google-drive

Drive Google Drive via curl + jq. The user's OAuth bearer token is in $GOOGLE_DRIVE_TOKEN; every call needs it as Authorization: Bearer $GOOGLE_DRIVE_TOKEN. At minimum the token carries drive.readonly plus the identity scopes (openid email profile); if the user opted in to write at install time it also carries the broader drive scope (full read + write).

The Drive API returns standard JSON; failures surface as {"error": {"code": 401|403|..., "message": "..."}} — show that error verbatim to the user. 401 means the token expired and the user must re-install the connector. 403 insufficientPermissions on a write means the user did not grant the drive scope at install — ask them to re-install with the read+write box checked.

Before any destructive write (renaming, moving, trashing, or bulk-mutating files) show the exact target list and ask the user to confirm. Never trash by guessing an id — always echo back the file name + path you're about to touch.