gogcli-mcp-classroom 2.30.0 → 4.0.0

package/manifest.json

@@ -3,7 +3,7 @@
   "manifest_version": "0.3",
   "name": "gogcli-mcp-classroom",
   "display_name": "gogcli (Classroom)",
-  "version": "2.30.0",
+  "version": "4.0.0",
   "description": "Extended Google Classroom for Claude via gogcli — auth + full Classroom support (courses, rosters, coursework, submissions, announcements, topics, invitations)",
   "author": {
     "name": "Chris Hall",

package/mint.yaml

@@ -12,25 +12,29 @@ env:
   - name: GOG_CLIENT_ID
     required: false
     help: >-
-      Google OAuth client id. NOTE: on the local-spawn path the child `gog`
-      receives a sanitized env — runner.ts drops GOG_ACCESS_TOKEN and every
-      *_TOKEN / *_SECRET / *_KEY / *_CREDENTIALS variable — so the CLI
-      authenticates from its own stored credentials under $HOME (see
-      state.dataDir), not from these variables being passed through.
+      Google OAuth client id. Read by the Node wrapper at startup
+      (bootstrap-auth.ts), which imports it into gog's keyring via a temp file
+      together with GOG_CLIENT_SECRET, GOG_REFRESH_TOKEN and GOG_ACCOUNT — set
+      all four or none. Not a secret, so unlike GOG_CLIENT_SECRET and
+      GOG_REFRESH_TOKEN it is not stripped from the spawned `gog`'s
+      environment; gog authenticates from its keyring under $HOME (see
+      state.dataDir).
   - name: GOG_CLIENT_SECRET
     secret: true
     required: false
     help: >-
-      Google OAuth client secret. Stripped from the spawned CLI's environment
-      by runner.ts's *_SECRET rule — see GOG_CLIENT_ID.
+      Google OAuth client secret. Imported into gog's keyring at startup with
+      GOG_CLIENT_ID; stripped from the spawned CLI's environment by runner.ts's
+      *_SECRET rule.
   - name: GOG_REFRESH_TOKEN
     secret: true
     required: false
     help: >-
-      Google OAuth refresh token. Stripped from the spawned CLI's environment
-      by runner.ts's *_TOKEN rule — see GOG_CLIENT_ID. A hosted deployment must
-      therefore carry gog's authorised-account state in its persisted data dir,
-      or drive a remote runner via GOG_RUNNER_URL.
+      Google OAuth refresh token (`gog auth tokens export` prints one). Imported
+      into gog's keyring at startup with GOG_CLIENT_ID; stripped from the
+      spawned CLI's environment by runner.ts's *_TOKEN rule. Changing it
+      re-imports on the next start; an in-connector re-auth
+      (gog_auth_add_url/complete) stays in effect until it changes.
   - name: GOG_ACCESS_TOKEN
     secret: true
     required: false
@@ -41,8 +45,21 @@ env:
   - name: GOG_ACCOUNT
     required: false
     help: >-
-      Which configured Google account to act as, when more than one is
-      authorised. Defaults to the single/most recent account.
+      The Google account to act as. Required for the startup auth bootstrap
+      (the refresh token is imported under this email); otherwise defaults to
+      gog's single/most recent account.
+  - name: GOG_KEYRING_BACKEND
+    required: false
+    help: >-
+      gog's credential store. Set to "file" on a headless host — there is no OS
+      keychain — so the keyring lives on the persistent data dir.
+  - name: GOG_KEYRING_PASSWORD
+    secret: true
+    required: false
+    help: >-
+      Encrypts gog's file keyring on the data dir. Required with
+      GOG_KEYRING_BACKEND=file. Deliberately not stripped from the spawned
+      CLI's environment — it is the one credential gog itself reads.
   - name: GOG_READONLY
     required: false
     help: >-
@@ -53,17 +70,6 @@ env:
     help: >-
       Path to the `gog` binary. Leave unset when the dependency below supplies
       it; set it only to point at a binary you manage yourself.
-  - name: GOG_RUNNER_URL
-    required: false
-    help: >-
-      URL of a remote gog runner to execute against instead of spawning the
-      local binary. If you set this, add its host to egress.allow.
-  - name: GOG_RUNNER_KEY
-    secret: true
-    required: false
-    help: >-
-      Shared key authenticating calls to GOG_RUNNER_URL. Required whenever that
-      is set.
   - name: GOG_TIMEZONE
     required: false
     help: >-
@@ -82,9 +88,8 @@ dependencies:
   # Every tool shells out to the `gog` CLI; without it the server starts and
   # then fails on the first call. This tag must track
   # packages/gogcli-mcp/src/runner.ts's MIN_GOG_VERSION (the floor the tools
-  # assume) and the fly-gog-runner/Dockerfile GOG_VERSION build arg. See
-  # CLAUDE.md "Required gog version" — bumping the floor means bumping these
-  # nine pins too.
+  # assume). See CLAUDE.md "Required gog version" — bumping the floor means
+  # bumping these nine pins, and the pin stored on each mcp-host registration.
   - kind: github-release
     repo: openclaw/gogcli
     tag: v0.40.0
@@ -93,15 +98,14 @@ dependencies:
 state:
   dataDir: true
   reason: >-
-    `gog` keeps its authorised-account state and token cache under $HOME.
-    Without a persistent data dir every cold start has no account configured and
-    every tool call fails until the credentials are re-supplied.
+    `gog` keeps its authorised-account state and file keyring under $HOME, and
+    the wrapper keeps its auth-bootstrap marker (~/.gogcli-mcp) there, so a
+    restart neither re-imports an unchanged secret nor discards an
+    in-connector re-auth. Without a persistent data dir every cold start has
+    only what the env secrets can re-seed.
 egress:
   allow:
     # Google OAuth token exchange and the Google REST APIs the CLI calls.
     - oauth2.googleapis.com
     - www.googleapis.com
     - googleapis.com
-    #
-    # NOTE: if you set GOG_RUNNER_URL to run against a remote gog runner, add
-    # that host here too — it is supplied at runtime and cannot be declared.

