gogcli-mcp-sheets 4.4.0 → 4.5.1

package/.claude-plugin/marketplace.json

@@ -7,7 +7,7 @@
   },
   "metadata": {
     "description": "Extended Google Sheets for Claude via gogcli — auth + full Sheets support",
-    "version": "4.4.0"
+    "version": "4.5.1"
   },
   "plugins": [
     {
@@ -15,7 +15,7 @@
       "displayName": "gogcli (Sheets)",
       "source": "./",
       "description": "Extended Google Sheets for Claude via gogcli — auth + full Sheets support",
-      "version": "4.4.0",
+      "version": "4.5.1",
       "author": {
         "name": "Chris Hall"
       },

package/.claude-plugin/plugin.json

@@ -1,7 +1,7 @@
 {
   "name": "gogcli-mcp-sheets",
   "displayName": "gogcli (Sheets)",
-  "version": "4.4.0",
+  "version": "4.5.1",
   "description": "Extended Google Sheets for Claude via gogcli — auth + full Sheets support",
   "author": {
     "name": "Chris Hall",

package/dist/index.js

@@ -37,6 +37,33 @@ var storage2 = new AsyncLocalStorage2();
 function withCallerCapabilities(capabilities, fn) {
   return capabilities ? storage2.run(capabilities, fn) : fn();
 }
+function currentCallerCapabilities() {
+  return storage2.getStore();
+}
+var ENVELOPE_CAPABILITIES_KEY = "io.modelcontextprotocol/clientCapabilities";
+var ELICITATION_MODES = ["form", "url"];
+function isRecord(value) {
+  return typeof value === "object" && value !== null && !Array.isArray(value);
+}
+function callerCapabilities(ctx) {
+  const envelope = isRecord(ctx) && isRecord(ctx.mcpReq) ? ctx.mcpReq.envelope : void 0;
+  if (isRecord(envelope)) {
+    const declared = envelope[ENVELOPE_CAPABILITIES_KEY];
+    if (isRecord(declared))
+      return declared;
+  }
+  return currentCallerCapabilities();
+}
+function callerAcceptsFormElicitation(ctx) {
+  const capabilities = callerCapabilities(ctx);
+  if (!capabilities)
+    return void 0;
+  const elicitation = capabilities.elicitation;
+  if (!isRecord(elicitation))
+    return false;
+  const namedModes = ELICITATION_MODES.filter((mode) => mode in elicitation);
+  return namedModes.length === 0 || namedModes.includes("form");
+}
 
 // ../../node_modules/@modelcontextprotocol/server/dist/chunk-Br0eD_fh.mjs
 var __create = Object.create;
@@ -24101,6 +24128,37 @@ var inputRequired = Object.assign(buildInputRequired, {
     return { method: "roots/list" };
   }
 });
+function acceptedContent(responses, key, schema) {
+  const view = inputResponse(responses, key);
+  if (view.kind !== "elicit" || view.action !== "accept" || view.content === void 0) return void 0;
+  if (schema === void 0) return view.content;
+  const outcome = schema["~standard"].validate(view.content);
+  if (outcome instanceof Promise) throw new TypeError("acceptedContent(responses, key, schema) requires a synchronously-validating schema");
+  return outcome.issues === void 0 ? outcome.value : void 0;
+}
+function inputResponse(responses, key) {
+  if (responses === void 0 || typeof responses !== "object" || responses === null) return { kind: "missing" };
+  const entry = responses[key];
+  if (entry === null || typeof entry !== "object" || Array.isArray(entry)) return { kind: "missing" };
+  const candidate = entry;
+  if (candidate["action"] === "accept" || candidate["action"] === "decline" || candidate["action"] === "cancel") {
+    const content = candidate["content"];
+    return {
+      kind: "elicit",
+      action: candidate["action"],
+      ...content !== null && typeof content === "object" && !Array.isArray(content) && { content }
+    };
+  }
+  if (Array.isArray(candidate["roots"])) return {
+    kind: "roots",
+    roots: candidate["roots"]
+  };
+  if (typeof candidate["role"] === "string" && candidate["content"] !== void 0) return {
+    kind: "sampling",
+    result: candidate
+  };
+  return { kind: "missing" };
+}
 var REQUEST_STATE_ONLY_LEG_PACING_MS = 250;
 function inputRequiredRoundsExceededMessage(method, maxRounds) {
   return `Multi-round-trip request '${method}' still required input after ${maxRounds} rounds (inputRequired.maxRounds)`;
@@ -34148,14 +34206,14 @@ function serveStdio(factory, options = {}) {
     return false;
   };
   const answerLegacyRejection = (request, reason, requestedVersion) => {
-    const rejection2 = modernOnlyStrictRejection({
+    const rejection3 = modernOnlyStrictRejection({
       kind: "legacy",
       reason,
       ...requestedVersion !== void 0 && { requestedVersion }
     }, SUPPORTED_MODERN_PROTOCOL_VERSIONS);
-    if (rejection2 === void 0) return Promise.resolve();
-    reportError(/* @__PURE__ */ new Error(`Rejected 2025-era request on a modern-only stdio connection (${rejection2.cell}): ${rejection2.message}`));
-    return writeErrorResponse(request.id, rejection2.code, rejection2.message, rejection2.data);
+    if (rejection3 === void 0) return Promise.resolve();
+    reportError(/* @__PURE__ */ new Error(`Rejected 2025-era request on a modern-only stdio connection (${rejection3.cell}): ${rejection3.message}`));
+    return writeErrorResponse(request.id, rejection3.code, rejection3.message, rejection3.data);
   };
   const onInstanceClosed = (channel) => {
     if (closing || channel === discarding) return;
@@ -34458,6 +34516,11 @@ function walk(value, keep, drop) {
 }
 
 // ../../node_modules/@chrischall/mcp-utils/dist/response/index.js
+function textResult(data) {
+  return {
+    content: [{ type: "text", text: JSON.stringify(data, null, 2) }]
+  };
+}
 function rawTextResult(text) {
   return { content: [{ type: "text", text }] };
 }
@@ -34468,6 +34531,416 @@ function errorResult(message) {
   };
 }
 
