setuplisted

You are helping a user install and configure the `bq` CLI so an agent (you) can query BigQuery, with **bq-guard** already gating what you're allowed to run. Walk through these steps interactively, running the read-only/inspection commands yourself and asking the user to run anything that requires interactive browser auth. ## 1. Check what's already installed Run: ```bash which bq gcloud bq version 2>/dev/null gcloud --version 2>/dev/null ``` If both are present, skip to step 3. ## 2. Install the Google Cloud SDK (includes `bq`) - **macOS with Homebrew**: `brew install --cask google-cloud-sdk` - **macOS/Linux without Homebrew**: download the archive from <https://cloud.google.com/sdk/docs/install> and run its `install.sh`. - **Do not** `pip install` a package claiming to be `bq` or `gcloud` — the real CLI only ships via Google's installer or your OS package manager. ## 3. Authenticate (user does this step) Tell the user to run this themselves, since it opens a browser: ```bash gcloud auth login gcloud config set project <their-project-id> ``` Prefer this over a downloaded service-account key file sitting on disk. If a service account is required (e.g. CI), it should be **read-only** on BigQuery (`roles/bigquery.dataViewer` + `roles/bigquery.jobUser`, not `roles/bigquery.dataEditor` or `roles/bigquery.admin`) — bq-guard is a guardrail against mistakes, not a substitute for least-privilege IAM. See the README's threat-model section. ## 4. Confirm bq-guard is activ