auto\|always\|never |
+| `--disable-commands` | `string` |  | Comma-separated list of disabled commands; dot paths allowed |
+| `-n`<br>`--dry-run`<br>`--dryrun`<br>`--noop`<br>`--preview` | `bool` |  | Do not make changes; print intended actions and exit successfully |
+| `--enable-commands` | `string` |  | Comma-separated list of enabled commands; dot paths allowed (restricts CLI) |
+| `-y`<br>`--force`<br>`--assume-yes`<br>`--yes` | `bool` |  | Skip confirmations for destructive commands |
+| `--gmail-no-send` | `bool` | false | Block Gmail send operations (agent safety) |
+| `-h`<br>`--help` | `kong.helpFlag` |  | Show context-sensitive help. |
+| `-j`<br>`--json`<br>`--machine` | `bool` | false | Output JSON to stdout (best for scripting) |
+| `--no-input`<br>`--non-interactive`<br>`--noninteractive` | `bool` |  | Never prompt; fail instead (useful for CI) |
+| `-p`<br>`--plain`<br>`--tsv` | `bool` | false | Output stable, parseable text to stdout (TSV; no colors) |
+| `--results-only` | `bool` |  | In JSON mode, emit only the primary result (drops envelope fields like nextPageToken) |
+| `--select`<br>`--pick`<br>`--project` | `string` |  | In JSON mode, select comma-separated fields (best-effort; supports dot paths). Desire path: use --fields for most commands. |
+| `-v`<br>`--verbose` | `bool` |  | Enable verbose logging |
+| `--version` | `kong.VersionFlag` |  | Print version and exit |
+
+## See Also
+
+- [gog calendar alias](gog-calendar-alias.md)
+- [Command index](README.md)

docs/commands/gog-calendar-alias-set.md

@@ -0,0 +1,42 @@
+# `gog calendar alias set`
+
+> Generated from `gog schema --json`. Do not edit this page by hand; run `make docs-commands`.
+
+Set a calendar alias
+
+## Usage
+
+```bash
+gog calendar (cal) alias set <alias> <calendarId>
+```
+
+## Parent
+
+- [gog calendar alias](gog-calendar-alias.md)
+
+## Flags
+
+| Flag | Type | Default | Help |
+| --- | --- | --- | --- |
+| `--access-token` | `string` |  | Use provided access token directly (bypasses stored refresh tokens; token expires in ~1h) |
+| `-a`<br>`--account`<br>`--acct` | `string` |  | Account email for API commands (gmail/calendar/chat/classroom/drive/docs/slides/contacts/tasks/people/sheets/forms/appscript/ads) |
+| `--client` | `string` |  | OAuth client name (selects stored credentials + token bucket) |
+| `--color` | `string` | auto | Color output: auto\|always\|never |
+| `--disable-commands` | `string` |  | Comma-separated list of disabled commands; dot paths allowed |
+| `-n`<br>`--dry-run`<br>`--dryrun`<br>`--noop`<br>`--preview` | `bool` |  | Do not make changes; print intended actions and exit successfully |
+| `--enable-commands` | `string` |  | Comma-separated list of enabled commands; dot paths allowed (restricts CLI) |
+| `-y`<br>`--force`<br>`--assume-yes`<br>`--yes` | `bool` |  | Skip confirmations for destructive commands |
+| `--gmail-no-send` | `bool` | false | Block Gmail send operations (agent safety) |
+| `-h`<br>`--help` | `kong.helpFlag` |  | Show context-sensitive help. |
+| `-j`<br>`--json`<br>`--machine` | `bool` | false | Output JSON to stdout (best for scripting) |
+| `--no-input`<br>`--non-interactive`<br>`--noninteractive` | `bool` |  | Never prompt; fail instead (useful for CI) |
+| `-p`<br>`--plain`<br>`--tsv` | `bool` | false | Output stable, parseable text to stdout (TSV; no colors) |
+| `--results-only` | `bool` |  | In JSON mode, emit only the primary result (drops envelope fields like nextPageToken) |
+| `--select`<br>`--pick`<br>`--project` | `string` |  | In JSON mode, select comma-separated fields (best-effort; supports dot paths). Desire path: use --fields for most commands. |
+| `-v`<br>`--verbose` | `bool` |  | Enable verbose logging |
+| `--version` | `kong.VersionFlag` |  | Print version and exit |
+
+## See Also
+
+- [gog calendar alias](gog-calendar-alias.md)
+- [Command index](README.md)

docs/commands/gog-calendar-alias-unset.md

@@ -0,0 +1,42 @@
+# `gog calendar alias unset`
+
+> Generated from `gog schema --json`. Do not edit this page by hand; run `make docs-commands`.
+
+Remove a calendar alias
+
+## Usage
+
+```bash
+gog calendar (cal) alias unset <alias>
+```
+
+## Parent
+
+- [gog calendar alias](gog-calendar-alias.md)
+
+## Flags
+
+| Flag | Type | Default | Help |
+| --- | --- | --- | --- |
+| `--access-token` | `string` |  | Use provided access token directly (bypasses stored refresh tokens; token expires in ~1h) |
+| `-a`<br>`--account`<br>`--acct` | `string` |  | Account email for API commands (gmail/calendar/chat/classroom/drive/docs/slides/contacts/tasks/people/sheets/forms/appscript/ads) |
+| `--client` | `string` |  | OAuth client name (selects stored credentials + token bucket) |
+| `--color` | `string` | auto | Color output: auto\|always\|never |
+| `--disable-commands` | `string` |  | Comma-separated list of disabled commands; dot paths allowed |
+| `-n`<br>`--dry-run`<br>`--dryrun`<br>`--noop`<br>`--preview` | `bool` |  | Do not make changes; print intended actions and exit successfully |
+| `--enable-commands` | `string` |  | Comma-separated list of enabled commands; dot paths allowed (restricts CLI) |
+| `-y`<br>`--force`<br>`--assume-yes`<br>`--yes` | `bool` |  | Skip confirmations for destructive commands |
+| `--gmail-no-send` | `bool` | false | Block Gmail send operations (agent safety) |
+| `-h`<br>`--help` | `kong.helpFlag` |  | Show context-sensitive help. |
+| `-j`<br>`--json`<br>`--machine` | `bool` | false | Output JSON to stdout (best for scripting) |
+| `--no-input`<br>`--non-interactive`<br>`--noninteractive` | `bool` |  | Never prompt; fail instead (useful for CI) |
+| `-p`<br>`--plain`<br>`--tsv` | `bool` | false | Output stable, parseable text to stdout (TSV; no colors) |
+| `--results-only` | `bool` |  | In JSON mode, emit only the primary result (drops envelope fields like nextPageToken) |
+| `--select`<br>`--pick`<br>`--project` | `string` |  | In JSON mode, select comma-separated fields (best-effort; supports dot paths). Desire path: use --fields for most commands. |
+| `-v`<br>`--verbose` | `bool` |  | Enable verbose logging |
+| `--version` | `kong.VersionFlag` |  | Print version and exit |
+
+## See Also
+
+- [gog calendar alias](gog-calendar-alias.md)
+- [Command index](README.md)

