@persistmemory/cli 0.1.1 → 0.2.0

package/dist/bin.js

@@ -234,6 +234,27 @@ var HttpClient = class {
       ...options ? { options } : {}
     });
   }
+  /** POST with a file as the body. The type describes the bytes, not JSON. */
+  async postBytes(path, bytes, contentType, query, options) {
+    return this.#request({
+      method: "POST",
+      path,
+      rawBody: bytes,
+      contentType,
+      ...query ? { query } : {},
+      ...options ? { options } : {}
+    });
+  }
+  /** GET that returns bytes rather than JSON, for downloading a file. */
+  async getBytes(path, query, options) {
+    return this.#request({
+      method: "GET",
+      path,
+      rawResponse: true,
+      ...query ? { query } : {},
+      ...options ? { options } : {}
+    });
+  }
   async patch(path, body, options) {
     return this.#request({
       method: "PATCH",
@@ -286,11 +307,20 @@ var HttpClient = class {
         this.#fetch(url, {
           method: request.method,
           headers: this.#headers(request),
-          ...request.body !== void 0 ? { body: JSON.stringify(request.body) } : {},
+          ...request.rawBody !== void 0 ? { body: request.rawBody } : request.body !== void 0 ? { body: JSON.stringify(request.body) } : {},
           signal: deadline.signal
         }),
         deadline.signal
       );
+      if (request.rawResponse && response.ok) {
+        const disposition = response.headers.get("content-disposition") ?? "";
+        const named = /filename="([^"]+)"/.exec(disposition)?.[1];
+        return {
+          bytes: new Uint8Array(await response.arrayBuffer()),
+          contentType: response.headers.get("content-type") ?? "application/octet-stream",
+          ...named ? { filename: named } : {}
+        };
+      }
       const payload = await readBody(response);
       if (!response.ok) throw errorFromResponse(response.status, payload, response.headers);
       return payload;
@@ -311,9 +341,11 @@ var HttpClient = class {
     return {
       // The only place the key is ever read.
       authorization: `Bearer ${this.#apiKey}`,
-      accept: "application/json",
+      // A download route answers with the file's own type, so `*/*` rather
+      // than a promise to accept only JSON that the server would have to break.
+      accept: request.rawResponse ? "*/*" : "application/json",
       "user-agent": this.#userAgent,
-      ...request.body !== void 0 ? { "content-type": "application/json" } : {},
+      ...request.rawBody !== void 0 ? { "content-type": request.contentType ?? "application/octet-stream" } : request.body !== void 0 ? { "content-type": "application/json" } : {},
       ...request.options?.idempotencyKey ? { "idempotency-key": request.options.idempotencyKey } : {}
     };
   }
@@ -344,7 +376,7 @@ var SignalFired = class extends Error {
 };
 function untilAborted(work, signal) {
   work.catch(() => void 0);
-  return new Promise((resolve6, reject) => {
+  return new Promise((resolve8, reject) => {
     if (signal.aborted) {
       reject(new SignalFired());
       return;
@@ -354,7 +386,7 @@ function untilAborted(work, signal) {
     work.then(
       (value) => {
         signal.removeEventListener("abort", onAbort);
-        resolve6(value);
+        resolve8(value);
       },
       (error) => {
         signal.removeEventListener("abort", onAbort);
@@ -364,14 +396,14 @@ function untilAborted(work, signal) {
   });
 }
 function defaultSleep(ms, signal) {
-  return new Promise((resolve6, reject) => {
+  return new Promise((resolve8, reject) => {
     if (signal?.aborted) {
       reject(new AbortError());
       return;
     }
     const timer = setTimeout(() => {
       signal?.removeEventListener("abort", onAbort);
-      resolve6();
+      resolve8();
     }, ms);
     function onAbort() {
       clearTimeout(timer);
@@ -558,6 +590,58 @@ var Spaces = class {
   async create(params, options) {
     return this.#http.post("/api/v1/spaces", params, options);
   }
+  /**
+   * Deletes a Space. You must say what happens to what is in it.
+   *
+   * There is no default, here or in the API, and that is deliberate: "delete
+   * this Space" means the label to some people and everything inside it to
+   * others, and a client that guessed would destroy or keep somebody's
+   * material without being asked.
+   *
+   * `delete` never destroys a memory that is filed in another Space as well —
+   * that one is detached and left alone. `deleted` and `kept` come back so you
+   * can say what actually happened.
+   */
+  async delete(id, params, options) {
+    return this.#http.delete(
+      `/api/v1/spaces/${encodeURIComponent(id)}`,
+      params,
+      options
+    );
+  }
+  /**
+   * Merges Spaces into a NEW one, leaving every source exactly as it was.
