gogcli-mcp-calendar 2.23.2 → 2.25.0

package/dist/index.js

@@ -31177,10 +31177,11 @@ function sanitizedEnv() {
   }
   return result;
 }
+var TOKEN_LEFT_BOUNDARY = "(?<![A-Za-z0-9+/])";
 var GOOGLE_TOKEN_PATTERNS = [
-  /ya29\.[A-Za-z0-9._\-]+/g,
+  new RegExp(`${TOKEN_LEFT_BOUNDARY}ya29\\.[A-Za-z0-9._\\-]+`, "g"),
   // OAuth2 access tokens
-  /1\/\/[A-Za-z0-9._\-]+/g
+  new RegExp(`${TOKEN_LEFT_BOUNDARY}1//[A-Za-z0-9._\\-]+`, "g")
   // OAuth2 refresh tokens
 ];
 function redactGoogleTokens(text) {
@@ -31193,6 +31194,26 @@ function redactGoogleTokens(text) {
 function redactSecrets2(text) {
   return redactGoogleTokens(redactSecrets(text));
 }
+var OPAQUE_FIELD_VALUE = "[A-Za-z0-9+/_-]{16,}={0,2}";
+var opaquePlaceholder = (i) => `\0gogOpaque${i}\0`;
+function redactPreservingOpaqueFields(text, fields, redact) {
+  const lifted = [];
+  let staged = text;
+  for (const field of fields) {
+    const escaped = field.replace(/[.*+?^${}()|[\]\\]/g, "\\$&");
+    const re = new RegExp(`("${escaped}"\\s*:\\s*")(${OPAQUE_FIELD_VALUE})(")`, "g");
+    staged = staged.replace(re, (_m, open, value, close) => {
+      lifted.push(value);
+      return `${open}${opaquePlaceholder(lifted.length - 1)}${close}`;
+    });
+  }
+  if (lifted.length === 0) return redact(text);
+  let redacted = redact(staged);
+  lifted.forEach((value, i) => {
+    redacted = redacted.split(opaquePlaceholder(i)).join(value);
+  });
+  return redacted;
+}
 function augmentedPath() {
   const home = process.env.HOME;
   const candidates = [
@@ -31223,19 +31244,24 @@ function formatTimeout(ms) {
   return `${ms}ms`;
 }
 async function spawnWithTempFiles(args, opts) {
-  const { mkdtemp, writeFile, rm } = await import("node:fs/promises");
+  const { mkdtemp, mkdir, writeFile, rm } = await import("node:fs/promises");
   const { tmpdir } = await import("node:os");
   const dir = await mkdtemp(join(tmpdir(), "gogcli-mcp-"));
   try {
     const argv = [];
+    let seq = 0;
     for (const arg of args) {
       if (!isGogFileArg(arg)) {
         argv.push(arg);
         continue;
       }
-      const path = join(dir, `${arg.flag}.${arg.ext ?? "txt"}`);
-      await writeFile(path, arg.contents, { encoding: "utf8", mode: 384 });
-      argv.push(`--${arg.flag}=${path}`);
+      const sub = join(dir, String(seq));
+      seq += 1;
+      await mkdir(sub, { recursive: true, mode: 448 });
+      const path = join(sub, arg.filename ?? `${arg.flag}.${arg.ext ?? "txt"}`);
+      const data = arg.encoding === "base64" ? Buffer.from(arg.contents, "base64") : Buffer.from(arg.contents, "utf8");
+      await writeFile(path, data, { mode: 384 });
+      argv.push(arg.positional ? path : `--${arg.flag}=${path}`);
     }
     return await spawnGog(argv, opts);
   } finally {
@@ -31320,8 +31346,9 @@ function assembleArgs(args, opts) {
   return fullArgs;
 }
 async function run(args, options = {}) {
-  const { account, spawner, interactive = false, timeout, readonly: readonly2 = false, redactMode = "full" } = options;
-  const redact = redactMode === "tokens" ? redactGoogleTokens : redactSecrets2;
+  const { account, spawner, interactive = false, timeout, readonly: readonly2 = false, redactMode = "full", opaqueFields } = options;
+  const base = redactMode === "tokens" ? redactGoogleTokens : redactSecrets2;
+  const redact = opaqueFields?.length ? (text) => redactPreservingOpaqueFields(text, opaqueFields, base) : base;
   const fullArgs = assembleArgs(args, { account, interactive, readonly: readonly2 });
   const store = activeExecutor();
   try {
@@ -31335,7 +31362,7 @@ async function run(args, options = {}) {
     }
     return redact(output);
   } catch (err) {
-    const message = redact(err instanceof Error ? err.message : String(err));
+    const message = base(err instanceof Error ? err.message : String(err));
     if (isRunnerTransportError(err)) {
       throw new RunnerTransportError(message, err.kind, err.status);
     }
@@ -31756,6 +31783,7 @@ function formatAuthHealth(raw, now) {
 // ../gogcli-mcp/src/tools/auth.ts
 function registerAuthToolsWith(server, defaultServices) {
   const servicesDescribe = `Services to authorize: "all" or comma-separated list (e.g. "sheets,gmail,calendar"). Default: "${defaultServices}". Prefer the narrowest set you need \u2014 requesting a service whose Google API is not enabled on the OAuth client's project makes Google reject the WHOLE request with invalid_scope.`;
