hyperagents 1.2.3rc5.post3__py3-none-any.whl

hyperclaw/google_workspace/auth.py

@@ -0,0 +1,397 @@
+"""Google sign-in for the Workspace tools: one sign-in per person, in their own
+browser, through the team's INTERNAL Google app (installed-app OAuth,
+loopback redirect, PKCE).
+
+- The OAuth client file (Desktop app, ``{"installed": {...}}``) arrives in
+  each person's team profile and is never part of the package or the repo:
+  ``HYPERCLAW_GOOGLE_CLIENT_FILE``, else ``$HYPERCLAW_ROOT/profile/google-client.json``.
+  A client file inside the installed package is refused.
+- Scopes (Vaughn, 12 Oct): Gmail read, compose and send; read-only Calendar,
+  Meet (records and transcripts), Drive, Docs, Sheets and Slides. Calendar
+  write (``calendar.events``) is asked for only when Hyper's managed config
+  sets ``"google_calendar_write": true``. A grant with any other scope is
+  refused and nothing is stored; a grant missing some scopes is kept, and
+  the tools that need a missing scope say so.
+- The token lives in the OS secret store when one is available (``keyring``),
+  else in ``$HYPERCLAW_ROOT/google/token.json`` (0600, directory 0700). Either
+  way it is keyed by this install's ``HYPERCLAW_ROOT``: every person's agent
+  has its own token and there is no shared store, so nothing passes between
+  people's agents. The token is never printed, logged or sent to a model.
+"""
+from __future__ import annotations
+
+import hashlib
+import json
+import logging
+import os
+import secrets
+import stat
+import time
+from pathlib import Path
+from typing import Callable, Dict, List, Optional
+from urllib.parse import urlencode, urlsplit
+
+import httpx
+
+from .errors import GoogleError, Reason
+
+log = logging.getLogger("hyperclaw.google")
+
+_G = "https://www.googleapis.com/auth/"
+GMAIL_READ = _G + "gmail.readonly"
+GMAIL_COMPOSE = _G + "gmail.compose"
+GMAIL_SEND = _G + "gmail.send"
+CALENDAR_READ = _G + "calendar.readonly"
+CALENDAR_WRITE = _G + "calendar.events"
+MEET_READ = _G + "meetings.space.readonly"
+DRIVE_READ = _G + "drive.readonly"
+DOCS_READ = _G + "documents.readonly"
+SHEETS_READ = _G + "spreadsheets.readonly"
+SLIDES_READ = _G + "presentations.readonly"
+
+SCOPES = (GMAIL_READ, GMAIL_COMPOSE, GMAIL_SEND, CALENDAR_READ, MEET_READ, DRIVE_READ,
+          DOCS_READ, SHEETS_READ, SLIDES_READ)
+OPTIONAL_SCOPES = (CALENDAR_WRITE,)
+
+AUTH_URI = "https://accounts.google.com/o/oauth2/v2/auth"
+TOKEN_URI = "https://oauth2.googleapis.com/token"
+TIMEOUT = 20.0
+CONSENT_WAIT = 300.0
+KEYRING_SERVICE = "HyperAgents Google"
+STORE_ENV = "HYPERCLAW_GOOGLE_TOKEN_STORE"     # "file" forces the file store
+CLIENT_ENV = "HYPERCLAW_GOOGLE_CLIENT_FILE"
+
+
+def _root() -> Path:
+    return Path(os.environ.get("HYPERCLAW_ROOT", Path.home() / ".hyperclaw")).expanduser()
+
+
+def _loopback(url: str) -> bool:
+    return (urlsplit(url).hostname or "") in ("127.0.0.1", "localhost", "::1")
+
+
+def token_uri() -> str:
+    """Google's token endpoint. A loopback override exists for tests only."""
+    o = os.environ.get("HYPERCLAW_GOOGLE_TOKEN_URI", "").strip()
+    return o if o and _loopback(o) else TOKEN_URI
+
+
+# ───────────────────────── scopes ─────────────────────────
+
+def calendar_write_allowed() -> bool:
+    """Hyper's managed config turns on Calendar write (off by default)."""
