gogcli-mcp-sheets 4.5.1 → 4.6.0

package/.claude-plugin/marketplace.json

@@ -7,7 +7,7 @@
   },
   "metadata": {
     "description": "Extended Google Sheets for Claude via gogcli — auth + full Sheets support",
-    "version": "4.5.1"
+    "version": "4.6.0"
   },
   "plugins": [
     {
@@ -15,7 +15,7 @@
       "displayName": "gogcli (Sheets)",
       "source": "./",
       "description": "Extended Google Sheets for Claude via gogcli — auth + full Sheets support",
-      "version": "4.5.1",
+      "version": "4.6.0",
       "author": {
         "name": "Chris Hall"
       },

package/.claude-plugin/plugin.json

@@ -1,7 +1,7 @@
 {
   "name": "gogcli-mcp-sheets",
   "displayName": "gogcli (Sheets)",
-  "version": "4.5.1",
+  "version": "4.6.0",
   "description": "Extended Google Sheets for Claude via gogcli — auth + full Sheets support",
   "author": {
     "name": "Chris Hall",

package/dist/index.js

@@ -19790,7 +19790,7 @@ function date4(params) {
   return _coercedDate(ZodDate, params);
 }
 
-// ../../node_modules/@modelcontextprotocol/core/dist/auth-CUe6YdwF.mjs
+// ../../node_modules/@modelcontextprotocol/server/node_modules/@modelcontextprotocol/core/dist/auth-CGP0BDVq.mjs
 var LATEST_PROTOCOL_VERSION = "2025-11-25";
 var SUPPORTED_PROTOCOL_VERSIONS = [
   LATEST_PROTOCOL_VERSION,
@@ -20627,7 +20627,8 @@ var OAuthMetadataSchema = looseObject({
   introspection_endpoint_auth_signing_alg_values_supported: array(string2()).optional(),
   code_challenge_methods_supported: array(string2()).optional(),
   client_id_metadata_document_supported: boolean2().optional(),
-  authorization_response_iss_parameter_supported: boolean2().optional().catch(void 0)
+  authorization_response_iss_parameter_supported: boolean2().optional().catch(void 0),
+  dpop_signing_alg_values_supported: array(string2()).optional()
 });
 var OpenIdProviderMetadataSchema = looseObject({
   issuer: string2(),
@@ -20728,7 +20729,7 @@ var OAuthTokenRevocationRequestSchema = object({
   token_type_hint: string2().optional()
 }).strip();
 
-// ../../node_modules/@modelcontextprotocol/server/dist/src-CX2iR2pK.mjs
+// ../../node_modules/@modelcontextprotocol/server/dist/src-D-y6h4N7.mjs
 var BRANDS = /* @__PURE__ */ Symbol.for("mcp.sdk.errorBrands");
 function stampErrorBrands(instance, ctor) {
   const brands = /* @__PURE__ */ new Set();
@@ -20842,8 +20843,18 @@ var SdkError = class extends Error {
     if (typeof this !== "function") throw new TypeError("isInstance must be called on the class (e.g. `SdkError.isInstance(value)`); for callbacks use `v => SdkError.isInstance(v)`");
     return brandedHasInstance(this, value);
   }
-  constructor(code, message, data) {
-    super(message);
+  /**
+  * @param code - Stable string code identifying the failure ({@linkcode SdkErrorCode}).
+  * @param message - Human-readable description.
+  * @param data - Optional structured payload (for example the HTTP status carried by
+  * {@linkcode SdkHttpError}). Opaque to the SDK: a `cause` key inside `data` is not
+  * promoted to `Error.cause`.
+  * @param options - Standard `ErrorOptions`, forwarded to `Error`. Pass the underlying
+  * failure as `{ cause }` so it is reachable through the `Error.cause` chain that
+  * loggers and error trackers walk.
+  */
+  constructor(code, message, data, options) {
+    super(message, options);
     this.code = code;
     this.data = data;
     this.name = "SdkError";
@@ -20854,8 +20865,11 @@ var SdkHttpError = class extends SdkError {
   static {
     Object.defineProperty(this, "mcpBrand", { value: "mcp.SdkHttpError" });
   }
-  constructor(code, message, data) {
-    super(code, message, data);
+  /**
+  * @param options - Standard `ErrorOptions`, forwarded to `Error` (see {@linkcode SdkError}).
+  */
+  constructor(code, message, data, options) {
+    super(code, message, data, options);
     this.name = "SdkHttpError";
   }
   get status() {
@@ -23806,7 +23820,7 @@ var INBOUND_VALIDATION_LADDER = [
     evaluatedAt: "pre-dispatch",
     codes: [HEADER_MISMATCH_ERROR_CODE],
     conformance: ["http-header-validation"],
-    rationale: "SEP-2243 standard `Mcp-Method` / `Mcp-Name` headers \u2014 presence, sentinel decoding, and `Mcp-Name` \u2194 body cross-check \u2014 are validated by the HTTP entry on a modern-classified request after the supported-revision gate and before dispatch. The classifier\u2019s own header-mismatch cells (protocol-version, `Mcp-Method` mismatch) stay on the edge `era-classification` rung; this rung carries the entry-layer presence/`Mcp-Name` half. Evaluated before the capability gate, the factory call, and the `Mcp-Param-*` rung so a request that fails several rungs is answered by the standard-header rung first. The documented order (after method-registry 5 and request-params 6) is NOT the observed precedence: serveModern evaluates this rung immediately after the supported-revision gate, so a request that also fails a dispatch rung is answered here before the dispatch rungs (5\u20136) are consulted."
