# Google Drive private document retrieval with gog

Use when the user references a Google Drive folder/document and the configured `gog` CLI account should be used.

## Workflow

1. Use the configured Google account (for this environment often `friday.uplink@gmail.com` when user context says so).
2. Set non-interactive environment variables for every command that reads OAuth tokens. In this Hermes profile the durable secret file is `/home/agent/.hermes/secrets/gog_keyring.env` (mode 600). **Source it instead of asking the user for the password. Never print its contents.**
   ```bash
   export HOME=/home/agent
   export XDG_CONFIG_HOME=/home/agent/.config
   set -a
   [ -f /home/agent/.hermes/secrets/gog_keyring.env ] && . /home/agent/.hermes/secrets/gog_keyring.env
   set +a
   ```
   If `GOG_KEYRING_PASSWORD` is still empty, search prior local scripts/session notes for already-configured usage before telling the user it is missing. Known historical place to check: `/home/agent/tmp/franzoesisch_import/resume_drive_upload.py` (do not reveal the value).
3. Prefer JSON for automation:
   ```bash
   gog -a <account> drive search "<query>" --json --results-only --no-input
   gog -a <account> drive ls --parent <folder_id> --json --no-input
   gog -a <account> drive download <file_id> --no-input
   ```
4. If `gog` reports `no TTY available for keyring file backend password prompt`, do not ask the user to paste secrets immediately. First check already-configured memory/secret conventions for the keyring password, and use it only as an environment variable with redacted command logging.
5. Downloaded Drive files may land under `~/.config/gogcli/drive-downloads/` with an ID-prefixed filename; copy them into a task-local working directory before processing.
6. When re-checking whether Drive contains the same private originals already analysed locally, compare SHA-256 hashes of the downloaded and archived files. Matching hashes are stronger evidence than matching filenames or timestamps.
7. For generated report + interactive-HTML pairs, upload both to the same target folder and set the HTML MIME type explicitly:
   ```bash
   gog -a <account> drive upload report.pdf --parent <folder_id> --json --results-only --no-input
   gog -a <account> drive upload calculator.html --parent <folder_id> --mime-type text/html --json --results-only --no-input
   ```
   Google Drive may not execute HTML in its preview. Tell the user to download and open it locally; if offline use matters, embed JavaScript dependencies in the HTML rather than relying on a CDN.
8. Verify every uploaded artifact with `gog drive get <file_id> --json --no-input`. Confirm name, MIME type, size, parent folder ID, and stable `webViewLink` before reporting success.

## Safety

- Never print OAuth tokens, keyring passwords, PATs, or full credential files.
- Do not commit downloaded private documents or generated reports into Git repos.
- Prefer read/list/search before mutating Drive.