+// ../../node_modules/@chrischall/mcp-utils/dist/server/confirmation.js
+import { createHash, createHmac, timingSafeEqual } from "node:crypto";
+
+// ../../node_modules/@chrischall/mcp-utils/dist/server/canonical.js
+function canonicalJson(value) {
+  if (value === null || typeof value === "string" || typeof value === "boolean")
+    return JSON.stringify(value);
+  if (value === void 0)
+    return "null";
+  if (typeof value === "number")
+    return Number.isFinite(value) ? JSON.stringify(value) : `{"$num":"${String(value)}"}`;
+  if (typeof value === "bigint")
+    return `{"$bigint":"${value.toString()}"}`;
+  if (typeof value === "function" || typeof value === "symbol") {
+    throw new TypeError(`confirmation: cannot bind a ${typeof value} argument value.`);
+  }
+  if (Array.isArray(value))
+    return `[${value.map(canonicalJson).join(",")}]`;
+  if (value instanceof Date) {
+    return `{"$date":${JSON.stringify(Number.isNaN(value.getTime()) ? "Invalid Date" : value.toISOString())}}`;
+  }
+  if (ArrayBuffer.isView(value)) {
+    const bytes = Buffer.from(value.buffer, value.byteOffset, value.byteLength);
+    return `{"$bytes":${JSON.stringify(bytes.toString("base64"))}}`;
+  }
+  if (value instanceof ArrayBuffer)
+    return `{"$bytes":${JSON.stringify(Buffer.from(value).toString("base64"))}}`;
+  if (value instanceof Map) {
+    const entries2 = [...value.entries()].map(([k, v]) => `[${canonicalJson(k)},${canonicalJson(v)}]`).sort();
+    return `{"$map":[${entries2.join(",")}]}`;
+  }
+  if (value instanceof Set) {
+    return `{"$set":[${[...value].map(canonicalJson).sort().join(",")}]}`;
+  }
+  const proto = Object.getPrototypeOf(value);
+  if (proto !== Object.prototype && proto !== null) {
+    throw new TypeError("confirmation: cannot bind a non-plain object argument value (class instance).");
+  }
+  const entries = Object.entries(value).filter(([, v]) => v !== void 0).sort(([a], [b]) => a < b ? -1 : a > b ? 1 : 0);
+  return `{${entries.map(([k, v]) => `${JSON.stringify(escapeKey(k))}:${canonicalJson(v)}`).join(",")}}`;
+}
+function escapeKey(key) {
+  return key.startsWith("$") ? `$${key}` : key;
+}
+
+// ../../node_modules/@chrischall/mcp-utils/dist/server/confirmation.js
+var DEFAULT_REQUEST_KEY = "confirmation";
+var DEFAULT_CONFIRMATION_LABEL = "Confirm this action should proceed.";
+var UNSUPPORTED_NOTE = "Nothing was done because this client cannot show a confirmation prompt (it declares no MCP elicitation capability), and this action is never taken without one";
+var STATE_PREFIX = "mcpu.confirm.v1.";
+function bindingKey(binding) {
+  if (binding.ttlSeconds !== void 0 && !(Number.isFinite(binding.ttlSeconds) && binding.ttlSeconds > 0)) {
+    throw new RangeError("requireConfirmation: binding.ttlSeconds must be a finite number greater than 0.");
+  }
+  const key = typeof binding.key === "string" ? Buffer.from(binding.key, "utf8") : Buffer.from(binding.key);
+  if (key.length < 32) {
+    throw new RangeError("requireConfirmation: binding.key must be at least 32 bytes.");
+  }
+  return key;
+}
+function commitment(action, args) {
+  return createHash("sha256").update(`${action}\0${canonicalJson(args)}`).digest("base64url");
+}
+function mintState(key, action, binding) {
+  const exp = Math.floor(Date.now() / 1e3) + (binding.ttlSeconds ?? 600);
+  const body = Buffer.from(JSON.stringify({ c: commitment(action, binding.args), exp })).toString("base64url");
+  const mac3 = createHmac("sha256", key).update(`${STATE_PREFIX}${body}`).digest("base64url");
+  return `${STATE_PREFIX}${body}.${mac3}`;
+}
+function verifyState(key, action, binding, state) {
+  if (typeof state !== "string" || !state.startsWith(STATE_PREFIX))
+    return false;
+  const rest = state.slice(STATE_PREFIX.length);
+  const dot = rest.indexOf(".");
+  if (dot < 0)
+    return false;
+  const body = rest.slice(0, dot);
+  const mac3 = Buffer.from(rest.slice(dot + 1), "base64url");
+  const expected = createHmac("sha256", key).update(`${STATE_PREFIX}${body}`).digest();
+  if (mac3.length !== expected.length || !timingSafeEqual(mac3, expected))
+    return false;
+  let payload;
+  try {
+    payload = JSON.parse(Buffer.from(body, "base64url").toString("utf8"));
+  } catch {
+    return false;
+  }
+  if (typeof payload.exp !== "number" || payload.exp * 1e3 <= Date.now())
+    return false;
+  const want = Buffer.from(commitment(action, binding.args));
+  const got = Buffer.from(typeof payload.c === "string" ? payload.c : "");
+  return got.length === want.length && timingSafeEqual(got, want);
+}
+function echoedState(ctx) {
+  const accessor = ctx.mcpReq.requestState;
+  return typeof accessor === "function" ? accessor() : void 0;
+}
+function requireConfirmation(ctx, options) {
+  const requestKey = options.requestKey ?? DEFAULT_REQUEST_KEY;
+  const key = options.binding ? bindingKey(options.binding) : void 0;
+  const confirmationSchema = external_exports.object({
+    confirmed: external_exports.boolean().describe(options.confirmationLabel ?? DEFAULT_CONFIRMATION_LABEL)
+  });
+  const ask = () => {
+    const preview = {
+      action: options.action,
+      ...options.details === void 0 ? {} : { details: options.details }
+    };
+    return inputRequired({
+      inputRequests: {
+        [requestKey]: inputRequired.elicit({
+          message: `${options.message}
+${JSON.stringify(preview, null, 2)}`,
+          requestedSchema: confirmationSchema
+        })
+      },
+      ...key && options.binding ? { requestState: mintState(key, options.action, options.binding) } : {}
+    });
+  };
+  const response = inputResponse(ctx.mcpReq.inputResponses, requestKey);
+  const accepted = acceptedContent(ctx.mcpReq.inputResponses, requestKey, confirmationSchema);
+  if (response.kind === "missing") {
+    if (callerAcceptsFormElicitation(ctx) === false) {
+      return textResult({
+        confirmed: false,
+        dispatched: false,
+        action: options.action,
+        reason: "confirmation-unsupported",
+        note: options.unsupportedNote ? `${UNSUPPORTED_NOTE}. ${options.unsupportedNote}` : `${UNSUPPORTED_NOTE}.`
+      });
+    }
+    return ask();
+  }
+  if (response.kind === "elicit" && response.action === "accept" && accepted?.confirmed === true) {
+    if (key && options.binding) {
+      const state = echoedState(ctx);
+      if (state === void 0 || state === null) {
+        return errorResult(`Confirmation for ${options.action} was accepted, but the retry carried no requestState, so it cannot be checked against the prompt that was shown. Nothing was done. The likely cause is that the MCP client or host does not round-trip requestState (it must echo the requestState from the input_required result back on the retry); asking again would loop.`);
+      }
+      if (!verifyState(key, options.action, options.binding, state))
+        return ask();
+    }
+    return void 0;
+  }
+  return textResult({
+    confirmed: false,
+    cancelled: true,
+    action: options.action,
+    note: "Nothing was changed because the confirmation was declined, cancelled, or left unchecked."
+  });
+}
+
+// ../../node_modules/@chrischall/mcp-utils/dist/server/confirm-token.js
+import { createHash as createHash2, createHmac as createHmac2, randomBytes, timingSafeEqual as timingSafeEqual2 } from "node:crypto";
+function createSpentTokenStore() {
+  const spent2 = /* @__PURE__ */ new Map();
+  return {
+    has: (nonce) => spent2.has(nonce),
+    add: (nonce, exp) => {
+      spent2.set(nonce, exp);
+    },
+    prune: (now) => {
+      for (const [nonce, exp] of spent2)
+        if (exp < now)
+          spent2.delete(nonce);
+    },
+    clear: () => spent2.clear(),
+    get size() {
+      return spent2.size;
+    }
+  };
+}
+var PROCESS_SPENT = createSpentTokenStore();
+var PREFIX = "mcpu.token.v1.";
+var DEFAULT_TTL_SECONDS = 600;
+function tokenKey(key) {
+  const bytes = typeof key === "string" ? Buffer.from(key, "utf8") : Buffer.from(key);
+  if (bytes.length < 32)
+    throw new RangeError("confirm token: key must be at least 32 bytes.");
+  return bytes;
+}
+function ttlOf(ttlSeconds) {
+  if (ttlSeconds === void 0)
+    return DEFAULT_TTL_SECONDS;
+  if (!(Number.isFinite(ttlSeconds) && ttlSeconds > 0)) {
+    throw new RangeError("confirm token: ttlSeconds must be a finite number greater than 0.");
+  }
+  return ttlSeconds;
+}
+function sign(key, body) {
+  return createHmac2("sha256", key).update(`${PREFIX}${body}`).digest();
+}
+function hashConfirmPayload(payload) {
+  return createHash2("sha256").update(canonicalJson(payload)).digest("base64url");
+}
+function issueConfirmToken(key, binding, options = {}) {
+  const k = tokenKey(key);
+  const now = options.now ?? Date.now();
+  const exp = now + ttlOf(options.ttlSeconds) * 1e3;
+  const claims = {
+    t: binding.tool,
+    ...binding.account === void 0 ? {} : { a: binding.account },
+    g: binding.target,
+    ...binding.revision === void 0 ? {} : { r: binding.revision },
+    h: binding.payloadHash,
+    exp,
+    n: randomBytes(16).toString("base64url")
+  };
+  const body = Buffer.from(JSON.stringify(claims), "utf8").toString("base64url");
+  return { token: `${PREFIX}${body}.${sign(k, body).toString("base64url")}`, expiresAt: new Date(exp).toISOString() };
+}
+function parseClaims(body) {
+  try {
+    const claims = JSON.parse(Buffer.from(body, "base64url").toString("utf8"));
+    return claims && typeof claims === "object" ? claims : void 0;
+  } catch {
+    return void 0;
+  }
+}
+function verifyConfirmToken(key, token, binding, options = {}) {
+  const k = tokenKey(key);
+  const now = options.now ?? Date.now();
+  const spent2 = options.spent ?? PROCESS_SPENT;
+  spent2.prune(now);
+  if (!token.startsWith(PREFIX))
+    return { ok: false, error: "TOKEN_INVALID" };
+  const rest = token.slice(PREFIX.length);
+  const dot = rest.indexOf(".");
+  const body = dot < 0 ? "" : rest.slice(0, dot);
+  const mac3 = Buffer.from(dot < 0 ? "" : rest.slice(dot + 1), "base64url");
+  const expected = sign(k, body);
+  if (!body || mac3.length !== expected.length || !timingSafeEqual2(mac3, expected))
+    return { ok: false, error: "TOKEN_INVALID" };
+  const claims = parseClaims(body);
+  if (!claims)
+    return { ok: false, error: "TOKEN_INVALID" };
+  if (claims.t !== binding.tool || claims.a !== binding.account || claims.g !== binding.target) {
+    return { ok: false, error: "TOKEN_INVALID" };
+  }
+  if (spent2.has(claims.n))
+    return { ok: false, error: "TOKEN_REUSED" };
+  if (now > claims.exp)
+    return { ok: false, error: "TOKEN_EXPIRED" };
+  if (claims.r !== binding.revision)
+    return { ok: false, error: "DRAFT_CHANGED", reason: "revision-changed" };
+  if (claims.h !== binding.payloadHash)
+    return { ok: false, error: "DRAFT_CHANGED", reason: "payload-changed" };
+  spent2.add(claims.n, claims.exp);
+  return { ok: true };
+}
+var CONFIRM_TOKEN_INSTRUCTION = "Show this preview to the user verbatim and proceed only after they explicitly approve in chat. Then call again with confirmToken.";
+var confirmTokenParam = external_exports.string().optional().describe(`ONLY for the two-step confirmation fallback (a client without MCP elicitation). The confirmToken from this same tool's phase-1 "confirmation-required" response, passed back ONLY after the user has seen that preview and explicitly approved it in chat \u2014 never on the first call, never invented, never reused. Call again with the same arguments. Ignored when the client supports elicitation.`);
+var TOKEN_ERROR_NOTE = {
+  TOKEN_EXPIRED: "Nothing was sent or changed: the confirmToken expired. Call again WITHOUT confirmToken for a fresh preview, and ask the user to approve it again.",
+  TOKEN_REUSED: "Nothing was sent or changed by this call: this confirmToken was already used, and one approval acts once. If doing it again is really intended, call again WITHOUT confirmToken and get a new approval.",
+  TOKEN_INVALID: "Nothing was sent or changed: this confirmToken was not issued by this server for this tool, account and target (or the server has restarted since). Call again WITHOUT confirmToken for a fresh preview and approval."
+};
+var CHANGED_NOTE = {
+  "revision-changed": "Nothing was sent or changed: the target was edited since the user approved it (its version rotated), so what would happen is not what they saw.",
+  "payload-changed": "Nothing was sent or changed: what would happen no longer matches what the user approved."
+};
+function isToolResult(value) {
+  return Array.isArray(value.content);
+}
+function rejection2(data) {
+  return { ...textResult({ status: "confirmation-rejected", confirmed: false, dispatched: false, ...data }), isError: true };
+}
+async function tokenConfirmation(action, fb) {
+  const subject = await fb.subject();
+  if (isToolResult(subject))
+    return subject;
+  const binding = {
+    tool: fb.tool,
+    ...fb.account === void 0 ? {} : { account: fb.account },
+    target: subject.target,
+    ...subject.revision === void 0 ? {} : { revision: subject.revision },
+    payloadHash: hashConfirmPayload(subject.payload)
+  };
+  const phaseOne = () => {
+    const { token, expiresAt } = issueConfirmToken(fb.key, binding, { ttlSeconds: fb.ttlSeconds });
+    return {
+      action,
+      preview: subject.preview,
+      confirmToken: token,
+      expiresAt,
+      ttlSeconds: ttlOf(fb.ttlSeconds),
+      instruction: fb.instruction ?? CONFIRM_TOKEN_INSTRUCTION
+    };
+  };
+  if (!fb.confirmToken) {
+    return textResult({ status: "confirmation-required", confirmed: false, dispatched: false, ...phaseOne() });
+  }
+  const verdict = verifyConfirmToken(fb.key, fb.confirmToken, binding, { spent: fb.spent });
+  if (verdict.ok)
+    return void 0;
+  if (verdict.error === "DRAFT_CHANGED") {
+    return rejection2({
+      error: "DRAFT_CHANGED",
+      reason: verdict.reason,
+      note: `${CHANGED_NOTE[verdict.reason]} The current preview and a fresh confirmToken are below.`,
+      ...phaseOne()
+    });
+  }
+  return rejection2({ error: verdict.error, action, note: TOKEN_ERROR_NOTE[verdict.error] });
+}
+async function requireConfirmationWithFallback(ctx, options) {
+  const { tokenFallback, ...confirmation } = options;
+  if (tokenFallback && callerAcceptsFormElicitation(ctx) === false) {
+    return tokenConfirmation(options.action, tokenFallback);
+  }
+  return requireConfirmation(ctx, confirmation);
+}
+
+// ../../node_modules/@chrischall/mcp-utils/dist/server/confirm-env.js
+import { createHash as createHash3, randomBytes as randomBytes2 } from "node:crypto";
+
+// ../../node_modules/@chrischall/mcp-utils/dist/config/index.js
+import { homedir } from "node:os";
+import { isAbsolute, join, resolve } from "node:path";
+var PLACEHOLDER_RE = /^\$\{[^}]*\}$/;
+function readEnvVar(key, opts = {}) {
+  const env = opts.env ?? process.env;
+  const raw = env[key];
+  if (typeof raw === "string") {
+    const trimmed = raw.trim();
+    if (trimmed.length > 0 && trimmed !== "undefined" && trimmed !== "null" && !PLACEHOLDER_RE.test(trimmed)) {
+      return trimmed;
+    }
+  }
+  return opts.default;
+}
+var TRUE_TOKENS = /* @__PURE__ */ new Set(["1", "true", "yes", "on"]);
+var FALSE_TOKENS = /* @__PURE__ */ new Set(["0", "false", "no", "off"]);
+function parseBoolEnv(key, opts = {}) {
+  const fallback = opts.default ?? false;
+  const raw = readEnvVar(key, { env: opts.env });
+  if (raw === void 0)
+    return fallback;
+  const token = raw.toLowerCase();
+  if (TRUE_TOKENS.has(token))
+    return true;
+  if (FALSE_TOKENS.has(token))
+    return false;
+  return fallback;
+}
+function expandPath(p) {
+  let expanded = p;
+  if (p === "~") {
+    expanded = homedir();
+  } else if (p.startsWith("~/")) {
+    expanded = join(homedir(), p.slice(2));
+  }
+  return isAbsolute(expanded) ? expanded : resolve(expanded);
+}
+
+// ../../node_modules/@chrischall/mcp-utils/dist/server/confirm-env.js
+var MODES = /* @__PURE__ */ new Set(["ask-user", "auto", "refuse"]);
+var DEFAULT_TTL_SECONDS2 = 600;
+var warned = /* @__PURE__ */ new Set();
+function readConfirmMode(env = process.env) {
+  const raw = readEnvVar("MCP_CONFIRM_MODE", { env })?.trim().toLowerCase();
+  if (!raw)
+    return "ask-user";
+  if (MODES.has(raw))
+    return raw;
+  if (!warned.has(raw)) {
+    warned.add(raw);
+    process.stderr.write(`MCP_CONFIRM_MODE="${raw}" is not one of ask-user, auto, refuse; treating it as refuse.
+`);
+  }
+  return "refuse";
+}
+function confirmTtlFromEnv(env = process.env) {
+  const raw = readEnvVar("MCP_CONFIRM_TTL_SECONDS", { env })?.trim();
+  return raw && /^[1-9]\d*$/.test(raw) ? Number(raw) : DEFAULT_TTL_SECONDS2;
+}
+var processKey;
+function confirmKeyFromEnv(env = process.env) {
+  const secret = readEnvVar("MCP_CONFIRM_SECRET", { env });
+  if (secret)
+    return createHash3("sha256").update(secret, "utf8").digest();
+  processKey ??= randomBytes2(32);
+  return processKey;
+}
+var CONFIRM_TOKEN_AUTO_INSTRUCTION = "Nothing has been done yet. Review this preview; if it is what was intended, call again with the same arguments plus confirmToken. (This server runs with MCP_CONFIRM_MODE=auto, so the user's approval in chat is not required.)";
+var REFUSE_HINT = "Set MCP_CONFIRM_MODE=ask-user on the server to allow two-step confirmation instead.";
+function confirmationFromEnv(options) {
+  const { tool, account, confirmToken, subject, instruction, spent: spent2, env = process.env, ...confirmation } = options;
+  const mode = readConfirmMode(env);
+  if (mode === "refuse") {
+    return {
+      ...confirmation,
+      unsupportedNote: confirmation.unsupportedNote ? `${confirmation.unsupportedNote} ${REFUSE_HINT}` : REFUSE_HINT
+    };
+  }
+  return {
+    ...confirmation,
+    tokenFallback: {
+      key: confirmKeyFromEnv(env),
+      tool,
+      ...account === void 0 ? {} : { account },
+      ...confirmToken === void 0 ? {} : { confirmToken },
+      subject,
+      ttlSeconds: confirmTtlFromEnv(env),
+      instruction: mode === "auto" ? CONFIRM_TOKEN_AUTO_INSTRUCTION : instruction ?? CONFIRM_TOKEN_INSTRUCTION,
+      ...spent2 === void 0 ? {} : { spent: spent2 }
+    }
+  };
+}
+
 // ../../node_modules/@chrischall/mcp-utils/dist/server/index.js
 var SERVER_PROTOCOL_VERSIONS = Object.freeze([
   "2026-07-28",
@@ -34643,45 +35116,6 @@ function runMcp(opts) {
   return handle;
 }
 
