gogcli-mcp-calendar 2.30.0 → 4.0.0

package/manifest.json

@@ -3,7 +3,7 @@
   "manifest_version": "0.3",
   "name": "gogcli-mcp-calendar",
   "display_name": "gogcli (Calendar)",
-  "version": "2.30.0",
+  "version": "4.0.0",
   "description": "Extended Google Calendar for Claude via gogcli — auth + Calendar events + Meet space management",
   "author": {
     "name": "Chris Hall",

package/mint.yaml

@@ -12,25 +12,29 @@ env:
   - name: GOG_CLIENT_ID
     required: false
     help: >-
-      Google OAuth client id. NOTE: on the local-spawn path the child `gog`
-      receives a sanitized env — runner.ts drops GOG_ACCESS_TOKEN and every
-      *_TOKEN / *_SECRET / *_KEY / *_CREDENTIALS variable — so the CLI
-      authenticates from its own stored credentials under $HOME (see
-      state.dataDir), not from these variables being passed through.
+      Google OAuth client id. Read by the Node wrapper at startup
+      (bootstrap-auth.ts), which imports it into gog's keyring via a temp file
+      together with GOG_CLIENT_SECRET, GOG_REFRESH_TOKEN and GOG_ACCOUNT — set
+      all four or none. Not a secret, so unlike GOG_CLIENT_SECRET and
+      GOG_REFRESH_TOKEN it is not stripped from the spawned `gog`'s
+      environment; gog authenticates from its keyring under $HOME (see
+      state.dataDir).
   - name: GOG_CLIENT_SECRET
     secret: true
     required: false
     help: >-
-      Google OAuth client secret. Stripped from the spawned CLI's environment
-      by runner.ts's *_SECRET rule — see GOG_CLIENT_ID.
+      Google OAuth client secret. Imported into gog's keyring at startup with
+      GOG_CLIENT_ID; stripped from the spawned CLI's environment by runner.ts's
+      *_SECRET rule.
   - name: GOG_REFRESH_TOKEN
     secret: true
     required: false
     help: >-
-      Google OAuth refresh token. Stripped from the spawned CLI's environment
-      by runner.ts's *_TOKEN rule — see GOG_CLIENT_ID. A hosted deployment must
-      therefore carry gog's authorised-account state in its persisted data dir,
-      or drive a remote runner via GOG_RUNNER_URL.
+      Google OAuth refresh token (`gog auth tokens export` prints one). Imported
+      into gog's keyring at startup with GOG_CLIENT_ID; stripped from the
+      spawned CLI's environment by runner.ts's *_TOKEN rule. Changing it
+      re-imports on the next start; an in-connector re-auth
+      (gog_auth_add_url/complete) stays in effect until it changes.
   - name: GOG_ACCESS_TOKEN
     secret: true
     required: false
@@ -41,8 +45,21 @@ env:
   - name: GOG_ACCOUNT
     required: false
     help: >-
-      Which configured Google account to act as, when more than one is
-      authorised. Defaults to the single/most recent account.
+      The Google account to act as. Required for the startup auth bootstrap
+      (the refresh token is imported under this email); otherwise defaults to
+      gog's single/most recent account.
+  - name: GOG_KEYRING_BACKEND
+    required: false
+    help: >-
+      gog's credential store. Set to "file" on a headless host — there is no OS
+      keychain — so the keyring lives on the persistent data dir.
+  - name: GOG_KEYRING_PASSWORD
+    secret: true
+    required: false
+    help: >-
+      Encrypts gog's file keyring on the data dir. Required with
+      GOG_KEYRING_BACKEND=file. Deliberately not stripped from the spawned
+      CLI's environment — it is the one credential gog itself reads.
   - name: GOG_READONLY
     required: false
     help: >-
@@ -53,17 +70,6 @@ env:
     help: >-
       Path to the `gog` binary. Leave unset when the dependency below supplies
       it; set it only to point at a binary you manage yourself.
-  - name: GOG_RUNNER_URL
-    required: false
-    help: >-
-      URL of a remote gog runner to execute against instead of spawning the
-      local binary. If you set this, add its host to egress.allow.
-  - name: GOG_RUNNER_KEY
-    secret: true
-    required: false
-    help: >-
-      Shared key authenticating calls to GOG_RUNNER_URL. Required whenever that
-      is set.
   - name: GOG_TIMEZONE
     required: false
     help: >-
@@ -82,9 +88,8 @@ dependencies:
   # Every tool shells out to the `gog` CLI; without it the server starts and
   # then fails on the first call. This tag must track
   # packages/gogcli-mcp/src/runner.ts's MIN_GOG_VERSION (the floor the tools
-  # assume) and the fly-gog-runner/Dockerfile GOG_VERSION build arg. See
-  # CLAUDE.md "Required gog version" — bumping the floor means bumping these
-  # nine pins too.
+  # assume). See CLAUDE.md "Required gog version" — bumping the floor means
+  # bumping these nine pins, and the pin stored on each mcp-host registration.
   - kind: github-release
     repo: openclaw/gogcli
     tag: v0.40.0
@@ -93,15 +98,14 @@ dependencies:
 state:
   dataDir: true
   reason: >-
-    `gog` keeps its authorised-account state and token cache under $HOME.
-    Without a persistent data dir every cold start has no account configured and
-    every tool call fails until the credentials are re-supplied.
+    `gog` keeps its authorised-account state and file keyring under $HOME, and
+    the wrapper keeps its auth-bootstrap marker (~/.gogcli-mcp) there, so a
+    restart neither re-imports an unchanged secret nor discards an
+    in-connector re-auth. Without a persistent data dir every cold start has
+    only what the env secrets can re-seed.
 egress:
   allow:
     # Google OAuth token exchange and the Google REST APIs the CLI calls.
     - oauth2.googleapis.com
     - www.googleapis.com
     - googleapis.com
-    #
-    # NOTE: if you set GOG_RUNNER_URL to run against a remote gog runner, add
-    # that host here too — it is supplied at runtime and cannot be declared.