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "gogcli-mcp-classroom",
-  "version": "2.30.0",
+  "version": "4.0.0",
   "mcpName": "io.github.chrischall/gogcli-mcp-classroom",
   "description": "Extended Google Classroom MCP server via gogcli — auth + full Classroom support",
   "author": "Claude Code (AI) <https://www.anthropic.com/claude>",
@@ -24,8 +24,8 @@
     "test:coverage": "vitest run --coverage"
   },
   "dependencies": {
-    "@chrischall/mcp-utils": "^0.23.3",
-    "@modelcontextprotocol/sdk": "^1.30.0",
+    "@chrischall/mcp-utils": "^0.28.0",
+    "@modelcontextprotocol/server": "^2.0.0",
     "zod": "^4.6.1"
   },
   "license": "MIT",

package/server.json

@@ -7,12 +7,12 @@
     "source": "github",
     "subfolder": "packages/gogcli-mcp-classroom"
   },
-  "version": "2.30.0",
+  "version": "4.0.0",
   "packages": [
     {
       "registryType": "npm",
       "identifier": "gogcli-mcp-classroom",
-      "version": "2.30.0",
+      "version": "4.0.0",
       "transport": {
         "type": "stdio"
       },

package/src/index.ts

@@ -1,11 +1,11 @@
 #!/usr/bin/env node
 import { runMcp } from '@chrischall/mcp-utils';
-import { VERSION, authToolsFor, registerClassroomTools, useRemoteGogRunner } from '../../gogcli-mcp/src/lib.js';
+import { VERSION, authToolsFor, registerClassroomTools, bootstrapGogAuth } from '../../gogcli-mcp/src/lib.js';
 import { registerExtraClassroomTools } from './tools/classroom-extra.js';
 
-// Execute `gog` on the Fly backend when the host points us at one; without
-// it, nothing changes and we spawn the local binary as before.
-useRemoteGogRunner();
+
+// Seed gog's keyring from GOG_CLIENT_ID/SECRET/REFRESH_TOKEN/ACCOUNT when the host injects them.
+await bootstrapGogAuth();
 
 await runMcp({
   name: 'gogcli-classroom',

package/src/tools/classroom-extra.ts

@@ -1,4 +1,4 @@
-import { McpServer } from '@modelcontextprotocol/sdk/server/mcp.js';
+import { McpServer } from '@modelcontextprotocol/server';
 import { z } from 'zod';
 import { accountParam, runOrDiagnose } from '../../../gogcli-mcp/src/lib.js';
 