-// ../../node_modules/@chrischall/mcp-utils/dist/config/index.js
-import { homedir } from "node:os";
-import { isAbsolute, join, resolve } from "node:path";
-var PLACEHOLDER_RE = /^\$\{[^}]*\}$/;
-function readEnvVar(key, opts = {}) {
-  const env = opts.env ?? process.env;
-  const raw = env[key];
-  if (typeof raw === "string") {
-    const trimmed = raw.trim();
-    if (trimmed.length > 0 && trimmed !== "undefined" && trimmed !== "null" && !PLACEHOLDER_RE.test(trimmed)) {
-      return trimmed;
-    }
-  }
-  return opts.default;
-}
-var TRUE_TOKENS = /* @__PURE__ */ new Set(["1", "true", "yes", "on"]);
-var FALSE_TOKENS = /* @__PURE__ */ new Set(["0", "false", "no", "off"]);
-function parseBoolEnv(key, opts = {}) {
-  const fallback = opts.default ?? false;
-  const raw = readEnvVar(key, { env: opts.env });
-  if (raw === void 0)
-    return fallback;
-  const token = raw.toLowerCase();
-  if (TRUE_TOKENS.has(token))
-    return true;
-  if (FALSE_TOKENS.has(token))
-    return false;
-  return fallback;
-}
-function expandPath(p) {
-  let expanded = p;
-  if (p === "~") {
-    expanded = homedir();
-  } else if (p.startsWith("~/")) {
-    expanded = join(homedir(), p.slice(2));
-  }
-  return isAbsolute(expanded) ? expanded : resolve(expanded);
-}
-
 // ../../node_modules/@chrischall/mcp-utils/dist/fs/confine.js
 import { existsSync, realpathSync } from "node:fs";
 import { dirname, isAbsolute as isAbsolute2, relative, resolve as resolve2, sep } from "node:path";
@@ -34763,9 +35197,9 @@ function offsetAt(instant, tz) {
   const w = wallPartsIn(instant, tz);
   const asUTC = Date.UTC(w.year, w.month - 1, w.day, w.hour, w.minute, w.second, instant.getUTCMilliseconds());
   const minutes = Math.round((asUTC - instant.getTime()) / 6e4);
-  const sign = minutes < 0 ? "-" : "+";
+  const sign2 = minutes < 0 ? "-" : "+";
   const abs = Math.abs(minutes);
-  return `${sign}${pad(Math.floor(abs / 60))}:${pad(abs % 60)}`;
+  return `${sign2}${pad(Math.floor(abs / 60))}:${pad(abs % 60)}`;
 }
 function wallPartsIn(instant, tz) {
   const parts = new Intl.DateTimeFormat("en-US", {
@@ -35470,6 +35904,7 @@ async function diagnose(err) {
   const isAuthError = !isTransientError && AUTH_ERROR_PATTERN.test(errText);
   const isGridLimitError = GRID_LIMIT_ERROR_PATTERN.test(errText);
   const hint = isInvalidGrant ? INVALID_GRANT_HINT : isAuthError ? AUTH_HINT : isTransientError ? TRANSIENT_HINT : isGridLimitError ? GRID_LIMIT_HINT : "";
+  if (!isAuthError && !isInvalidGrant) return errorResult(`${errText}${hint}`);
   try {
     const accounts = formatAccountList(await run(["auth", "list"]));
     return errorResult(`${errText}
@@ -35558,10 +35993,44 @@ function formatAuthHealth(raw, now) {
   return accounts.map((a) => formatOneAccountHealth(a, now)).join("\n\n");
 }
 