docs/commands/gog-calendar-alias.md

@@ -0,0 +1,48 @@
+# `gog calendar alias`
+
+> Generated from `gog schema --json`. Do not edit this page by hand; run `make docs-commands`.
+
+Manage calendar aliases
+
+## Usage
+
+```bash
+gog calendar (cal) alias <command>
+```
+
+## Parent
+
+- [gog calendar](gog-calendar.md)
+
+## Subcommands
+
+- [gog calendar alias list](gog-calendar-alias-list.md) - List calendar aliases
+- [gog calendar alias set](gog-calendar-alias-set.md) - Set a calendar alias
+- [gog calendar alias unset](gog-calendar-alias-unset.md) - Remove a calendar alias
+
+## Flags
+
+| Flag | Type | Default | Help |
+| --- | --- | --- | --- |
+| `--access-token` | `string` |  | Use provided access token directly (bypasses stored refresh tokens; token expires in ~1h) |
+| `-a`<br>`--account`<br>`--acct` | `string` |  | Account email for API commands (gmail/calendar/chat/classroom/drive/docs/slides/contacts/tasks/people/sheets/forms/appscript/ads) |
+| `--client` | `string` |  | OAuth client name (selects stored credentials + token bucket) |
+| `--color` | `string` | auto | Color output: auto\|always\|never |
+| `--disable-commands` | `string` |  | Comma-separated list of disabled commands; dot paths allowed |
+| `-n`<br>`--dry-run`<br>`--dryrun`<br>`--noop`<br>`--preview` | `bool` |  | Do not make changes; print intended actions and exit successfully |
+| `--enable-commands` | `string` |  | Comma-separated list of enabled commands; dot paths allowed (restricts CLI) |
+| `-y`<br>`--force`<br>`--assume-yes`<br>`--yes` | `bool` |  | Skip confirmations for destructive commands |
+| `--gmail-no-send` | `bool` | false | Block Gmail send operations (agent safety) |
+| `-h`<br>`--help` | `kong.helpFlag` |  | Show context-sensitive help. |
+| `-j`<br>`--json`<br>`--machine` | `bool` | false | Output JSON to stdout (best for scripting) |
+| `--no-input`<br>`--non-interactive`<br>`--noninteractive` | `bool` |  | Never prompt; fail instead (useful for CI) |
+| `-p`<br>`--plain`<br>`--tsv` | `bool` | false | Output stable, parseable text to stdout (TSV; no colors) |
+| `--results-only` | `bool` |  | In JSON mode, emit only the primary result (drops envelope fields like nextPageToken) |
+| `--select`<br>`--pick`<br>`--project` | `string` |  | In JSON mode, select comma-separated fields (best-effort; supports dot paths). Desire path: use --fields for most commands. |
+| `-v`<br>`--verbose` | `bool` |  | Enable verbose logging |
+| `--version` | `kong.VersionFlag` |  | Print version and exit |
+
+## See Also
+
+- [gog calendar](gog-calendar.md)
+- [Command index](README.md)

docs/commands/gog-calendar-calendars.md

@@ -0,0 +1,46 @@
+# `gog calendar calendars`
+
+> Generated from `gog schema --json`. Do not edit this page by hand; run `make docs-commands`.
+
+List calendars
+
+## Usage
+
+```bash
+gog calendar (cal) calendars [flags]
+```
+
+## Parent
+
+- [gog calendar](gog-calendar.md)
+
+## Flags
+
+| Flag | Type | Default | Help |
+| --- | --- | --- | --- |
+| `--access-token` | `string` |  | Use provided access token directly (bypasses stored refresh tokens; token expires in ~1h) |
+| `-a`<br>`--account`<br>`--acct` | `string` |  | Account email for API commands (gmail/calendar/chat/classroom/drive/docs/slides/contacts/tasks/people/sheets/forms/appscript/ads) |
+| `--all`<br>`--all-pages`<br>`--allpages` | `bool` |  | Fetch all pages |
+| `--client` | `string` |  | OAuth client name (selects stored credentials + token bucket) |
+| `--color` | `string` | auto | Color output: auto\|always\|never |
+| `--disable-commands` | `string` |  | Comma-separated list of disabled commands; dot paths allowed |
+| `-n`<br>`--dry-run`<br>`--dryrun`<br>`--noop`<br>`--preview` | `bool` |  | Do not make changes; print intended actions and exit successfully |
+| `--enable-commands` | `string` |  | Comma-separated list of enabled commands; dot paths allowed (restricts CLI) |
+| `--fail-empty`<br>`--non-empty`<br>`--require-results` | `bool` |  | Exit with code 3 if no results |
+| `-y`<br>`--force`<br>`--assume-yes`<br>`--yes` | `bool` |  | Skip confirmations for destructive commands |
+| `--gmail-no-send` | `bool` | false | Block Gmail send operations (agent safety) |
+| `-h`<br>`--help` | `kong.helpFlag` |  | Show context-sensitive help. |
+| `-j`<br>`--json`<br>`--machine` | `bool` | false | Output JSON to stdout (best for scripting) |
+| `--max`<br>`--limit` | `int64` | 100 | Max results |
+| `--no-input`<br>`--non-interactive`<br>`--noninteractive` | `bool` |  | Never prompt; fail instead (useful for CI) |
+| `--page`<br>`--cursor` | `string` |  | Page token |
+| `-p`<br>`--plain`<br>`--tsv` | `bool` | false | Output stable, parseable text to stdout (TSV; no colors) |
+| `--results-only` | `bool` |  | In JSON mode, emit only the primary result (drops envelope fields like nextPageToken) |
+| `--select`<br>`--pick`<br>`--project` | `string` |  | In JSON mode, select comma-separated fields (best-effort; supports dot paths). Desire path: use --fields for most commands. |
+| `-v`<br>`--verbose` | `bool` |  | Enable verbose logging |
+| `--version` | `kong.VersionFlag` |  | Print version and exit |
+
+## See Also
+
+- [gog calendar](gog-calendar.md)
+- [Command index](README.md)

docs/commands/gog-calendar-colors.md

@@ -0,0 +1,42 @@
+# `gog calendar colors`
+
+> Generated from `gog schema --json`. Do not edit this page by hand; run `make docs-commands`.
+
+Show calendar colors
+
+## Usage
+
+```bash
+gog calendar (cal) colors
+```
+
+## Parent
+
+- [gog calendar](gog-calendar.md)
+
+## Flags
+
+| Flag | Type | Default | Help |
+| --- | --- | --- | --- |
+| `--access-token` | `string` |  | Use provided access token directly (bypasses stored refresh tokens; token expires in ~1h) |
+| `-a`<br>`--account`<br>`--acct` | `string` |  | Account email for API commands (gmail/calendar/chat/classroom/drive/docs/slides/contacts/tasks/people/sheets/forms/appscript/ads) |
+| `--client` | `string` |  | OAuth client name (selects stored credentials + token bucket) |
+| `--color` | `string` | auto | Color output: auto\|always\|never |
+| `--disable-commands` | `string` |  | Comma-separated list of disabled commands; dot paths allowed |
+| `-n`<br>`--dry-run`<br>`--dryrun`<br>`--noop`<br>`--preview` | `bool` |  | Do not make changes; print intended actions and exit successfully |
+| `--enable-commands` | `string` |  | Comma-separated list of enabled commands; dot paths allowed (restricts CLI) |
+| `-y`<br>`--force`<br>`--assume-yes`<br>`--yes` | `bool` |  | Skip confirmations for destructive commands |
+| `--gmail-no-send` | `bool` | false | Block Gmail send operations (agent safety) |
+| `-h`<br>`--help` | `kong.helpFlag` |  | Show context-sensitive help. |
+| `-j`<br>`--json`<br>`--machine` | `bool` | false | Output JSON to stdout (best for scripting) |
+| `--no-input`<br>`--non-interactive`<br>`--noninteractive` | `bool` |  | Never prompt; fail instead (useful for CI) |
+| `-p`<br>`--plain`<br>`--tsv` | `bool` | false | Output stable, parseable text to stdout (TSV; no colors) |
+| `--results-only` | `bool` |  | In JSON mode, emit only the primary result (drops envelope fields like nextPageToken) |
+| `--select`<br>`--pick`<br>`--project` | `string` |  | In JSON mode, select comma-separated fields (best-effort; supports dot paths). Desire path: use --fields for most commands. |
+| `-v`<br>`--verbose` | `bool` |  | Enable verbose logging |
+| `--version` | `kong.VersionFlag` |  | Print version and exit |
+
+## See Also
+
+- [gog calendar](gog-calendar.md)
+- [Command index](README.md)

