v0.38.0

0.38.0 - 2026-08-25

• Sheets: add the full BigQuery Connected Sheets lifecycle—create, update, refresh, and safely delete data sources—with explicit billing and authorization, protected SQL previews, correct source matching, and reliable extract reads. (#938, #1001) — thanks @ryo-touch.
• Gmail: never silently drop a requested quoted message when sending, replying, forwarding, or creating drafts; surface fetch failures and warn when the original has no quotable text. (#996) — thanks @malob.
• Calendar: add --no-reminders when creating or updating events and correctly clear custom overrides when restoring calendar-default reminders. (#1002, #1016) — thanks @sorenisanerd.
• Gmail/Calendar: stop safely when Google repeats a pagination token, preventing stalled listings and resumed Gmail backups. (#1004) — thanks @SebTardif.
• Apps Script: pull project source and inspect deployments and versions without mutating remote projects. (#1018) — thanks @haosdent.
• Chat: include user mentions and emoji-reaction summaries in message-list JSON while preserving existing text output. (#1000) — thanks @Ben-Living.
• Slides: skip and unskip slides and expose their visibility without changing existing plain-text output. (#1009) — thanks @marnunez.
• Auth: explain Google Account and OAuth requirements, preserve enabled services during reauthorization, and provide client-specific repair guidance when credentials are missing. (#1014, #1015, #1017) — thanks @coeur-de-loup.
• Config: prevent intermittent Windows access-denied errors by safely serializing concurrent configuration updates.
• Output: clarify that --results-only unwraps command output before --select applies field projection. (#1007)
• Security: bound Google HTTP clients, Gmail watch listeners, and local OAuth callbacks so stalled, slow, or oversized requests cannot hang the CLI. (#995, #998)
• Security: harden HTML sanitization, untrusted-output allocation, tracking encryption, and live-evaluation session identifiers without changing public output formats. (#1011, #1012, #1013)
• Security: restrict GitHub Actions repository tokens to the minimum read-only permissions required by CI. (#1010)