+// ../gogcli-mcp/src/send-confirm-token.ts
+var spent = createSpentTokenStore();
+function confirmSpentStore() {
+  return spent;
+}
+
 // ../gogcli-mcp/src/dispatch-confirmation.ts
-var confirmTokenParam = external_exports.string().optional().describe(
-  `ONLY for the two-step fallback (client without MCP elicitation, server with GOG_SEND_CONFIRM_FALLBACK=token). The confirmToken from this same tool's phase-1 "confirmation-required" response, passed back ONLY after the user has seen that preview and explicitly approved it in chat \u2014 never on the first call, never invented, never reused. Call again with the same arguments. Ignored when the client supports elicitation.`
-);
+var CONFIRM_ACTION_INSTRUCTION = CONFIRM_TOKEN_INSTRUCTION;
+var CONFIRM_FALLBACK_DESCRIPTION = ' If the client cannot show that prompt (no MCP elicitation, e.g. claude.ai), a two-step flow applies instead: call WITHOUT confirmToken and nothing is sent or changed \u2014 the result has status "confirmation-required", the full preview and a confirmToken. Follow its instruction (by default: show the preview to the user verbatim and only after they explicitly approve it in chat, call again with the SAME arguments plus confirmToken). The tool re-reads what it would act on and refuses (DRAFT_CHANGED, with a fresh preview and token) if it changed; TOKEN_EXPIRED / TOKEN_REUSED / TOKEN_INVALID also do nothing. A server set to MCP_CONFIRM_MODE=refuse refuses instead.';
+function refusedInRun(what, via, does, instead) {
+  return `${what} ${does} and is not available through ${via}. ${instead}`;
+}
+function gatedElsewhere(what, via, does, tool) {
+  return refusedInRun(what, via, does, `Use ${tool}, which asks the user to confirm.`);
+}
+function hasCommandWord(args, words) {
+  return args.find((a) => words.has(a.toLowerCase()));
+}
+async function requireDispatchConfirmation(ctx, options) {
+  const { action, fallback } = options;
+  const confirmation = {
+    action,
+    message: options.message,
+    details: options.details,
+    confirmationLabel: options.confirmationLabel,
+    ...options.unsupportedNote ? { unsupportedNote: options.unsupportedNote } : {}
+  };
+  if (!fallback) return requireConfirmationWithFallback(ctx, confirmation);
+  return requireConfirmationWithFallback(ctx, confirmationFromEnv({
+    ...confirmation,
+    tool: fallback.tool,
+    account: fallback.account ?? readEnvVar("GOG_ACCOUNT") ?? "",
+    confirmToken: fallback.confirmToken,
+    subject: fallback.subject,
+    instruction: fallback.instruction ?? CONFIRM_ACTION_INSTRUCTION,
+    spent: confirmSpentStore()
+  }));
+}
 
 // ../gogcli-mcp/src/tools/auth.ts
 var AUTH_RUN_SUBCOMMANDS = ["list", "status", "services", "remove", "alias"];
@@ -35698,6 +36167,27 @@ function authToolsFor(defaultServices) {
 }
 
 // ../gogcli-mcp/src/tools/calendar.ts
+var ASKS = (tool) => `Use ${tool}, which asks the user to confirm.`;
+var CALENDAR_REFUSED = {
+  create: { does: "can change what guests see", instead: ASKS("gog_calendar_create") },
+  add: { does: "can change what guests see", instead: ASKS("gog_calendar_create") },
+  new: { does: "can change what guests see", instead: ASKS("gog_calendar_create") },
+  update: { does: "can change what guests see", instead: ASKS("gog_calendar_update") },
+  edit: { does: "can change what guests see", instead: ASKS("gog_calendar_update") },
+  set: { does: "can change what guests see", instead: ASKS("gog_calendar_update") },
+  respond: { does: "can change what guests see", instead: ASKS("gog_calendar_respond") },
+  rsvp: { does: "can change what guests see", instead: ASKS("gog_calendar_respond") },
+  reply: { does: "can change what guests see", instead: ASKS("gog_calendar_respond") },
+  move: { does: "moves an event off guests' calendars (and can email them)", instead: ASKS("gog_calendar_move") },
+  transfer: { does: "moves an event off guests' calendars (and can email them)", instead: ASKS("gog_calendar_move") },
+  delete: { does: "removes an event from every guest's calendar (the whole series by default)", instead: ASKS("gog_calendar_delete") },
+  del: { does: "removes an event from every guest's calendar (the whole series by default)", instead: ASKS("gog_calendar_delete") },
+  rm: { does: "removes an event from every guest's calendar (the whole series by default)", instead: ASKS("gog_calendar_delete") },
+  remove: { does: "removes an event from every guest's calendar (the whole series by default)", instead: ASKS("gog_calendar_delete") },
+  "delete-calendar": { does: "deletes a calendar and every event on it", instead: ASKS("gog_calendar_delete_calendar") },
+  "out-of-office": { does: "auto-declines invitations and notifies their organizers", instead: ASKS("gog_calendar_out_of_office") },
+  ooo: { does: "auto-declines invitations and notifies their organizers", instead: ASKS("gog_calendar_out_of_office") }
+};
 var reminderParams = {
   reminders: external_exports.array(external_exports.string()).max(5).optional().describe(
     `Reminders as method:duration, e.g. ["popup:30m", "email:1d"]. Method is popup or email; duration accepts m/h/d (max 40320 minutes = 4 weeks). Google allows at most 5. These REPLACE the event's reminders \u2014 on update, pass an EMPTY array to drop custom reminders and go back to the calendar's defaults. Cannot be combined with noReminders.`
@@ -35799,6 +36289,13 @@ function countNonEmptyCells(getOutput) {
 }
 
