Summary

• Cedar's Google grant is drive.file, so an agent can only read files a user picked in the app; a share, an email address or a pasted link grants nothing. The agent kept telling users to share with a "service account" that does not exist (a customer hit this on a template deck).
• New request-file action on document-write. In web chat it streams a "Choose from Drive" card that opens the Google Picker, saves the pick to the org knowledge base and messages the agent so its next turn starts. On Slack, cron and MCP (no picker possible) it returns the two ways to hand over a file.
• A link-shared Google file pasted as write-document sourceUrl is now read through Google's export endpoints instead of scraping a sign-in page. A private file fails with both options spelled out for the agent, and with a neutral message for humans.
• cedar-configuration and external-systems docs name the two ways in and forbid the service-account advice.

Known limits, decided deliberately

• The KB row is org-visible, but the picked file is readable only through the picking user's drive.file grant. The requester's own runs work; a teammate's run sees the entry and cannot read it. A user-scoped entry is a follow-up.
• request-file lives on document-write, so viewers do not see it. The scope-map classification is explicit and commented.

Test plan

• pnpm run autofix:local pieces (brand check, oxlint --deny-warnings, pnpm deps:check, mail jest) pass locally and in CI. chatHistoryList.test.ts failed once on my machine (it hard-codes "February" from a relative date) and passes in CI; this branch does not touch it.
• Full server vitest (src/): 1,161 files / 14,489 tests pass (run before the review-fix commits). After the fixes and the final staging merge I re-ran the affected areas (src/mastra/mcp, src/mastra/skills/account-config, src/mastra/tools, src/services/kb): 143 files / 2,288 tests pass.
• Server and mail typecheck exit 0 (mail after react-router typegen).
• New tests: google-public-link.test.ts (parsing, streaming size cap, stalled body, status classification, host allowlist, log shape), url-scraper-google.test.ts, documentTool.test.ts (request-file on interactive and autonomous surfaces), writeDocumentTool.test.ts, scope-map.test.ts, chat-message-persistence.test.ts, requestDriveFileResponseProcessor.test.tsx, requestDriveFileRenderer.test.tsx.
• Agent-feature battle test: NOT RUN. apps/server/.claude/skills/playbook-instruction-eval/request-file-eval.ts measures how often the model reaches for request-file (6 cases x 5 trials, claude-sonnet-5). It passes --dry; the live run was not approved (est. $1-2). The description is squeezed to about 60 bytes under the 2KB tool-description budget, so the fire rate is worth measuring before or soon after merge.
• Three independent thermo-review rounds; every finding fixed, including removing an unrelated agent-env change (kept as a separate patch). Greptile's three P2 comments (server-side idempotency in createKbFromGoogleDrive, absolute imports in the new mail tests, casts in a new test helper) are fixed in dc2142e33.

Verify in prod

• Axiom dataset cedar-prod (or cedar-staging):

  ['cedar-prod'] | where _time > ago(1h) and message == "kb.google-public-link.read"
  | summarize count() by outcome, tostring(kind)
  

  Attrs: operation, kind, outcome (ok / not_public / too_large / extraction_failed / html_response / http_error / unexpected_host / fetch_failed), httpStatus, contentType, bytes, durationMs. No file id, URL or content is ever logged. fetch_failed goes through logError.

  ['cedar-prod'] | where _time > ago(1h) and message == "document-write.request-file"
  | summarize count() by tostring(surface), tostring(cardShown)
  

  Attrs: operation, cardShown, surface (interactive / autonomous), purposeChars (never the text).
• CloudWatch: `/aws/ecs/