mizorewww/gdirect

Install

Prebuilt for macOS 15+ (Apple Silicon / Intel), Linux x8664 with glibc 2.35+ (Ubuntu 22.04+, Debian 12+, recent Fedora/Arch/openSUSE), and Windows x8664. Alpine/musl, older glibc and Linux ARM64 need a source build.

The installer puts gdirect in ~/.local/bin (Windows: %LOCALAPPDATA%\gdirect\bin) and tells you how to add it to PATH. On Windows, open a new terminal after installing.

To use mount, add --with-mount (PowerShell: -WithMount). This also installs rclone 1.75.2+ and, on Linux, FUSE3 through your package manager (uses sudo). On Windows it installs rclone and WinFsp with winget; WinFsp may ask for administrator approval.

Upgrade with brew update && brew upgrade gdirect, or by rerunning the installer.

curl -fsSL https://raw.githubusercontent.com/mizorewww/gdirect/main/scripts/install.sh | bash

One-time Google setup (about 10 minutes)

gdirect does not ship a shared Google client, so you create your own in a Google Cloud project, once. Follow the Google setup guide to download a Desktop app OAuth client JSON, then:

A browser opens. After you approve, the terminal prints Logged in. The JSON file is not needed again.

gdirect login --client-secret ~/Downloads/client_secret.json

How it works

The first transfer command scans candidate IPs automatically and keeps the fastest working one for 24 hours. login and mount do not scan. Each candidate is probed with the real SNI first, then with the forged identity, so the stored route always reflects what actually connects. Certificates are verified against Google's own GTS roots (embedded in the binary), never against a system CA bundle — a compromised third-party CA cannot impersonate Google for gdirect.

• Drive API, downloads, uploads (browse, ls, download, upload) — A scanned Google IP. The hostname and certificate check stay the same. If connections carrying the real SNI are reset, gdirect automatica
• Sign-in and token refresh (oauth2.googleapis.com) — Your normal system network (DNS, proxy)
• mount (rclone) — Your normal system network
• Sign-in and token refresh must reach oauth2.googleapis.com through your system network. If Google is blocked, you still need a proxy or VPN for this.
• If you use a TUN-mode proxy or VPN (for example Clash/Mihomo TUN), route the scanned Google IPs DIRECT and turn off fake-ip for them. Otherwise gdirect's traffic is captured again and the scan finds n

Daily use

browse shows the parent folder, the current folder and a preview side by side, like yazi. Press ? for every key.

Advanced route options (download and browse take all of them; ls and upload accept --ip and --sni):

Run gdirect scan to scan again and gdirect scan --list to see the results, including the last error for each IP. To test your own candidates, run gdirect scan --ips FILE. The file holds one public IP per line, and # starts a comment.

For scripts, GDIRECTACCESSTOKEN can supply an access token instead of a login (mount still needs gdirect login).

• j/k, ↑/↓ — Select
• g/G, Home/End — First / last item
• Ctrl-d/Ctrl-u, PgDn/PgUp — Half a page / a page down or up
• Enter, l/→ — Open folder
• h/←, Backspace — Parent folder
• / — Filter the current folder by name. Enter keeps the filter, Esc clears it
• Ctrl-r, F5 — Refresh
• Space — Mark or unmark an item. Marks are kept when you change folders
• Ctrl-a — Mark everything shown (press again to unmark)
• Esc — Clear the filter, then the marks, then the clipboard
• a — Create an empty file; a name ending in / creates a folder
• r — Rename
• y / x — Copy / cut the marked items, or the selected one
• p — Paste into the current folder. Cut items are moved; copied files are duplicated (Drive cannot copy folders)

Mount

Mounting requires the dependencies from --with-mount or the Homebrew step above.

• On macOS the mount uses the built-in NFS client, so no FUSE driver is needed. Linux uses FUSE3.
• On Windows the mount runs in the foreground and stops with Ctrl-C.
• The mount directory must be empty on macOS/Linux. On Windows it must not exist yet.
• Writes go to a local cache first and upload in the background. The cache tries to stay under 5 GiB, but open or unsent files can exceed that. Uploads are finished when the log printed by mount shows t
• unmount keeps files that have not been uploaded yet, and the next mount uploads them.
• -j sets how many rclone transfers run at once.

Your data and logout

Credentials, scanned IPs and settings are stored in one private SQLite file:

Use --db PATH to choose another file. gdirect logout removes the stored credentials and keeps the scanned IPs. Unmount before logging out. To switch Google accounts, run gdirect login --reauth.

Sign-in problems, the 7-day expiry and other questions are covered in Troubleshooting.

• macOS: ~/Library/Application Support/gdirect/state.sqlite3
• Linux: ~/.local/share/gdirect/state.sqlite3
• Windows: %LOCALAPPDATA%\gdirect\state.sqlite3