 // ../gogcli-mcp/src/tools/sheets.ts
+var DATASOURCE_ALIASES = /* @__PURE__ */ new Set(["datasource", "data-source", "data-sources", "connected-sheets"]);
+var DATASOURCE_BILLED = /* @__PURE__ */ new Set(["add", "update", "refresh"]);
+function vetSheetsRun(subcommand, args) {
+  if (!DATASOURCE_ALIASES.has(subcommand.toLowerCase())) return void 0;
+  const word = hasCommandWord(args, DATASOURCE_BILLED)?.toLowerCase();
+  return word ? gatedElsewhere(`gog sheets datasource ${word}`, "gog_sheets_run", "runs a billed BigQuery job", `gog_sheets_datasource_${word}`) : void 0;
+}
 var cellValueParam = external_exports.union([external_exports.string(), external_exports.number(), external_exports.boolean(), external_exports.null()]);
 var dryRunParam = external_exports.boolean().optional().describe(
   "Preview the operation without modifying the sheet (gog --dry-run): reports the intended actions and exits without writing."
@@ -35914,11 +36411,11 @@ function registerSheetsTools(server) {
   }, async ({ spreadsheetId, find, replace, account }) => {
     return runOrDiagnose(["sheets", "find-replace", pos(spreadsheetId), pos(find), pos(replace)], { account });
   });
-  registerRunTool(server, { service: "sheets", examples: '"freeze", "add-tab", "rename-tab"' });
+  registerRunTool(server, { service: "sheets", examples: '"freeze", "add-tab", "rename-tab"', vet: vetSheetsRun });
 }
 
 // ../gogcli-mcp/src/server.ts
-var VERSION = true ? "4.4.0" : "0.0.0";
+var VERSION = true ? "4.5.1" : "0.0.0";
 
 // ../gogcli-mcp/src/bootstrap-auth.ts
 import { join as join5 } from "node:path";
@@ -35955,12 +36452,12 @@ async function bootstrapGogAuth(env = process.env, options = {}) {
   const [clientId, clientSecret, refreshToken, account] = values;
   const { spawner } = options;
   try {
-    const { createHash } = await import("node:crypto");
+    const { createHash: createHash4 } = await import("node:crypto");
     const { mkdir, readFile, writeFile, chmod } = await import("node:fs/promises");
     const home = options.home ?? (await import("node:os")).homedir();
     const dir = join5(home, ".gogcli-mcp");
     const marker = join5(dir, AUTH_BOOTSTRAP_MARKER);
-    const fingerprint = createHash("sha256").update(values.join("\0")).digest("hex");
+    const fingerprint = createHash4("sha256").update(values.join("\0")).digest("hex");
     const previous = await readFile(marker, "utf8").catch(() => void 0);
     if (previous === fingerprint && await accountListed(account, spawner)) return "present";
     await run(
@@ -35997,6 +36494,32 @@ function resultText2(result) {
   const first = result.content[0];
   return first?.type === "text" ? first.text : void 0;
 }
+function spreadsheetTitle(raw) {
+  try {
+    const parsed = JSON.parse(String(raw));
+    const title = parsed?.spreadsheet?.properties?.title ?? parsed?.properties?.title;
+    return typeof title === "string" ? title : void 0;
+  } catch {
+    return void 0;
+  }
+}
+function dataSourceSnapshot(raw) {
+  let bq;
+  try {
+    const parsed = JSON.parse(String(raw));
+    bq = (parsed?.dataSource ?? parsed)?.spec?.bigQuery;
+  } catch {
+    bq = void 0;
+  }
+  const str = (v) => typeof v === "string" ? v : void 0;
+  const t = bq?.tableSpec;
+  const table = [t?.tableProjectId, t?.datasetId, t?.tableId].map(str).filter(Boolean).join(".");
+  return {
+    ...str(bq?.projectId) ? { billingProject: str(bq?.projectId) } : {},
+    ...str(bq?.querySpec?.rawQuery) ? { query: str(bq?.querySpec?.rawQuery) } : {},
+    ...table ? { table } : {}
+  };
+}
 function hexToRgb(hex3) {
   let h = hex3.trim().replace(/^#/, "");
   if (h.length === 3) h = h[0] + h[0] + h[1] + h[1] + h[2] + h[2];
@@ -36035,6 +36558,25 @@ async function checkDateFormatTarget(spreadsheetId, range, account) {
   if (!sawSmallInt) return null;
   return "Warning: applying DATE/DATE_TIME format to cells holding small integers (< 10000) will render them as dates near 1899-12-30 because Sheets interprets numeric values as day-serials from that epoch. If those integers are ordinals (1, 2, 3, ...) and not day offsets, this is almost certainly not what you want. Pass force:true to suppress this warning, or convert the cells to real dates / strings first.";
 }
+async function confirmBilledExecution(ctx, o) {
+  const got = await runOrDiagnose(["sheets", "metadata", pos(o.spreadsheetId), "--select=properties.title"], { account: o.account });
+  if (got.isError) return got;
+  const title = spreadsheetTitle(resultText2(got));
+  const view = { spreadsheet: { id: o.spreadsheetId, ...title !== void 0 ? { title } : {} }, ...o.view };
+  return requireDispatchConfirmation(ctx, {
+    action: o.action,
+    message: "Review and confirm starting a BigQuery execution \u2014 it is billed to the billing project:",
+    confirmationLabel: "Confirm that this billed BigQuery query should run now.",
+    details: view,
+    unsupportedNote: "Ask the user to run it from Google Sheets (Data > Data connectors).",
+    fallback: {
+      tool: o.tool,
+      account: o.account,
+      confirmToken: o.confirmToken,
+      subject: () => ({ target: o.target, payload: view, preview: view })
+    }
+  });
+}
 function registerExtraSheetsTools(server) {
   server.registerTool("gog_sheets_list_tabs", {
     description: "List tabs (sheets) in a spreadsheet with their titles, sheetIds, and indices. A friendlier view than gog_sheets_metadata when you only need the tab list \u2014 useful for restructuring a workbook over a long agent session without losing track of names.",
@@ -36955,7 +37497,7 @@ ${errorText(err)}`
     if (render) args.push(`--render=${render}`);
     return runOrDiagnose(args, { account });
   });
-  const bigQueryChargeNote = " COSTS MONEY AND RUNS ASYNCHRONOUSLY: this starts a BigQuery execution billed to the billing project, and returns once the execution has been REQUESTED \u2014 not once it has finished. Poll gog_sheets_datasource_describe until its dataExecutionStatus state is SUCCEEDED or FAILED before treating the data as current.";
+  const bigQueryChargeNote = " COSTS MONEY AND RUNS ASYNCHRONOUSLY: this starts a BigQuery execution billed to the billing project, and returns once the execution has been REQUESTED \u2014 not once it has finished. Poll gog_sheets_datasource_describe until its dataExecutionStatus state is SUCCEEDED or FAILED before treating the data as current. Because it bills, it first asks the MCP host to show the user a confirmation prompt naming the spreadsheet, the query or table and the billing project; nothing runs unless they accept." + CONFIRM_FALLBACK_DESCRIPTION;
   server.registerTool("gog_sheets_datasource_add", {
     description: "Add a BigQuery Connected Sheets data source to a spreadsheet, creating its linked DATA_SOURCE sheet. Point it at EITHER a custom SQL query (query) OR an existing native table (dataset + table) \u2014 never both. billingProject is the BigQuery project charged for the query; tableProject only names which project OWNS the table, and defaults to the billing project. Returns the new dataSourceId, which every other datasource tool takes." + bigQueryChargeNote + bigQueryScopeNote,
     annotations: { destructiveHint: false },
@@ -36966,9 +37508,10 @@ ${errorText(err)}`
       dataset: external_exports.string().optional().describe("BigQuery dataset ID of an existing table. Requires table; mutually exclusive with query."),
       table: external_exports.string().optional().describe("BigQuery table ID. Requires dataset; mutually exclusive with query."),
       tableProject: external_exports.string().optional().describe("BigQuery project that owns the table (default: the billing project). Only valid with dataset/table."),
-      account: accountParam
+      account: accountParam,
+      confirmToken: confirmTokenParam
     })
-  }, async ({ spreadsheetId, billingProject, query, dataset, table, tableProject, account }) => {
+  }, async ({ spreadsheetId, billingProject, query, dataset, table, tableProject, account, confirmToken }, ctx) => {
     const tableFlags = tableProject !== void 0 || dataset !== void 0 || table !== void 0;
     if (query !== void 0 && tableFlags) {
       throw new Error("query and the table fields (dataset, table, tableProject) are mutually exclusive \u2014 a data source is backed by one or the other.");
@@ -36981,6 +37524,17 @@ ${errorText(err)}`
     if (tableProject) args.push(`--table-project=${tableProject}`);
     if (dataset) args.push(`--dataset=${dataset}`);
     if (table) args.push(`--table=${table}`);
+    const source = query !== void 0 ? { query } : { table: [tableProject ?? billingProject, dataset, table].join(".") };
+    const confirmation = await confirmBilledExecution(ctx, {
+      tool: "gog_sheets_datasource_add",
+      action: "sheets.datasource-add",
+      account,
+      confirmToken,
+      spreadsheetId,
+      target: spreadsheetId,
+      view: { billingProject, ...source }
+    });
+    if (confirmation) return confirmation;
     return runOrDiagnose(args, { account });
   });
   server.registerTool("gog_sheets_datasource_update", {
@@ -36994,9 +37548,10 @@ ${errorText(err)}`
       dataset: external_exports.string().optional().describe("Replacement dataset ID. Only valid on a table-backed source."),
       table: external_exports.string().optional().describe("Replacement table ID. Only valid on a table-backed source."),
       tableProject: external_exports.string().optional().describe("Replacement project owning the table. Only valid on a table-backed source."),
-      account: accountParam
+      account: accountParam,
+      confirmToken: confirmTokenParam
     })
-  }, async ({ spreadsheetId, dataSourceId, billingProject, query, dataset, table, tableProject, account }) => {
+  }, async ({ spreadsheetId, dataSourceId, billingProject, query, dataset, table, tableProject, account, confirmToken }, ctx) => {
     const tableFlags = tableProject !== void 0 || dataset !== void 0 || table !== void 0;
     if (query !== void 0 && tableFlags) {
       throw new Error("query and the table fields (dataset, table, tableProject) are mutually exclusive \u2014 a data source is backed by one or the other.");
@@ -37010,6 +37565,17 @@ ${errorText(err)}`
     if (tableProject !== void 0) args.push(`--table-project=${tableProject}`);
     if (dataset !== void 0) args.push(`--dataset=${dataset}`);
     if (table !== void 0) args.push(`--table=${table}`);
+    const changes = Object.fromEntries(Object.entries({ billingProject, query, tableProject, dataset, table }).filter(([, v]) => v !== void 0));
+    const confirmation = await confirmBilledExecution(ctx, {
+      tool: "gog_sheets_datasource_update",
+      action: "sheets.datasource-update",
+      account,
+      confirmToken,
+      spreadsheetId,
+      target: `${spreadsheetId}/${dataSourceId}`,
+      view: { dataSourceId, changes }
+    });
+    if (confirmation) return confirmation;
     return runOrDiagnose(args, { account });
   });
   server.registerTool("gog_sheets_datasource_refresh", {
@@ -37019,11 +37585,24 @@ ${errorText(err)}`
       spreadsheetId: external_exports.string().describe("Spreadsheet ID"),
       dataSourceId: external_exports.string().describe("Data source ID, as reported by gog_sheets_datasource_list"),
       forceRefresh: external_exports.boolean().optional().describe("Refresh even when the previous execution failed"),
-      account: accountParam
+      account: accountParam,
+      confirmToken: confirmTokenParam
     })
-  }, async ({ spreadsheetId, dataSourceId, forceRefresh, account }) => {
+  }, async ({ spreadsheetId, dataSourceId, forceRefresh, account, confirmToken }, ctx) => {
     const args = ["sheets", "datasource", "refresh", pos(spreadsheetId), pos(dataSourceId)];
     if (forceRefresh) args.push("--force-refresh");
+    const described = await runOrDiagnose(["sheets", "datasource", "describe", pos(spreadsheetId), pos(dataSourceId)], { account });
+    if (described.isError) return described;
+    const confirmation = await confirmBilledExecution(ctx, {
+      tool: "gog_sheets_datasource_refresh",
+      action: "sheets.datasource-refresh",
+      account,
+      confirmToken,
+      spreadsheetId,
+      target: `${spreadsheetId}/${dataSourceId}`,
+      view: { dataSourceId, ...dataSourceSnapshot(resultText2(described)), forceRefresh: Boolean(forceRefresh) }
+    });
+    if (confirmation) return confirmation;
     return runOrDiagnose(args, { account });
   });
   server.registerTool("gog_sheets_datasource_delete", {

