This is probably not a problem, I think.

If you only have the "database" in the root folder (and potentially gogrepoc.py itsself), like this:
---8<---------------
gog-manifest.dat
gog-manifest.dat.bak
gogrepo.log
gogrepo.log.1
gog-resume-manifest.dat
gog-resume-manifest.dat.bak
gog-token.dat
!md5_xmls
GOG
---8<---------------
"Cleanup stuff" should happen only below of the subfolder "GOG"; and even if not, each game would still have its own subfolder, and "!orphaned" as well as "!downloading" are also themselves folders, so no deletions/moves in the actual root folder should ever occur, or am I wrong?

On additional drives/partitions, youv'e only "System Volume Information" on modern Windows, which Windows will refuse to remove in all normal cases, even if not, it would be re-created, "only" eventually created "snapshots" of a previous state residing inside would be lost then.

It is not a good idea to have it in the actual "root folder" of the system, though, which is "/" on Linux and almost always "C:\" on Windows. Even that should work well, if there's no bug involved, but at least it makes things "messy" to have normal user files mixed with critical system stuff at the same place.

However, I see no problem to have it in the root of an external hard disk, even if it were a "flat" repository like this:
---8<---------------
wrapper-script.cmd
gog-manifest.dat
gog-manifest.dat.bak
gogrepo.log
gogrepoc.py
gog-resume-manifest.dat
gog-resume-manifest.dat.bak
gog-token.dat
!md5_xmls
!orphaned
!downloading
game_1
game_2
…
game_N
---8<---------------

The "trash" and "clean" and "clear_partial_downloads" commands should not try to remove anything from the root folder, as long as they're not buggy.

Besides, for Linux those names starting with "!" are a poor choice, because the "!" has a special meaning in most shells.

It depends how you use it.

Me (and I think the OP) are always running gogrepoc.py script from within the same USB hard drive where it downloads the installers too.

So on that USB hard drive I have e.g. a subdirectory \GOG\ or \gogrepoc\ or whatever, to which I always go first to run the actual script because nothing will happen if I type "gogrepoc.py" anywhere else. That is the only place where the script is and runs.

And below that subdirectory I have the GOG\ subdirectory which contains the installers.

For me running e.g. "python gogrepoc.py download gog\" always works because I am always running the script from that same location on that same USB hard drive, under which the gog subdirectory with the installers always is. I don't need to have gogrepoc "installed" on several PCs, it always follows with the installers, no matter to which PC I connect it to (that PC must have python installed though, and the needed python modules).

It even works on Linux machines, but there I need to use the commands a bit differently, like "python3 gogrepoc.py download ./GOG/". That doesn't matter, I normally use a "linuxgog.sh" script that is on that same USB drive on Linux, while on Windows I use a windowsgog.bat batch file that have commands suitable for Windows.

If I used absolute paths with drive letters, it would often fail if that USB hard drive for some reason got a different drive letter when I connect it to a new PC.

windowsgog.bat:

python gogrepoc.py update -lang en -os windows
python gogrepoc.py download gog\
python gogrepoc.py clean gog\
python gogrepoc.py verify gog\

linuxgog.sh:

python3 gogrepoc.py update -lang en -os windows
python3 gogrepoc.py download ./GOG/
python3 gogrepoc.py clean ./GOG/
python3 gogrepoc.py verify ./GOG/

Ok. Well, unless you add it to the custom path environment (or use symlink/hardlink), like the python install does to itself. I use one in c:\scripts f.ex. to run ps and py files from anywhere.

Adding a folder as Admin is done with a small line:
setx /m PATH "%PATH%;c:\scripts"

If you manually select a drive letter then it won't collide and Windows will remember it. I have 4 external ones and all are using G -> Z. With A, B and C used internally, only D-F will be used (in that order) for others I plug in and my scripts will still work.

I used to use custom autorun.inf upon plugging in the external, and sometimes used the timed scheduler in Windows and Linux instead to autorun .cmd and .py script., but since I often reformat and Windows is pretty gnarly in such regard, I now just use the launcher from portableapps.com (on C:\) to run the gogbackup.bat script directly (on F:\):

I've also added F:\ to the path so I can call it from another place as well (if I'm fiddling with menus in cmd or py, and what not).

