gog-restricted

# gog (restricted)

Google Workspace CLI. Runs through a security wrapper — only whitelisted commands are allowed, everything else is hard-blocked.

## Account

- Default: via GOG_ACCOUNT env
- No need to pass `--account` unless overriding
- Always use `--json` for parseable output
- Always use `--no-input` to avoid interactive prompts

## Setup

Run `script/setup.sh` to install the security wrapper. This moves the real `gog` binary to `.gog-real` and replaces it with a wrapper that enforces the allowlist below. The script is idempotent — safe to run more than once.

## Allowed Commands

### System

- `gog --version` — print version and exit
- `gog --help` — show top-level help
- `gog auth status` — show auth configuration and keyring backend
- `gog auth list` — list stored accounts
- `gog auth services` — list supported auth services and scopes

### Gmail — Read

- `gog gmail search '<query>' --max N --json` — search threads using Gmail query syntax
- `gog gmail read <messageId>` — read a message (alias for `gmail thread`)
- `gog gmail get <messageId> --json` — get a message (full|metadata|raw)
- `gog gmail thread <threadId> --json` — get a thread with all messages
- `gog gmail thread attachments <threadId>` — list all attachments in a thread
- `gog gmail messages search '<query>' --max N --json` — search messages using Gmail query syntax
- `gog gmail attachment <messageId> <attachmentId>` — download a single attachment
- `gog gmail url <threadId>` — print Gmail web URL for a thread
- `gog gmail history` — Gmail change history

### Gmail — Organize

Organize operations use label modification. For example, to trash a message, add the `TRASH` label via `thread modify`; to archive, remove the `INBOX` label; to mark as read, remove the `UNREAD` label.

- `gog gmail thread modify <threadId> --add <label> --remove <label>` — modify labels on a thread
- `gog gmail batch modify <messageId> ... --add <label> --remove <label>` — modify labels on multiple messages

### Gmail...