+  const extraScopesDescribe = "Additional raw OAuth scope URIs to request, comma-separated, on top of the ones `services` implies. Use for scopes no service covers \u2014 e.g. https://www.googleapis.com/auth/bigquery.readonly, required before gog_sheets_datasource_* can read BigQuery-backed Connected Sheets. Leave unset otherwise: an extra scope whose API is not enabled on the OAuth client project makes Google reject the WHOLE authorization with invalid_scope.";
   server.registerTool("gog_auth_list", {
     description: "List the Google accounts stored in gogcli, with their scopes. This reads local configuration only \u2014 it does not contact Google and does NOT tell you whether an account still works: a signed-out account whose refresh token expired or was revoked is listed here exactly like a healthy one, scopes and all. Use gog_auth_health to check whether an account can actually authenticate.",
     annotations: { readOnlyHint: true },
@@ -31805,11 +31833,14 @@ function registerAuthToolsWith(server, defaultServices) {
     annotations: { destructiveHint: true },
     inputSchema: {
       email: external_exports.string().describe("Google account email to authorize"),
-      services: external_exports.string().optional().default(defaultServices).describe(servicesDescribe)
+      services: external_exports.string().optional().default(defaultServices).describe(servicesDescribe),
+      extraScopes: external_exports.string().optional().describe(extraScopesDescribe)
     }
-  }, async ({ email: email3, services = defaultServices }) => {
+  }, async ({ email: email3, services = defaultServices, extraScopes }) => {
     try {
-      return rawTextResult(await run(["auth", "add", email3, "--services", services], {
+      const args = ["auth", "add", email3, "--services", services];
+      if (extraScopes) args.push(`--extra-scopes=${extraScopes}`, "--force-consent");
+      return rawTextResult(await run(args, {
         interactive: true,
         timeout: 3e5
       }));
@@ -31821,14 +31852,14 @@ function registerAuthToolsWith(server, defaultServices) {
     description: "Begin REMOTE/headless Google authorization (step 1 of 2). Returns a sign-in URL to open in any browser \u2014 no local server or terminal on the gogcli host is needed, so this works over the hosted connector where the interactive gog_auth_add cannot. Hand the URL to the user; after they sign in, the browser is redirected to a localhost URL that fails to load \u2014 that is expected. They copy that full redirected URL (from the address bar) and you pass it to gog_auth_add_complete. The link is valid for 10 minutes. If you pass a custom `services` here, pass the SAME value to gog_auth_add_complete or the second step will not match this one.",
     inputSchema: {
       email: external_exports.string().describe("Google account email to authorize"),
-      services: external_exports.string().optional().default(defaultServices).describe(servicesDescribe)
+      services: external_exports.string().optional().default(defaultServices).describe(servicesDescribe),
+      extraScopes: external_exports.string().optional().describe(`${extraScopesDescribe} Pass the SAME value to gog_auth_add_complete.`)
     }
-  }, async ({ email: email3, services = defaultServices }) => {
+  }, async ({ email: email3, services = defaultServices, extraScopes }) => {
     try {
-      return rawTextResult(await run(
-        ["auth", "add", email3, "--remote", "--step", "1", "--services", services, "--force-consent"],
-        { redactMode: "tokens" }
-      ));
+      const args = ["auth", "add", email3, "--remote", "--step", "1", "--services", services, "--force-consent"];
+      if (extraScopes) args.push(`--extra-scopes=${extraScopes}`);
+      return rawTextResult(await run(args, { redactMode: "tokens" }));
     } catch (err) {
       return errorResult(errorText(err));
     }
@@ -31843,25 +31874,28 @@ function registerAuthToolsWith(server, defaultServices) {
       ),
       services: external_exports.string().optional().default(defaultServices).describe(
         `Services authorized \u2014 MUST match the value passed to gog_auth_add_url. Default: "${defaultServices}".`
+      ),
+      extraScopes: external_exports.string().optional().describe(
+        "Extra OAuth scope URIs \u2014 MUST match the value passed to gog_auth_add_url, for the same reason `services` must: the two steps have to describe the same grant."
       )
     }
-  }, async ({ email: email3, redirectUrl, services = defaultServices }) => {
+  }, async ({ email: email3, redirectUrl, services = defaultServices, extraScopes }) => {
     try {
-      return rawTextResult(await run(
-        [
-          "auth",
-          "add",
-          email3,
-          "--remote",
-          "--step",
-          "2",
-          "--auth-url",
-          redirectUrl,
-          "--services",