+    rationale: "SEP-2243 standard `MCP-Protocol-Version` / `Mcp-Method` / `Mcp-Name` headers \u2014 presence, sentinel decoding, and `Mcp-Name` \u2194 body cross-check \u2014 are validated by the HTTP entry on a modern-classified request after the supported-revision gate and before dispatch. The spec requires `MCP-Protocol-Version` and `Mcp-Method` on every modern *request* POST (`Mcp-Name` only for the methods that mirror `params.name` / `params.uri` / `params.taskId`, see `MCP_NAME_HEADER_SOURCE`) and names them in that order, so a request missing several is answered by the earliest. Notification POSTs are exempt: the presence half runs on requests only, so a modern-enveloped notification is dispatched even with no standard headers at all. The classifier\u2019s own header-mismatch cells (protocol-version, `Mcp-Method` mismatch) stay on the edge `era-classification` rung; this rung carries the entry-layer presence/`Mcp-Name` half \u2014 including the missing `MCP-Protocol-Version` cell, which cannot live on the edge rung without breaking body-primary classification. Evaluated before the capability gate, the factory call, and the `Mcp-Param-*` rung so a request that fails several rungs is answered by the standard-header rung first. The documented order (after method-registry 5 and request-params 6) is NOT the observed precedence: serveModern evaluates this rung immediately after the supported-revision gate, so a request that also fails a dispatch rung is answered here before the dispatch rungs (5\u20136) are consulted."
   },
   {
     rung: "client-capabilities",
@@ -24607,7 +24621,7 @@ var Protocol = class {
     return this._requestHandlers.get(method);
   }
   async _oncancel(notification) {
-    if (!notification.params.requestId) return;
+    if (notification.params.requestId === void 0) return;
     this._requestHandlerAbortControllers.get(notification.params.requestId)?.abort(notification.params.reason);
   }
   _setupTimeout(messageId, timeout, maxTotalTimeout, onTimeout, resetTimeoutOnProgress = false) {
@@ -25006,19 +25020,20 @@ var Protocol = class {
       const cancel = (reason) => {
         if (responseReceived) return;
         this._progressHandlers.delete(messageId);
-        if (requestAbort === void 0) this._transport?.send(this._envelopeOutbound({
-          jsonrpc: "2.0",
-          method: "notifications/cancelled",
-          params: {
-            requestId: messageId,
-            reason: String(reason)
-          }
-        }), {
-          relatedRequestId,
-          resumptionToken,
-          onresumptiontoken
-        }).catch((error62) => this._onerror(/* @__PURE__ */ new Error(`Failed to send cancellation: ${error62}`)));
-        else requestAbort.abort();
+        if (requestAbort === void 0) {
+          if (request.method !== "initialize") this._transport?.send(this._envelopeOutbound({
+            jsonrpc: "2.0",
+            method: "notifications/cancelled",
+            params: {
+              requestId: messageId,
+              reason: String(reason)
+            }
+          }), {
+            relatedRequestId,
+            resumptionToken,
+            onresumptiontoken
+          }).catch((error62) => this._onerror(/* @__PURE__ */ new Error(`Failed to send cancellation: ${error62}`)));
+        } else requestAbort.abort();
         reject(reason instanceof SdkError ? reason : new SdkError(SdkErrorCode.RequestTimeout, String(reason)));
       };
       this._responseHandlers.set(messageId, (response) => {
@@ -25098,7 +25113,7 @@ var Protocol = class {
       jsonrpc: "2.0",
       ...notification
     });
-    if ((this._options?.debouncedNotificationMethods ?? []).includes(notification.method) && !notification.params && !options?.relatedRequestId) {
+    if ((this._options?.debouncedNotificationMethods ?? []).includes(notification.method) && !notification.params && options?.relatedRequestId === void 0) {
       if (this._pendingDebouncedNotifications.has(notification.method)) return;
       this._pendingDebouncedNotifications.add(notification.method);
       Promise.resolve().then(() => {
@@ -32401,7 +32416,7 @@ var Ajv = import_ajv.Ajv;
 // ../../node_modules/@modelcontextprotocol/server/dist/shimsNode.mjs
 import process2 from "node:process";
 
-// ../../node_modules/@modelcontextprotocol/server/dist/mcp-DXXb3Vv3.mjs
+// ../../node_modules/@modelcontextprotocol/server/dist/mcp-Dw2OlZ1f.mjs
 var COMPLETABLE_SYMBOL = /* @__PURE__ */ Symbol.for("mcp.completable");
 function isCompletable(schema) {
   return !!schema && typeof schema === "object" && COMPLETABLE_SYMBOL in schema;
@@ -32594,6 +32609,9 @@ function notificationToServerEvent(method, uri) {
       };
   }
 }
+function supportsScopeChallengeResolver(transport) {
+  return typeof transport === "object" && transport !== null && "setScopeChallengeResolver" in transport && typeof transport.setScopeChallengeResolver === "function";
+}
 var DEFAULT_LEGACY_SHIM_MAX_ROUNDS = 8;
 var DEFAULT_LEGACY_SHIM_ROUND_TIMEOUT_MS = 6e5;
 function resolveLegacyShimOptions(options) {
@@ -33404,6 +33422,7 @@ var McpServer = class {
   * ```
   */
   async connect(transport) {
+    if (supportsScopeChallengeResolver(transport)) transport.setScopeChallengeResolver((context) => this.resolveScopeChallenge(context));
     return await this.server.connect(transport);
   }
   /**
@@ -33412,6 +33431,41 @@ var McpServer = class {
   async close() {
     await this.server.close();
   }
+  /** @internal */
+  resolveScopeChallenge = (context) => {
+    switch (context.request.method) {
+      case "tools/call": {
+        const toolName = context.request.params?.name;
+        if (typeof toolName !== "string") return;
+        const tool = this._registeredTools[toolName];
+        if (tool === void 0 || !tool.enabled) return;
+        return tool.scopeChallenge?.(context);
+      }
+      case "resources/read": {
+        const resourceUri = context.request.params?.uri;
+        if (typeof resourceUri !== "string") return;
+        let uri;
+        try {
+          uri = new URL(resourceUri);
+        } catch {
+          return;
+        }
+        const resource = this._registeredResources[uri.toString()];
+        if (resource !== void 0) return resource.enabled ? resource.scopeChallenge?.(context) : void 0;
+        for (const template of Object.values(this._registeredResourceTemplates)) if (template.resourceTemplate.uriTemplate.match(uri.toString())) return template.enabled ? template.scopeChallenge?.(context) : void 0;
+        return;
+      }
+      case "prompts/get": {
+        const promptName = context.request.params?.name;