@@ -34,11 +34,11 @@ const courseworkSharedFields = {
 export function registerExtraClassroomTools(server: McpServer): void {
   server.registerTool('gog_classroom_courses_create', {
     description: 'Create a new Google Classroom course.',
-    inputSchema: {
+    inputSchema: z.object({
       name: z.string().describe('Course name'),
       ...courseSharedFields,
       account: accountParam,
-    },
+    }),
   }, async ({ name, owner, section, descriptionHeading, description, room, state, account }) => {
     const args = ['classroom', 'courses', 'create', `--name=${name}`];
     if (owner) args.push(`--owner=${owner}`);
@@ -53,12 +53,12 @@ export function registerExtraClassroomTools(server: McpServer): void {
   server.registerTool('gog_classroom_courses_update', {
     description: 'Update an existing Google Classroom course.',
     annotations: { destructiveHint: true },
-    inputSchema: {
+    inputSchema: z.object({
       courseId: z.string().describe('Course ID'),
       name: z.string().optional().describe('Course name'),
       ...courseSharedFields,
       account: accountParam,
-    },
+    }),
   }, async ({ courseId, name, owner, section, descriptionHeading, description, room, state, account }) => {
     const args = ['classroom', 'courses', 'update', courseId];
     if (name) args.push(`--name=${name}`);
@@ -74,10 +74,10 @@ export function registerExtraClassroomTools(server: McpServer): void {
   server.registerTool('gog_classroom_courses_delete', {
     description: 'Delete a Google Classroom course.',
     annotations: { destructiveHint: true },
-    inputSchema: {
+    inputSchema: z.object({
       courseId: z.string().describe('Course ID'),
       account: accountParam,
-    },
+    }),
   }, async ({ courseId, account }) => {
     return runOrDiagnose(['classroom', 'courses', 'delete', courseId, '--force'], { account }); // gog gates this op; without --force the runner's --no-input makes it refuse
   });
@@ -85,32 +85,32 @@ export function registerExtraClassroomTools(server: McpServer): void {
   server.registerTool('gog_classroom_courses_archive', {
     description: 'Archive a Google Classroom course.',
     annotations: { destructiveHint: true },
-    inputSchema: {
+    inputSchema: z.object({
       courseId: z.string().describe('Course ID'),
       account: accountParam,
-    },
+    }),
   }, async ({ courseId, account }) => {
     return runOrDiagnose(['classroom', 'courses', 'archive', courseId], { account });
   });
 
   server.registerTool('gog_classroom_courses_unarchive', {
     description: 'Unarchive a Google Classroom course (restore to ACTIVE).',
-    inputSchema: {
+    inputSchema: z.object({
       courseId: z.string().describe('Course ID'),
       account: accountParam,
-    },
+    }),
   }, async ({ courseId, account }) => {
     return runOrDiagnose(['classroom', 'courses', 'unarchive', courseId], { account });
   });
 
   server.registerTool('gog_classroom_students_add', {
     description: 'Add a student to a Google Classroom course.',
-    inputSchema: {
+    inputSchema: z.object({
       courseId: z.string().describe('Course ID'),
       userId: z.string().describe('Student user ID (or "me")'),
       enrollmentCode: z.string().optional().describe('Enrollment code (required if adding self via code)'),
       account: accountParam,
-    },
+    }),
   }, async ({ courseId, userId, enrollmentCode, account }) => {
     const args = ['classroom', 'students', 'add', courseId, userId];
     if (enrollmentCode) args.push(`--enrollment-code=${enrollmentCode}`);
@@ -120,22 +120,22 @@ export function registerExtraClassroomTools(server: McpServer): void {
   server.registerTool('gog_classroom_students_remove', {
     description: 'Remove a student from a Google Classroom course.',
     annotations: { destructiveHint: true },
-    inputSchema: {
+    inputSchema: z.object({
       courseId: z.string().describe('Course ID'),
       userId: z.string().describe('Student user ID'),
       account: accountParam,
-    },
+    }),
   }, async ({ courseId, userId, account }) => {
     return runOrDiagnose(['classroom', 'students', 'remove', courseId, userId, '--force'], { account }); // gog gates this op; without --force the runner's --no-input makes it refuse
   });
 