package/manifest.json

@@ -3,7 +3,7 @@
   "manifest_version": "0.3",
   "name": "gogcli-mcp-sheets",
   "display_name": "gogcli (Sheets)",
-  "version": "4.4.0",
+  "version": "4.5.1",
   "description": "Extended Google Sheets for Claude via gogcli — auth + full Sheets support",
   "author": {
     "name": "Chris Hall",
@@ -349,15 +349,15 @@
     },
     {
       "name": "gog_sheets_datasource_add",
-      "description": "Add a BigQuery Connected Sheets data source (custom SQL or a native table)"
+      "description": "Add a BigQuery Connected Sheets data source (custom SQL or a native table) (billed; asks the user to confirm)"
     },
     {
       "name": "gog_sheets_datasource_update",
-      "description": "Repoint a Connected Sheets data source's SQL, table or billing project"
+      "description": "Repoint a Connected Sheets data source's SQL, table or billing project (billed; asks the user to confirm)"
     },
     {
       "name": "gog_sheets_datasource_refresh",
-      "description": "Re-run a Connected Sheets data source against current BigQuery data"
+      "description": "Re-run a Connected Sheets data source against current BigQuery data (billed; asks the user to confirm)"
     },
     {
       "name": "gog_sheets_datasource_delete",

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "gogcli-mcp-sheets",
-  "version": "4.4.0",
+  "version": "4.5.1",
   "mcpName": "io.github.chrischall/gogcli-mcp-sheets",
   "description": "Extended Google Sheets MCP server via gogcli — all base tools plus full Sheets support",
   "author": "Claude Code (AI) <https://www.anthropic.com/claude>",
@@ -24,7 +24,7 @@
     "test:coverage": "vitest run --coverage"
   },
   "dependencies": {
-    "@chrischall/mcp-utils": "^2.4.0",
+    "@chrischall/mcp-utils": "^2.6.0",
     "@modelcontextprotocol/server": "^2.0.0",
     "zod": "^4.6.1"
   },

package/server.json

@@ -7,12 +7,12 @@
     "source": "github",
     "subfolder": "packages/gogcli-mcp-sheets"
   },
-  "version": "4.4.0",
+  "version": "4.5.1",
   "packages": [
     {
       "registryType": "npm",
       "identifier": "gogcli-mcp-sheets",
-      "version": "4.4.0",
+      "version": "4.5.1",
       "transport": {
         "type": "stdio"
       },

package/src/tools/sheets-extra.ts

@@ -2,7 +2,20 @@ import { McpServer } from '@modelcontextprotocol/server';
 import type { CallToolResult } from '@modelcontextprotocol/server';
 import { z } from 'zod';
 import { rawTextResult } from '@chrischall/mcp-utils';
-import { accountParam, runOrDiagnose, run, diagnose, errorText, payloadArg, pos, confinePath, confineAtFile } from '../../../gogcli-mcp/src/lib.js';
+import {
+  accountParam,
+  runOrDiagnose,
+  run,
+  diagnose,
+  errorText,
+  payloadArg,
+  pos,
+  confinePath,
+  confineAtFile,
+  CONFIRM_FALLBACK_DESCRIPTION,
+  confirmTokenParam,
+  requireDispatchConfirmation,
+} from '../../../gogcli-mcp/src/lib.js';
 import type { GogArg } from '../../../gogcli-mcp/src/lib.js';
 
 // Pull the text out of a single-text-block tool result; undefined for any
@@ -12,6 +25,44 @@ function resultText(result: CallToolResult): string | undefined {
   return first?.type === 'text' ? first.text : undefined;
 }
 
+/** A spreadsheet's title from `gog sheets metadata --select=properties.title`. Unreadable output names nothing. */
+export function spreadsheetTitle(raw: string | undefined): string | undefined {
+  try {
+    const parsed = JSON.parse(String(raw)) as { properties?: { title?: unknown }; spreadsheet?: { properties?: { title?: unknown } } } | null;
+    const title = parsed?.spreadsheet?.properties?.title ?? parsed?.properties?.title;
+    return typeof title === 'string' ? title : undefined;
+  } catch {
+    return undefined;
+  }
+}
+
+/**
+ * What a data source queries and who pays, from `gog sheets datasource describe`,
+ * for a refresh's prompt. Best effort: only the fields found are named.
+ */
+export function dataSourceSnapshot(raw: string | undefined): { billingProject?: string; query?: string; table?: string } {
+  type BigQuerySpec = {
+    projectId?: unknown;
+    querySpec?: { rawQuery?: unknown };
+    tableSpec?: { tableProjectId?: unknown; datasetId?: unknown; tableId?: unknown };
+  };
+  let bq: BigQuerySpec | undefined;
+  try {
+    const parsed = JSON.parse(String(raw)) as ({ dataSource?: { spec?: { bigQuery?: BigQuerySpec } }; spec?: { bigQuery?: BigQuerySpec } }) | null;
+    bq = (parsed?.dataSource ?? parsed)?.spec?.bigQuery;
+  } catch {
+    bq = undefined;
+  }
+  const str = (v: unknown) => (typeof v === 'string' ? v : undefined);
+  const t = bq?.tableSpec;
+  const table = [t?.tableProjectId, t?.datasetId, t?.tableId].map(str).filter(Boolean).join('.');
+  return {
+    ...(str(bq?.projectId) ? { billingProject: str(bq?.projectId) } : {}),
+    ...(str(bq?.querySpec?.rawQuery) ? { query: str(bq?.querySpec?.rawQuery) } : {}),
+    ...(table ? { table } : {}),
+  };
+}
+
 // Convert a CSS-style hex color ("#FFF5D9", "#FD9", "FFF5D9") to the
 // {red, green, blue} 0-1 float triple that Sheets API CellFormat expects.
 // Returns null on unparseable input — caller decides whether to fall back
@@ -77,6 +128,42 @@ async function checkDateFormatTarget(
   );
 }
 