+    try:
+        from hyperclaw import managed_config
+        data, _ok = managed_config.raw()     # system file, else the verified team profile
+        return isinstance(data, dict) and data.get("google_calendar_write") is True
+    except Exception:
+        return False
+
+
+def requested_scopes() -> tuple:
+    return SCOPES + (OPTIONAL_SCOPES if calendar_write_allowed() else ())
+
+
+def check_scopes(granted: str) -> List[str]:
+    """The granted scopes, or GoogleError when any was not asked for."""
+    got = sorted(set((granted or "").split()))
+    allowed = set(requested_scopes())
+    extra = [s for s in got if s not in allowed]
+    if extra:
+        raise GoogleError(Reason.EXTRA_SCOPE, f"{len(extra)} extra")
+    if not got:
+        raise GoogleError(Reason.CONSENT, "no scopes granted")
+    return got
+
+
+# ───────────────────────── the client file ─────────────────────────
+
+def client_path() -> Path:
+    explicit = os.environ.get(CLIENT_ENV, "").strip()
+    if explicit:
+        return Path(explicit).expanduser()
+    return _root() / "profile" / "google-client.json"
+
+
+def _inside_package(p: Path) -> bool:
+    pkg = Path(__file__).resolve().parents[2]
+    try:
+        p.resolve().relative_to(pkg)
+        return (pkg / "hyperclaw").is_dir()
+    except ValueError:
+        return False
+
+
+def load_client(path: Optional[Path] = None) -> Dict[str, str]:
+    p = Path(path) if path else client_path()
+    if not p.is_file():
+        raise GoogleError(Reason.CLIENT_FILE, "missing")
+    if _inside_package(p):
+        raise GoogleError(Reason.CLIENT_FILE, "inside the package")
+    try:
+        data = json.loads(p.read_text(encoding="utf-8"))
+    except Exception:
+        raise GoogleError(Reason.CLIENT_FILE, "unparseable")
+    inst = data.get("installed") if isinstance(data, dict) else None
+    if not isinstance(inst, dict) or not inst.get("client_id") or not inst.get("client_secret"):
+        raise GoogleError(Reason.CLIENT_FILE, "not a desktop client")
+    return {"client_id": str(inst["client_id"]), "client_secret": str(inst["client_secret"])}
+
+
+# ───────────────────────── token storage (per install) ─────────────────────────
+
+def install_key() -> str:
+    """This install's identity for the secret store: a hash of its root."""
+    return hashlib.sha256(str(_root().resolve()).encode()).hexdigest()[:24]
+
+
+def token_file() -> Path:
+    return _root() / "google" / "token.json"
+
+
+def _keyring():
+    if os.environ.get(STORE_ENV, "").strip().lower() == "file":
+        return None
+    try:
+        import keyring  # optional: the OS secret store
+        from keyring.backends import fail
+        kr = keyring.get_keyring()
+        if isinstance(kr, fail.Keyring) or "fail" in type(kr).__module__:
+            return None
+        return keyring
+    except Exception:
+        return None
+
+
+def store_name() -> str:
+    return "os-secret-store" if _keyring() is not None else "file"
+
+
+def _too_open(p: Path) -> bool:
+    try:
+        return bool(p.stat().st_mode & (stat.S_IRWXG | stat.S_IRWXO))
+    except FileNotFoundError:
+        return False
+
+
+def load_token() -> dict:
+    kr = _keyring()
+    if kr is not None:
+        try:
+            raw = kr.get_password(KEYRING_SERVICE, install_key())
+        except Exception:
+            raw = None
+        if raw:
+            try:
+                d = json.loads(raw)
+                return d if isinstance(d, dict) else {}
+            except ValueError:
+                return {}
+    p = token_file()
+    if not p.exists():
+        return {}
+    if _too_open(p):
+        raise GoogleError(Reason.TOKEN_FILE_OPEN)
+    try:
+        d = json.loads(p.read_text(encoding="utf-8"))
+        return d if isinstance(d, dict) else {}
+    except Exception:
+        return {}
+
+
+def save_token(tok: dict) -> str:
+    """Store the token; returns where ("os-secret-store" | "file")."""