   server.registerTool('gog_classroom_teachers_add', {
     description: 'Add a teacher to a Google Classroom course.',
-    inputSchema: {
+    inputSchema: z.object({
       courseId: z.string().describe('Course ID'),
       userId: z.string().describe('Teacher user ID'),
       account: accountParam,
-    },
+    }),
   }, async ({ courseId, userId, account }) => {
     return runOrDiagnose(['classroom', 'teachers', 'add', courseId, userId], { account });
   });
@@ -143,23 +143,23 @@ export function registerExtraClassroomTools(server: McpServer): void {
   server.registerTool('gog_classroom_teachers_remove', {
     description: 'Remove a teacher from a Google Classroom course.',
     annotations: { destructiveHint: true },
-    inputSchema: {
+    inputSchema: z.object({
       courseId: z.string().describe('Course ID'),
       userId: z.string().describe('Teacher user ID'),
       account: accountParam,
-    },
+    }),
   }, async ({ courseId, userId, account }) => {
     return runOrDiagnose(['classroom', 'teachers', 'remove', courseId, userId, '--force'], { account }); // gog gates this op; without --force the runner's --no-input makes it refuse
   });
 
   server.registerTool('gog_classroom_coursework_create', {
     description: 'Create a new coursework item (assignment, question, etc.) in a course.',
-    inputSchema: {
+    inputSchema: z.object({
       courseId: z.string().describe('Course ID'),
       title: z.string().describe('Coursework title'),
       ...courseworkSharedFields,
       account: accountParam,
-    },
+    }),
   }, async ({ courseId, title, description, type, state, maxPoints, due, dueDate, dueTime, scheduled, topic, account }) => {
     const args = ['classroom', 'coursework', 'create', courseId, `--title=${title}`];
     if (description) args.push(`--description=${description}`);
@@ -177,13 +177,13 @@ export function registerExtraClassroomTools(server: McpServer): void {
   server.registerTool('gog_classroom_coursework_update', {
     description: 'Update an existing coursework item.',
     annotations: { destructiveHint: true },
-    inputSchema: {
+    inputSchema: z.object({
       courseId: z.string().describe('Course ID'),
       courseworkId: z.string().describe('Coursework ID'),
       title: z.string().optional().describe('New title'),
       ...courseworkSharedFields,
       account: accountParam,
-    },
+    }),
   }, async ({ courseId, courseworkId, title, description, type, state, maxPoints, due, dueDate, dueTime, scheduled, topic, account }) => {
     const args = ['classroom', 'coursework', 'update', courseId, courseworkId];
     if (title) args.push(`--title=${title}`);
@@ -202,11 +202,11 @@ export function registerExtraClassroomTools(server: McpServer): void {
   server.registerTool('gog_classroom_coursework_delete', {
     description: 'Delete a coursework item.',
     annotations: { destructiveHint: true },
-    inputSchema: {
+    inputSchema: z.object({
       courseId: z.string().describe('Course ID'),
       courseworkId: z.string().describe('Coursework ID'),
       account: accountParam,
-    },
+    }),
   }, async ({ courseId, courseworkId, account }) => {
     return runOrDiagnose(['classroom', 'coursework', 'delete', courseId, courseworkId, '--force'], { account }); // gog gates this op; without --force the runner's --no-input makes it refuse
   });
@@ -214,14 +214,14 @@ export function registerExtraClassroomTools(server: McpServer): void {
   server.registerTool('gog_classroom_announcements_update', {
     description: 'Update an existing announcement.',
     annotations: { destructiveHint: true },
-    inputSchema: {
+    inputSchema: z.object({
       courseId: z.string().describe('Course ID'),
       announcementId: z.string().describe('Announcement ID'),
       text: z.string().optional().describe('New text'),
       state: workState.optional().describe('State'),
       scheduled: z.string().optional().describe('Scheduled publish time'),
       account: accountParam,
-    },
+    }),
   }, async ({ courseId, announcementId, text, state, scheduled, account }) => {
     const args = ['classroom', 'announcements', 'update', courseId, announcementId];
     if (text) args.push(`--text=${text}`);
@@ -233,22 +233,22 @@ export function registerExtraClassroomTools(server: McpServer): void {
   server.registerTool('gog_classroom_announcements_delete', {
     description: 'Delete an announcement.',
     annotations: { destructiveHint: true },
-    inputSchema: {
+    inputSchema: z.object({
       courseId: z.string().describe('Course ID'),
       announcementId: z.string().describe('Announcement ID'),
       account: accountParam,
-    },
+    }),
   }, async ({ courseId, announcementId, account }) => {
     return runOrDiagnose(['classroom', 'announcements', 'delete', courseId, announcementId, '--force'], { account }); // gog gates this op; without --force the runner's --no-input makes it refuse
   });
 