+/**
+ * Fleet audit 2026-09-24 SEC-6: every datasource add / update / refresh starts
+ * a BigQuery job billed to a project, so each asks first — naming the
+ * spreadsheet by title, what will be queried and who pays.
+ */
+async function confirmBilledExecution(
+  ctx: Parameters<typeof requireDispatchConfirmation>[0],
+  o: {
+    tool: string;
+    action: string;
+    account: string | undefined;
+    confirmToken: string | undefined;
+    spreadsheetId: string;
+    target: string;
+    view: Record<string, unknown>;
+  },
+) {
+  const got = await runOrDiagnose(['sheets', 'metadata', pos(o.spreadsheetId), '--select=properties.title'], { account: o.account });
+  if (got.isError) return got;
+  const title = spreadsheetTitle(resultText(got));
+  const view = { spreadsheet: { id: o.spreadsheetId, ...(title !== undefined ? { title } : {}) }, ...o.view };
+  return requireDispatchConfirmation(ctx, {
+    action: o.action,
+    message: 'Review and confirm starting a BigQuery execution — it is billed to the billing project:',
+    confirmationLabel: 'Confirm that this billed BigQuery query should run now.',
+    details: view,
+    unsupportedNote: 'Ask the user to run it from Google Sheets (Data > Data connectors).',
+    fallback: {
+      tool: o.tool,
+      account: o.account,
+      confirmToken: o.confirmToken,
+      subject: () => ({ target: o.target, payload: view, preview: view }),
+    },
+  });
+}
+
 export function registerExtraSheetsTools(server: McpServer): void {
 
   server.registerTool('gog_sheets_list_tabs', {
@@ -1144,7 +1231,9 @@ export function registerExtraSheetsTools(server: McpServer): void {
   const bigQueryChargeNote =
     ' COSTS MONEY AND RUNS ASYNCHRONOUSLY: this starts a BigQuery execution billed to the billing project, and returns ' +
     'once the execution has been REQUESTED — not once it has finished. Poll gog_sheets_datasource_describe until its ' +
-    'dataExecutionStatus state is SUCCEEDED or FAILED before treating the data as current.';
+    'dataExecutionStatus state is SUCCEEDED or FAILED before treating the data as current. Because it bills, it first asks ' +
+    'the MCP host to show the user a confirmation prompt naming the spreadsheet, the query or table and the billing ' +
+    'project; nothing runs unless they accept.' + CONFIRM_FALLBACK_DESCRIPTION;
 
   server.registerTool('gog_sheets_datasource_add', {
     description:
@@ -1162,8 +1251,9 @@ export function registerExtraSheetsTools(server: McpServer): void {
       table: z.string().optional().describe('BigQuery table ID. Requires dataset; mutually exclusive with query.'),
       tableProject: z.string().optional().describe('BigQuery project that owns the table (default: the billing project). Only valid with dataset/table.'),
       account: accountParam,
+      confirmToken: confirmTokenParam,
     }),
-  }, async ({ spreadsheetId, billingProject, query, dataset, table, tableProject, account }) => {
+  }, async ({ spreadsheetId, billingProject, query, dataset, table, tableProject, account, confirmToken }, ctx) => {
     const tableFlags = tableProject !== undefined || dataset !== undefined || table !== undefined;
     if (query !== undefined && tableFlags) {
       throw new Error('query and the table fields (dataset, table, tableProject) are mutually exclusive — a data source is backed by one or the other.');
@@ -1176,6 +1266,12 @@ export function registerExtraSheetsTools(server: McpServer): void {
     if (tableProject) args.push(`--table-project=${tableProject}`);
     if (dataset) args.push(`--dataset=${dataset}`);
     if (table) args.push(`--table=${table}`);
+    const source = query !== undefined ? { query } : { table: [tableProject ?? billingProject, dataset, table].join('.') };
+    const confirmation = await confirmBilledExecution(ctx, {
+      tool: 'gog_sheets_datasource_add', action: 'sheets.datasource-add', account, confirmToken, spreadsheetId,
+      target: spreadsheetId, view: { billingProject, ...source },
+    });
+    if (confirmation) return confirmation;
     return runOrDiagnose(args, { account });
   });
 
@@ -1196,8 +1292,9 @@ export function registerExtraSheetsTools(server: McpServer): void {
       table: z.string().optional().describe('Replacement table ID. Only valid on a table-backed source.'),
       tableProject: z.string().optional().describe('Replacement project owning the table. Only valid on a table-backed source.'),
       account: accountParam,
+      confirmToken: confirmTokenParam,
     }),
-  }, async ({ spreadsheetId, dataSourceId, billingProject, query, dataset, table, tableProject, account }) => {
+  }, async ({ spreadsheetId, dataSourceId, billingProject, query, dataset, table, tableProject, account, confirmToken }, ctx) => {
     const tableFlags = tableProject !== undefined || dataset !== undefined || table !== undefined;
     if (query !== undefined && tableFlags) {
       throw new Error('query and the table fields (dataset, table, tableProject) are mutually exclusive — a data source is backed by one or the other.');
@@ -1211,6 +1308,12 @@ export function registerExtraSheetsTools(server: McpServer): void {
     if (tableProject !== undefined) args.push(`--table-project=${tableProject}`);
     if (dataset !== undefined) args.push(`--dataset=${dataset}`);
     if (table !== undefined) args.push(`--table=${table}`);
+    const changes = Object.fromEntries(Object.entries({ billingProject, query, tableProject, dataset, table }).filter(([, v]) => v !== undefined));
+    const confirmation = await confirmBilledExecution(ctx, {
+      tool: 'gog_sheets_datasource_update', action: 'sheets.datasource-update', account, confirmToken, spreadsheetId,
+      target: `${spreadsheetId}/${dataSourceId}`, view: { dataSourceId, changes },
+    });
+    if (confirmation) return confirmation;
     return runOrDiagnose(args, { account });
   });
 
@@ -1240,10 +1343,19 @@ export function registerExtraSheetsTools(server: McpServer): void {
       dataSourceId: z.string().describe('Data source ID, as reported by gog_sheets_datasource_list'),
       forceRefresh: z.boolean().optional().describe('Refresh even when the previous execution failed'),
       account: accountParam,
+      confirmToken: confirmTokenParam,
     }),
-  }, async ({ spreadsheetId, dataSourceId, forceRefresh, account }) => {
+  }, async ({ spreadsheetId, dataSourceId, forceRefresh, account, confirmToken }, ctx) => {
     const args: GogArg[] = ['sheets', 'datasource', 'refresh', pos(spreadsheetId), pos(dataSourceId)];
     if (forceRefresh) args.push('--force-refresh');
+    const described = await runOrDiagnose(['sheets', 'datasource', 'describe', pos(spreadsheetId), pos(dataSourceId)], { account });
+    if (described.isError) return described;
+    const confirmation = await confirmBilledExecution(ctx, {
+      tool: 'gog_sheets_datasource_refresh', action: 'sheets.datasource-refresh', account, confirmToken, spreadsheetId,
+      target: `${spreadsheetId}/${dataSourceId}`,
+      view: { dataSourceId, ...dataSourceSnapshot(resultText(described)), forceRefresh: Boolean(forceRefresh) },
+    });
+    if (confirmation) return confirmation;
     return runOrDiagnose(args, { account });
   });
 