+   *
+   * Additive, not destructive: a memory ends up in the sources AND the result,
+   * every existing search over a source returns what it did before, and
+   * undoing it is deleting the Space this returns. A memory in two sources is
+   * filed once.
+   */
+  async merge(params, options) {
+    return this.#http.post(
+      "/api/v1/spaces/merge",
+      params,
+      options
+    );
+  }
+  /**
+   * The Space this account files into when a capture names none.
+   *
+   * `{}` — an object with no `space` — means there is no default, which is the
+   * normal state rather than a gap. It is also what comes back after the Space
+   * somebody chose has been deleted.
+   */
+  async getDefault(options) {
+    return this.#http.get("/api/v1/spaces/default", void 0, options);
+  }
+  /** `null` clears it. Not the same as omitting it, which is why the type says so. */
+  async setDefault(spaceId, options) {
+    return this.#http.patch(
+      "/api/v1/spaces/default",
+      { spaceId },
+      options
+    );
+  }
   /** Renaming, retention, and archiving - `archived` is a field, not a verb. */
   async update(id, params, options) {
     return this.#http.patch(`/api/v1/spaces/${encodeURIComponent(id)}`, params, options);
@@ -838,6 +922,119 @@ var Conversations = class {
     );
   }
 };
+var Google = class {
+  #http;
+  constructor(http) {
+    this.#http = http;
+  }
+  /** Files by name, newest first. Omit the query for recently changed ones. */
+  async searchDrive(params = {}, options) {
+    return this.#http.get(
+      "/api/v1/google/drive/files",
+      {
+        ...params.query !== void 0 ? { query: params.query } : {},
+        ...params.limit !== void 0 ? { limit: params.limit } : {}
+      },
+      options
+    );
+  }
+  async getDriveFile(fileId, options) {
+    return this.#http.get(
+      `/api/v1/google/drive/files/${encodeURIComponent(fileId)}`,
+      void 0,
+      options
+    );
+  }
+  /**
+   * The bytes of a Drive file.
+   *
+   * A Google Doc, Sheet or Slide holds no bytes of its own and is exported on
+   * the way - a document as PDF, a spreadsheet as CSV - so `filename` comes
+   * back describing what it BECAME. Writing it under the id instead produces a
+   * file nothing will open.
+   */
+  async downloadDriveFile(fileId, options) {
+    return this.#http.getBytes(
+      `/api/v1/google/drive/files/${encodeURIComponent(fileId)}/content`,
+      void 0,
+      options
+    );
+  }
+  /**
+   * Writes a file into the user's Drive.
+   *
+   * Needs one of the Drive write permissions on their connection. A read-only
+   * grant is refused by Google, and the error names the missing permission
+   * rather than reporting a failed upload - one is fixed with a checkbox and
+   * the other sends somebody looking for a bug.
+   */
+  async saveToDrive(params, options) {
+    return this.#http.postBytes(
+      "/api/v1/google/drive/files",
+      params.bytes,
+      params.contentType ?? "application/octet-stream",
+      {
+        name: params.name,
+        ...params.folderId !== void 0 ? { folderId: params.folderId } : {}
+      },
+      options
+    );
+  }
+  /**
+   * Recent messages - senders, subjects and a one-line preview, never bodies.
+   *
+   * `query` is Gmail's own syntax passed through as written: `from:priya`,
+   * `has:attachment`, `newer_than:7d`. It selects within the connected mailbox
+   * and cannot reach another one.
+   */
+  async searchMail(params = {}, options) {
+    return this.#http.get(
+      "/api/v1/google/mail",
+      {
+        ...params.query !== void 0 ? { query: params.query } : {},
+        ...params.limit !== void 0 ? { limit: params.limit } : {}
+      },
+      options
+    );
+  }
+  /** One message, with its body and the names of what is attached. */
+  async readMail(messageId, options) {
+    return this.#http.get(
+      `/api/v1/google/mail/${encodeURIComponent(messageId)}`,
+      void 0,
+      options
+    );
+  }
+  /**
+   * The bytes of one attachment.
+   *
+   * Separate from `readMail` so listing a mailbox never drags attachments
+   * across the network: a message with a 40 MB deck should not cost 40 MB to
+   * summarise.
