feat: add retry logic, concurrent fetching, and extended commands

[salmonumbrella]

Summary

This PR adds resilience, performance improvements, and significant feature expansion to gogcli.

Resilience

• RetryTransport with circuit breaker for 429/5xx resilience
• Exponential backoff with jitter, respects Retry-After headers
• Circuit breaker auto-resets after 30s of successful requests

Performance

• Concurrent gmail thread fetching (fixes N+1 query pattern)
• Bounded concurrency with semaphore (max 10 parallel requests)

Multi-Account Management

• auth add: authorize and store accounts via OAuth flow
• auth list: list all stored accounts
• auth remove: remove stored accounts
• auth manage: open accounts manager UI in browser
• auth tokens: manage refresh tokens (list, export, import, delete)
• auth credentials: store OAuth client credentials

New Calendar Commands

• events --all: list events from all calendars (merged, time-sorted)
• colors: list available event/calendar colors
• conflicts: check availability across calendars
• search: find events by text query
• time: show current time in multiple timezones
• respond: respond to calendar invites (accept/decline/tentative)
• freebusy: check free/busy status for calendars

New Gmail Commands

• get: get message by ID (full/metadata/raw format)
• attachment: download attachments
• history: list mailbox history entries
• watch: Pub/Sub push with webhook forwarding
• autoforward: get/enable/disable auto-forwarding
• delegates: list/add/remove mail delegation
• filters: list/create/delete inbox filters
• forwarding: manage forwarding addresses
• sendas: manage send-as aliases
• vacation: get/enable/disable vacation responder
• batch: bulk operations (mark-read, archive, label, delete)

New People Commands

• me: get current authenticated user info
• contacts: search contacts
• directory: search organization directory

New Services

• Sheets: read/write/append spreadsheet data
• Tasks: full task management
  • lists: list, create task lists
  • items: list, create, update, complete, delete tasks
  • clear: remove completed tasks

Developer Experience

• Shell completion (bash, zsh, fish, powershell)
• version command with build info
• --debug flag for verbose logging
• lefthook for pre-commit hooks

Test Plan

• All existing tests pass
• New tests for retry transport, circuit breaker, concurrent fetching
• Tests pass with -race flag (thread-safe)
• Manual testing of new commands

[steipete]

Thanks, that's a big one. I'll review.

[steipete]

Taking over from here.

High-level: majority looks salvageable. Branch builds + tests pass locally, and most changes are additive. Biggest risk is size + merge conflicts + CLI flag consistency.

Blocker

• PR currently not mergeable (conflicts). Merge attempt shows conflicts in: README.md, internal/cmd/auth.go, internal/cmd/calendar.go, internal/cmd/drive.go, internal/cmd/execute_auth_add_test.go (modify/delete), internal/cmd/gmail.go, internal/cmd/gmail_drafts.go, internal/cmd/gmail_send.go, internal/cmd/root.go, internal/cmd/version.go (add/add), internal/secrets/store.go.

Resilience/retry

• Potential body leak: internal/googleapi/transport.go:51-64 overwrites req.Body when req.GetBody != nil without closing the original body.
• Keep-alive friendliness: before resp.Body.Close() on retry paths, consider draining (io.Copy(io.Discard, resp.Body)) so the connection can be reused. (internal/googleapi/transport.go:99,123)
• Backoff footgun: internal/googleapi/transport.go:151 can panic if BaseDelay/2 == 0; clamp.
• Two retry stacks: internal/googleapi/retry.go exists but transport retry is already wired in internal/googleapi/client.go; please pick one approach + delete/unused.
• Logging: retry logs at Info (internal/googleapi/transport.go:94,119); likely Debug unless --debug.

Gmail/thread

• JSON shape: DownloadError field never set; current behavior returns on first download failure (internal/cmd/gmail_thread.go:44-85). Either populate per-attachment error and continue, or remove the field.

Watch server auth

• shared token compare uses plain string equality; low-risk but easy win: subtle.ConstantTimeCompare (internal/cmd/gmail_watch_server.go:352-358). Also consider header-only tokens; query param tokens tend to leak into logs.

Repo/tooling consistency

• .lefthook.yml runs gofmt + golangci-lint directly, while Makefile uses goimports+gofumpt and installs golangci-lint under .tools. Recommend single source of truth.

Suggested merge strategy (what I’m going to do next)

1. Create an integration branch; merge PR branch into it; resolve conflicts there.
2. Normalize CLI args/flags with current conventions (output/json/plain/debug/confirm/no-input/etc) so UX stays consistent.
3. Fix the retry/transport issues above.
4. Run full gate (fmt/lint/tests/docs).
5. Add missing tests where it fits + add changelog/release note entry.
6. Then merge the cleaned integration branch back to main.

[steipete]

Thanks — big upgrade (retry/circuit breaker + expanded cmds).

I’m taking over from here.

Majority salvageable: yes. Needs follow-up polish to match gogcli conventions:

• flag unification (avoid collisions; keep output flags consistent)
• help text + args consistency across services
• more regression tests + CI gate
• changelog + README tweaks

I’ll do the cleanup on main in a focused follow-up PR/commits.