package/tests/tools/sheets-extra-gates.test.ts

@@ -0,0 +1,158 @@
+import { describe, it, expect, vi, beforeEach, afterEach } from 'vitest';
+import { registerExtraSheetsTools, dataSourceSnapshot, spreadsheetTitle } from '../../src/tools/sheets-extra.js';
+import * as lib from '../../../gogcli-mcp/src/lib.js';
+import { createTestHarness } from '@chrischall/mcp-utils/test';
+import { rawTextResult } from '@chrischall/mcp-utils';
+import type { ElicitRequest, ElicitResult } from '@modelcontextprotocol/server';
+import { pos } from '../../../gogcli-mcp/src/argv.js';
+import { resetConfirmTokenState } from '../../../gogcli-mcp/src/send-confirm-token.js';
+
+vi.mock('../../../gogcli-mcp/src/lib.js', async (importOriginal) => {
+  const actual = await importOriginal<typeof lib>();
+  return { ...actual, runOrDiagnose: vi.fn() };
+});
+
+// Fleet audit 2026-09-24 SEC-6: datasource add / update / refresh each start a
+// BigQuery job billed to a project, so each asks first — naming the spreadsheet,
+// what is queried and who pays.
+
+const ORIGINAL_ENV = { ...process.env };
+beforeEach(() => {
+  vi.clearAllMocks();
+  process.env = { ...ORIGINAL_ENV };
+  delete process.env.MCP_CONFIRM_MODE;
+  resetConfirmTokenState();
+});
+afterEach(() => { process.env = ORIGINAL_ENV; });
+
+const json = (r: { content: Array<{ text?: string }> }) => JSON.parse(r.content[0]!.text as string);
+async function prompted(answer: ElicitResult = { action: 'accept', content: { confirmed: true } }) {
+  const seen: ElicitRequest[] = [];
+  const harness = await createTestHarness(registerExtraSheetsTools, { elicitation: async (r) => { seen.push(r); return answer; } });
+  const details = () => JSON.parse(seen[0]!.params.message.split('\n').slice(1).join('\n')).details;
+  return { harness, seen, details };
+}
+const unprompted = () => createTestHarness(registerExtraSheetsTools);
+
+const META = JSON.stringify({ properties: { title: 'Sales dashboard' } });
+const DESCRIBE = JSON.stringify({ dataSource: { dataSourceId: 'ds1', spec: { bigQuery: { projectId: 'billing-1', querySpec: { rawQuery: 'SELECT 1' } } } } });
+function stub(failing?: string) {
+  vi.mocked(lib.runOrDiagnose).mockImplementation(async (args) => {
+    const key = args.filter((a): a is string => typeof a === 'string' && !a.startsWith('--')).join(' ');
+    if (failing && key.startsWith(failing)) return { content: [{ type: 'text', text: 'Error: not found' }], isError: true };
+    if (key === 'sheets metadata') return rawTextResult(META);
+    if (key === 'sheets datasource describe') return rawTextResult(DESCRIBE);
+    return rawTextResult('{"ok":true}');
+  });
+}
+const callsTo = (...words: string[]) => vi.mocked(lib.runOrDiagnose).mock.calls.filter(([args]) =>
+  words.every((w, i) => args[i] === w));
+
+const SHEET = { id: 'sid', title: 'Sales dashboard' };
+const CASES = [
+  {
+    tool: 'gog_sheets_datasource_add',
+    args: { spreadsheetId: 'sid', billingProject: 'billing-1', dataset: 'sales', table: 'orders' },
+    action: 'sheets.datasource-add',
+    details: { spreadsheet: SHEET, billingProject: 'billing-1', table: 'billing-1.sales.orders' },
+    write: 'add',
+    reads: ['sheets metadata'],
+    changed: { table: 'refunds' },
+  },
+  {
+    tool: 'gog_sheets_datasource_update',
+    args: { spreadsheetId: 'sid', dataSourceId: 'ds1', query: 'SELECT 2', billingProject: 'billing-2' },
+    action: 'sheets.datasource-update',
+    details: { spreadsheet: SHEET, dataSourceId: 'ds1', changes: { billingProject: 'billing-2', query: 'SELECT 2' } },
+    write: 'update',
+    reads: ['sheets metadata'],
+    changed: { query: 'SELECT 3' },
+  },
+  {
+    tool: 'gog_sheets_datasource_refresh',
+    args: { spreadsheetId: 'sid', dataSourceId: 'ds1', forceRefresh: true },
+    action: 'sheets.datasource-refresh',
+    details: { spreadsheet: SHEET, dataSourceId: 'ds1', billingProject: 'billing-1', query: 'SELECT 1', forceRefresh: true },
+    write: 'refresh',
+    reads: ['sheets datasource describe', 'sheets metadata'],
+    changed: { forceRefresh: false },
+  },
+];
+
+describe.each(CASES)('$tool', (c) => {
+  it('asks naming the spreadsheet, the source and who pays; runs once accepted', async () => {
+    stub();
+    const { harness, details, seen } = await prompted();
+    await harness.callTool(c.tool, c.args);
+    expect(seen[0]!.params.message).toMatch(/billed/);
+    expect(details()).toEqual(c.details);
+    expect(callsTo('sheets', 'metadata')[0]![0]).toEqual(['sheets', 'metadata', pos('sid'), '--select=properties.title']);
+    expect(callsTo('sheets', 'datasource', c.write)).toHaveLength(1);
+  });
+
+  it('runs nothing when the user declines', async () => {
+    stub();
+    expect(json(await (await prompted({ action: 'decline' })).harness.callTool(c.tool, c.args)))
+      .toMatchObject({ cancelled: true, action: c.action });
+    expect(callsTo('sheets', 'datasource', c.write)).toHaveLength(0);
+  });
+
+  it.each(c.reads)('returns a failed read (%s) without asking or running', async (failing) => {
+    stub(failing);
+    const { harness, seen } = await prompted();
+    expect((await harness.callTool(c.tool, c.args)).isError).toBe(true);
+    expect(seen).toHaveLength(0);
+    expect(callsTo('sheets', 'datasource', c.write)).toHaveLength(0);
+  });
+
+  it('refuses a client that cannot be prompted', async () => {
+    process.env.MCP_CONFIRM_MODE = 'refuse';
+    stub();
+    const r = json(await (await unprompted()).callTool(c.tool, c.args));
+    expect(r).toMatchObject({ reason: 'confirmation-unsupported', action: c.action });
+    expect(r.note).toMatch(/Data connectors/);
+  });
+
+  it('token fallback: changed arguments are refused, the same call runs', async () => {
+    process.env.MCP_CONFIRM_MODE = 'ask-user';
+    stub();
+    const harness = await unprompted();
+    const p1 = json(await harness.callTool(c.tool, c.args));
+    expect(p1.preview).toEqual(c.details);
+    expect(json(await harness.callTool(c.tool, { ...c.args, ...c.changed, confirmToken: p1.confirmToken })))
+      .toMatchObject({ error: 'DRAFT_CHANGED' });
+    await harness.callTool(c.tool, { ...c.args, confirmToken: p1.confirmToken });
+    expect(callsTo('sheets', 'datasource', c.write)).toHaveLength(1);
+  });
+});
+
+it('a query-backed add previews the SQL', async () => {
+  stub();
+  const { harness, details } = await prompted({ action: 'decline' });
+  await harness.callTool('gog_sheets_datasource_add', { spreadsheetId: 'sid', billingProject: 'b', query: 'SELECT 9', });
+  expect(details()).toEqual({ spreadsheet: SHEET, billingProject: 'b', query: 'SELECT 9' });
+});
+
+it('a table in another project names that project', async () => {
+  stub();
+  const { harness, details } = await prompted({ action: 'decline' });
+  await harness.callTool('gog_sheets_datasource_add', { spreadsheetId: 'sid', billingProject: 'b', tableProject: 'p', dataset: 'd', table: 't' });
+  expect(details().table).toBe('p.d.t');
+});
+
+describe('parsers', () => {
+  it('spreadsheetTitle reads either shape and tolerates unreadable output', () => {
+    expect(spreadsheetTitle(JSON.stringify({ spreadsheet: { properties: { title: 'A' } } }))).toBe('A');
+    expect(spreadsheetTitle(JSON.stringify({ properties: { title: 7 } }))).toBeUndefined();
+    expect(spreadsheetTitle('null')).toBeUndefined();
+    expect(spreadsheetTitle(undefined)).toBeUndefined();
+  });
+
+  it('dataSourceSnapshot names a table source, a bare spec, and nothing for unreadable output', () => {
+    expect(dataSourceSnapshot(JSON.stringify({ spec: { bigQuery: { tableSpec: { tableProjectId: 'p', datasetId: 'd', tableId: 't' } } } })))
+      .toEqual({ table: 'p.d.t' });
+    expect(dataSourceSnapshot(JSON.stringify({ dataSource: { spec: { bigQuery: { projectId: 7 } } } }))).toEqual({});
+    expect(dataSourceSnapshot('null')).toEqual({});
+    expect(dataSourceSnapshot('nope')).toEqual({});
+  });
+});

package/tests/tools/sheets-extra.test.ts

@@ -15,7 +15,10 @@ vi.mock('../../../gogcli-mcp/src/lib.js', async (importOriginal) => {
   };
 });
 
-const setupHandlers = () => createTestHarness(registerExtraSheetsTools);
+// The billed datasource tools ask first (sheets-extra-gates.test.ts covers the prompts); here the user accepts.
+const setupHandlers = () => createTestHarness(registerExtraSheetsTools, {
+  elicitation: async () => ({ action: 'accept', content: { confirmed: true } }),
+});
 
 beforeEach(() => vi.clearAllMocks());