+   */
+  async downloadAttachment(messageId, attachmentId, options) {
+    return this.#http.getBytes(
+      `/api/v1/google/mail/${encodeURIComponent(messageId)}/attachments/${encodeURIComponent(attachmentId)}`,
+      void 0,
+      options
+    );
+  }
+  /** Sends as the connected account. Needs the send permission. */
+  async sendMail(params, options) {
+    return this.#http.post("/api/v1/google/mail/send", params, options);
+  }
+  /** People in the user's contacts. Omit the query to list them. */
+  async contacts(params = {}, options) {
+    return this.#http.get(
+      "/api/v1/google/contacts",
+      {
+        ...params.query !== void 0 ? { query: params.query } : {},
+        ...params.limit !== void 0 ? { limit: params.limit } : {}
+      },
+      options
+    );
+  }
+};
 var Integrations = class {
   #http;
   constructor(http) {
@@ -920,6 +1117,42 @@ var Health = class {
     return this.#http.get("/health/ready", void 0, options);
   }
 };
+var Agent = class {
+  #http;
+  constructor(http) {
+    this.#http = http;
+  }
+  /** The row, including whether it finished and how large the result is. */
+  async request(id, options) {
+    return this.#http.get(
+      `/api/v1/agent/request/${encodeURIComponent(id)}`,
+      void 0,
+      options
+    );
+  }
+  /**
+   * A short-lived link to the bytes of a finished request.
+   *
+   * Returns the URL rather than the file, and that is a deliberate limit of
+   * this package rather than an oversight. The transport under every other
+   * method parses JSON, retries, and attaches the API key; none of those is
+   * right for a hundred-megabyte binary body, and building a second request
+   * path inside the SDK to serve one method is how a client ends up with two
+   * retry policies that differ only during an outage. Fetch the URL with
+   * whatever already streams in your runtime - it needs no credential, which
+   * is the whole reason it is signed.
+   *
+   * Treat the URL as the file. It is a bearer credential for exactly one
+   * object, it expires in minutes, and it should not be logged or stored.
+   */
+  async downloadLink(id, options) {
+    return this.#http.get(
+      `/api/v1/agent/request/${encodeURIComponent(id)}/download`,
+      void 0,
+      options
+    );
+  }
+};
 var PersistMemory = class {
   memories;
   search;
@@ -932,7 +1165,10 @@ var PersistMemory = class {
   conflicts;
   conversations;
   integrations;
+  /** Drive, mail and contacts on the user's connected Google account. */
+  google;
   health;
+  agent;
   #http;
   constructor(options) {
     this.#http = new HttpClient(options);
@@ -947,7 +1183,9 @@ var PersistMemory = class {
     this.conflicts = new Conflicts(this.#http);
     this.conversations = new Conversations(this.#http);
     this.integrations = new Integrations(this.#http);
+    this.google = new Google(this.#http);
     this.health = new Health(this.#http);
+    this.agent = new Agent(this.#http);
   }
   /**
    * An escape hatch for an endpoint this package has not caught up with.
@@ -1289,7 +1527,7 @@ function shortDate(iso) {
 }
 
 // src/help.ts
-var VERSION = "0.1.1";
+var VERSION = "0.1.2";
 var PACKAGE = "@persistmemory/cli";
 var HELP = `
   pm \u2014 PersistMemory from your terminal
@@ -1334,8 +1572,15 @@ var HELP = `
     list spaces                      your Spaces
     get memory <id>                  one memory, in full
 
+    drive [name]                     search your Google Drive
+    drive get <id> [--out path]      download one file here
+    drive put <file> [--name n]      save a file into Drive
+    mail [search]                    recent mail \u2014 from:priya, has:attachment
+    mail read <id>                   one message, with its body
+
     status                           is the service healthy
     requests                         file requests waiting for you to approve
+    requests get <id>                write a finished one to a file here
 
     update                           install the newest version
     uninstall                        remove pm from this machine
@@ -1479,8 +1724,8 @@ async function startLoopback(options = {}) {
   const timeoutMs = options.timeoutMs ?? 5 * 60 * 1e3;
   let resolveCallback;
   let rejectCallback;
-  const received = new Promise((resolve6, reject) => {
-    resolveCallback = resolve6;
+  const received = new Promise((resolve8, reject) => {
+    resolveCallback = resolve8;
     rejectCallback = reject;
   });
   const server = createServer((request, response) => {
@@ -1506,9 +1751,9 @@ async function startLoopback(options = {}) {
     response.end(donePage(callback));
     resolveCallback?.(callback);
   });
-  await new Promise((resolve6, reject) => {
+  await new Promise((resolve8, reject) => {
     server.once("error", reject);
-    server.listen(0, "127.0.0.1", resolve6);
+    server.listen(0, "127.0.0.1", resolve8);
   });
   const address = server.address();
   if (address === null || typeof address === "string") {
@@ -1770,7 +2015,7 @@ function safeEqual(a, b) {
 }
 async function openBrowser(url) {
   const [command, args] = process.platform === "darwin" ? ["open", [url]] : process.platform === "win32" ? ["cmd", ["/c", "start", "", url]] : ["xdg-open", [url]];
-  await new Promise((resolve6, reject) => {
+  await new Promise((resolve8, reject) => {
     const child = spawn(command, args, {
       stdio: "ignore",