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "gogcli-mcp-calendar",
-  "version": "2.30.0",
+  "version": "4.0.0",
   "mcpName": "io.github.chrischall/gogcli-mcp-calendar",
   "description": "Extended Google Calendar + Meet MCP server via gogcli — auth + Calendar events + Meet space management",
   "author": "Claude Code (AI) <https://www.anthropic.com/claude>",
@@ -24,8 +24,8 @@
     "test:coverage": "vitest run --coverage"
   },
   "dependencies": {
-    "@chrischall/mcp-utils": "^0.23.3",
-    "@modelcontextprotocol/sdk": "^1.30.0",
+    "@chrischall/mcp-utils": "^0.28.0",
+    "@modelcontextprotocol/server": "^2.0.0",
     "zod": "^4.6.1"
   },
   "license": "MIT",

package/src/index.ts

@@ -1,11 +1,11 @@
 #!/usr/bin/env node
 import { runMcp } from '@chrischall/mcp-utils';
-import { VERSION, authToolsFor, registerCalendarTools, useRemoteGogRunner } from '../../gogcli-mcp/src/lib.js';
+import { VERSION, authToolsFor, registerCalendarTools, bootstrapGogAuth } from '../../gogcli-mcp/src/lib.js';
 import { registerExtraCalendarTools } from './tools/calendar-extra.js';
 
-// Execute `gog` on the Fly backend when the host points us at one; without
-// it, nothing changes and we spawn the local binary as before.
-useRemoteGogRunner();
+
+// Seed gog's keyring from GOG_CLIENT_ID/SECRET/REFRESH_TOKEN/ACCOUNT when the host injects them.
+await bootstrapGogAuth();
 
 await runMcp({
   name: 'gogcli-calendar',

package/src/tools/calendar-extra.ts

@@ -1,4 +1,4 @@
-import { McpServer } from '@modelcontextprotocol/sdk/server/mcp.js';
+import { McpServer } from '@modelcontextprotocol/server';
 import { z } from 'zod';
 import { accountParam, runOrDiagnose, pageTokenParam, pageAliasParam, resolvePageToken} from '../../../gogcli-mcp/src/lib.js';
 