+        if (typeof promptName !== "string") return;
+        const prompt = this._registeredPrompts[promptName];
+        if (prompt === void 0 || !prompt.enabled) return;
+        return prompt.scopeChallenge?.(context);
+      }
+      default:
+        return;
+    }
+  };
   _toolHandlersInitialized = false;
   setToolRequestHandlers() {
     if (this._toolHandlersInitialized) return;
@@ -33578,7 +33632,10 @@ var McpServer = class {
       }
       for (const template of Object.values(this._registeredResourceTemplates)) {
         const variables = template.resourceTemplate.uriTemplate.match(uri.toString());
-        if (variables) return attachCacheHintFallback(await template.readCallback(uri, variables, ctx), template.cacheHint);
+        if (variables) {
+          if (!template.enabled) throw new ProtocolError(ProtocolErrorCode.InvalidParams, `Resource template ${template.resourceTemplate.uriTemplate} disabled`);
+          return attachCacheHintFallback(await template.readCallback(uri, variables, ctx), template.cacheHint);
+        }
       }
       throw new ResourceNotFoundError(request.params.uri);
     });
@@ -33609,36 +33666,32 @@ var McpServer = class {
     this._promptHandlersInitialized = true;
   }
   registerResource(name, uriOrTemplate, config2, readCallback) {
-    const cacheHint = config2.cacheHint;
-    let metadata = config2;
-    if (cacheHint !== void 0) {
-      assertValidCacheHint(cacheHint, `resource ${name}`);
-      const rest = { ...config2 };
-      delete rest.cacheHint;
-      metadata = rest;
-    }
+    const { cacheHint, scopeChallenge, ...resourceMetadata } = config2;
+    const metadata = resourceMetadata;
+    if (cacheHint !== void 0) assertValidCacheHint(cacheHint, `resource ${name}`);
     if (typeof uriOrTemplate === "string") {
       if (this._registeredResources[uriOrTemplate]) throw new Error(`Resource ${uriOrTemplate} is already registered`);
-      const registeredResource = this._createRegisteredResource(name, config2.title, uriOrTemplate, metadata, readCallback);
+      const registeredResource = this._createRegisteredResource(name, config2.title, uriOrTemplate, metadata, scopeChallenge, readCallback);
       if (cacheHint !== void 0) registeredResource.cacheHint = cacheHint;
       this.setResourceRequestHandlers();
       this.sendResourceListChanged();
       return registeredResource;
     } else {
       if (this._registeredResourceTemplates[name]) throw new Error(`Resource template ${name} is already registered`);
-      const registeredResourceTemplate = this._createRegisteredResourceTemplate(name, config2.title, uriOrTemplate, metadata, readCallback);
+      const registeredResourceTemplate = this._createRegisteredResourceTemplate(name, config2.title, uriOrTemplate, metadata, scopeChallenge, readCallback);
       if (cacheHint !== void 0) registeredResourceTemplate.cacheHint = cacheHint;
       this.setResourceRequestHandlers();
       this.sendResourceListChanged();
       return registeredResourceTemplate;
     }
   }
-  _createRegisteredResource(name, title, uri, metadata, readCallback) {
+  _createRegisteredResource(name, title, uri, metadata, scopeChallenge, readCallback) {
     const registeredResource = {
       name,
       title,
       metadata,
       readCallback,
+      scopeChallenge,
       enabled: true,
       disable: () => registeredResource.update({ enabled: false }),
       enable: () => registeredResource.update({ enabled: true }),
@@ -33652,6 +33705,7 @@ var McpServer = class {
         if (updates.title !== void 0) registeredResource.title = updates.title;
         if (updates.metadata !== void 0) registeredResource.metadata = updates.metadata;
         if (updates.callback !== void 0) registeredResource.readCallback = updates.callback;
+        if (updates.scopeChallenge !== void 0) registeredResource.scopeChallenge = updates.scopeChallenge === null ? void 0 : updates.scopeChallenge;
         if (updates.enabled !== void 0) registeredResource.enabled = updates.enabled;
         this.sendResourceListChanged();
       }
@@ -33659,12 +33713,13 @@ var McpServer = class {
     this._registeredResources[uri] = registeredResource;
     return registeredResource;
   }
-  _createRegisteredResourceTemplate(name, title, template, metadata, readCallback) {
+  _createRegisteredResourceTemplate(name, title, template, metadata, scopeChallenge, readCallback) {
     const registeredResourceTemplate = {
       resourceTemplate: template,
       title,
       metadata,
       readCallback,
+      scopeChallenge,
       enabled: true,
       disable: () => registeredResourceTemplate.update({ enabled: false }),
       enable: () => registeredResourceTemplate.update({ enabled: true }),
@@ -33678,6 +33733,7 @@ var McpServer = class {
         if (updates.template !== void 0) registeredResourceTemplate.resourceTemplate = updates.template;
         if (updates.metadata !== void 0) registeredResourceTemplate.metadata = updates.metadata;
         if (updates.callback !== void 0) registeredResourceTemplate.readCallback = updates.callback;
+        if (updates.scopeChallenge !== void 0) registeredResourceTemplate.scopeChallenge = updates.scopeChallenge === null ? void 0 : updates.scopeChallenge;
         if (updates.enabled !== void 0) registeredResourceTemplate.enabled = updates.enabled;
         this.sendResourceListChanged();
       }
@@ -33687,7 +33743,7 @@ var McpServer = class {
     if (Array.isArray(variableNames) && variableNames.some((v) => !!template.completeCallback(v))) this.setCompletionRequestHandler();
     return registeredResourceTemplate;
   }
-  _createRegisteredPrompt(name, title, description, argsSchema, callback, icons, _meta) {
+  _createRegisteredPrompt(name, title, description, argsSchema, callback, icons, scopeChallenge, _meta) {
     let currentArgsSchema = argsSchema;
     let currentCallback = callback;
     const registeredPrompt = {
@@ -33695,6 +33751,7 @@ var McpServer = class {
       description,
       argsSchema,
       icons,
+      scopeChallenge,
       _meta,
       handler: createPromptHandler(name, argsSchema, callback),
       enabled: true,
@@ -33709,6 +33766,7 @@ var McpServer = class {
         if (updates.title !== void 0) registeredPrompt.title = updates.title;
         if (updates.description !== void 0) registeredPrompt.description = updates.description;
         if (updates.icons !== void 0) registeredPrompt.icons = updates.icons;
+        if (updates.scopeChallenge !== void 0) registeredPrompt.scopeChallenge = updates.scopeChallenge === null ? void 0 : updates.scopeChallenge;