docs/commands/gog-calendar-conflicts.md

@@ -0,0 +1,51 @@
+# `gog calendar conflicts`
+
+> Generated from `gog schema --json`. Do not edit this page by hand; run `make docs-commands`.
+
+Find conflicts
+
+## Usage
+
+```bash
+gog calendar (cal) conflicts [flags]
+```
+
+## Parent
+
+- [gog calendar](gog-calendar.md)
+
+## Flags
+
+| Flag | Type | Default | Help |
+| --- | --- | --- | --- |
+| `--access-token` | `string` |  | Use provided access token directly (bypasses stored refresh tokens; token expires in ~1h) |
+| `-a`<br>`--account`<br>`--acct` | `string` |  | Account email for API commands (gmail/calendar/chat/classroom/drive/docs/slides/contacts/tasks/people/sheets/forms/appscript/ads) |
+| `--all` | `bool` |  | Query all calendars |
+| `--cal` | `[]string` |  | Calendar ID, name, or index (can be repeated) |
+| `--calendars` | `string` |  | Comma-separated calendar IDs, names, or indices from 'calendar calendars' |
+| `--client` | `string` |  | OAuth client name (selects stored credentials + token bucket) |
+| `--color` | `string` | auto | Color output: auto\|always\|never |
+| `--days` | `int` | 0 | Next N days (timezone-aware) |
+| `--disable-commands` | `string` |  | Comma-separated list of disabled commands; dot paths allowed |
+| `-n`<br>`--dry-run`<br>`--dryrun`<br>`--noop`<br>`--preview` | `bool` |  | Do not make changes; print intended actions and exit successfully |
+| `--enable-commands` | `string` |  | Comma-separated list of enabled commands; dot paths allowed (restricts CLI) |
+| `-y`<br>`--force`<br>`--assume-yes`<br>`--yes` | `bool` |  | Skip confirmations for destructive commands |
+| `--from` | `string` |  | Start time (RFC3339, date, or relative: today, tomorrow, monday) |
+| `--gmail-no-send` | `bool` | false | Block Gmail send operations (agent safety) |
+| `-h`<br>`--help` | `kong.helpFlag` |  | Show context-sensitive help. |
+| `-j`<br>`--json`<br>`--machine` | `bool` | false | Output JSON to stdout (best for scripting) |
+| `--no-input`<br>`--non-interactive`<br>`--noninteractive` | `bool` |  | Never prompt; fail instead (useful for CI) |
+| `-p`<br>`--plain`<br>`--tsv` | `bool` | false | Output stable, parseable text to stdout (TSV; no colors) |
+| `--results-only` | `bool` |  | In JSON mode, emit only the primary result (drops envelope fields like nextPageToken) |
+| `--select`<br>`--pick`<br>`--project` | `string` |  | In JSON mode, select comma-separated fields (best-effort; supports dot paths). Desire path: use --fields for most commands. |
+| `--to` | `string` |  | End time (RFC3339, date, or relative) |
+| `--today` | `bool` |  | Today only (timezone-aware) |
+| `-v`<br>`--verbose` | `bool` |  | Enable verbose logging |
+| `--version` | `kong.VersionFlag` |  | Print version and exit |
+| `--week` | `bool` |  | This week (uses --week-start, default Mon) |
+| `--week-start` | `string` |  | Week start day for --week (sun, mon, ...) |
+
+## See Also
+
+- [gog calendar](gog-calendar.md)
+- [Command index](README.md)

docs/commands/gog-calendar-create-calendar.md

@@ -0,0 +1,45 @@
+# `gog calendar create-calendar`
+
+> Generated from `gog schema --json`. Do not edit this page by hand; run `make docs-commands`.
+
+Create a new secondary calendar
+
+## Usage
+
+```bash
+gog calendar (cal) create-calendar (new-calendar) <summary> [flags]
+```
+
+## Parent
+
+- [gog calendar](gog-calendar.md)
+
+## Flags
+
+| Flag | Type | Default | Help |
+| --- | --- | --- | --- |
+| `--access-token` | `string` |  | Use provided access token directly (bypasses stored refresh tokens; token expires in ~1h) |
+| `-a`<br>`--account`<br>`--acct` | `string` |  | Account email for API commands (gmail/calendar/chat/classroom/drive/docs/slides/contacts/tasks/people/sheets/forms/appscript/ads) |
+| `--client` | `string` |  | OAuth client name (selects stored credentials + token bucket) |
+| `--color` | `string` | auto | Color output: auto\|always\|never |
+| `--description` | `string` |  | Calendar description |
+| `--disable-commands` | `string` |  | Comma-separated list of disabled commands; dot paths allowed |
+| `-n`<br>`--dry-run`<br>`--dryrun`<br>`--noop`<br>`--preview` | `bool` |  | Do not make changes; print intended actions and exit successfully |
+| `--enable-commands` | `string` |  | Comma-separated list of enabled commands; dot paths allowed (restricts CLI) |
+| `-y`<br>`--force`<br>`--assume-yes`<br>`--yes` | `bool` |  | Skip confirmations for destructive commands |
+| `--gmail-no-send` | `bool` | false | Block Gmail send operations (agent safety) |
+| `-h`<br>`--help` | `kong.helpFlag` |  | Show context-sensitive help. |
+| `-j`<br>`--json`<br>`--machine` | `bool` | false | Output JSON to stdout (best for scripting) |
+| `--location` | `string` |  | Calendar location |
+| `--no-input`<br>`--non-interactive`<br>`--noninteractive` | `bool` |  | Never prompt; fail instead (useful for CI) |
+| `-p`<br>`--plain`<br>`--tsv` | `bool` | false | Output stable, parseable text to stdout (TSV; no colors) |
+| `--results-only` | `bool` |  | In JSON mode, emit only the primary result (drops envelope fields like nextPageToken) |
+| `--select`<br>`--pick`<br>`--project` | `string` |  | In JSON mode, select comma-separated fields (best-effort; supports dot paths). Desire path: use --fields for most commands. |
+| `--timezone`<br>`--tz` | `string` |  | IANA timezone (e.g., America/New_York) |
+| `-v`<br>`--verbose` | `bool` |  | Enable verbose logging |
+| `--version` | `kong.VersionFlag` |  | Print version and exit |
+
+## See Also
+
+- [gog calendar](gog-calendar.md)
+- [Command index](README.md)

