gogcli-mcp-contacts 2.30.0 → 4.0.0

package/manifest.json

@@ -3,7 +3,7 @@
   "manifest_version": "0.3",
   "name": "gogcli-mcp-contacts",
   "display_name": "gogcli (Contacts)",
-  "version": "2.30.0",
+  "version": "4.0.0",
   "description": "Extended Google Contacts for Claude via gogcli — auth + Contacts + Workspace directory (People API)",
   "author": {
     "name": "Chris Hall",

package/mint.yaml

@@ -12,25 +12,29 @@ env:
   - name: GOG_CLIENT_ID
     required: false
     help: >-
-      Google OAuth client id. NOTE: on the local-spawn path the child `gog`
-      receives a sanitized env — runner.ts drops GOG_ACCESS_TOKEN and every
-      *_TOKEN / *_SECRET / *_KEY / *_CREDENTIALS variable — so the CLI
-      authenticates from its own stored credentials under $HOME (see
-      state.dataDir), not from these variables being passed through.
+      Google OAuth client id. Read by the Node wrapper at startup
+      (bootstrap-auth.ts), which imports it into gog's keyring via a temp file
+      together with GOG_CLIENT_SECRET, GOG_REFRESH_TOKEN and GOG_ACCOUNT — set
+      all four or none. Not a secret, so unlike GOG_CLIENT_SECRET and
+      GOG_REFRESH_TOKEN it is not stripped from the spawned `gog`'s
+      environment; gog authenticates from its keyring under $HOME (see
+      state.dataDir).
   - name: GOG_CLIENT_SECRET
     secret: true
     required: false
     help: >-
-      Google OAuth client secret. Stripped from the spawned CLI's environment
-      by runner.ts's *_SECRET rule — see GOG_CLIENT_ID.
+      Google OAuth client secret. Imported into gog's keyring at startup with
+      GOG_CLIENT_ID; stripped from the spawned CLI's environment by runner.ts's
+      *_SECRET rule.
   - name: GOG_REFRESH_TOKEN
     secret: true
     required: false
     help: >-
-      Google OAuth refresh token. Stripped from the spawned CLI's environment
-      by runner.ts's *_TOKEN rule — see GOG_CLIENT_ID. A hosted deployment must
-      therefore carry gog's authorised-account state in its persisted data dir,
-      or drive a remote runner via GOG_RUNNER_URL.
+      Google OAuth refresh token (`gog auth tokens export` prints one). Imported
+      into gog's keyring at startup with GOG_CLIENT_ID; stripped from the
+      spawned CLI's environment by runner.ts's *_TOKEN rule. Changing it
+      re-imports on the next start; an in-connector re-auth
+      (gog_auth_add_url/complete) stays in effect until it changes.
   - name: GOG_ACCESS_TOKEN
     secret: true
     required: false
@@ -41,8 +45,21 @@ env:
   - name: GOG_ACCOUNT
     required: false
     help: >-
-      Which configured Google account to act as, when more than one is
-      authorised. Defaults to the single/most recent account.
+      The Google account to act as. Required for the startup auth bootstrap
+      (the refresh token is imported under this email); otherwise defaults to
+      gog's single/most recent account.
+  - name: GOG_KEYRING_BACKEND
+    required: false
+    help: >-
+      gog's credential store. Set to "file" on a headless host — there is no OS
+      keychain — so the keyring lives on the persistent data dir.
+  - name: GOG_KEYRING_PASSWORD
+    secret: true
+    required: false
+    help: >-
+      Encrypts gog's file keyring on the data dir. Required with
+      GOG_KEYRING_BACKEND=file. Deliberately not stripped from the spawned
+      CLI's environment — it is the one credential gog itself reads.
   - name: GOG_READONLY
     required: false
     help: >-
@@ -53,17 +70,6 @@ env:
     help: >-
       Path to the `gog` binary. Leave unset when the dependency below supplies
       it; set it only to point at a binary you manage yourself.
-  - name: GOG_RUNNER_URL
-    required: false
-    help: >-
-      URL of a remote gog runner to execute against instead of spawning the
-      local binary. If you set this, add its host to egress.allow.
-  - name: GOG_RUNNER_KEY
-    secret: true
-    required: false
-    help: >-
-      Shared key authenticating calls to GOG_RUNNER_URL. Required whenever that
-      is set.
   - name: GOG_TIMEZONE
     required: false
     help: >-
@@ -82,9 +88,8 @@ dependencies:
   # Every tool shells out to the `gog` CLI; without it the server starts and
   # then fails on the first call. This tag must track
   # packages/gogcli-mcp/src/runner.ts's MIN_GOG_VERSION (the floor the tools
-  # assume) and the fly-gog-runner/Dockerfile GOG_VERSION build arg. See
-  # CLAUDE.md "Required gog version" — bumping the floor means bumping these
-  # nine pins too.
+  # assume). See CLAUDE.md "Required gog version" — bumping the floor means
+  # bumping these nine pins, and the pin stored on each mcp-host registration.
   - kind: github-release
     repo: openclaw/gogcli
     tag: v0.40.0
@@ -93,15 +98,14 @@ dependencies:
 state:
   dataDir: true
   reason: >-
-    `gog` keeps its authorised-account state and token cache under $HOME.
-    Without a persistent data dir every cold start has no account configured and
-    every tool call fails until the credentials are re-supplied.
+    `gog` keeps its authorised-account state and file keyring under $HOME, and
+    the wrapper keeps its auth-bootstrap marker (~/.gogcli-mcp) there, so a
+    restart neither re-imports an unchanged secret nor discards an
+    in-connector re-auth. Without a persistent data dir every cold start has
+    only what the env secrets can re-seed.
 egress:
   allow:
     # Google OAuth token exchange and the Google REST APIs the CLI calls.
     - oauth2.googleapis.com
     - www.googleapis.com
     - googleapis.com
-    #
-    # NOTE: if you set GOG_RUNNER_URL to run against a remote gog runner, add
-    # that host here too — it is supplied at runtime and cannot be declared.