+    text = json.dumps(tok)
+    kr = _keyring()
+    if kr is not None:
+        try:
+            kr.set_password(KEYRING_SERVICE, install_key(), text)
+            _remove_file()
+            return "os-secret-store"
+        except Exception:
+            log.warning("google: OS secret store unavailable; using the private file")
+    p = token_file()
+    p.parent.mkdir(parents=True, exist_ok=True)
+    try:
+        os.chmod(p.parent, 0o700)
+    except OSError:
+        pass
+    tmp = p.with_name(p.name + ".tmp")
+    fd = os.open(str(tmp), os.O_WRONLY | os.O_CREAT | os.O_TRUNC, 0o600)
+    with os.fdopen(fd, "w", encoding="utf-8") as f:
+        f.write(text)
+    os.chmod(tmp, 0o600)
+    os.replace(tmp, p)
+    return "file"
+
+
+def _remove_file() -> None:
+    try:
+        token_file().unlink()
+    except FileNotFoundError:
+        pass
+
+
+def disconnect() -> bool:
+    had = False
+    kr = _keyring()
+    if kr is not None:
+        try:
+            if kr.get_password(KEYRING_SERVICE, install_key()):
+                kr.delete_password(KEYRING_SERVICE, install_key())
+                had = True
+        except Exception:
+            pass
+    if token_file().exists():
+        _remove_file()
+        had = True
+    return had
+
+
+def connected() -> bool:
+    try:
+        return bool(load_token().get("refresh_token"))
+    except GoogleError:
+        return False
+
+
+def granted_scopes() -> List[str]:
+    try:
+        return list(load_token().get("scopes") or [])
+    except GoogleError:
+        return []
+
+
+def has_scope(scope: str) -> bool:
+    return scope in granted_scopes()
+
+
+def account() -> str:
+    try:
+        return str(load_token().get("account") or "")
+    except GoogleError:
+        return ""
+
+
+# ───────────────────────── consent flow ─────────────────────────
+
+def auth_url(client_id: str, redirect_uri: str, state: str, challenge: str) -> str:
+    return AUTH_URI + "?" + urlencode({
+        "client_id": client_id,
+        "redirect_uri": redirect_uri,
+        "response_type": "code",
+        "scope": " ".join(requested_scopes()),
+        "access_type": "offline",
+        "prompt": "consent",
+        "state": state,
+        "code_challenge": challenge,
+        "code_challenge_method": "S256",
+    })
+
+
+def connect(*, client_file: Optional[Path] = None, show: Callable[[str], None] = print,
+            open_browser: Optional[Callable[[str], object]] = None,
+            http: Optional[httpx.Client] = None, wait: float = CONSENT_WAIT,
+            on_listening: Optional[Callable[[str, str], None]] = None,
+            whoami: Optional[Callable[[str], str]] = None) -> dict:
+    """Run the consent flow in the person's own browser (loopback), verify the
+    scopes, store the token. Raises a named GoogleError; nothing is stored
+    on failure. ``on_listening(redirect_uri, state)`` is a test hook."""
+    from hyperclaw.brief.google_auth import _Catcher, _pkce
+    client = load_client(client_file)
+    verifier, challenge = _pkce()
+    state = secrets.token_urlsafe(24)
+    catcher = _Catcher()
+    redirect_uri = f"http://127.0.0.1:{catcher.port}"
+    catcher.start()
+    try:
+        url = auth_url(client["client_id"], redirect_uri, state, challenge)
+        show("Open this address in your own browser and sign in with your Google account. "
+             "HyperAgents asks to read Gmail, write drafts and send mail you approve, and to "
+             "read Calendar, Meet records and transcripts, Drive, Docs, Sheets and Slides:\n\n"
+             + url + "\n")
+        if open_browser:
+            try:
+                open_browser(url)
+            except Exception:
+                pass
+        if on_listening:
+            on_listening(redirect_uri, state)
+        if not catcher.event.wait(wait):
+            raise GoogleError(Reason.CONSENT, "timeout")
+        res = catcher.result
+    finally:
+        catcher.close()
+    if res.get("state") != state or res.get("error") or not res.get("code"):
+        raise GoogleError(Reason.CONSENT, "denied or state mismatch")
+    tok = token_request({
+        "grant_type": "authorization_code", "code": res["code"],