But yeah, it all depends on the circumstance and what one wishes to use.
Odd. That's what I did with updates after hiding the bigger ones by reading the git page, but idk. Maybe I'll test it later on again.

I haven't tested it but sometimes wondered, what happens if I connect two external drives with the same assigned letter? I sometimes have several (3-4) external hard drives and/or memory sticks connected to the PC at the same time while copying stuff around between them, and can't recall which drive letters I may have assigned to each.

Either way, with the current setup I don't have to think about the drive letters at all, nor have gogrepoc "installed" on all the PCs where I might run gogrepoc, from my Windows and Linux laptops all the way to Raspberry Pi4.

If both have the same letter the second one to be attached will be assigned the next available letter ( hopefully, you sometimes get weird things where the older drive temporarily gets detached and then reattached in the process which can result in it getting the next available letter but that's not what's supposed to happen ).

Kalanyr, Gog is going to enable 2FA with autenticator for logins, could you please make gogrepoc compatible with it?

How does it need to be changed? What changes from gogrepoc's point of view?

Is there some announcement thread about this 2FA change?

I don't know the technicalities, but I can't seem to login with gogrepoc after enabling 2FA.

GOG announced it on Discord, but it's in test phase for now.

I haven't had to deal with GOG 2FA for awhile, but doesn't it currently send some code to your email you need to enter to the login (either in your browser or in gogrepoc)?

Even if and when GOG allows the usage of MFA phone apps, I presume much not will change from the user point of view: you will still just enter a code which you get either in your email or the authenticator app.

I think gogrepoc already now allows you to type in the 2FA code if needed, but how I've normally dealt with that 2FA is that I log into GOG with my browser once first (2FA asked or not), and then gogrepoc will not require 2FA when you run gogrepoc login. I presume successfully logging into GOG on that PC just registers GOG to acknowledge that logins coming from that PC/IP address are ok, so no further 2FA is required even if you change browser (or log in with gogrepoc).

I just tested that now that I am logged into GOG.com with my EDGE browser, and logging into GOG also on Firefox on the side (where I don't have any valid login cookies etc. for GOG) goes fine without requiring any 2FA authentication code. Apparently GOG just recognizes my login attempt as valid because it is coming from the same IP address from where I've logged into GOG successfully recently, and I knew the username and password.

2FA autenticator on mobile.
I simply tried the login command and I got this error.
If it's not related to 2FA and gogrepoc will be compatible, that's good, but then this should still be fixed anyway:

1630: DeprecationWarning: Testing an element's truth value will always return True in future versions. Use specific 'len(elem)' or 'elem is not None' test instead.
if (not loginForm) or len(loginForm.findall('.//div[@class="g-recaptcha form__recaptcha"]')) > 0:

I've used 2FA on GOG since they added it years ago with no problem login in... so, they're changing from email to app?

It does ask and wait for the 2FA code when changing IP address ("enter two-step security code: "), but the "error" is just a warning about different library version, lxml, so not really an error, and as I understand nothing about the script itself.

EDIT: I get the same warning.

I haven't been prompted for authenticator 2FA ( the joy of having an Australian IP I assume ) yet so I don't have the info required to add it, once I get tagged with it, I'll see what can be done, might be another login in a browser then copy / paste affair again.

It will be enabled for everyone who wants it near the end of the month. For now they're testing it.
Good if it will be an easy fix for gogrepoc.

What does that mean "for everyone who wants it"? Why can't they just make it a selectable option, like the current 2FA? Even keeping the email 2FA option as another option?

I guess it depends how the authenticator app works. To me it seems they quite often work like the current email authentication, ie. you just type in the numeric code from the app to your browser (or gogrepoc) that you'd normally get into your email. If it is that, then maybe gogrepoc doesn't need to be changed at all (doesn't it ask for that numeric code already now, if it is triggered?).

But sometimes it may work differently, e.g. the web page shows you two digits you should enter into your app etc... but I think those have been specifically some Microsoft services, like logging into your Outlook account or something, and you must use the Microsoft authenticator for them I presume.

Yeah, we use Teams/Office extensively and there we plug xx number into the authenticator. But it's painfully slow at times (even times out sometimes also) so hopefully GOG don't ever stop with the email option.