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "gogcli-mcp-contacts",
-  "version": "2.30.0",
+  "version": "4.0.0",
   "mcpName": "io.github.chrischall/gogcli-mcp-contacts",
   "description": "Extended Google Contacts + People MCP server via gogcli — auth + Contacts + Workspace directory (People API)",
   "author": "Claude Code (AI) <https://www.anthropic.com/claude>",
@@ -24,8 +24,8 @@
     "test:coverage": "vitest run --coverage"
   },
   "dependencies": {
-    "@chrischall/mcp-utils": "^0.23.3",
-    "@modelcontextprotocol/sdk": "^1.30.0",
+    "@chrischall/mcp-utils": "^0.28.0",
+    "@modelcontextprotocol/server": "^2.0.0",
     "zod": "^4.6.1"
   },
   "license": "MIT",

package/src/index.ts

@@ -1,11 +1,11 @@
 #!/usr/bin/env node
 import { runMcp } from '@chrischall/mcp-utils';
-import { VERSION, authToolsFor, registerContactsTools, useRemoteGogRunner } from '../../gogcli-mcp/src/lib.js';
+import { VERSION, authToolsFor, registerContactsTools, bootstrapGogAuth } from '../../gogcli-mcp/src/lib.js';
 import { registerExtraContactsTools } from './tools/contacts-extra.js';
 
-// Execute `gog` on the Fly backend when the host points us at one; without
-// it, nothing changes and we spawn the local binary as before.
-useRemoteGogRunner();
+
+// Seed gog's keyring from GOG_CLIENT_ID/SECRET/REFRESH_TOKEN/ACCOUNT when the host injects them.
+await bootstrapGogAuth();
 
 await runMcp({
   name: 'gogcli-contacts',

package/src/tools/contacts-extra.ts

@@ -1,4 +1,4 @@
-import { McpServer } from '@modelcontextprotocol/sdk/server/mcp.js';
+import { McpServer } from '@modelcontextprotocol/server';
 import { z } from 'zod';
 import { accountParam, runOrDiagnose, pageTokenParam, pageAliasParam, resolvePageToken} from '../../../gogcli-mcp/src/lib.js';
 