         if (updates._meta !== void 0) registeredPrompt._meta = updates._meta;
         let needsHandlerRegen = false;
         if (updates.argsSchema !== void 0) {
@@ -33736,7 +33794,7 @@ var McpServer = class {
     }
     return registeredPrompt;
   }
-  _createRegisteredTool(name, title, description, inputSchema, outputSchema, annotations, icons, execution, _meta, handler) {
+  _createRegisteredTool(name, title, description, inputSchema, outputSchema, annotations, icons, execution, scopeChallenge, _meta, handler) {
     validateAndWarnToolName(name);
     if (inputSchema !== void 0) try {
       const json2 = standardSchemaToJsonSchema(inputSchema, "input");
@@ -33755,6 +33813,7 @@ var McpServer = class {
       annotations,
       icons,
       execution,
+      scopeChallenge,
       _meta,
       handler,
       executor: createToolExecutor(inputSchema, handler),
@@ -33793,6 +33852,7 @@ var McpServer = class {
         }
         if (updates.annotations !== void 0) registeredTool.annotations = updates.annotations;
         if (updates.icons !== void 0) registeredTool.icons = updates.icons;
+        if (updates.scopeChallenge !== void 0) registeredTool.scopeChallenge = updates.scopeChallenge === null ? void 0 : updates.scopeChallenge;
         if (updates._meta !== void 0) registeredTool._meta = updates._meta;
         if (updates.enabled !== void 0) registeredTool.enabled = updates.enabled;
         this.sendToolListChanged();
@@ -33805,13 +33865,13 @@ var McpServer = class {
   }
   registerTool(name, config2, cb) {
     if (this._registeredTools[name]) throw new Error(`Tool ${name} is already registered`);
-    const { title, description, inputSchema, outputSchema, annotations, icons, _meta } = config2;
-    return this._createRegisteredTool(name, title, description, normalizeRawShapeSchema(inputSchema), normalizeRawShapeSchema(outputSchema), annotations, icons, void 0, _meta, cb);
+    const { title, description, inputSchema, outputSchema, annotations, icons, scopeChallenge, _meta } = config2;
+    return this._createRegisteredTool(name, title, description, normalizeRawShapeSchema(inputSchema), normalizeRawShapeSchema(outputSchema), annotations, icons, void 0, scopeChallenge, _meta, cb);
   }
   registerPrompt(name, config2, cb) {
     if (this._registeredPrompts[name]) throw new Error(`Prompt ${name} is already registered`);
-    const { title, description, argsSchema, icons, _meta } = config2;
-    const registeredPrompt = this._createRegisteredPrompt(name, title, description, normalizeRawShapeSchema(argsSchema), cb, icons, _meta);
+    const { title, description, argsSchema, icons, scopeChallenge, _meta } = config2;
+    const registeredPrompt = this._createRegisteredPrompt(name, title, description, normalizeRawShapeSchema(argsSchema), cb, icons, scopeChallenge, _meta);
     this.setPromptRequestHandlers();
     this.sendPromptListChanged();
     return registeredPrompt;
@@ -33923,6 +33983,7 @@ function unwrapOptionalSchema(schema) {
 }
 
 // ../../node_modules/@modelcontextprotocol/server/dist/stdio.mjs
+var swallowsErrorsAfterClose = /* @__PURE__ */ Symbol("swallowsErrorsAfterClose");
 var StdioServerTransport = class {
   _readBuffer;
   _started = false;
@@ -33949,18 +34010,27 @@ var StdioServerTransport = class {
     this.onerror?.(error62);
   };
   _onstdouterror = (error62) => {
+    if (this._closed) return;
     this.onerror?.(error62);
     this.close().catch(() => {
     });
   };
+  _onstdinclose = () => {
+    this.close().catch(() => {
+    });
+  };
   /**
   * Starts listening for messages on `stdin`.
   */
   async start() {
     if (this._started) throw new Error("StdioServerTransport already started! If using Server class, note that connect() calls start() automatically.");
     this._started = true;
+    for (const listener of this._stdout.listeners("error")) if (listener[swallowsErrorsAfterClose]) this._stdout.off("error", listener);
+    if (this._stdin.readableEnded || this._stdin.destroyed) setImmediate(this._onstdinclose);
     this._stdin.on("data", this._ondata);
     this._stdin.on("error", this._onerror);
+    this._stdin.on("end", this._onstdinclose);
+    this._stdin.on("close", this._onstdinclose);
     this._stdout.on("error", this._onstdouterror);
   }
   processReadBuffer() {
@@ -33977,7 +34047,9 @@ var StdioServerTransport = class {
     this._closed = true;
     this._stdin.off("data", this._ondata);
     this._stdin.off("error", this._onerror);
-    this._stdout.off("error", this._onstdouterror);
+    this._stdin.off("end", this._onstdinclose);
+    this._stdin.off("close", this._onstdinclose);
+    this._onstdouterror[swallowsErrorsAfterClose] = true;
     if (this._stdin.listenerCount("data") === 0) this._stdin.pause();
     this._readBuffer.clear();
     this.onclose?.();
@@ -34254,6 +34326,7 @@ function serveStdio(factory, options = {}) {
         return;
       }
       if (state.era === "modern" && await tryServeListen(message)) return;
+      if (isTornDown()) return;
       state.instance.channel.deliver(message);
       return;
     }
@@ -34320,6 +34393,7 @@ function serveStdio(factory, options = {}) {
           };
         }
         if (await tryServeListen(message)) return;
+        if (isTornDown()) return;
         state.instance.channel.deliver(message, { classification: opening.classification });
         return;
       case "legacy": {
@@ -34406,6 +34480,9 @@ function toError(value) {
   return value instanceof Error ? value : new Error(String(value));
 }
 
+// ../../node_modules/@modelcontextprotocol/server/dist/index.mjs
+var DEFAULT_MAX_REQUEST_BODY_SIZE = 4 * 1024 * 1024;
+
 // ../../node_modules/@chrischall/mcp-utils/dist/errors/index.js
 var McpToolError = class extends Error {
   /** Actionable remediation text, when one applies. */
@@ -36292,6 +36369,9 @@ function countNonEmptyCells(getOutput) {
 var DATASOURCE_ALIASES = /* @__PURE__ */ new Set(["datasource", "data-source", "data-sources", "connected-sheets"]);
 var DATASOURCE_BILLED = /* @__PURE__ */ new Set(["add", "update", "refresh"]);
 function vetSheetsRun(subcommand, args) {
+  if (subcommand.toLowerCase() === "batch-request") {
+    return gatedElsewhere("gog sheets batch-request", "gog_sheets_run", "applies structural changes to a spreadsheet", "gog_sheets_batch_request");
+  }
   if (!DATASOURCE_ALIASES.has(subcommand.toLowerCase())) return void 0;
   const word = hasCommandWord(args, DATASOURCE_BILLED)?.toLowerCase();
   return word ? gatedElsewhere(`gog sheets datasource ${word}`, "gog_sheets_run", "runs a billed BigQuery job", `gog_sheets_datasource_${word}`) : void 0;
@@ -36415,7 +36495,7 @@ function registerSheetsTools(server) {