@@ -9,11 +9,11 @@ const meetAccess = z.enum(['open', 'trusted', 'restricted']);
 export function registerExtraCalendarTools(server: McpServer): void {
   server.registerTool('gog_meet_create', {
     description: 'Create a Google Meet space and return its meeting code.',
-    inputSchema: {
+    inputSchema: z.object({
       access: meetAccess.optional().describe('Access type (default: trusted)'),
       open: z.boolean().optional().describe('Open the meeting in a browser after creation'),
       account: accountParam,
-    },
+    }),
   }, async ({ access, open, account }) => {
     const args = ['meet', 'create'];
     if (access) args.push(`--access=${access}`);
@@ -24,10 +24,10 @@ export function registerExtraCalendarTools(server: McpServer): void {
   server.registerTool('gog_meet_get', {
     description: 'Get a Google Meet space by its meeting code.',
     annotations: { readOnlyHint: true },
-    inputSchema: {
+    inputSchema: z.object({
       meetingCode: z.string().describe('Meeting code (e.g. abc-defg-hij)'),
       account: accountParam,
-    },
+    }),
   }, async ({ meetingCode, account }) => {
     return runOrDiagnose(['meet', 'get', meetingCode], { account });
   });
@@ -35,11 +35,11 @@ export function registerExtraCalendarTools(server: McpServer): void {
   server.registerTool('gog_meet_update', {
     description: 'Update a Google Meet space configuration.',
     annotations: { destructiveHint: true },
-    inputSchema: {
+    inputSchema: z.object({
       meetingCode: z.string().describe('Meeting code'),
       access: meetAccess.optional().describe('Access type'),
       account: accountParam,
-    },
+    }),
   }, async ({ meetingCode, access, account }) => {
     const args = ['meet', 'update', meetingCode];
     if (access) args.push(`--access=${access}`);
@@ -49,10 +49,10 @@ export function registerExtraCalendarTools(server: McpServer): void {
   server.registerTool('gog_meet_end', {
     description: 'End the active conference in a Google Meet space.',
     annotations: { destructiveHint: true },
-    inputSchema: {
+    inputSchema: z.object({
       meetingCode: z.string().describe('Meeting code'),
       account: accountParam,
-    },
+    }),
   }, async ({ meetingCode, account }) => {
     return runOrDiagnose(['meet', 'end', meetingCode, '--force'], { account }); // gog gates this op; without --force the runner's --no-input makes it refuse
   });
@@ -60,14 +60,14 @@ export function registerExtraCalendarTools(server: McpServer): void {
   server.registerTool('gog_meet_history', {
     description: 'List past calls (conferences) in a Google Meet space.',
     annotations: { readOnlyHint: true },
-    inputSchema: {
+    inputSchema: z.object({
       meetingCode: z.string().describe('Meeting code'),
       max: z.number().optional().describe('Max results (default: 20)'),
       pageToken: pageTokenParam,
       page: pageAliasParam,
       all: z.boolean().optional().describe('Fetch all pages'),
       account: accountParam,
-    },
+    }),
   }, async ({ meetingCode, max, pageToken, page, all, account }) => {
     const args = ['meet', 'history', meetingCode];
     if (max !== undefined) args.push(`--max=${max}`);
@@ -83,13 +83,13 @@ export function registerExtraCalendarTools(server: McpServer): void {
   server.registerTool('gog_zoom_auth_setup', {
     description: 'Store Zoom Server-to-Server (S2S) OAuth credentials so calendar events can be attached to Zoom meetings via the --with-zoom flag on gog_calendar_create / gog_calendar_update. Credentials are saved in gogcli\'s keyring under the given alias.',
     annotations: { destructiveHint: true },
-    inputSchema: {
+    inputSchema: z.object({
       accountId: z.string().describe('Zoom S2S OAuth account ID'),
       clientId: z.string().describe('Zoom S2S OAuth client ID'),
       clientSecret: z.string().describe('Zoom S2S OAuth client secret'),
       alias: z.string().optional().describe('Zoom credential alias (default: "default")'),
       skipValidate: z.boolean().optional().describe('Store credentials without calling Zoom /users/me to validate'),
-    },
+    }),
   }, async ({ accountId, clientId, clientSecret, alias, skipValidate }) => {
     const args = ['zoom', 'auth', 'setup'];
     if (alias) args.push(`--alias=${alias}`);
@@ -103,9 +103,9 @@ export function registerExtraCalendarTools(server: McpServer): void {
   server.registerTool('gog_zoom_auth_doctor', {
     description: 'Validate stored Zoom S2S OAuth credentials by calling Zoom /users/me.',
     annotations: { readOnlyHint: true },
-    inputSchema: {
+    inputSchema: z.object({
       alias: z.string().optional().describe('Zoom credential alias to check (default: "default")'),
-    },
+    }),
   }, async ({ alias }) => {
     const args = ['zoom', 'auth', 'doctor'];
     if (alias) args.push(`--alias=${alias}`);
@@ -117,13 +117,13 @@ export function registerExtraCalendarTools(server: McpServer): void {
   server.registerTool('gog_calendar_calendars', {
     description: 'List the calendars in your calendar list (id, summary, access role, primary flag).',
     annotations: { readOnlyHint: true },