   server.registerTool('gog_classroom_topics_create', {
     description: 'Create a topic in a Google Classroom course.',
-    inputSchema: {
+    inputSchema: z.object({
       courseId: z.string().describe('Course ID'),
       name: z.string().describe('Topic name'),
       account: accountParam,
-    },
+    }),
   }, async ({ courseId, name, account }) => {
     return runOrDiagnose(['classroom', 'topics', 'create', courseId, `--name=${name}`], { account });
   });
@@ -256,12 +256,12 @@ export function registerExtraClassroomTools(server: McpServer): void {
   server.registerTool('gog_classroom_topics_update', {
     description: 'Rename an existing topic.',
     annotations: { destructiveHint: true },
-    inputSchema: {
+    inputSchema: z.object({
       courseId: z.string().describe('Course ID'),
       topicId: z.string().describe('Topic ID'),
       name: z.string().describe('New topic name'),
       account: accountParam,
-    },
+    }),
   }, async ({ courseId, topicId, name, account }) => {
     return runOrDiagnose(['classroom', 'topics', 'update', courseId, topicId, `--name=${name}`], { account });
   });
@@ -269,23 +269,23 @@ export function registerExtraClassroomTools(server: McpServer): void {
   server.registerTool('gog_classroom_topics_delete', {
     description: 'Delete a topic.',
     annotations: { destructiveHint: true },
-    inputSchema: {
+    inputSchema: z.object({
       courseId: z.string().describe('Course ID'),
       topicId: z.string().describe('Topic ID'),
       account: accountParam,
-    },
+    }),
   }, async ({ courseId, topicId, account }) => {
     return runOrDiagnose(['classroom', 'topics', 'delete', courseId, topicId, '--force'], { account }); // gog gates this op; without --force the runner's --no-input makes it refuse
   });
 
   server.registerTool('gog_classroom_invitations_create', {
     description: 'Create an invitation to a Google Classroom course.',
-    inputSchema: {
+    inputSchema: z.object({
       courseId: z.string().describe('Course ID'),
       userId: z.string().describe('User ID to invite'),
       role: z.enum(['STUDENT', 'TEACHER', 'OWNER']).describe('Role for the invited user'),
       account: accountParam,
-    },
+    }),
   }, async ({ courseId, userId, role, account }) => {
     return runOrDiagnose(['classroom', 'invitations', 'create', courseId, userId, `--role=${role}`], { account });
   });
@@ -293,10 +293,10 @@ export function registerExtraClassroomTools(server: McpServer): void {
   server.registerTool('gog_classroom_invitations_delete', {
     description: 'Delete (revoke) a Google Classroom invitation.',
     annotations: { destructiveHint: true },
-    inputSchema: {
+    inputSchema: z.object({
       invitationId: z.string().describe('Invitation ID'),
       account: accountParam,
-    },
+    }),
   }, async ({ invitationId, account }) => {
     return runOrDiagnose(['classroom', 'invitations', 'delete', invitationId, '--force'], { account }); // gog gates this op; without --force the runner's --no-input makes it refuse
   });

package/tsconfig.json

@@ -5,5 +5,5 @@
     "rootDir": "../"
   },
   "include": ["src/**/*", "../gogcli-mcp/src/**/*"],
-  "exclude": ["node_modules", "dist", "../gogcli-mcp/src/worker.ts"]
+  "exclude": ["node_modules", "dist"]
 }