-          services,
-          "--force-consent"
-        ]
-      ));
+      const args = [
+        "auth",
+        "add",
+        email3,
+        "--remote",
+        "--step",
+        "2",
+        "--auth-url",
+        redirectUrl,
+        "--services",
+        services,
+        "--force-consent"
+      ];
+      if (extraScopes) args.push(`--extra-scopes=${extraScopes}`);
+      return rawTextResult(await run(args));
     } catch (err) {
       return errorResult(errorText(err));
     }
@@ -31880,13 +31914,19 @@ function authToolsFor(defaultServices) {
 // ../gogcli-mcp/src/tools/calendar.ts
 function registerCalendarTools(server) {
   server.registerTool("gog_calendar_events", {
-    description: 'List calendar events. Filters can be combined (e.g. --from + --to for a range, or --today for just today). gog returns only 10 events by default, so a wide date range is USUALLY INCOMPLETE: raise max, or page with pageToken until the response carries no nextPageToken. A response carrying "truncated": true is an incomplete view \u2014 never conclude an event does not exist from one.',
+    description: 'List calendar events. Describe the window ONE way and one way only (gog >= 0.36.0 rejects the rest as ambiguous rather than silently discarding a flag): today on its own; or from + to; or from + days; or days on its own (a window of that many days starting today). today cannot be combined with from, to or days, and days cannot be combined with to. gog returns only 10 events by default, so a wide date range is USUALLY INCOMPLETE: raise max, or page with pageToken until the response carries no nextPageToken. A response carrying "truncated": true is an incomplete view \u2014 never conclude an event does not exist from one.',
     annotations: { readOnlyHint: true },
     inputSchema: {
       calendarId: external_exports.string().optional().describe("Calendar ID (default: primary calendar)"),
       from: external_exports.string().optional().describe("Start time filter (RFC3339, date, or natural language)"),
-      to: external_exports.string().optional().describe("End time filter (RFC3339, date, or natural language)"),
-      today: external_exports.boolean().optional().describe("Only show today's events"),
+      to: external_exports.string().optional().describe("End time filter (RFC3339, date, or natural language). Mutually exclusive with today and with days."),
+      // gog >= 0.36.0 (openclaw/gogcli#981). Before that release --days sat in
+      // a switch arm evaluated ahead of --from, so `--from 2026-09-25 --days 5`
+      // silently threw --from away and answered for today instead — at exit 0,
+      // in a well-formed table. It is only exposed here now that it means what
+      // it says.
+      days: external_exports.number().int().positive().optional().describe('Window LENGTH in days (calendar days, DST-aware), measured from `from` when one is given and from today otherwise. Use from + days for "the week of the 25th"; days alone for "the next N days". Mutually exclusive with to and with today.'),
+      today: external_exports.boolean().optional().describe("Only show today's events. A complete window on its own \u2014 mutually exclusive with from, to and days."),
       query: external_exports.string().optional().describe("Free text search within events"),
       max: external_exports.number().int().optional().describe("Max events to return. gog defaults to 10, which silently hides the rest \u2014 raise it, or page with pageToken."),
       pageToken: pageTokenParam,
@@ -31896,11 +31936,12 @@ function registerCalendarTools(server) {
       timezone: external_exports.string().optional().describe(`Display timezone for event times (IANA name, e.g. America/New_York, or "local" for the system timezone). Default: each event's timezone, then its calendar's timezone.`),
       account: accountParam
     }
-  }, async ({ calendarId, from, to, today, query, max, pageToken, page, all, eventTypes, timezone, account }) => {
+  }, async ({ calendarId, from, to, days, today, query, max, pageToken, page, all, eventTypes, timezone, account }) => {
     const args = ["calendar", "events"];
     if (calendarId) args.push(calendarId);
     if (from) args.push(`--from=${from}`);
     if (to) args.push(`--to=${to}`);
+    if (days !== void 0) args.push(`--days=${days}`);
     if (today) args.push("--today");
     if (query) args.push(`--query=${query}`);
     if (max !== void 0) args.push(`--max=${max}`);
@@ -32017,6 +32058,26 @@ function registerCalendarTools(server) {
   registerRunTool(server, { service: "calendar", examples: '"calendars", "freebusy"' });
 }
 