-    inputSchema: {
+    inputSchema: z.object({
       max: z.number().optional().describe('Max results (default: 100)'),
       pageToken: pageTokenParam,
       page: pageAliasParam,
       all: z.boolean().optional().describe('Fetch all pages'),
       account: accountParam,
-    },
+    }),
   }, async ({ max, pageToken, page, all, account }) => {
     const args = ['calendar', 'calendars'];
     if (max !== undefined) args.push(`--max=${max}`);
@@ -138,7 +138,7 @@ export function registerExtraCalendarTools(server: McpServer): void {
       + 'Describe the window ONE way only (gog >= 0.36.0 rejects the rest as ambiguous instead of discarding a flag): one of today / tomorrow / week on its own, '
       + 'or from + to, or from + days, or days on its own. The fixed presets cannot be combined with from, to or days, and days cannot be combined with to.',
     annotations: { readOnlyHint: true },
-    inputSchema: {
+    inputSchema: z.object({
       query: z.string().describe('Search query'),
       from: z.string().optional().describe('Start time (RFC3339, date, or relative: now, today, tomorrow, monday)'),
       to: z.string().optional().describe('End time (RFC3339, date, or relative: now, today, tomorrow, monday). Mutually exclusive with days.'),
@@ -153,7 +153,7 @@ export function registerExtraCalendarTools(server: McpServer): void {
       calendar: z.string().optional().describe('Calendar ID (default: primary)'),
       max: z.number().optional().describe('Max results (default: 25)'),
       account: accountParam,
-    },
+    }),
   }, async ({ query, from, to, today, tomorrow, week, days, weekStart, calendar, max, account }) => {
     const args = ['calendar', 'search', query];
     if (from) args.push(`--from=${from}`);
@@ -171,14 +171,14 @@ export function registerExtraCalendarTools(server: McpServer): void {
   server.registerTool('gog_calendar_changed', {
     description: 'List most recently changed events (including cancellations/deletions) across one or more calendars, ordered by last-modification time. Requires gog >= 0.31.1.',
     annotations: { readOnlyHint: true },
-    inputSchema: {
+    inputSchema: z.object({
       calendarId: z.string().optional().describe('Calendar ID (default: primary)'),
       calendarIds: z.string().optional().describe('Comma-separated calendar IDs, names, or indices'),
       since: z.string().optional().describe('Lower bound for last-modification time (RFC3339, date, or Go duration like 24h, 168h; default: 720h / 30 days). Google rejects windows too far in the past (410 updatedMinTooLongAgo) — retry with a shorter duration if that happens'),
       max: z.number().optional().describe('Max results (default: 10)'),
       all: z.boolean().optional().describe('Fetch from all calendars'),
       account: accountParam,
-    },
+    }),
   }, async ({ calendarId, calendarIds, since, max, all, account }) => {
     const args = ['calendar', 'changed'];
     if (calendarId) args.push(calendarId);
@@ -192,13 +192,13 @@ export function registerExtraCalendarTools(server: McpServer): void {
   server.registerTool('gog_calendar_freebusy', {
     description: 'Query free/busy intervals for one or more calendars over a time window.',
     annotations: { readOnlyHint: true },
-    inputSchema: {
+    inputSchema: z.object({
       from: z.string().describe('Start time (RFC3339, required)'),
       to: z.string().describe('End time (RFC3339, required)'),
       calendarIds: z.string().optional().describe('Comma-separated calendar IDs, names, or indices'),
       all: z.boolean().optional().describe('Query all calendars'),
       account: accountParam,
-    },
+    }),
   }, async ({ from, to, calendarIds, all, account }) => {
     const args = ['calendar', 'freebusy'];
     if (calendarIds) args.push(calendarIds);
@@ -211,9 +211,9 @@ export function registerExtraCalendarTools(server: McpServer): void {
   server.registerTool('gog_calendar_colors', {
     description: 'Show the available calendar and event color palette (color IDs to hex values).',
     annotations: { readOnlyHint: true },
-    inputSchema: {
+    inputSchema: z.object({
       account: accountParam,
-    },
+    }),
   }, async ({ account }) => {
     return runOrDiagnose(['calendar', 'colors'], { account });
   });
@@ -221,14 +221,14 @@ export function registerExtraCalendarTools(server: McpServer): void {
   server.registerTool('gog_calendar_acl', {
     description: 'List the access control list (sharing rules) for a calendar.',
     annotations: { readOnlyHint: true },
-    inputSchema: {
+    inputSchema: z.object({
       calendarId: z.string().describe('Calendar ID'),
       max: z.number().optional().describe('Max results (default: 100)'),
       pageToken: pageTokenParam,
       page: pageAliasParam,
       all: z.boolean().optional().describe('Fetch all pages'),
       account: accountParam,
-    },
+    }),
   }, async ({ calendarId, max, pageToken, page, all, account }) => {
     const args = ['calendar', 'acl', calendarId];
     if (max !== undefined) args.push(`--max=${max}`);
@@ -240,13 +240,13 @@ export function registerExtraCalendarTools(server: McpServer): void {
 