+        "redirect_uri": redirect_uri, "client_id": client["client_id"],
+        "client_secret": client["client_secret"], "code_verifier": verifier,
+    }, http)
+    scopes = check_scopes(tok.get("scope", ""))
+    if not tok.get("refresh_token"):
+        raise GoogleError(Reason.CONSENT, "no refresh token")
+    acct = ""
+    if whoami is not None and GMAIL_READ in scopes:
+        try:
+            acct = whoami(tok["access_token"])
+        except Exception:
+            acct = ""
+    where = save_token({
+        "refresh_token": tok["refresh_token"], "access_token": tok.get("access_token", ""),
+        "expiry": time.time() + float(tok.get("expires_in") or 0), "scopes": scopes,
+        "account": acct, "install": install_key(),
+        "connected_at": time.strftime("%Y-%m-%dT%H:%M:%S%z"),
+    })
+    missing = [s for s in SCOPES if s not in scopes]
+    return {"scopes": scopes, "missing": missing, "store": where, "account": acct}
+
+
+def token_request(form: dict, http: Optional[httpx.Client] = None) -> dict:
+    c = http or httpx.Client(timeout=TIMEOUT, follow_redirects=False)
+    try:
+        resp = c.post(token_uri(), data=form)
+    except httpx.HTTPError as e:
+        raise GoogleError(Reason.UNREACHABLE, type(e).__name__)
+    finally:
+        if http is None:
+            c.close()
+    try:
+        body = resp.json()
+    except Exception:
+        body = {}
+    if resp.status_code == 200 and isinstance(body, dict) and body.get("access_token"):
+        return body
+    err = body.get("error") if isinstance(body, dict) else ""
+    if err in ("invalid_grant", "unauthorized_client", "invalid_client"):
+        raise GoogleError(Reason.EXPIRED, str(err))
+    if resp.status_code >= 500:
+        raise GoogleError(Reason.UNREACHABLE, f"HTTP {resp.status_code}")
+    raise GoogleError(Reason.CONSENT, f"HTTP {resp.status_code}")
+
+
+def access_token(http: Optional[httpx.Client] = None, now: Optional[float] = None,
+                 force_refresh: bool = False) -> str:
+    """A valid access token for THIS install, refreshed when needed (and
+    reloaded from the store each time, so a re-sign-in takes effect at once).
+    A revoked grant raises EXPIRED: sign in again."""
+    tok = load_token()
+    if not tok.get("refresh_token"):
+        raise GoogleError(Reason.NOT_CONNECTED)
+    if tok.get("install") and tok["install"] != install_key():
+        raise GoogleError(Reason.NOT_CONNECTED, "token belongs to another install")
+    now = time.time() if now is None else now
+    if not force_refresh and tok.get("access_token") and float(tok.get("expiry") or 0) - 60 > now:
+        check_scopes(" ".join(tok.get("scopes") or []))
+        return tok["access_token"]
+    client = load_client()
+    fresh = token_request({
+        "grant_type": "refresh_token", "refresh_token": tok["refresh_token"],
+        "client_id": client["client_id"], "client_secret": client["client_secret"],
+    }, http)
+    scopes = check_scopes(fresh.get("scope") or " ".join(tok.get("scopes") or []))
+    tok.update({"access_token": fresh["access_token"], "scopes": scopes,
+                "expiry": now + float(fresh.get("expires_in") or 3600)})
+    save_token(tok)
+    return tok["access_token"]

hyperclaw/google_workspace/calendar.py

@@ -0,0 +1,157 @@
+"""Google Calendar: list events and free/busy (reads, GET only); create or
+change an event (ask tier, and only when Hyper's managed config grants
+Calendar write; the default sign-in is read-only).
+
+Free/busy is worked out from the events list (GET), so a read never sends a
+request body anywhere. Restricted-client guard: each event (title,
+description, location, attendees, organizer) is checked on its own.
+"""
+from __future__ import annotations
+
+import datetime as _dt
+from typing import Any, Dict, List, Optional
+from urllib.parse import quote
+
+from hyperclaw import client_guard
+
+from . import auth
+from .api import GoogleApi
+from .errors import GoogleError, Reason
+
+MAX_EVENTS = 100
+MAX_DESC = 2000
+SOURCE = "google_calendar"
+
+
+def _iso(value: str, *, field: str) -> str:
+    """RFC 3339 from 'YYYY-MM-DD', 'YYYY-MM-DD HH:MM' or an RFC 3339 string (UTC if no zone)."""