       // Detached so closing the terminal does not close the browser, and so
@@ -1779,7 +2024,7 @@ async function openBrowser(url) {
     });
     child.once("error", reject);
     child.unref();
-    resolve6();
+    resolve8();
   });
 }
 async function describe(response) {
@@ -1841,13 +2086,13 @@ async function currentCredential(resolved, deps) {
 // src/context.ts
 import { createInterface } from "node:readline";
 async function askOnTty(prompt) {
-  return new Promise((resolve6) => {
+  return new Promise((resolve8) => {
     const readline = createInterface({ input: process.stdin, output: process.stdout });
     readline.question(prompt, (answer3) => {
       readline.close();
-      resolve6(answer3.trim());
+      resolve8(answer3.trim());
     });
-    readline.once("close", () => resolve6(""));
+    readline.once("close", () => resolve8(""));
   });
 }
 var ETX = "";
@@ -1856,13 +2101,13 @@ var BACKSPACE = "\b";
 async function readSecretFromTty(prompt) {
   const input = process.stdin;
   if (!input.isTTY) {
-    return new Promise((resolve6) => {
+    return new Promise((resolve8) => {
       const readline = createInterface({ input });
       readline.once("line", (line) => {
         readline.close();
-        resolve6(line.trim());
+        resolve8(line.trim());
       });
-      readline.once("close", () => resolve6(""));
+      readline.once("close", () => resolve8(""));
     });
   }
   process.stdout.write(prompt);
@@ -1870,14 +2115,14 @@ async function readSecretFromTty(prompt) {
   input.setRawMode?.(true);
   input.resume();
   input.setEncoding("utf8");
-  return new Promise((resolve6) => {
+  return new Promise((resolve8) => {
     let value = "";
     const finish2 = () => {
       input.removeListener("data", onData);
       input.setRawMode?.(previouslyRaw);
       input.pause();
       process.stdout.write("\n");
-      resolve6(value.trim());
+      resolve8(value.trim());
     };
     const onData = (chunk) => {
       for (const character of chunk) {
@@ -1914,8 +2159,8 @@ async function readStdin() {
 // src/commands/agent.ts
 import { hostname } from "node:os";
 import { homedir as homedir2 } from "node:os";
-import { resolve as resolve3 } from "node:path";
-import { readFileSync as readFileSync4, statSync as statSync2 } from "node:fs";
+import { join as join4, resolve as resolve3 } from "node:path";
+import { readFileSync as readFileSync4, readdirSync, statSync as statSync2 } from "node:fs";
 
 // src/files.ts
 import { existsSync as existsSync3, readFileSync as readFileSync3, realpathSync, statSync, writeFileSync as writeFileSync3 } from "node:fs";
@@ -1928,11 +2173,13 @@ var OutsideWorkspace = class extends Error {
 };
 var TooLarge = class extends Error {
   constructor(path, bytes, limit) {
-    super(`${path} is ${Math.round(bytes / 1024)} KB, over the ${Math.round(limit / 1024)} KB limit.`);
+    const say = (value) => value >= 1024 * 1024 ? `${(value / (1024 * 1024)).toFixed(1)} MB` : `${Math.round(value / 1024)} KB`;
+    super(`${path} is ${say(bytes)}, over the ${say(limit)} limit.`);
     this.name = "TooLarge";
   }
 };
 var MAX_READ_BYTES = 512 * 1024;
+var MAX_TRANSFER_BYTES = 100 * 1024 * 1024;
 function realLocation(absolute) {
   let existing = absolute;
   const trailing = [];
@@ -2046,19 +2293,41 @@ async function answer(context, apiUrl, token, roots, request) {
     return { ok: false, error: error instanceof Error ? error.message : "refused" };
   }
   let bytes;
+  let filename = request.path.split("/").pop() ?? "file";
+  if (request.kind === "list_dir") {
+    try {
+      const stats = statSync2(located);
+      if (!stats.isDirectory()) return { ok: false, error: `${request.path} is not a folder.` };
+      const entries = readdirSync(located, { withFileTypes: true }).filter((entry) => !entry.name.startsWith(".")).slice(0, MAX_LISTED).map((entry) => {
+        if (entry.isDirectory()) return `${entry.name}/`;
+        try {
+          return `${entry.name}  ${sizeOf(join4(located, entry.name))}`;
+        } catch {
+          return entry.name;
+        }
+      }).sort();
+      const listing = entries.length > 0 ? entries.join("\n") : "(empty)";
+      bytes = Buffer.from(`${request.path}
+
+${listing}
+`, "utf8");
+      filename = `${request.path.split("/").filter(Boolean).pop() ?? "listing"}.txt`;
+      const grant = await upload(apiUrl, token, filename, bytes);
+      return grant;
+    } catch (error) {
+      return { ok: false, error: error instanceof Error ? error.message : "could not list it" };
+    }
+  }
   try {
     const stats = statSync2(located);
     if (!stats.isFile()) return { ok: false, error: `${request.path} is not a file.` };
-    if (stats.size > MAX_READ_BYTES) {
-      return {
-        ok: false,
-        error: new TooLarge(request.path, stats.size, MAX_READ_BYTES).message
-      };
-    }
     bytes = readFileSync4(located);
   } catch (error) {
     return { ok: false, error: error instanceof Error ? error.message : "could not read it" };
   }
+  return upload(apiUrl, token, filename, bytes);
+}
+async function upload(apiUrl, token, filename, bytes) {
   const grant = await fetch(`${apiUrl}/api/v1/agent/upload-url`, {
     method: "POST",
     headers: { authorization: `Bearer ${token}`, "content-type": "application/json" },
@@ -2070,13 +2339,17 @@ async function answer(context, apiUrl, token, roots, request) {
       // No content type is sent: this machine has a path, not a declaration.