   server.registerTool('gog_calendar_move', {
     description: 'Move an event from one calendar to another; the destination calendar becomes the organizer.',
-    inputSchema: {
+    inputSchema: z.object({
       calendarId: z.string().describe('Source calendar ID'),
       eventId: z.string().describe('Event ID'),
       destinationCalendarId: z.string().describe('Destination calendar ID that becomes the event organizer'),
       sendUpdates: z.enum(['all', 'externalOnly', 'none']).optional().describe('Notification mode (default: none)'),
       account: accountParam,
-    },
+    }),
   }, async ({ calendarId, eventId, destinationCalendarId, sendUpdates, account }) => {
     const args = ['calendar', 'move', calendarId, eventId, destinationCalendarId];
     if (sendUpdates) args.push(`--send-updates=${sendUpdates}`);
@@ -255,7 +255,7 @@ export function registerExtraCalendarTools(server: McpServer): void {
 
   server.registerTool('gog_calendar_out_of_office', {
     description: 'Create an Out of Office event that auto-declines invitations during the block.',
-    inputSchema: {
+    inputSchema: z.object({
       from: z.string().describe('Start date or datetime (RFC3339 or YYYY-MM-DD)'),
       to: z.string().describe('End date or datetime (RFC3339 or YYYY-MM-DD)'),
       calendarId: z.string().optional().describe('Calendar ID (default: primary)'),
@@ -264,7 +264,7 @@ export function registerExtraCalendarTools(server: McpServer): void {
       declineMessage: z.string().optional().describe('Message for declined invitations'),
       allDay: z.boolean().optional().describe('Create as an all-day event'),
       account: accountParam,
-    },
+    }),
   }, async ({ from, to, calendarId, summary, autoDecline, declineMessage, allDay, account }) => {
     const args = ['calendar', 'out-of-office'];
     if (calendarId) args.push(calendarId);
@@ -280,10 +280,10 @@ export function registerExtraCalendarTools(server: McpServer): void {
   server.registerTool('gog_calendar_unsubscribe', {
     description: 'Remove a calendar from your calendar list (the underlying calendar is not deleted — you can re-subscribe). For deleting a secondary calendar you own, use gog_calendar_delete_calendar.',
     annotations: { destructiveHint: true },
-    inputSchema: {
+    inputSchema: z.object({
       calendarId: z.string().describe('Calendar ID or alias to remove from your calendar list'),
       account: accountParam,
-    },
+    }),
   }, async ({ calendarId, account }) => {
     return runOrDiagnose(['calendar', 'unsubscribe', calendarId], { account });
   });
@@ -291,10 +291,10 @@ export function registerExtraCalendarTools(server: McpServer): void {
   server.registerTool('gog_calendar_delete_calendar', {
     description: 'Permanently delete an owned secondary calendar and all its events. Cannot delete your primary calendar. To merely remove a calendar you do not own from your list, use gog_calendar_unsubscribe.',
     annotations: { destructiveHint: true },
-    inputSchema: {
+    inputSchema: z.object({
       calendarId: z.string().describe('Owned secondary calendar ID or alias'),
       account: accountParam,
-    },
+    }),
   }, async ({ calendarId, account }) => {
     return runOrDiagnose(['calendar', 'delete-calendar', calendarId, '--force'], { account }); // gog gates this op; without --force the runner's --no-input makes it refuse
   });
@@ -302,7 +302,7 @@ export function registerExtraCalendarTools(server: McpServer): void {
   server.registerTool('gog_meet_participants', {
     description: 'List participants from the latest (or a specific) Meet call.',
     annotations: { readOnlyHint: true },
-    inputSchema: {
+    inputSchema: z.object({
       meetingCode: z.string().describe('Meeting code'),
       conference: z.string().optional().describe('Specific conference ID (default: most recent)'),
       max: z.number().optional().describe('Max results (default: 50)'),
@@ -310,7 +310,7 @@ export function registerExtraCalendarTools(server: McpServer): void {
       page: pageAliasParam,
       all: z.boolean().optional().describe('Fetch all pages'),
       account: accountParam,
-    },
+    }),
   }, async ({ meetingCode, conference, max, pageToken, page, all, account }) => {
     const args = ['meet', 'participants', meetingCode];
     if (conference) args.push(`--conference=${conference}`);

package/tsconfig.json

@@ -5,5 +5,5 @@
     "rootDir": "../"
   },
   "include": ["src/**/*", "../gogcli-mcp/src/**/*"],
-  "exclude": ["node_modules", "dist", "../gogcli-mcp/src/worker.ts"]
+  "exclude": ["node_modules", "dist"]
 }