@@ -8,9 +8,9 @@ export function registerExtraContactsTools(server: McpServer): void {
   server.registerTool('gog_people_me', {
     description: 'Show your own People profile (people/me).',
     annotations: { readOnlyHint: true },
-    inputSchema: {
+    inputSchema: z.object({
       account: accountParam,
-    },
+    }),
   }, async ({ account }) => {
     return runOrDiagnose(['people', 'me'], { account });
   });
@@ -18,10 +18,10 @@ export function registerExtraContactsTools(server: McpServer): void {
   server.registerTool('gog_people_get', {
     description: 'Get a People profile by resource name.',
     annotations: { readOnlyHint: true },
-    inputSchema: {
+    inputSchema: z.object({
       userId: z.string().describe('Person resource name (people/...) or email'),
       account: accountParam,
-    },
+    }),
   }, async ({ userId, account }) => {
     return runOrDiagnose(['people', 'get', userId], { account });
   });
@@ -29,14 +29,14 @@ export function registerExtraContactsTools(server: McpServer): void {
   server.registerTool('gog_people_search', {
     description: 'Search the Google Workspace directory (covers internal users, unlike contacts search which is limited to your personal contacts).',
     annotations: { readOnlyHint: true },
-    inputSchema: {
+    inputSchema: z.object({
       query: z.string().describe('Search query (name, email, etc.)'),
       max: z.number().optional().describe('Max results (default: 50)'),
       pageToken: pageTokenParam,
       page: pageAliasParam,
       all: z.boolean().optional().describe('Fetch all pages'),
       account: accountParam,
-    },
+    }),
   }, async ({ query, max, pageToken, page, all, account }) => {
     const args = ['people', 'search', query];
     if (max !== undefined) args.push(`--max=${max}`);
@@ -49,11 +49,11 @@ export function registerExtraContactsTools(server: McpServer): void {
   server.registerTool('gog_people_relations', {
     description: 'Get relations (manager, reports, etc.) for a user. Defaults to self when userId is omitted.',
     annotations: { readOnlyHint: true },
-    inputSchema: {
+    inputSchema: z.object({
       userId: z.string().optional().describe('Person resource name (defaults to self when omitted)'),
       type: z.string().optional().describe('Filter to a specific relation type (e.g. "manager")'),
       account: accountParam,
-    },
+    }),
   }, async ({ userId, type, account }) => {
     const args = ['people', 'relations'];
     if (userId) args.push(userId);
@@ -63,7 +63,7 @@ export function registerExtraContactsTools(server: McpServer): void {
 