       // The server resolves it from the name against the one table that knows
       // which types it can read, and tells us below what it decided.
-      filename: request.path.split("/").pop() ?? "file"
+      filename
     })
   });
   if (!grant.ok) {
     return { ok: false, error: await said(grant, "could not get an upload url") };
   }
-  const { uploadUrl, contentType } = await grant.json();
+  const { uploadUrl, contentType, maxBytes } = await grant.json();
+  const limit = maxBytes ?? MAX_TRANSFER_BYTES;
+  if (bytes.length > limit) {
+    return { ok: false, error: new TooLarge(filename, bytes.length, limit).message };
+  }
   const put = await fetch(uploadUrl, {
     method: "PUT",
     // The type the grant was signed for. Anything else is refused.
@@ -2088,6 +2361,13 @@ async function answer(context, apiUrl, token, roots, request) {
   if (!stored.attachToken) return { ok: false, error: "the upload returned no reference" };
   return { ok: true, attachToken: stored.attachToken, bytes: bytes.length };
 }
+var MAX_LISTED = 200;
+function sizeOf(path) {
+  const size = statSync2(path).size;
+  if (size < 1024) return `${size} B`;
+  if (size < 1024 * 1024) return `${Math.round(size / 1024)} KB`;
+  return `${(size / (1024 * 1024)).toFixed(1)} MB`;
+}
 async function agentCommand(context) {
   const credential = context.resolved.credential;
   if (!credential) {
@@ -2141,7 +2421,7 @@ async function agentCommand(context) {
     body: JSON.stringify(body)
   });
   let complaint;
-  const complain = (message2) => {
+  const complain2 = (message2) => {
     if (complaint === message2) return;
     complaint = message2;
     context.error(`  ${message2}`);
@@ -2156,7 +2436,7 @@ async function agentCommand(context) {
     try {
       const beat = await call("heartbeat", { hostname: name, platform: process.platform });
       if (!beat.ok) {
-        complain(await said(beat, "the service refused this machine"));
+        complain2(await said(beat, "the service refused this machine"));
       } else {
         working();
         const state = await beat.json();
@@ -2171,7 +2451,7 @@ async function agentCommand(context) {
       }
       const claimed = await call("claim", { hostname: name, limit: 5 });
       if (!claimed.ok) {
-        complain(await said(claimed, "could not pick up work"));
+        complain2(await said(claimed, "could not pick up work"));
       } else {
         const { items } = await claimed.json();
         for (const request of items) {
@@ -2196,8 +2476,174 @@ async function agentCommand(context) {
   return 0;
 }
 
+// src/commands/google.ts
+import { writeFileSync as writeFileSync4 } from "node:fs";
+import { basename, resolve as resolve4 } from "node:path";
+import { readFileSync as readFileSync5 } from "node:fs";
+async function callApi(context, path, init = {}) {
+  const credential = context.resolved.credential;
+  if (!credential) {
+    context.error("Sign in first: pm auth login");
+    return void 0;
+  }
+  const apiUrl = context.resolved.apiUrl.replace(/\/+$/, "");
+  return fetch(`${apiUrl}${path}`, {
+    ...init,
+    headers: {
+      authorization: `Bearer ${credential.token}`,
+      ...init.headers ?? {}
+    }
+  });
+}
+async function complain(context, response) {
+  const body = await response.json().catch(() => void 0);
+  context.error(body?.error?.message ?? `That failed (${response.status}).`);
+  return response.status === 409 ? 3 : 1;
+}
+async function driveCommand(context) {
+  const [, noun, ...rest] = context.args.words;
+  if (noun === "get") return driveGet(context, rest.join(" ").trim());
+  if (noun === "put" || noun === "save") return drivePut(context, rest.join(" ").trim());
+  const query = [noun, ...rest].filter(Boolean).join(" ").trim();
+  const response = await callApi(
+    context,
+    `/api/v1/google/drive/files?limit=20${query ? `&query=${encodeURIComponent(query)}` : ""}`
+  );
+  if (!response) return 1;
+  if (!response.ok) return complain(context, response);
+  const { data } = await response.json();
+  if (data.length === 0) {
+    context.print(query ? `Nothing in Drive matches "${query}".` : "That Drive is empty.");
+    return 0;
+  }