docs/commands/gog-calendar-create.md

@@ -0,0 +1,78 @@
+# `gog calendar create`
+
+> Generated from `gog schema --json`. Do not edit this page by hand; run `make docs-commands`.
+
+Create an event
+
+## Usage
+
+```bash
+gog calendar (cal) create (add,new) <calendarId> [flags]
+```
+
+## Parent
+
+- [gog calendar](gog-calendar.md)
+
+## Flags
+
+| Flag | Type | Default | Help |
+| --- | --- | --- | --- |
+| `--access-token` | `string` |  | Use provided access token directly (bypasses stored refresh tokens; token expires in ~1h) |
+| `-a`<br>`--account`<br>`--acct` | `string` |  | Account email for API commands (gmail/calendar/chat/classroom/drive/docs/slides/contacts/tasks/people/sheets/forms/appscript/ads) |
+| `--all-day` | `bool` |  | All-day event (use date-only in --from/--to) |
+| `--attachment` | `[]string` |  | File attachment URL (can be repeated) |
+| `--attendees` | `string` |  | Comma-separated attendee emails |
+| `--client` | `string` |  | OAuth client name (selects stored credentials + token bucket) |
+| `--color` | `string` | auto | Color output: auto\|always\|never |
+| `--description` | `string` |  | Description |
+| `--disable-commands` | `string` |  | Comma-separated list of disabled commands; dot paths allowed |
+| `-n`<br>`--dry-run`<br>`--dryrun`<br>`--noop`<br>`--preview` | `bool` |  | Do not make changes; print intended actions and exit successfully |
+| `--enable-commands` | `string` |  | Comma-separated list of enabled commands; dot paths allowed (restricts CLI) |
+| `--end-timezone`<br>`--to-timezone` | `string` |  | IANA timezone metadata for --to (e.g., America/New_York) |
+| `--event-color` | `string` |  | Event color ID (1-11). Use 'gog calendar colors' to see available colors. |
+| `--event-type` | `string` |  | Event type: default, focus-time, out-of-office, working-location |
+| `--focus-auto-decline` | `string` |  | Focus Time auto-decline mode: none, all, new |
+| `--focus-chat-status` | `string` |  | Focus Time chat status: available, doNotDisturb |
+| `--focus-decline-message` | `string` |  | Focus Time decline message |
+| `-y`<br>`--force`<br>`--assume-yes`<br>`--yes` | `bool` |  | Skip confirmations for destructive commands |
+| `--from` | `string` |  | Start time (RFC3339) |
+| `--gmail-no-send` | `bool` | false | Block Gmail send operations (agent safety) |
+| `--guests-can-invite` | `*bool` |  | Allow guests to invite others |
+| `--guests-can-modify` | `*bool` |  | Allow guests to modify event |
+| `--guests-can-see-others` | `*bool` |  | Allow guests to see other guests |
+| `-h`<br>`--help` | `kong.helpFlag` |  | Show context-sensitive help. |
+| `-j`<br>`--json`<br>`--machine` | `bool` | false | Output JSON to stdout (best for scripting) |
+| `--location` | `string` |  | Location |
+| `--no-input`<br>`--non-interactive`<br>`--noninteractive` | `bool` |  | Never prompt; fail instead (useful for CI) |
+| `--ooo-auto-decline` | `string` |  | Out of Office auto-decline mode: none, all, new |
+| `--ooo-decline-message` | `string` |  | Out of Office decline message |
+| `-p`<br>`--plain`<br>`--tsv` | `bool` | false | Output stable, parseable text to stdout (TSV; no colors) |
+| `--private-prop` | `[]string` |  | Private extended property (key=value, can be repeated) |
+| `--reminder` | `[]string` |  | Custom reminders as method:duration (e.g., popup:30m, email:1d). Can be repeated (max 5). |
+| `--results-only` | `bool` |  | In JSON mode, emit only the primary result (drops envelope fields like nextPageToken) |
+| `--rrule` | `[]string` |  | Recurrence rules (e.g., 'RRULE:FREQ=MONTHLY;BYMONTHDAY=11'). Can be repeated. |
+| `--select`<br>`--pick`<br>`--project` | `string` |  | In JSON mode, select comma-separated fields (best-effort; supports dot paths). Desire path: use --fields for most commands. |
+| `--send-updates` | `string` |  | Notification mode: all, externalOnly, none (default: none) |
+| `--shared-prop` | `[]string` |  | Shared extended property (key=value, can be repeated) |
+| `--source-title` | `string` |  | Title of the source |
+| `--source-url` | `string` |  | URL where event was created/imported from |
+| `--start-timezone`<br>`--from-timezone` | `string` |  | IANA timezone metadata for --from (e.g., Europe/Rome) |
+| `--summary` | `string` |  | Event summary/title |
+| `--to` | `string` |  | End time (RFC3339) |
+| `--transparency` | `string` |  | Show as busy (opaque) or free (transparent). Aliases: busy, free |
+| `-v`<br>`--verbose` | `bool` |  | Enable verbose logging |
+| `--version` | `kong.VersionFlag` |  | Print version and exit |
+| `--visibility` | `string` |  | Event visibility: default, public, private, confidential |
+| `--with-meet` | `bool` |  | Create a Google Meet video conference for this event |
+| `--working-building-id` | `string` |  | Working location building ID |
+| `--working-custom-label` | `string` |  | Working location custom label |
+| `--working-desk-id` | `string` |  | Working location desk ID |
+| `--working-floor-id` | `string` |  | Working location floor ID |
+| `--working-location-type` | `string` |  | Working location type: home, office, custom |
+| `--working-office-label` | `string` |  | Working location office name/label |
+
+## See Also
+
+- [gog calendar](gog-calendar.md)
+- [Command index](README.md)

docs/commands/gog-calendar-delete.md

@@ -0,0 +1,45 @@
+# `gog calendar delete`
+
+> Generated from `gog schema --json`. Do not edit this page by hand; run `make docs-commands`.
+
+Delete an event
+
+## Usage
+
+```bash
+gog calendar (cal) delete (rm,del,remove) <calendarId> <eventId> [flags]
+```
+
+## Parent
+
+- [gog calendar](gog-calendar.md)
+
+## Flags
+
+| Flag | Type | Default | Help |
+| --- | --- | --- | --- |
+| `--access-token` | `string` |  | Use provided access token directly (bypasses stored refresh tokens; token expires in ~1h) |
+| `-a`<br>`--account`<br>`--acct` | `string` |  | Account email for API commands (gmail/calendar/chat/classroom/drive/docs/slides/contacts/tasks/people/sheets/forms/appscript/ads) |
+| `--client` | `string` |  | OAuth client name (selects stored credentials + token bucket) |
+| `--color` | `string` | auto | Color output: auto\|always\|never |
+| `--disable-commands` | `string` |  | Comma-separated list of disabled commands; dot paths allowed |
+| `-n`<br>`--dry-run`<br>`--dryrun`<br>`--noop`<br>`--preview` | `bool` |  | Do not make changes; print intended actions and exit successfully |
+| `--enable-commands` | `string` |  | Comma-separated list of enabled commands; dot paths allowed (restricts CLI) |
+| `-y`<br>`--force`<br>`--assume-yes`<br>`--yes` | `bool` |  | Skip confirmations for destructive commands |
+| `--gmail-no-send` | `bool` | false | Block Gmail send operations (agent safety) |
+| `-h`<br>`--help` | `kong.helpFlag` |  | Show context-sensitive help. |
+| `-j`<br>`--json`<br>`--machine` | `bool` | false | Output JSON to stdout (best for scripting) |
+| `--no-input`<br>`--non-interactive`<br>`--noninteractive` | `bool` |  | Never prompt; fail instead (useful for CI) |
+| `--original-start` | `string` |  | Original start time of instance (required for scope=single,future) |
+| `-p`<br>`--plain`<br>`--tsv` | `bool` | false | Output stable, parseable text to stdout (TSV; no colors) |
+| `--results-only` | `bool` |  | In JSON mode, emit only the primary result (drops envelope fields like nextPageToken) |
+| `--scope` | `string` | all | For recurring events: single, future, all |
+| `--select`<br>`--pick`<br>`--project` | `string` |  | In JSON mode, select comma-separated fields (best-effort; supports dot paths). Desire path: use --fields for most commands. |
+| `--send-updates` | `string` |  | Notification mode: all, externalOnly, none (default: none) |
+| `-v`<br>`--verbose` | `bool` |  | Enable verbose logging |
+| `--version` | `kong.VersionFlag` |  | Print version and exit |
+
+## See Also
+
+- [gog calendar](gog-calendar.md)
+- [Command index](README.md)