+    v = (value or "").strip()
+    if not v:
+        raise ValueError(f"{field} is required")
+    for fmt in ("%Y-%m-%d %H:%M", "%Y-%m-%dT%H:%M", "%Y-%m-%d"):
+        try:
+            d = _dt.datetime.strptime(v, fmt).replace(tzinfo=_dt.timezone.utc)
+            return d.isoformat().replace("+00:00", "Z")
+        except ValueError:
+            pass
+    try:
+        d = _dt.datetime.fromisoformat(v.replace("Z", "+00:00"))
+    except ValueError:
+        raise ValueError(f"{field} must be a date and time like 2026-10-14 15:00")
+    if d.tzinfo is None:
+        d = d.replace(tzinfo=_dt.timezone.utc)
+    return d.isoformat()
+
+
+def _window(start: str, end: str, days: int) -> tuple:
+    now = _dt.datetime.now(_dt.timezone.utc)
+    t0 = _iso(start, field="start") if start else now.isoformat()
+    if end:
+        t1 = _iso(end, field="end")
+    else:
+        base = _dt.datetime.fromisoformat(t0.replace("Z", "+00:00"))
+        t1 = (base + _dt.timedelta(days=max(1, min(int(days or 7), 62)))).isoformat()
+    return t0, t1
+
+
+def _event(e: dict) -> dict:
+    def when(x):
+        x = x or {}
+        return str(x.get("dateTime") or x.get("date") or "")
+    desc = str(e.get("description") or "")
+    return {
+        "id": str(e.get("id") or ""), "summary": str(e.get("summary") or ""),
+        "start": when(e.get("start")), "end": when(e.get("end")),
+        "location": str(e.get("location") or ""),
+        "description": desc[:MAX_DESC] + ("... [clipped]" if len(desc) > MAX_DESC else ""),
+        "attendees": [str(a.get("email") or a.get("displayName") or "")
+                      for a in (e.get("attendees") or []) if isinstance(a, dict)],
+        "organizer": str((e.get("organizer") or {}).get("email") or ""),
+        "status": str(e.get("status") or ""),
+        "transparency": str(e.get("transparency") or "opaque"),
+        "meet_link": str(e.get("hangoutLink") or ""),
+    }
+
+
+def _events(api: GoogleApi, calendar_id: str, t0: str, t1: str, query: str = "",
+            limit: int = MAX_EVENTS) -> List[dict]:
+    params = {"timeMin": t0, "timeMax": t1, "singleEvents": "true", "orderBy": "startTime",
+              "maxResults": max(1, min(int(limit or MAX_EVENTS), MAX_EVENTS))}
+    if query:
+        params["q"] = query
+    body = api.get("calendar", f"calendars/{quote(calendar_id or 'primary', safe='@.')}/events",
+                   params)
+    return [_event(e) for e in (body.get("items") or []) if isinstance(e, dict)]
+
+
+def list_events(api: GoogleApi, *, start: str = "", end: str = "", days: int = 7,
+                query: str = "", calendar_id: str = "primary", max_results: int = 25,
+                outside: Optional[bool] = None) -> dict:
+    t0, t1 = _window(start, end, days)
+    items = _events(api, calendar_id, t0, t1, query, max_results)
+    kept, withheld = client_guard.filter_items(items, SOURCE, outside=outside)
+    return {"calendar": calendar_id, "from": t0, "to": t1, "items": kept,
+            "withheld": withheld}
+
+
+def free_busy(api: GoogleApi, *, start: str = "", end: str = "", days: int = 1,
+              calendar_id: str = "primary", outside: Optional[bool] = None) -> dict:
+    """Busy blocks only (no titles): times of events that block time."""