+  if (context.flags.output === "json") {
+    context.print(JSON.stringify(data, void 0, 2));
+    return 0;
+  }
+  for (const file of data) {
+    context.print(`  ${file.name}`);
+    context.print(
+      `    ${file.id}${file.size ? ` \xB7 ${Math.round(file.size / 1024)} KB` : ""}${file.modifiedTime ? ` \xB7 ${file.modifiedTime.slice(0, 10)}` : ""}`
+    );
+  }
+  context.print("");
+  context.print("Fetch one with: pm drive get <id>");
+  return 0;
+}
+async function driveGet(context, fileId) {
+  if (!fileId) {
+    context.error("Say which file: pm drive get <id>");
+    return 2;
+  }
+  const response = await callApi(
+    context,
+    `/api/v1/google/drive/files/${encodeURIComponent(fileId)}/content`
+  );
+  if (!response) return 1;
+  if (!response.ok) return complain(context, response);
+  const disposition = response.headers.get("content-disposition") ?? "";
+  const named = /filename="([^"]+)"/.exec(disposition)?.[1];
+  const out = stringFlag(context.args, "out");
+  const target = resolve4(out ?? basename(named ?? fileId));
+  writeFileSync4(target, Buffer.from(await response.arrayBuffer()));
+  context.print(target);
+  return 0;
+}
+async function drivePut(context, path) {
+  if (!path) {
+    context.error("Say which file: pm drive put ./notes.md");
+    return 2;
+  }
+  let bytes;
+  try {
+    bytes = readFileSync5(resolve4(path));
+  } catch {
+    context.error(`Cannot read ${path}.`);
+    return 1;
+  }
+  const name = stringFlag(context.args, "name") ?? basename(path);
+  const response = await callApi(
+    context,
+    `/api/v1/google/drive/files?name=${encodeURIComponent(name)}`,
+    {
+      method: "POST",
+      // The bytes as bytes. Base64 in JSON would be a third larger and would
+      // make the limit somebody was told about stop matching the one they hit.
+      headers: { "content-type": "application/octet-stream" },
+      body: new Uint8Array(bytes)
+    }
+  );
+  if (!response) return 1;
+  if (!response.ok) return complain(context, response);
+  const saved = await response.json();
+  context.print(`Saved "${saved.name}" to Drive.${saved.link ? ` ${saved.link}` : ""}`);
+  return 0;
+}
+async function mailCommand(context) {
+  const [, noun, ...rest] = context.args.words;
+  if (noun === "read" || noun === "get") {
+    const messageId = rest.join(" ").trim();
+    if (!messageId) {
+      context.error("Say which message: pm mail read <id>");
+      return 2;
+    }
+    const response2 = await callApi(
+      context,
+      `/api/v1/google/mail/${encodeURIComponent(messageId)}`
+    );
+    if (!response2) return 1;
+    if (!response2.ok) return complain(context, response2);
+    const message2 = await response2.json();
+    if (context.flags.output === "json") {
+      context.print(JSON.stringify(message2, void 0, 2));
+      return 0;
+    }
+    context.print(`From:    ${message2.from ?? "unknown"}`);
+    context.print(`Subject: ${message2.subject ?? "(none)"}`);
+    if (message2.date) context.print(`Date:    ${message2.date}`);
+    context.print("");
+    context.print(message2.body);
+    if (message2.attachments.length > 0) {
+      context.print("");
+      context.print("Attached:");
+      for (const one of message2.attachments) context.print(`  ${one.filename} (${one.mimeType})`);
+    }
+    return 0;
+  }
+  const query = [noun, ...rest].filter(Boolean).join(" ").trim();
+  const response = await callApi(
+    context,
+    `/api/v1/google/mail?limit=20${query ? `&query=${encodeURIComponent(query)}` : ""}`
+  );
+  if (!response) return 1;
+  if (!response.ok) return complain(context, response);
+  const { data } = await response.json();
+  if (data.length === 0) {
+    context.print(query ? `No mail matches "${query}".` : "Nothing in that mailbox.");
+    return 0;
+  }
+  if (context.flags.output === "json") {
+    context.print(JSON.stringify(data, void 0, 2));
+    return 0;
+  }
+  for (const message2 of data) {
+    const marks = [message2.unread ? "unread" : "", message2.hasAttachments ? "attachment" : ""].filter(Boolean).join(", ");
+    context.print(`  ${message2.subject ?? "(no subject)"}${marks ? `  [${marks}]` : ""}`);
+    context.print(