docs/commands/gog-calendar-event.md

@@ -0,0 +1,42 @@
+# `gog calendar event`
+
+> Generated from `gog schema --json`. Do not edit this page by hand; run `make docs-commands`.
+
+Get event
+
+## Usage
+
+```bash
+gog calendar (cal) event (get,info,show) <calendarId> <eventId>
+```
+
+## Parent
+
+- [gog calendar](gog-calendar.md)
+
+## Flags
+
+| Flag | Type | Default | Help |
+| --- | --- | --- | --- |
+| `--access-token` | `string` |  | Use provided access token directly (bypasses stored refresh tokens; token expires in ~1h) |
+| `-a`<br>`--account`<br>`--acct` | `string` |  | Account email for API commands (gmail/calendar/chat/classroom/drive/docs/slides/contacts/tasks/people/sheets/forms/appscript/ads) |
+| `--client` | `string` |  | OAuth client name (selects stored credentials + token bucket) |
+| `--color` | `string` | auto | Color output: auto\|always\|never |
+| `--disable-commands` | `string` |  | Comma-separated list of disabled commands; dot paths allowed |
+| `-n`<br>`--dry-run`<br>`--dryrun`<br>`--noop`<br>`--preview` | `bool` |  | Do not make changes; print intended actions and exit successfully |
+| `--enable-commands` | `string` |  | Comma-separated list of enabled commands; dot paths allowed (restricts CLI) |
+| `-y`<br>`--force`<br>`--assume-yes`<br>`--yes` | `bool` |  | Skip confirmations for destructive commands |
+| `--gmail-no-send` | `bool` | false | Block Gmail send operations (agent safety) |
+| `-h`<br>`--help` | `kong.helpFlag` |  | Show context-sensitive help. |
+| `-j`<br>`--json`<br>`--machine` | `bool` | false | Output JSON to stdout (best for scripting) |
+| `--no-input`<br>`--non-interactive`<br>`--noninteractive` | `bool` |  | Never prompt; fail instead (useful for CI) |
+| `-p`<br>`--plain`<br>`--tsv` | `bool` | false | Output stable, parseable text to stdout (TSV; no colors) |
+| `--results-only` | `bool` |  | In JSON mode, emit only the primary result (drops envelope fields like nextPageToken) |
+| `--select`<br>`--pick`<br>`--project` | `string` |  | In JSON mode, select comma-separated fields (best-effort; supports dot paths). Desire path: use --fields for most commands. |
+| `-v`<br>`--verbose` | `bool` |  | Enable verbose logging |
+| `--version` | `kong.VersionFlag` |  | Print version and exit |
+
+## See Also
+
+- [gog calendar](gog-calendar.md)
+- [Command index](README.md)

docs/commands/gog-calendar-events.md

@@ -0,0 +1,61 @@
+# `gog calendar events`
+
+> Generated from `gog schema --json`. Do not edit this page by hand; run `make docs-commands`.
+
+List events from a calendar or all calendars
+
+## Usage
+
+```bash
+gog calendar (cal) events (list,ls) [<calendarId> ...] [flags]
+```
+
+## Parent
+
+- [gog calendar](gog-calendar.md)
+
+## Flags
+
+| Flag | Type | Default | Help |
+| --- | --- | --- | --- |
+| `--access-token` | `string` |  | Use provided access token directly (bypasses stored refresh tokens; token expires in ~1h) |
+| `-a`<br>`--account`<br>`--acct` | `string` |  | Account email for API commands (gmail/calendar/chat/classroom/drive/docs/slides/contacts/tasks/people/sheets/forms/appscript/ads) |
+| `--all` | `bool` |  | Fetch events from all calendars |
+| `--all-pages`<br>`--allpages` | `bool` |  | Fetch all pages |
+| `--cal` | `[]string` |  | Calendar ID or name (can be repeated) |
+| `--calendars` | `string` |  | Comma-separated calendar IDs, names, or indices from 'calendar calendars' |
+| `--client` | `string` |  | OAuth client name (selects stored credentials + token bucket) |
+| `--color` | `string` | auto | Color output: auto\|always\|never |
+| `--days` | `int` | 0 | Next N days (timezone-aware) |
+| `--disable-commands` | `string` |  | Comma-separated list of disabled commands; dot paths allowed |
+| `-n`<br>`--dry-run`<br>`--dryrun`<br>`--noop`<br>`--preview` | `bool` |  | Do not make changes; print intended actions and exit successfully |
+| `--enable-commands` | `string` |  | Comma-separated list of enabled commands; dot paths allowed (restricts CLI) |
+| `--fail-empty`<br>`--non-empty`<br>`--require-results` | `bool` |  | Exit with code 3 if no results |
+| `--fields` | `string` |  | Comma-separated fields to return |
+| `-y`<br>`--force`<br>`--assume-yes`<br>`--yes` | `bool` |  | Skip confirmations for destructive commands |
+| `--from` | `string` |  | Start time (RFC3339 with timezone, date, or relative: today, tomorrow, monday) |
+| `--gmail-no-send` | `bool` | false | Block Gmail send operations (agent safety) |
+| `-h`<br>`--help` | `kong.helpFlag` |  | Show context-sensitive help. |
+| `-j`<br>`--json`<br>`--machine` | `bool` | false | Output JSON to stdout (best for scripting) |
+| `--max`<br>`--limit` | `int64` | 10 | Max results |
+| `--no-input`<br>`--non-interactive`<br>`--noninteractive` | `bool` |  | Never prompt; fail instead (useful for CI) |
+| `--page`<br>`--cursor` | `string` |  | Page token |
+| `-p`<br>`--plain`<br>`--tsv` | `bool` | false | Output stable, parseable text to stdout (TSV; no colors) |
+| `--private-prop-filter` | `string` |  | Filter by private extended property (key=value) |
+| `--query` | `string` |  | Free text search |
+| `--results-only` | `bool` |  | In JSON mode, emit only the primary result (drops envelope fields like nextPageToken) |
+| `--select`<br>`--pick`<br>`--project` | `string` |  | In JSON mode, select comma-separated fields (best-effort; supports dot paths). Desire path: use --fields for most commands. |
+| `--shared-prop-filter` | `string` |  | Filter by shared extended property (key=value) |
+| `--to` | `string` |  | End time (RFC3339 with timezone, date, or relative) |
+| `--today` | `bool` |  | Today only (timezone-aware) |
+| `--tomorrow` | `bool` |  | Tomorrow only (timezone-aware) |
+| `-v`<br>`--verbose` | `bool` |  | Enable verbose logging |
+| `--version` | `kong.VersionFlag` |  | Print version and exit |
+| `--week` | `bool` |  | This week (uses --week-start, default Mon) |
+| `--week-start` | `string` |  | Week start day for --week (sun, mon, ...) |
+| `--weekday` | `bool` | false | Include start/end day-of-week columns |
+
+## See Also
+
+- [gog calendar](gog-calendar.md)
+- [Command index](README.md)