 }
 
 // ../gogcli-mcp/src/server.ts
-var VERSION = true ? "4.5.1" : "0.0.0";
+var VERSION = true ? "4.6.0" : "0.0.0";
 
 // ../gogcli-mcp/src/bootstrap-auth.ts
 import { join as join5 } from "node:path";
@@ -36578,6 +36658,35 @@ async function confirmBilledExecution(ctx, o) {
   });
 }
 function registerExtraSheetsTools(server) {
+  server.registerTool("gog_sheets_batch_begin", {
+    description: "Open a persisted, revision-locked Sheets request batch. Pass its returned batchId to gog_sheets_batch_request using batch=<id>; no spreadsheet changes are submitted until gog_sheets_batch_end.",
+    annotations: { destructiveHint: false },
+    inputSchema: external_exports.object({ spreadsheetId: external_exports.string().describe("Spreadsheet ID the batch is locked to"), name: external_exports.string().optional().describe("Optional batch label"), account: accountParam })
+  }, async ({ spreadsheetId, name, account }) => {
+    const args = ["batch", "begin", `--service=sheets`, `--spreadsheet=${spreadsheetId}`];
+    if (name) args.push(`--name=${name}`);
+    return runOrDiagnose(args, { account });
+  });
+  server.registerTool("gog_sheets_batch_end", {
+    description: "Submit a persisted Sheets request batch atomically against its locked revision. The queued requests are shown for review and require confirmation before they are applied.",
+    annotations: { destructiveHint: true },
+    inputSchema: external_exports.object({ batchId: external_exports.string().describe("Batch ID returned by gog_sheets_batch_begin"), account: accountParam, confirmToken: confirmTokenParam })
+  }, async ({ batchId, account, confirmToken }, ctx) => {
+    const previewResult = await runOrDiagnose(["batch", "show", pos(batchId)], { account });
+    if (previewResult.isError) return previewResult;
+    const preview = resultText2(previewResult);
+    if (preview === void 0) throw new Error("gog returned no queued batch preview; refusing to submit an unreviewed batch.");
+    if (Buffer.byteLength(preview, "utf8") > 1e5) throw new Error("The queued batch is too large to review safely through this tool; inspect and submit it with gog directly.");
+    const confirmation = await requireDispatchConfirmation(ctx, {
+      action: "sheets.batch-end",
+      message: "Review and confirm applying the queued Sheets requests:",
+      confirmationLabel: "Confirm applying this atomic Sheets batch.",
+      details: { batchId, queuedBatch: preview },
+      fallback: { tool: "gog_sheets_batch_end", account, confirmToken, subject: () => ({ target: batchId, payload: { queuedBatch: preview }, preview: { batchId, queuedBatch: preview } }) }
+    });
+    if (confirmation) return confirmation;
+    return runOrDiagnose(["batch", "end", pos(batchId), "--force"], { account });
+  });
   server.registerTool("gog_sheets_list_tabs", {
     description: "List tabs (sheets) in a spreadsheet with their titles, sheetIds, and indices. A friendlier view than gog_sheets_metadata when you only need the tab list \u2014 useful for restructuring a workbook over a long agent session without losing track of names.",
     annotations: { readOnlyHint: true },
@@ -37103,6 +37212,54 @@ ${resultText2(result) ?? ""}` }] };
     if (responseDateTimeRender) args.push(`--response-date-time-render=${responseDateTimeRender}`);
     return runOrDiagnose(args, { account });
   });
+  server.registerTool("gog_sheets_batch_request", {
+    description: "Submit a Google Sheets API structural request array atomically (for example addDimension, repeatCell, mergeCells, or updateSheetProperties). requestsJson must be a JSON array of Sheets API Request objects. Requests are previewed and require confirmation before submission. Use batch=<id> to append these requests to a persisted Sheets batch instead of submitting immediately.",
+    annotations: { destructiveHint: true },
+    inputSchema: external_exports.object({
+      spreadsheetId: external_exports.string().describe("Spreadsheet ID"),
+      requestsJson: external_exports.string().describe('JSON array of Google Sheets API Request objects, e.g. [{"addSheet":{"properties":{"title":"Archive"}}}]'),
+      batch: external_exports.string().optional().describe("Persisted Sheets batch ID; append requests without submitting yet"),
+      account: accountParam,
+      confirmToken: confirmTokenParam
+    })
+  }, async ({ spreadsheetId, requestsJson, batch, account, confirmToken }, ctx) => {
+    confineAtFile(requestsJson, "requestsJson");
+    let requests;
+    try {
+      requests = JSON.parse(requestsJson);
+    } catch {
+      throw new Error("requestsJson must be valid JSON");
+    }
+    if (!Array.isArray(requests) || requests.length === 0) throw new Error("requestsJson must be a non-empty JSON array");
+    if (Buffer.byteLength(requestsJson, "utf8") > 1e5) throw new Error("requestsJson exceeds the 100 KB inline limit; split the requests across persisted batches");
+    const args = ["sheets", "batch-request", pos(spreadsheetId), `--requests-json=${requestsJson}`];
+    if (batch) {
+      args.push(`--batch=${batch}`);
+      return runOrDiagnose(args, { account });
+    }
+    const got = await runOrDiagnose(["sheets", "metadata", pos(spreadsheetId), "--select=properties.title"], { account });
+    if (got.isError) return got;
+    const title = spreadsheetTitle(resultText2(got));
+    const confirmation = await requireDispatchConfirmation(ctx, {
+      action: "sheets.batch-request",
+      message: "Review and confirm these structural changes to the spreadsheet:",
+      confirmationLabel: "Confirm submitting this atomic Sheets request batch.",
+      details: {
+        spreadsheet: { id: spreadsheetId, ...title !== void 0 ? { title } : {} },
+        requestCount: requests.length,
+        requests
+      },
+      fallback: {
+        tool: "gog_sheets_batch_request",
+        account,
+        confirmToken,
+        subject: () => ({ target: spreadsheetId, payload: { requests }, preview: { requestCount: requests.length, requests } })
+      }
+    });
+    if (confirmation) return confirmation;
+    args.push("--force");
+    return runOrDiagnose(args, { account });
+  });
   server.registerTool("gog_sheets_reorder_tab", {
     description: "Move a tab to a specific 0-based position. `tab` is the tab name or numeric sheetId; `to=0` is the leftmost slot.",
     annotations: { destructiveHint: true },
@@ -37627,7 +37784,7 @@ await runMcp({
 });
 /*! Bundled license information:
 
-@modelcontextprotocol/server/dist/src-CX2iR2pK.mjs:
+@modelcontextprotocol/server/dist/src-D-y6h4N7.mjs:
   (*!