+      `    ${message2.from ?? "unknown"}${message2.date ? ` \xB7 ${message2.date.slice(0, 10)}` : ""}`
+    );
+    context.print(`    ${message2.id}`);
+  }
+  context.print("");
+  context.print("Read one with: pm mail read <id>");
+  return 0;
+}
+
 // src/commands/requests.ts
+import { existsSync as existsSync4, writeFileSync as writeFileSync5 } from "node:fs";
+import { resolve as resolve5 } from "node:path";
 async function requestsCommand(context) {
+  if (context.args.words[1] === "get") return collectCommand(context);
   const credential = context.resolved.credential;
   if (!credential) {
     context.error("Sign in first: pm auth login");
@@ -2235,16 +2681,53 @@ async function requestsCommand(context) {
   context.print("They cannot be approved from here \u2014 see `pm help requests`.");
   return 0;
 }
+async function collectCommand(context) {
+  const credential = context.resolved.credential;
+  if (!credential) {
+    context.error("Sign in first: pm auth login");
+    return 1;
+  }
+  const id = context.args.words[2];
+  if (!id) {
+    context.error("Which request? `pm requests` lists them with their ids.");
+    return 2;
+  }
+  const apiUrl = context.resolved.apiUrl.replace(/\/+$/, "");
+  const link = await fetch(
+    `${apiUrl}/api/v1/agent/request/${encodeURIComponent(id)}/download`,
+    { headers: { authorization: `Bearer ${credential.token}` } }
+  );
+  if (!link.ok) {
+    const body = await link.json().catch(() => void 0);
+    context.error(body?.error?.message ?? `Could not prepare that file (${link.status}).`);
+    return 1;
+  }
+  const { downloadUrl, filename } = await link.json();
+  const file = await fetch(downloadUrl);
+  if (!file.ok) {
+    context.error(`The download refused it (${file.status}). Links expire in minutes \u2014 try again.`);
+    return 1;
+  }
+  const name = stringFlag(context.args, "output", "o") ?? filename;
+  const target = resolve5(name);
+  if (existsSync4(target)) {
+    context.error(`${target} already exists. Pass --output to write somewhere else.`);
+    return 1;
+  }
+  writeFileSync5(target, new Uint8Array(await file.arrayBuffer()));
+  context.print(`Wrote ${target}`);
+  return 0;
+}
 
 // src/workspace.ts
-import { existsSync as existsSync4, readFileSync as readFileSync5, writeFileSync as writeFileSync4 } from "node:fs";
-import { dirname as dirname3, join as join4, resolve as resolvePath } from "node:path";
+import { existsSync as existsSync5, readFileSync as readFileSync6, writeFileSync as writeFileSync6 } from "node:fs";
+import { dirname as dirname3, join as join5, resolve as resolvePath } from "node:path";
 var WORKSPACE_FILE = ".persistmemory.json";
 function findWorkspace(from = process.cwd()) {
   let dir = resolvePath(from);
   for (; ; ) {
-    const file = join4(dir, WORKSPACE_FILE);
-    if (existsSync4(file)) {
+    const file = join5(dir, WORKSPACE_FILE);
+    if (existsSync5(file)) {
       const config = readWorkspace(file);
       if (config) return { file, dir, config };
     }
@@ -2255,7 +2738,7 @@ function findWorkspace(from = process.cwd()) {
 }
 function readWorkspace(file) {
   try {
-    const parsed = JSON.parse(readFileSync5(file, "utf8"));
+    const parsed = JSON.parse(readFileSync6(file, "utf8"));
     const space = parsed.space;
     if (space && typeof space === "object" && typeof space.id === "string" && space.id !== "" && typeof space.name === "string") {
       return { space: { id: space.id, name: space.name } };
@@ -2266,8 +2749,8 @@ function readWorkspace(file) {
   }
 }
 function writeWorkspace(dir, config) {
-  const file = join4(dir, WORKSPACE_FILE);
-  writeFileSync4(file, `${JSON.stringify(config, null, 2)}
+  const file = join5(dir, WORKSPACE_FILE);
+  writeFileSync6(file, `${JSON.stringify(config, null, 2)}
 `, "utf8");
   return file;
 }
@@ -2536,9 +3019,9 @@ function message(error) {
 }
 
 // src/commands/maintain.ts
-import { existsSync as existsSync5, rmSync } from "node:fs";
+import { existsSync as existsSync6, rmSync } from "node:fs";
 import { spawnSync } from "node:child_process";
-import { dirname as dirname4, resolve as resolve5 } from "node:path";
+import { dirname as dirname4, resolve as resolve7 } from "node:path";