docs/commands/gog-calendar-focus-time.md

@@ -0,0 +1,49 @@
+# `gog calendar focus-time`
+
+> Generated from `gog schema --json`. Do not edit this page by hand; run `make docs-commands`.
+
+Create a Focus Time block
+
+## Usage
+
+```bash
+gog calendar (cal) focus-time (focus) --from=STRING --to=STRING [<calendarId>] [flags]
+```
+
+## Parent
+
+- [gog calendar](gog-calendar.md)
+
+## Flags
+
+| Flag | Type | Default | Help |
+| --- | --- | --- | --- |
+| `--access-token` | `string` |  | Use provided access token directly (bypasses stored refresh tokens; token expires in ~1h) |
+| `-a`<br>`--account`<br>`--acct` | `string` |  | Account email for API commands (gmail/calendar/chat/classroom/drive/docs/slides/contacts/tasks/people/sheets/forms/appscript/ads) |
+| `--auto-decline` | `string` | all | Auto-decline mode: none, all, new |
+| `--chat-status` | `string` | doNotDisturb | Chat status: available, doNotDisturb |
+| `--client` | `string` |  | OAuth client name (selects stored credentials + token bucket) |
+| `--color` | `string` | auto | Color output: auto\|always\|never |
+| `--decline-message` | `string` |  | Message for declined invitations |
+| `--disable-commands` | `string` |  | Comma-separated list of disabled commands; dot paths allowed |
+| `-n`<br>`--dry-run`<br>`--dryrun`<br>`--noop`<br>`--preview` | `bool` |  | Do not make changes; print intended actions and exit successfully |
+| `--enable-commands` | `string` |  | Comma-separated list of enabled commands; dot paths allowed (restricts CLI) |
+| `-y`<br>`--force`<br>`--assume-yes`<br>`--yes` | `bool` |  | Skip confirmations for destructive commands |
+| `--from` | `string` |  | Start time (RFC3339) |
+| `--gmail-no-send` | `bool` | false | Block Gmail send operations (agent safety) |
+| `-h`<br>`--help` | `kong.helpFlag` |  | Show context-sensitive help. |
+| `-j`<br>`--json`<br>`--machine` | `bool` | false | Output JSON to stdout (best for scripting) |
+| `--no-input`<br>`--non-interactive`<br>`--noninteractive` | `bool` |  | Never prompt; fail instead (useful for CI) |
+| `-p`<br>`--plain`<br>`--tsv` | `bool` | false | Output stable, parseable text to stdout (TSV; no colors) |
+| `--results-only` | `bool` |  | In JSON mode, emit only the primary result (drops envelope fields like nextPageToken) |
+| `--rrule` | `[]string` |  | Recurrence rules. Can be repeated. |
+| `--select`<br>`--pick`<br>`--project` | `string` |  | In JSON mode, select comma-separated fields (best-effort; supports dot paths). Desire path: use --fields for most commands. |
+| `--summary` | `string` | Focus Time | Focus time title |
+| `--to` | `string` |  | End time (RFC3339) |
+| `-v`<br>`--verbose` | `bool` |  | Enable verbose logging |
+| `--version` | `kong.VersionFlag` |  | Print version and exit |
+
+## See Also
+
+- [gog calendar](gog-calendar.md)
+- [Command index](README.md)

docs/commands/gog-calendar-freebusy.md

@@ -0,0 +1,46 @@
+# `gog calendar freebusy`
+
+> Generated from `gog schema --json`. Do not edit this page by hand; run `make docs-commands`.
+
+Get free/busy
+
+## Usage
+
+```bash
+gog calendar (cal) freebusy [<calendarIds>] [flags]
+```
+
+## Parent
+
+- [gog calendar](gog-calendar.md)
+
+## Flags
+
+| Flag | Type | Default | Help |
+| --- | --- | --- | --- |
+| `--access-token` | `string` |  | Use provided access token directly (bypasses stored refresh tokens; token expires in ~1h) |
+| `-a`<br>`--account`<br>`--acct` | `string` |  | Account email for API commands (gmail/calendar/chat/classroom/drive/docs/slides/contacts/tasks/people/sheets/forms/appscript/ads) |
+| `--all` | `bool` |  | Query all calendars |
+| `--cal` | `[]string` |  | Calendar ID, name, or index (can be repeated) |
+| `--client` | `string` |  | OAuth client name (selects stored credentials + token bucket) |
+| `--color` | `string` | auto | Color output: auto\|always\|never |
+| `--disable-commands` | `string` |  | Comma-separated list of disabled commands; dot paths allowed |
+| `-n`<br>`--dry-run`<br>`--dryrun`<br>`--noop`<br>`--preview` | `bool` |  | Do not make changes; print intended actions and exit successfully |
+| `--enable-commands` | `string` |  | Comma-separated list of enabled commands; dot paths allowed (restricts CLI) |
+| `-y`<br>`--force`<br>`--assume-yes`<br>`--yes` | `bool` |  | Skip confirmations for destructive commands |
+| `--from` | `string` |  | Start time (RFC3339, required) |
+| `--gmail-no-send` | `bool` | false | Block Gmail send operations (agent safety) |
+| `-h`<br>`--help` | `kong.helpFlag` |  | Show context-sensitive help. |
+| `-j`<br>`--json`<br>`--machine` | `bool` | false | Output JSON to stdout (best for scripting) |
+| `--no-input`<br>`--non-interactive`<br>`--noninteractive` | `bool` |  | Never prompt; fail instead (useful for CI) |
+| `-p`<br>`--plain`<br>`--tsv` | `bool` | false | Output stable, parseable text to stdout (TSV; no colors) |
+| `--results-only` | `bool` |  | In JSON mode, emit only the primary result (drops envelope fields like nextPageToken) |
+| `--select`<br>`--pick`<br>`--project` | `string` |  | In JSON mode, select comma-separated fields (best-effort; supports dot paths). Desire path: use --fields for most commands. |
+| `--to` | `string` |  | End time (RFC3339, required) |
+| `-v`<br>`--verbose` | `bool` |  | Enable verbose logging |
+| `--version` | `kong.VersionFlag` |  | Print version and exit |
+
+## See Also
+
+- [gog calendar](gog-calendar.md)
+- [Command index](README.md)