+// ../gogcli-mcp/src/attachments.ts
+var MAX_INLINE_ATTACHMENT_BYTES = 8 * 1024 * 1024;
+var RUNNER_MAX_BODY_BYTES = 32 * 1024 * 1024;
+var RUNNER_BODY_JSON_RESERVE_BYTES = 256 * 1024;
+var MAX_REQUEST_PAYLOAD_WIRE_BYTES = RUNNER_MAX_BODY_BYTES - RUNNER_BODY_JSON_RESERVE_BYTES;
+var MAX_INLINE_ATTACHMENT_TOTAL_BYTES = Math.floor(MAX_REQUEST_PAYLOAD_WIRE_BYTES * 3 / 4);
+var formatMiB = (bytes) => `${Math.floor(bytes / (1024 * 1024))} MiB`;
+var INLINE_ATTACHMENT_LIMITS_TEXT = `up to ${formatMiB(MAX_INLINE_ATTACHMENT_BYTES)} per file and ${formatMiB(MAX_INLINE_ATTACHMENT_TOTAL_BYTES)} in total`;
+var inlineAttachmentSchema = external_exports.object({
+  filename: external_exports.string().min(1).describe(
+    `Filename the recipient will see, e.g. "pendant-layouts.png". gog infers the attachment's MIME type from this extension, so give it the right one \u2014 a .png sent as "layouts" arrives as an untyped blob. Must be a single filename, not a path.`
+  ),
+  contentBase64: external_exports.string().min(1).describe(
+    "The file's bytes, base64-encoded (standard alphabet, with padding). This is the whole point of this parameter: the bytes travel with the request, so nothing needs to exist on the gog server's filesystem."
+  )
+});
+var attachInlineParam = external_exports.array(inlineAttachmentSchema).optional().describe(
+  `Attachments supplied as BYTES rather than as server-side paths \u2014 use this whenever you hold a file and the gog server does not, which is always the case on the hosted connector and on any remote deployment. Each entry is {filename, contentBase64} (${INLINE_ATTACHMENT_LIMITS_TEXT}). Can be combined with \`attach\`: the two name disjoint files (paths read on the server vs. bytes sent with the call), and both end up as ordinary attachments on the message.`
+);
+
 // ../gogcli-mcp/src/tools/sheets.ts
 var cellValueParam = external_exports.union([external_exports.string(), external_exports.number(), external_exports.boolean(), external_exports.null()]);
 var dryRunParam = external_exports.boolean().optional().describe(
@@ -32027,7 +32088,7 @@ var failIfNotEmptyParam = external_exports.boolean().optional().describe(
 );
 