 import { fileURLToPath } from "node:url";
 async function updateCommand(context) {
   const manager = installer();
@@ -2580,7 +3063,7 @@ Delete the file it runs from: ${processPath()}`
   return 0;
 }
 async function deleteCommand(context) {
-  if (!existsSync5(context.paths.dir)) {
+  if (!existsSync6(context.paths.dir)) {
     context.print(`Nothing to delete: ${context.paths.dir} does not exist.`);
     return 0;
   }
@@ -2609,7 +3092,7 @@ async function deleteCommand(context) {
   return 0;
 }
 function removeEverything(context) {
-  const dir = resolve5(context.paths.dir);
+  const dir = resolve7(context.paths.dir);
   if (dir === "/" || dir.split("/").filter(Boolean).length < 2) {
     context.error(`Refusing to delete ${dir}: that does not look like a data directory.`);
     return;
@@ -2621,7 +3104,7 @@ function installer() {
 }
 function processPath() {
   try {
-    return resolve5(dirname4(fileURLToPath(import.meta.url)));
+    return resolve7(dirname4(fileURLToPath(import.meta.url)));
   } catch {
     return process.argv[1] ?? "";
   }
@@ -2633,12 +3116,12 @@ import { randomUUID } from "node:crypto";
 import { relative as relative2 } from "node:path";
 
 // src/events.ts
-import { appendFileSync, existsSync as existsSync6, mkdirSync as mkdirSync3, readFileSync as readFileSync6 } from "node:fs";
-import { join as join5 } from "node:path";
+import { appendFileSync, existsSync as existsSync7, mkdirSync as mkdirSync3, readFileSync as readFileSync7 } from "node:fs";
+import { join as join6 } from "node:path";
 function openSessionLog(paths, id) {
-  const directory = join5(paths.dir, "sessions");
+  const directory = join6(paths.dir, "sessions");
   mkdirSync3(directory, { recursive: true, mode: 448 });
-  const path = join5(directory, `${id}.jsonl`);
+  const path = join6(directory, `${id}.jsonl`);
   return {
     id,
     path,
@@ -2650,8 +3133,8 @@ function openSessionLog(paths, id) {
       }
     },
     read() {
-      if (!existsSync6(path)) return [];
-      return readFileSync6(path, "utf8").split("\n").filter((line) => line.trim() !== "").flatMap((line) => {
+      if (!existsSync7(path)) return [];
+      return readFileSync7(path, "utf8").split("\n").filter((line) => line.trim() !== "").flatMap((line) => {
         try {
           return [JSON.parse(line)];
         } catch {
@@ -2728,9 +3211,9 @@ async function sessionCommand(context) {
   context.print(`  Ask anything. /help for commands, /exit to leave.
 `);
   const readline = createInterface2({ input: process.stdin, output: process.stdout });
-  const ask = (prompt) => new Promise((resolve6) => {
-    readline.question(prompt, resolve6);
-    readline.once("close", () => resolve6(void 0));
+  const ask = (prompt) => new Promise((resolve8) => {
+    readline.question(prompt, resolve8);
+    readline.once("close", () => resolve8(void 0));
   });
   const root = process.cwd();
   let running = true;
@@ -2914,7 +3397,7 @@ async function write2(args) {
 }
 
 // src/commands/memory.ts
-import { readFileSync as readFileSync7 } from "node:fs";
+import { readFileSync as readFileSync8 } from "node:fs";
 
 // src/spaces.ts
 async function spacesFor(context, client, env = process.env) {
@@ -2978,7 +3461,7 @@ async function rememberCommand(context) {
   let text;
   if (file) {
     try {
-      text = readFileSync7(file, "utf8");
+      text = readFileSync8(file, "utf8");
     } catch {
       context.error(`Could not read ${file}.`);
       return 1;
@@ -3286,6 +3769,18 @@ async function dispatch(context) {
       return statusCommand(context);
     case "requests":
       return requestsCommand(context);
+    /*
+          Google, through the API rather than through Google.
+    
+          A laptop holds a bearer token and no database connection, so the
+          credential it can prove is the one the API accepts. Google's own tokens
+          never leave the deployment — which is what stops a stolen
+          `~/.persistmemory` from being a stolen mailbox.
+        */
+    case "drive":
+      return driveCommand(context);
+    case "mail":
+      return mailCommand(context);
     /**
      * `pm <verb> <noun>`, the grammar the Harness CLI uses.
      *