   * content-type
   * Copyright(c) 2015 Douglas Christopher Wilson

package/manifest.json

@@ -3,7 +3,7 @@
   "manifest_version": "0.3",
   "name": "gogcli-mcp-sheets",
   "display_name": "gogcli (Sheets)",
-  "version": "4.5.1",
+  "version": "4.6.0",
   "description": "Extended Google Sheets for Claude via gogcli — auth + full Sheets support",
   "author": {
     "name": "Chris Hall",
@@ -362,6 +362,18 @@
     {
       "name": "gog_sheets_datasource_delete",
       "description": "Delete a Connected Sheets data source and its linked sheet"
+    },
+    {
+      "name": "gog_sheets_batch_request",
+      "description": "Submit an atomic array of Google Sheets structural requests after confirmation."
+    },
+    {
+      "name": "gog_sheets_batch_begin",
+      "description": "Open a revision-locked Sheets request batch."
+    },
+    {
+      "name": "gog_sheets_batch_end",
+      "description": "Review and atomically submit a Sheets request batch after confirmation."
     }
   ],
   "compatibility": {

package/mint.yaml

@@ -92,7 +92,7 @@ dependencies:
   # bumping these nine pins, and the pin stored on each mcp-host registration.
   - kind: github-release
     repo: openclaw/gogcli
-    tag: v0.41.0
+    tag: v0.43.0
     asset: "gogcli_*_linux_amd64.tar.gz"
     bin: [gog]
 state:

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "gogcli-mcp-sheets",
-  "version": "4.5.1",
+  "version": "4.6.0",
   "mcpName": "io.github.chrischall/gogcli-mcp-sheets",
   "description": "Extended Google Sheets MCP server via gogcli — all base tools plus full Sheets support",
   "author": "Claude Code (AI) <https://www.anthropic.com/claude>",
@@ -25,7 +25,7 @@
   },
   "dependencies": {
     "@chrischall/mcp-utils": "^2.6.0",
-    "@modelcontextprotocol/server": "^2.0.0",
+    "@modelcontextprotocol/server": "^2.1.0",
     "zod": "^4.6.1"
   },
   "license": "MIT",

package/server.json

@@ -7,12 +7,12 @@
     "source": "github",
     "subfolder": "packages/gogcli-mcp-sheets"
   },
-  "version": "4.5.1",
+  "version": "4.6.0",
   "packages": [
     {
       "registryType": "npm",
       "identifier": "gogcli-mcp-sheets",
-      "version": "4.5.1",
+      "version": "4.6.0",
       "transport": {
         "type": "stdio"
       },

package/src/tools/sheets-extra.ts

@@ -166,6 +166,37 @@ async function confirmBilledExecution(
 
 export function registerExtraSheetsTools(server: McpServer): void {
 
+  server.registerTool('gog_sheets_batch_begin', {
+    description: 'Open a persisted, revision-locked Sheets request batch. Pass its returned batchId to gog_sheets_batch_request using batch=<id>; no spreadsheet changes are submitted until gog_sheets_batch_end.',
+    annotations: { destructiveHint: false },
+    inputSchema: z.object({ spreadsheetId: z.string().describe('Spreadsheet ID the batch is locked to'), name: z.string().optional().describe('Optional batch label'), account: accountParam }),
+  }, async ({ spreadsheetId, name, account }) => {
+    const args: GogArg[] = ['batch', 'begin', `--service=sheets`, `--spreadsheet=${spreadsheetId}`];
+    if (name) args.push(`--name=${name}`);
+    return runOrDiagnose(args, { account });
+  });
+
+  server.registerTool('gog_sheets_batch_end', {
+    description: 'Submit a persisted Sheets request batch atomically against its locked revision. The queued requests are shown for review and require confirmation before they are applied.',
+    annotations: { destructiveHint: true },
+    inputSchema: z.object({ batchId: z.string().describe('Batch ID returned by gog_sheets_batch_begin'), account: accountParam, confirmToken: confirmTokenParam }),
+  }, async ({ batchId, account, confirmToken }, ctx) => {
+    const previewResult = await runOrDiagnose(['batch', 'show', pos(batchId)], { account });
+    if (previewResult.isError) return previewResult;
+    const preview = resultText(previewResult);
+    if (preview === undefined) throw new Error('gog returned no queued batch preview; refusing to submit an unreviewed batch.');
+    if (Buffer.byteLength(preview, 'utf8') > 100_000) throw new Error('The queued batch is too large to review safely through this tool; inspect and submit it with gog directly.');
+    const confirmation = await requireDispatchConfirmation(ctx, {
+      action: 'sheets.batch-end',
+      message: 'Review and confirm applying the queued Sheets requests:',
+      confirmationLabel: 'Confirm applying this atomic Sheets batch.',
+      details: { batchId, queuedBatch: preview },
+      fallback: { tool: 'gog_sheets_batch_end', account, confirmToken, subject: () => ({ target: batchId, payload: { queuedBatch: preview }, preview: { batchId, queuedBatch: preview } }) },
+    });
+    if (confirmation) return confirmation;
+    return runOrDiagnose(['batch', 'end', pos(batchId), '--force'], { account });
+  });
+
   server.registerTool('gog_sheets_list_tabs', {
     description: 'List tabs (sheets) in a spreadsheet with their titles, sheetIds, and indices. A friendlier view than gog_sheets_metadata when you only need the tab list — useful for restructuring a workbook over a long agent session without losing track of names.',
     annotations: { readOnlyHint: true },