 // ../gogcli-mcp/src/server.ts
-var VERSION = true ? "2.23.2" : "0.0.0";
+var VERSION = true ? "2.25.0" : "0.0.0";
 
 // ../gogcli-mcp/src/auth-log.ts
 var FAILURES = /* @__PURE__ */ new Set([
@@ -32630,16 +32691,19 @@ function registerExtraCalendarTools(server) {
     return runOrDiagnose(args, { account });
   });
   server.registerTool("gog_calendar_search", {
-    description: "Full-text search for events matching a query string, with optional time filters.",
+    description: "Full-text search for events matching a query string, with optional time filters. Describe the window ONE way only (gog >= 0.36.0 rejects the rest as ambiguous instead of discarding a flag): one of today / tomorrow / week on its own, or from + to, or from + days, or days on its own. The fixed presets cannot be combined with from, to or days, and days cannot be combined with to.",
     annotations: { readOnlyHint: true },
     inputSchema: {
       query: external_exports.string().describe("Search query"),
       from: external_exports.string().optional().describe("Start time (RFC3339, date, or relative: now, today, tomorrow, monday)"),
-      to: external_exports.string().optional().describe("End time (RFC3339, date, or relative: now, today, tomorrow, monday)"),
-      today: external_exports.boolean().optional().describe("Today only"),
-      tomorrow: external_exports.boolean().optional().describe("Tomorrow only"),
-      week: external_exports.boolean().optional().describe("This week (uses weekStart, default Mon)"),
-      days: external_exports.number().optional().describe("Next N days"),
+      to: external_exports.string().optional().describe("End time (RFC3339, date, or relative: now, today, tomorrow, monday). Mutually exclusive with days."),
+      today: external_exports.boolean().optional().describe("Today only. A complete window on its own \u2014 not combinable with from/to/days."),
+      tomorrow: external_exports.boolean().optional().describe("Tomorrow only. A complete window on its own \u2014 not combinable with from/to/days."),
+      week: external_exports.boolean().optional().describe("This week (uses weekStart, default Mon). A complete window on its own \u2014 not combinable with from/to/days."),
+      // gog >= 0.36.0 (openclaw/gogcli#981) anchors --days at --from. It used
+      // to mean "next N days from today" no matter what --from said, which is
+      // why the old description here read that way.
+      days: external_exports.number().optional().describe('Window LENGTH in days, measured from `from` when one is given and from today otherwise \u2014 NOT always "the next N days".'),
       weekStart: external_exports.string().optional().describe("Week start day for week (sun, mon, ...)"),
       calendar: external_exports.string().optional().describe("Calendar ID (default: primary)"),
       max: external_exports.number().optional().describe("Max results (default: 25)"),

package/manifest.json

@@ -3,7 +3,7 @@
   "manifest_version": "0.3",
   "name": "gogcli-mcp-calendar",
   "display_name": "gogcli (Calendar)",
-  "version": "2.23.2",
+  "version": "2.25.0",
   "description": "Extended Google Calendar for Claude via gogcli — auth + Calendar events + Meet space management",
   "author": {
     "name": "Chris Hall",

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "gogcli-mcp-calendar",
-  "version": "2.23.2",
+  "version": "2.25.0",
   "mcpName": "io.github.chrischall/gogcli-mcp-calendar",
   "description": "Extended Google Calendar + Meet MCP server via gogcli — auth + Calendar events + Meet space management",
   "author": "Claude Code (AI) <https://www.anthropic.com/claude>",

package/src/tools/calendar-extra.ts

@@ -134,16 +134,21 @@ export function registerExtraCalendarTools(server: McpServer): void {
   });
 