docs/commands/gog-calendar-move.md

@@ -0,0 +1,43 @@
+# `gog calendar move`
+
+> Generated from `gog schema --json`. Do not edit this page by hand; run `make docs-commands`.
+
+Move an event to another calendar
+
+## Usage
+
+```bash
+gog calendar (cal) move (transfer) <calendarId> <eventId> <destinationCalendarId> [flags]
+```
+
+## Parent
+
+- [gog calendar](gog-calendar.md)
+
+## Flags
+
+| Flag | Type | Default | Help |
+| --- | --- | --- | --- |
+| `--access-token` | `string` |  | Use provided access token directly (bypasses stored refresh tokens; token expires in ~1h) |
+| `-a`<br>`--account`<br>`--acct` | `string` |  | Account email for API commands (gmail/calendar/chat/classroom/drive/docs/slides/contacts/tasks/people/sheets/forms/appscript/ads) |
+| `--client` | `string` |  | OAuth client name (selects stored credentials + token bucket) |
+| `--color` | `string` | auto | Color output: auto\|always\|never |
+| `--disable-commands` | `string` |  | Comma-separated list of disabled commands; dot paths allowed |
+| `-n`<br>`--dry-run`<br>`--dryrun`<br>`--noop`<br>`--preview` | `bool` |  | Do not make changes; print intended actions and exit successfully |
+| `--enable-commands` | `string` |  | Comma-separated list of enabled commands; dot paths allowed (restricts CLI) |
+| `-y`<br>`--force`<br>`--assume-yes`<br>`--yes` | `bool` |  | Skip confirmations for destructive commands |
+| `--gmail-no-send` | `bool` | false | Block Gmail send operations (agent safety) |
+| `-h`<br>`--help` | `kong.helpFlag` |  | Show context-sensitive help. |
+| `-j`<br>`--json`<br>`--machine` | `bool` | false | Output JSON to stdout (best for scripting) |
+| `--no-input`<br>`--non-interactive`<br>`--noninteractive` | `bool` |  | Never prompt; fail instead (useful for CI) |
+| `-p`<br>`--plain`<br>`--tsv` | `bool` | false | Output stable, parseable text to stdout (TSV; no colors) |
+| `--results-only` | `bool` |  | In JSON mode, emit only the primary result (drops envelope fields like nextPageToken) |
+| `--select`<br>`--pick`<br>`--project` | `string` |  | In JSON mode, select comma-separated fields (best-effort; supports dot paths). Desire path: use --fields for most commands. |
+| `--send-updates` | `string` |  | Notification mode: all, externalOnly, none (default: none) |
+| `-v`<br>`--verbose` | `bool` |  | Enable verbose logging |
+| `--version` | `kong.VersionFlag` |  | Print version and exit |
+
+## See Also
+
+- [gog calendar](gog-calendar.md)
+- [Command index](README.md)

docs/commands/gog-calendar-out-of-office.md

@@ -0,0 +1,48 @@
+# `gog calendar out-of-office`
+
+> Generated from `gog schema --json`. Do not edit this page by hand; run `make docs-commands`.
+
+Create an Out of Office event
+
+## Usage
+
+```bash
+gog calendar (cal) out-of-office (ooo) --from=STRING --to=STRING [<calendarId>] [flags]
+```
+
+## Parent
+
+- [gog calendar](gog-calendar.md)
+
+## Flags
+
+| Flag | Type | Default | Help |
+| --- | --- | --- | --- |
+| `--access-token` | `string` |  | Use provided access token directly (bypasses stored refresh tokens; token expires in ~1h) |
+| `-a`<br>`--account`<br>`--acct` | `string` |  | Account email for API commands (gmail/calendar/chat/classroom/drive/docs/slides/contacts/tasks/people/sheets/forms/appscript/ads) |
+| `--all-day` | `bool` |  | Create as all-day event |
+| `--auto-decline` | `string` | all | Auto-decline mode: none, all, new |
+| `--client` | `string` |  | OAuth client name (selects stored credentials + token bucket) |
+| `--color` | `string` | auto | Color output: auto\|always\|never |
+| `--decline-message` | `string` | I am out of office and will respond when I return. | Message for declined invitations |
+| `--disable-commands` | `string` |  | Comma-separated list of disabled commands; dot paths allowed |
+| `-n`<br>`--dry-run`<br>`--dryrun`<br>`--noop`<br>`--preview` | `bool` |  | Do not make changes; print intended actions and exit successfully |
+| `--enable-commands` | `string` |  | Comma-separated list of enabled commands; dot paths allowed (restricts CLI) |
+| `-y`<br>`--force`<br>`--assume-yes`<br>`--yes` | `bool` |  | Skip confirmations for destructive commands |
+| `--from` | `string` |  | Start date or datetime (RFC3339 or YYYY-MM-DD) |
+| `--gmail-no-send` | `bool` | false | Block Gmail send operations (agent safety) |
+| `-h`<br>`--help` | `kong.helpFlag` |  | Show context-sensitive help. |
+| `-j`<br>`--json`<br>`--machine` | `bool` | false | Output JSON to stdout (best for scripting) |
+| `--no-input`<br>`--non-interactive`<br>`--noninteractive` | `bool` |  | Never prompt; fail instead (useful for CI) |
+| `-p`<br>`--plain`<br>`--tsv` | `bool` | false | Output stable, parseable text to stdout (TSV; no colors) |
+| `--results-only` | `bool` |  | In JSON mode, emit only the primary result (drops envelope fields like nextPageToken) |
+| `--select`<br>`--pick`<br>`--project` | `string` |  | In JSON mode, select comma-separated fields (best-effort; supports dot paths). Desire path: use --fields for most commands. |
+| `--summary` | `string` | Out of office | Out of office title |
+| `--to` | `string` |  | End date or datetime (RFC3339 or YYYY-MM-DD) |
+| `-v`<br>`--verbose` | `bool` |  | Enable verbose logging |
+| `--version` | `kong.VersionFlag` |  | Print version and exit |
+
+## See Also
+
+- [gog calendar](gog-calendar.md)
+- [Command index](README.md)