@@ -734,6 +765,49 @@ export function registerExtraSheetsTools(server: McpServer): void {
     return runOrDiagnose(args, { account });
   });
 
+  server.registerTool('gog_sheets_batch_request', {
+    description: 'Submit a Google Sheets API structural request array atomically (for example addDimension, repeatCell, mergeCells, or updateSheetProperties). requestsJson must be a JSON array of Sheets API Request objects. Requests are previewed and require confirmation before submission. Use batch=<id> to append these requests to a persisted Sheets batch instead of submitting immediately.',
+    annotations: { destructiveHint: true },
+    inputSchema: z.object({
+      spreadsheetId: z.string().describe('Spreadsheet ID'),
+      requestsJson: z.string().describe('JSON array of Google Sheets API Request objects, e.g. [{"addSheet":{"properties":{"title":"Archive"}}}]'),
+      batch: z.string().optional().describe('Persisted Sheets batch ID; append requests without submitting yet'),
+      account: accountParam,
+      confirmToken: confirmTokenParam,
+    }),
+  }, async ({ spreadsheetId, requestsJson, batch, account, confirmToken }, ctx) => {
+    confineAtFile(requestsJson, 'requestsJson');
+    let requests: unknown;
+    try { requests = JSON.parse(requestsJson); } catch { throw new Error('requestsJson must be valid JSON'); }
+    if (!Array.isArray(requests) || requests.length === 0) throw new Error('requestsJson must be a non-empty JSON array');
+    if (Buffer.byteLength(requestsJson, 'utf8') > 100_000) throw new Error('requestsJson exceeds the 100 KB inline limit; split the requests across persisted batches');
+    const args: GogArg[] = ['sheets', 'batch-request', pos(spreadsheetId), `--requests-json=${requestsJson}`];
+    if (batch) {
+      args.push(`--batch=${batch}`);
+      return runOrDiagnose(args, { account });
+    }
+    const got = await runOrDiagnose(['sheets', 'metadata', pos(spreadsheetId), '--select=properties.title'], { account });
+    if (got.isError) return got;
+    const title = spreadsheetTitle(resultText(got));
+    const confirmation = await requireDispatchConfirmation(ctx, {
+      action: 'sheets.batch-request',
+      message: 'Review and confirm these structural changes to the spreadsheet:',
+      confirmationLabel: 'Confirm submitting this atomic Sheets request batch.',
+      details: {
+        spreadsheet: { id: spreadsheetId, ...(title !== undefined ? { title } : {}) },
+        requestCount: requests.length,
+        requests,
+      },
+      fallback: {
+        tool: 'gog_sheets_batch_request', account, confirmToken,
+        subject: () => ({ target: spreadsheetId, payload: { requests }, preview: { requestCount: requests.length, requests } }),
+      },
+    });
+    if (confirmation) return confirmation;
+    args.push('--force');
+    return runOrDiagnose(args, { account });
+  });
+
   server.registerTool('gog_sheets_reorder_tab', {
     description: 'Move a tab to a specific 0-based position. `tab` is the tab name or numeric sheetId; `to=0` is the leftmost slot.',
     annotations: { destructiveHint: true },

package/tests/tools/sheets-extra.test.ts

@@ -894,6 +894,121 @@ describe('gog_sheets_batch_update', () => {
   });
 });
 
+describe('gog_sheets_batch_request', () => {
+  it('opens a revision-locked Sheets batch', async () => {
+    vi.mocked(lib.runOrDiagnose).mockResolvedValue(rawTextResult('{}'));
+    const harness = await setupHandlers();
+    await harness.callTool('gog_sheets_batch_begin', { spreadsheetId: 'sid', name: 'quarterly' });
+    expect(lib.runOrDiagnose).toHaveBeenCalledWith(
+      ['batch', 'begin', '--service=sheets', '--spreadsheet=sid', '--name=quarterly'], { account: undefined });
+    await harness.callTool('gog_sheets_batch_begin', { spreadsheetId: 'sid' });
+    expect(lib.runOrDiagnose).toHaveBeenCalledWith(
+      ['batch', 'begin', '--service=sheets', '--spreadsheet=sid'], { account: undefined });
+  });
+
+  it('shows and confirms the queued requests before ending a batch', async () => {
+    vi.mocked(lib.runOrDiagnose).mockResolvedValue(rawTextResult('{"requests":[{"addSheet":{}}]}'));
+    const harness = await setupHandlers();
+    await harness.callTool('gog_sheets_batch_end', { batchId: 'batch-1' });
+    expect(lib.runOrDiagnose).toHaveBeenCalledWith(['batch', 'show', pos('batch-1')], { account: undefined });
+    expect(lib.runOrDiagnose).toHaveBeenCalledWith(['batch', 'end', pos('batch-1'), '--force'], { account: undefined });
+  });
+
+  it('does not end a batch when the preview fails or is too large', async () => {
+    vi.mocked(lib.runOrDiagnose).mockResolvedValue({ isError: true, content: [{ type: 'text', text: 'failed' }] });
+    const harness = await setupHandlers();
+    expect((await harness.callTool('gog_sheets_batch_end', { batchId: 'batch-1' })).isError).toBe(true);
+    expect(lib.runOrDiagnose).toHaveBeenCalledTimes(1);
+    vi.mocked(lib.runOrDiagnose).mockResolvedValue(rawTextResult('x'.repeat(100_001)));
+    expect((await harness.callTool('gog_sheets_batch_end', { batchId: 'batch-1' })).isError).toBe(true);
+    expect(lib.runOrDiagnose).toHaveBeenCalledTimes(2);
+  });
+
+  it('refuses to submit when gog returns no batch preview', async () => {