   server.registerTool('gog_calendar_search', {
-    description: 'Full-text search for events matching a query string, with optional time filters.',
+    description: 'Full-text search for events matching a query string, with optional time filters. '
+      + 'Describe the window ONE way only (gog >= 0.36.0 rejects the rest as ambiguous instead of discarding a flag): one of today / tomorrow / week on its own, '
+      + 'or from + to, or from + days, or days on its own. The fixed presets cannot be combined with from, to or days, and days cannot be combined with to.',
     annotations: { readOnlyHint: true },
     inputSchema: {
       query: z.string().describe('Search query'),
       from: z.string().optional().describe('Start time (RFC3339, date, or relative: now, today, tomorrow, monday)'),
-      to: z.string().optional().describe('End time (RFC3339, date, or relative: now, today, tomorrow, monday)'),
-      today: z.boolean().optional().describe('Today only'),
-      tomorrow: z.boolean().optional().describe('Tomorrow only'),
-      week: z.boolean().optional().describe('This week (uses weekStart, default Mon)'),
-      days: z.number().optional().describe('Next N days'),
+      to: z.string().optional().describe('End time (RFC3339, date, or relative: now, today, tomorrow, monday). Mutually exclusive with days.'),
+      today: z.boolean().optional().describe('Today only. A complete window on its own — not combinable with from/to/days.'),
+      tomorrow: z.boolean().optional().describe('Tomorrow only. A complete window on its own — not combinable with from/to/days.'),
+      week: z.boolean().optional().describe('This week (uses weekStart, default Mon). A complete window on its own — not combinable with from/to/days.'),
+      // gog >= 0.36.0 (openclaw/gogcli#981) anchors --days at --from. It used
+      // to mean "next N days from today" no matter what --from said, which is
+      // why the old description here read that way.
+      days: z.number().optional().describe('Window LENGTH in days, measured from `from` when one is given and from today otherwise — NOT always "the next N days".'),
       weekStart: z.string().optional().describe('Week start day for week (sun, mon, ...)'),
       calendar: z.string().optional().describe('Calendar ID (default: primary)'),
       max: z.number().optional().describe('Max results (default: 25)'),

package/tests/tools/calendar-extra.test.ts

@@ -172,16 +172,16 @@ describe('gog_calendar_search', () => {
     expect(lib.runOrDiagnose).toHaveBeenCalledWith(['calendar', 'search', 'standup'], { account: undefined });
   });
 
-  it('passes all filter flags when provided', async () => {
+  // One case per LEGAL window, not one case passing every flag at once. gog
+  // >= 0.36.0 (openclaw/gogcli#981) rejects a fixed preset alongside
+  // from/to/days, and days alongside to, with exit 2 — so the all-flags array
+  // this used to assert is one gog will not run, and a mocked test asserting
+  // it would keep passing forever while the tool was broken in the field.
+  it('passes an explicit from/to range with the non-window filters', async () => {
     await harness.callTool('gog_calendar_search', {
       query: 'standup',
       from: 'today',
       to: 'tomorrow',
-      today: true,
-      tomorrow: true,
-      week: true,
-      days: 7,
-      weekStart: 'sun',
       calendar: 'primary',
       max: 10,
     });
@@ -189,14 +189,39 @@ describe('gog_calendar_search', () => {
       [
         'calendar', 'search', 'standup',
         '--from=today', '--to=tomorrow',
-        '--today', '--tomorrow', '--week',
-        '--days=7', '--week-start=sun',
         '--calendar=primary', '--max=10',
       ],
       { account: undefined },
     );
   });
 
+  it('anchors --days at --from when both are given', async () => {
+    await harness.callTool('gog_calendar_search', { query: 'standup', from: '2026-09-25', days: 7 });
+    expect(lib.runOrDiagnose).toHaveBeenCalledWith(
+      ['calendar', 'search', 'standup', '--from=2026-09-25', '--days=7'],
+      { account: undefined },
+    );
+  });
+
+  it('passes each fixed preset on its own', async () => {
+    for (const [param, flag] of [['today', '--today'], ['tomorrow', '--tomorrow'], ['week', '--week']] as const) {
+      vi.mocked(lib.runOrDiagnose).mockClear();
+      await harness.callTool('gog_calendar_search', { query: 'standup', [param]: true });
+      expect(lib.runOrDiagnose).toHaveBeenCalledWith(
+        ['calendar', 'search', 'standup', flag],
+        { account: undefined },
+      );
+    }
+  });
+
+  it('passes --week-start alongside --week', async () => {
+    await harness.callTool('gog_calendar_search', { query: 'standup', week: true, weekStart: 'sun' });
+    expect(lib.runOrDiagnose).toHaveBeenCalledWith(
+      ['calendar', 'search', 'standup', '--week', '--week-start=sun'],
+      { account: undefined },
+    );
+  });
+
   it('omits boolean flags when false', async () => {
     await harness.callTool('gog_calendar_search', {
       query: 'standup', today: false, tomorrow: false, week: false,