docs/commands/gog-calendar-propose-time.md

@@ -0,0 +1,45 @@
+# `gog calendar propose-time`
+
+> Generated from `gog schema --json`. Do not edit this page by hand; run `make docs-commands`.
+
+Generate URL to propose a new meeting time (browser-only feature)
+
+## Usage
+
+```bash
+gog calendar (cal) propose-time <calendarId> <eventId> [flags]
+```
+
+## Parent
+
+- [gog calendar](gog-calendar.md)
+
+## Flags
+
+| Flag | Type | Default | Help |
+| --- | --- | --- | --- |
+| `--access-token` | `string` |  | Use provided access token directly (bypasses stored refresh tokens; token expires in ~1h) |
+| `-a`<br>`--account`<br>`--acct` | `string` |  | Account email for API commands (gmail/calendar/chat/classroom/drive/docs/slides/contacts/tasks/people/sheets/forms/appscript/ads) |
+| `--client` | `string` |  | OAuth client name (selects stored credentials + token bucket) |
+| `--color` | `string` | auto | Color output: auto\|always\|never |
+| `--comment` | `string` |  | Comment to include with decline (implies --decline) |
+| `--decline` | `bool` |  | Also decline the event (notifies organizer) |
+| `--disable-commands` | `string` |  | Comma-separated list of disabled commands; dot paths allowed |
+| `-n`<br>`--dry-run`<br>`--dryrun`<br>`--noop`<br>`--preview` | `bool` |  | Do not make changes; print intended actions and exit successfully |
+| `--enable-commands` | `string` |  | Comma-separated list of enabled commands; dot paths allowed (restricts CLI) |
+| `-y`<br>`--force`<br>`--assume-yes`<br>`--yes` | `bool` |  | Skip confirmations for destructive commands |
+| `--gmail-no-send` | `bool` | false | Block Gmail send operations (agent safety) |
+| `-h`<br>`--help` | `kong.helpFlag` |  | Show context-sensitive help. |
+| `-j`<br>`--json`<br>`--machine` | `bool` | false | Output JSON to stdout (best for scripting) |
+| `--no-input`<br>`--non-interactive`<br>`--noninteractive` | `bool` |  | Never prompt; fail instead (useful for CI) |
+| `--open` | `bool` |  | Open the URL in browser automatically |
+| `-p`<br>`--plain`<br>`--tsv` | `bool` | false | Output stable, parseable text to stdout (TSV; no colors) |
+| `--results-only` | `bool` |  | In JSON mode, emit only the primary result (drops envelope fields like nextPageToken) |
+| `--select`<br>`--pick`<br>`--project` | `string` |  | In JSON mode, select comma-separated fields (best-effort; supports dot paths). Desire path: use --fields for most commands. |
+| `-v`<br>`--verbose` | `bool` |  | Enable verbose logging |
+| `--version` | `kong.VersionFlag` |  | Print version and exit |
+
+## See Also
+
+- [gog calendar](gog-calendar.md)
+- [Command index](README.md)

docs/commands/gog-calendar-raw.md

@@ -0,0 +1,43 @@
+# `gog calendar raw`
+
+> Generated from `gog schema --json`. Do not edit this page by hand; run `make docs-commands`.
+
+Dump raw Google Calendar API response as JSON (Events.Get; lossless; for scripting and LLM consumption)
+
+## Usage
+
+```bash
+gog calendar (cal) raw <calendarId> <eventId> [flags]
+```
+
+## Parent
+
+- [gog calendar](gog-calendar.md)
+
+## Flags
+
+| Flag | Type | Default | Help |
+| --- | --- | --- | --- |
+| `--access-token` | `string` |  | Use provided access token directly (bypasses stored refresh tokens; token expires in ~1h) |
+| `-a`<br>`--account`<br>`--acct` | `string` |  | Account email for API commands (gmail/calendar/chat/classroom/drive/docs/slides/contacts/tasks/people/sheets/forms/appscript/ads) |
+| `--client` | `string` |  | OAuth client name (selects stored credentials + token bucket) |
+| `--color` | `string` | auto | Color output: auto\|always\|never |
+| `--disable-commands` | `string` |  | Comma-separated list of disabled commands; dot paths allowed |
+| `-n`<br>`--dry-run`<br>`--dryrun`<br>`--noop`<br>`--preview` | `bool` |  | Do not make changes; print intended actions and exit successfully |
+| `--enable-commands` | `string` |  | Comma-separated list of enabled commands; dot paths allowed (restricts CLI) |
+| `-y`<br>`--force`<br>`--assume-yes`<br>`--yes` | `bool` |  | Skip confirmations for destructive commands |
+| `--gmail-no-send` | `bool` | false | Block Gmail send operations (agent safety) |
+| `-h`<br>`--help` | `kong.helpFlag` |  | Show context-sensitive help. |
+| `-j`<br>`--json`<br>`--machine` | `bool` | false | Output JSON to stdout (best for scripting) |
+| `--no-input`<br>`--non-interactive`<br>`--noninteractive` | `bool` |  | Never prompt; fail instead (useful for CI) |
+| `-p`<br>`--plain`<br>`--tsv` | `bool` | false | Output stable, parseable text to stdout (TSV; no colors) |
+| `--pretty` | `bool` |  | Pretty-print JSON (default: compact single-line) |
+| `--results-only` | `bool` |  | In JSON mode, emit only the primary result (drops envelope fields like nextPageToken) |
+| `--select`<br>`--pick`<br>`--project` | `string` |  | In JSON mode, select comma-separated fields (best-effort; supports dot paths). Desire path: use --fields for most commands. |
+| `-v`<br>`--verbose` | `bool` |  | Enable verbose logging |
+| `--version` | `kong.VersionFlag` |  | Print version and exit |
+
+## See Also
+
+- [gog calendar](gog-calendar.md)
+- [Command index](README.md)

docs/commands/gog-calendar-respond.md

@@ -0,0 +1,44 @@
+# `gog calendar respond`
+
+> Generated from `gog schema --json`. Do not edit this page by hand; run `make docs-commands`.
+
+Respond to an event invitation
+
+## Usage
+
+```bash
+gog calendar (cal) respond (rsvp,reply) <calendarId> <eventId> [flags]
+```
+
+## Parent
+
+- [gog calendar](gog-calendar.md)
+
+## Flags
+
+| Flag | Type | Default | Help |
+| --- | --- | --- | --- |
+| `--access-token` | `string` |  | Use provided access token directly (bypasses stored refresh tokens; token expires in ~1h) |
+| `-a`<br>`--account`<br>`--acct` | `string` |  | Account email for API commands (gmail/calendar/chat/classroom/drive/docs/slides/contacts/tasks/people/sheets/forms/appscript/ads) |
+| `--client` | `string` |  | OAuth client name (selects stored credentials + token bucket) |
+| `--color` | `string` | auto | Color output: auto\|always\|never |
+| `--comment` | `string` |  | Optional comment/note to include with response |
+| `--disable-commands` | `string` |  | Comma-separated list of disabled commands; dot paths allowed |
+| `-n`<br>`--dry-run`<br>`--dryrun`<br>`--noop`<br>`--preview` | `bool` |  | Do not make changes; print intended actions and exit successfully |
+| `--enable-commands` | `string` |  | Comma-separated list of enabled commands; dot paths allowed (restricts CLI) |
+| `-y`<br>`--force`<br>`--assume-yes`<br>`--yes` | `bool` |  | Skip confirmations for destructive commands |
+| `--gmail-no-send` | `bool` | false | Block Gmail send operations (agent safety) |
+| `-h`<br>`--help` | `kong.helpFlag` |  | Show context-sensitive help. |
+| `-j`<br>`--json`<br>`--machine` | `bool` | false | Output JSON to stdout (best for scripting) |
+| `--no-input`<br>`--non-interactive`<br>`--noninteractive` | `bool` |  | Never prompt; fail instead (useful for CI) |
+| `-p`<br>`--plain`<br>`--tsv` | `bool` | false | Output stable, parseable text to stdout (TSV; no colors) |
+| `--results-only` | `bool` |  | In JSON mode, emit only the primary result (drops envelope fields like nextPageToken) |
+| `--select`<br>`--pick`<br>`--project` | `string` |  | In JSON mode, select comma-separated fields (best-effort; supports dot paths). Desire path: use --fields for most commands. |
+| `--status` | `string` |  | Response status (accepted, declined, tentative, needsAction) |
+| `-v`<br>`--verbose` | `bool` |  | Enable verbose logging |
+| `--version` | `kong.VersionFlag` |  | Print version and exit |
+
+## See Also
+
+- [gog calendar](gog-calendar.md)
+- [Command index](README.md)