+    vi.mocked(lib.runOrDiagnose).mockResolvedValue({ content: [] });
+    const harness = await setupHandlers();
+    expect((await harness.callTool('gog_sheets_batch_end', { batchId: 'batch-1' })).isError).toBe(true);
+    expect(lib.runOrDiagnose).toHaveBeenCalledTimes(1);
+  });
+
+  it('confirms an unprompted client using a one-time token bound to the queued requests', async () => {
+    process.env.MCP_CONFIRM_MODE = 'ask-user';
+    vi.mocked(lib.runOrDiagnose).mockResolvedValue(rawTextResult('{"requests":[{"addSheet":{}}]}'));
+    const harness = await createTestHarness(registerExtraSheetsTools);
+    const preview = await harness.callTool('gog_sheets_batch_end', { batchId: 'batch-1' });
+    const payload = JSON.parse(preview.content[0]!.text!);
+    await harness.callTool('gog_sheets_batch_end', { batchId: 'batch-1', confirmToken: payload.confirmToken });
+    expect(lib.runOrDiagnose).toHaveBeenCalledWith(['batch', 'end', pos('batch-1'), '--force'], { account: undefined });
+    delete process.env.MCP_CONFIRM_MODE;
+  });
+
+  it('confirms and submits a structural request array atomically', async () => {
+    vi.mocked(lib.runOrDiagnose).mockResolvedValue(rawTextResult('{"properties":{"title":"Plan"}}'));
+    const harness = await setupHandlers();
+    const requestsJson = '[{"addSheet":{"properties":{"title":"Archive"}}}]';
+    await harness.callTool('gog_sheets_batch_request', { spreadsheetId: 'sid', requestsJson });
+    expect(lib.runOrDiagnose).toHaveBeenNthCalledWith(1,
+      ['sheets', 'metadata', pos('sid'), '--select=properties.title'], { account: undefined });
+    expect(lib.runOrDiagnose).toHaveBeenCalledWith(
+      ['sheets', 'batch-request', pos('sid'), `--requests-json=${requestsJson}`, '--force'], { account: undefined });
+  });
+
+  it('appends requests to a persisted batch without submitting or prompting', async () => {
+    vi.mocked(lib.runOrDiagnose).mockResolvedValue(rawTextResult('{}'));
+    const harness = await setupHandlers();
+    const requestsJson = '[{"addSheet":{"properties":{"title":"Archive"}}}]';
+    await harness.callTool('gog_sheets_batch_request', { spreadsheetId: 'sid', requestsJson, batch: 'batch-1' });
+    expect(lib.runOrDiagnose).toHaveBeenCalledWith(
+      ['sheets', 'batch-request', pos('sid'), `--requests-json=${requestsJson}`, '--batch=batch-1'], { account: undefined });
+  });
+
+  it('rejects malformed or empty request arrays before calling gog', async () => {
+    const harness = await setupHandlers();
+    const malformed = await harness.callTool('gog_sheets_batch_request', { spreadsheetId: 'sid', requestsJson: '{' });
+    expect(malformed.isError).toBe(true);
+    const empty = await harness.callTool('gog_sheets_batch_request', { spreadsheetId: 'sid', requestsJson: '[]' });
+    expect(empty.isError).toBe(true);
+    expect(lib.runOrDiagnose).not.toHaveBeenCalled();
+  });
+
+  it('rejects request payloads that exceed the safe argv size', async () => {
+    const harness = await setupHandlers();
+    const result = await harness.callTool('gog_sheets_batch_request', {
+      spreadsheetId: 'sid', requestsJson: JSON.stringify([{ updateCells: { userEnteredValue: { stringValue: 'x'.repeat(100_001) } } }]),
+    });
+    expect(result.isError).toBe(true);
+    expect(lib.runOrDiagnose).not.toHaveBeenCalled();
+  });
+
+  it('does not submit if the title lookup fails', async () => {
+    vi.mocked(lib.runOrDiagnose).mockResolvedValue({ isError: true, content: [{ type: 'text', text: 'failed' }] });
+    const harness = await setupHandlers();
+    await harness.callTool('gog_sheets_batch_request', { spreadsheetId: 'sid', requestsJson: '[{"addSheet":{}}]' });
+    expect(lib.runOrDiagnose).toHaveBeenCalledTimes(1);
+  });
+
+  it('confirms by spreadsheet ID when metadata has no title', async () => {
+    vi.mocked(lib.runOrDiagnose).mockResolvedValue(rawTextResult('{}'));
+    const harness = await setupHandlers();
+    await harness.callTool('gog_sheets_batch_request', { spreadsheetId: 'sid', requestsJson: '[{"addSheet":{}}]' });
+    expect(lib.runOrDiagnose).toHaveBeenCalledWith(
+      ['sheets', 'batch-request', pos('sid'), '--requests-json=[{"addSheet":{}}]', '--force'], { account: undefined });
+  });
+
+  it('uses a one-time token when the client cannot prompt', async () => {
+    process.env.MCP_CONFIRM_MODE = 'ask-user';
+    vi.mocked(lib.runOrDiagnose).mockResolvedValue(rawTextResult('{"properties":{"title":"Plan"}}'));
+    const harness = await createTestHarness(registerExtraSheetsTools);
+    const args = { spreadsheetId: 'sid', requestsJson: '[{"addSheet":{"properties":{"title":"Archive"}}}]' };
+    const preview = await harness.callTool('gog_sheets_batch_request', args);
+    const payload = JSON.parse(preview.content[0]!.text!);
+    await harness.callTool('gog_sheets_batch_request', { ...args, confirmToken: payload.confirmToken });
+    expect(lib.runOrDiagnose).toHaveBeenCalledWith(
+      ['sheets', 'batch-request', pos('sid'), `--requests-json=${args.requestsJson}`, '--force'], { account: undefined });
+    delete process.env.MCP_CONFIRM_MODE;
+  });
+});
+
 // 24. reorder-tab (gog 0.18.0)
 describe('gog_sheets_reorder_tab', () => {
   it('passes --tab and --to', async () => {