+    t0, t1 = _window(start, end, days)
+    busy = []
+    for e in _events(api, calendar_id, t0, t1):
+        if e["status"] == "cancelled" or e["transparency"] == "transparent":
+            continue
+        busy.append({"start": e["start"], "end": e["end"]})
+    return {"calendar": calendar_id, "from": t0, "to": t1, "busy": busy}
+
+
+# ───────────────────────── writes (ask tier only) ─────────────────────────
+
+def _need_write() -> None:
+    if not auth.calendar_write_allowed() or not auth.has_scope(auth.CALENDAR_WRITE):
+        raise GoogleError(Reason.MISSING_SCOPE, "calendar write")
+
+
+def _event_body(title: str, start: str, end: str, location: str = "", description: str = "",
+                attendees: Optional[List[str]] = None) -> Dict[str, Any]:
+    body: Dict[str, Any] = {}
+    if title:
+        body["summary"] = title
+    if start:
+        body["start"] = {"dateTime": _iso(start, field="start")}
+    if end:
+        body["end"] = {"dateTime": _iso(end, field="end")}
+    if location:
+        body["location"] = location
+    if description:
+        body["description"] = description
+    if attendees:
+        body["attendees"] = [{"email": a} for a in attendees]
+    return body
+
+
+def create_event(api: GoogleApi, *, title: str, start: str, end: str, location: str = "",
+                 description: str = "", attendees: Optional[List[str]] = None,
+                 calendar_id: str = "primary") -> dict:
+    _need_write()
+    body = _event_body(title, start, end, location, description, attendees)
+    res = api.post("calendar", f"calendars/{quote(calendar_id, safe='@.')}/events"
+                               f"?sendUpdates=none", body)
+    if not res.get("id"):
+        raise GoogleError(Reason.UNREADABLE, "no event id")
+    return {"event_id": str(res["id"])}
+
+
+def update_event(api: GoogleApi, *, event_id: str, title: str = "", start: str = "",
+                 end: str = "", location: str = "", description: str = "",
+                 calendar_id: str = "primary") -> dict:
+    _need_write()
+    body = _event_body(title, start, end, location, description)
+    if not body:
+        raise ValueError("nothing to change")
+    res = api.patch("calendar", f"calendars/{quote(calendar_id, safe='@.')}/events/"
+                                f"{quote(event_id, safe='')}?sendUpdates=none", body)
+    if not res.get("id"):
+        raise GoogleError(Reason.UNREADABLE, "no event id")
+    return {"event_id": str(res["id"])}

hyperclaw/google_workspace/cli.py

@@ -0,0 +1,72 @@
+"""`hyperclaw google ...` (local terminal = the owner): connect, status, disconnect.
+
+One sign-in per person, in their own browser. The token is never shown.
+"""
+from __future__ import annotations
+
+import typer
+
+google_app = typer.Typer(help="Google Workspace for HyperAgents: Gmail, Calendar, Drive, Docs, "
+                              "Sheets, Slides and Meet (sends and changes need your approval)")
+
+
+def _env() -> None:
+    try:
+        from hyperclaw.userconfig import load_env_into_process
+        load_env_into_process()
+    except Exception:
+        pass
+
+
+def _whoami(token: str) -> str:
+    from .api import GoogleApi
+    from .gmail import profile_email
+    with GoogleApi(token_fn=lambda **_: token) as api:
+        return profile_email(api)
+
+
+@google_app.command("connect")
+def connect_cmd(open_browser: bool = typer.Option(
+        False, "--open", help="Open the sign-in page in your default browser")) -> None:
+    """Sign in to Google in your own browser (loopback; nothing is shared with other installs)."""
+    _env()
+    from . import auth
+    from .errors import GoogleError
+    opener = None
+    if open_browser:
+        import webbrowser
+        opener = webbrowser.open
+    try:
+        res = auth.connect(show=typer.echo, open_browser=opener, whoami=_whoami)
+    except GoogleError as e:
+        typer.echo(e.text)
+        raise typer.Exit(1)
+    who = f" as {res['account']}" if res.get("account") else ""
+    typer.echo(f"✓ Google connected{who}. Token kept in "
+               f"{'the system keychain' if res['store'] == 'os-secret-store' else 'a private file'}"
+               f" for this install only.")
+    if res.get("missing"):
+        typer.echo("Not granted at sign-in (the tools that need these will say so): "
+                   + ", ".join(s.rsplit("/", 1)[-1] for s in res["missing"]))
+
+
+@google_app.command("status")
+def status_cmd() -> None:
+    """Is Google connected on this install, and with which access."""
+    _env()
+    from . import auth
+    if not auth.connected():
+        typer.echo("Google: not connected. Run `hyperclaw google connect`.")
+        return
+    acct = auth.account()
+    typer.echo(f"Google: connected{(' as ' + acct) if acct else ''} "
+               f"({'system keychain' if auth.store_name() == 'os-secret-store' else 'private file'}).")
+    typer.echo("Access: " + ", ".join(s.rsplit("/", 1)[-1] for s in auth.granted_scopes()))
+
+
+@google_app.command("disconnect")
+def disconnect_cmd() -> None:
+    """Remove this install's Google token."""
+    _env()
+    from . import auth
+    typer.echo("Google disconnected." if auth.disconnect() else "Google wasn't connected.")