   server.registerTool('gog_contacts_update', {
     description: 'Update an existing Google Contact. Empty string clears a field; repeatable fields (url/address/custom/relation) take comma/semicolon-separated lists.',
-    inputSchema: {
+    inputSchema: z.object({
       resourceName: z.string().describe('Contact resource name (people/...)'),
       given: z.string().optional().describe('Given (first) name'),
       family: z.string().optional().describe('Family (last) name'),
@@ -77,7 +77,7 @@ export function registerExtraContactsTools(server: McpServer): void {
       birthday: z.string().optional().describe('Birthday in YYYY-MM-DD (empty string clears)'),
       ignoreEtag: z.boolean().optional().describe('Allow update even if a supplied etag is stale (may overwrite concurrent changes)'),
       account: accountParam,
-    },
+    }),
   }, async ({ resourceName, given, family, email, phone, org, title, url, note, address, birthday, ignoreEtag, account }) => {
     const args = ['contacts', 'update', resourceName];
     if (given !== undefined) args.push(`--given=${given}`);
@@ -97,10 +97,10 @@ export function registerExtraContactsTools(server: McpServer): void {
   server.registerTool('gog_contacts_delete', {
     description: 'Delete a Google Contact by resource name.',
     annotations: { destructiveHint: true },
-    inputSchema: {
+    inputSchema: z.object({
       resourceName: z.string().describe('Contact resource name (people/...)'),
       account: accountParam,
-    },
+    }),
   }, async ({ resourceName, account }) => {
     return runOrDiagnose(['contacts', 'delete', resourceName, '--force'], { account }); // gog gates this op; without --force the runner's --no-input makes it refuse
   });
@@ -108,7 +108,7 @@ export function registerExtraContactsTools(server: McpServer): void {
   server.registerTool('gog_contacts_export', {
     description: 'Export contacts as vCard (.vcf). Provide a selector (resource name, email, or name), or use query / all to export multiple.',
     annotations: { readOnlyHint: true },
-    inputSchema: {
+    inputSchema: z.object({
       selector: z.string().optional().describe('Contact resource name (people/...), email, or name'),
       query: z.string().optional().describe('Search query to export (max 30 results)'),
       all: z.boolean().optional().describe('Export all personal contacts'),
@@ -117,7 +117,7 @@ export function registerExtraContactsTools(server: McpServer): void {
       pageToken: pageTokenParam,
       page: pageAliasParam,
       account: accountParam,
-    },
+    }),
   }, async ({ selector, query, all, out, max, pageToken, page, account }) => {
     const args = ['contacts', 'export'];
     if (selector) args.push(selector);
@@ -133,14 +133,14 @@ export function registerExtraContactsTools(server: McpServer): void {
   server.registerTool('gog_contacts_dedupe', {
     description: 'Find likely duplicate personal contacts. Defaults to a read-only preview of the merge plan; set apply to actually merge each duplicate group and delete the redundant contacts (etag-checked, with ambiguous or unmergeable groups refused). Scope a risky apply with resource. Always preview first.',
     annotations: { destructiveHint: true },
-    inputSchema: {
+    inputSchema: z.object({
       match: z.string().optional().describe('Match fields, comma-separated from email,phone,name (default: email,phone)'),
       max: z.number().optional().describe('Max contacts to scan (0 = all). Mutually exclusive with resource — gog rejects passing both.'),
       resource: z.array(z.string()).optional().describe('Limit dedupe to these exact contact resource names (e.g. people/c123), repeatable — useful to scope an apply to known duplicates. Mutually exclusive with max.'),
       apply: z.boolean().optional().describe('Merge each duplicate group and DELETE the redundant contacts. Without this the tool only previews the plan. Destructive — preview first.'),
       failEmpty: z.boolean().optional().describe('Exit with an error (code 3) when no duplicates are found, instead of succeeding empty.'),
       account: accountParam,
-    },
+    }),
   }, async ({ match, max, resource, apply, failEmpty, account }) => {
     const args = ['contacts', 'dedupe'];
     if (match) args.push(`--match=${match}`);
@@ -155,13 +155,13 @@ export function registerExtraContactsTools(server: McpServer): void {
   server.registerTool('gog_contacts_directory_list', {
     description: 'List people from the Google Workspace directory (domain shared contacts).',
     annotations: { readOnlyHint: true },
-    inputSchema: {
+    inputSchema: z.object({
       max: z.number().optional().describe('Max results (default: 50)'),
       pageToken: pageTokenParam,
       page: pageAliasParam,
       all: z.boolean().optional().describe('Fetch all pages'),
       account: accountParam,
-    },
+    }),
   }, async ({ max, pageToken, page, all, account }) => {
     const args = ['contacts', 'directory', 'list'];
     if (max !== undefined) args.push(`--max=${max}`);
@@ -174,13 +174,13 @@ export function registerExtraContactsTools(server: McpServer): void {
   server.registerTool('gog_contacts_other_list', {
     description: 'List "other contacts" — auto-collected addresses (e.g. people you have emailed) that are not in your saved contacts.',
     annotations: { readOnlyHint: true },
-    inputSchema: {
+    inputSchema: z.object({
       max: z.number().optional().describe('Max results (default: 100)'),
       pageToken: pageTokenParam,
       page: pageAliasParam,
       all: z.boolean().optional().describe('Fetch all pages'),
       account: accountParam,
-    },
+    }),
   }, async ({ max, pageToken, page, all, account }) => {
     const args = ['contacts', 'other', 'list'];
     if (max !== undefined) args.push(`--max=${max}`);
@@ -193,11 +193,11 @@ export function registerExtraContactsTools(server: McpServer): void {
   server.registerTool('gog_contacts_other_search', {
     description: 'Search "other contacts" — auto-collected addresses not in your saved contacts.',
     annotations: { readOnlyHint: true },
-    inputSchema: {
+    inputSchema: z.object({
       query: z.string().describe('Search query'),
       max: z.number().optional().describe('Max results (default: 50)'),
       account: accountParam,
-    },
+    }),
   }, async ({ query, max, account }) => {
     const args = ['contacts', 'other', 'search', query];
     if (max !== undefined) args.push(`--max=${max}`);
@@ -207,12 +207,12 @@ export function registerExtraContactsTools(server: McpServer): void {
   server.registerTool('gog_people_raw', {
     description: 'Dump the raw People API response as JSON (lossless; for scripting and LLM consumption).',
     annotations: { readOnlyHint: true },
-    inputSchema: {
+    inputSchema: z.object({
       userId: z.string().describe('Person resource name (people/...) or email'),
       personFields: z.string().optional().describe('People API personFields mask (default: broad set)'),
       pretty: z.boolean().optional().describe('Pretty-print JSON (default: compact single-line)'),
       account: accountParam,
-    },
+    }),
   }, async ({ userId, personFields, pretty, account }) => {
     const args = ['people', 'raw', userId];
     if (personFields) args.push(`--person-fields=${personFields}`);

package/tsconfig.json

@@ -5,5 +5,5 @@
     "rootDir": "../"
   },
   "include": ["src/**/*", "../gogcli-mcp/src/**/*"],
-  "exclude": ["node_modules", "dist", "../gogcli-mcp/src/worker.ts"]
+  "exclude": ["node_modules", "dist"]
 }