gogcli-mcp 1.0.4 → 1.0.5

package/.mcp.json

@@ -6,8 +6,7 @@
       "cwd": "/Users/chris/git/gogcli-mcp",
       "env": {
         "GOG_ACCOUNT": "${GOG_ACCOUNT}",
-        "GOG_PATH": "${GOG_PATH}",
-        "GOG_ACCESS_TOKEN": "${GOG_ACCESS_TOKEN}"
+        "GOG_PATH": "${GOG_PATH}"
       }
     }
   }

package/CLAUDE.md

@@ -31,7 +31,7 @@ Main is always one version ahead of the latest tag. To release, run the **Tag &
 4. Rebuilds, commits, and pushes main + tag
 5. The tag push triggers the **Release** workflow (CI + npm publish + .mcpb + .skill + GitHub release)
 
-Do NOT manually bump versions or create tags unless the user explicitly asks.
+Do NOT manually bump versions or create tags unless the user explicitly asks. Always prefer the Tag & Bump action: `gh workflow run tag-and-bump.yml --ref main`. The action handles all four version files, tagging, and triggering the release.
 
 ## Architecture
 

package/dist/index.js

@@ -30137,7 +30137,8 @@ async function run(args, options = {}) {
   fullArgs.push(...args);
   const effectiveTimeout = timeout ?? TIMEOUT_MS;
   return new Promise((resolve, reject) => {
-    const child = spawner(process.env.GOG_PATH ?? "gog", fullArgs, { env: process.env });
+    const { GOG_ACCESS_TOKEN: _, ...cleanEnv } = process.env;
+    const child = spawner(process.env.GOG_PATH ?? "gog", fullArgs, { env: cleanEnv });
     const stdoutChunks = [];
     const stderrChunks = [];
     let settled = false;
@@ -30965,7 +30966,7 @@ function registerTasksTools(server2) {
 }
 
 // src/index.ts
-var server = new McpServer({ name: "gogcli", version: "1.0.4" });
+var server = new McpServer({ name: "gogcli", version: "1.0.5" });
 registerAuthTools(server);
 registerCalendarTools(server);
 registerContactsTools(server);

package/manifest.json

@@ -3,7 +3,7 @@
   "manifest_version": "0.3",
   "name": "gogcli-mcp",
   "display_name": "gogcli",
-  "version": "1.0.4",
+  "version": "1.0.5",
   "description": "Google Sheets (and more) for Claude via gogcli — read, write, and manage spreadsheets",
   "author": {
     "name": "Chris Hall",
@@ -37,8 +37,7 @@
       ],
       "env": {
         "GOG_ACCOUNT": "${user_config.gog_account}",
-        "GOG_PATH": "${user_config.gog_path}",
-        "GOG_ACCESS_TOKEN": "${user_config.gog_access_token}"
+        "GOG_PATH": "${user_config.gog_path}"
       }
     }
   },
@@ -54,13 +53,6 @@
       "title": "gog Executable Path",
       "description": "Path to the gog executable (optional — defaults to 'gog' on your PATH)",
       "required": false
-    },
-    "gog_access_token": {
-      "type": "string",
-      "title": "Google Access Token",
-      "description": "Short-lived OAuth access token (optional — bypasses stored refresh tokens, expires in ~1h). Useful for CI or automated contexts.",
-      "required": false,
-      "sensitive": true
     }
   },
   "tools": [

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "gogcli-mcp",
-  "version": "1.0.4",
+  "version": "1.0.5",
   "description": "MCP server wrapping gogcli for Google service access",
   "repository": {
     "type": "git",

package/src/index.ts

@@ -10,7 +10,7 @@ import { registerGmailTools } from './tools/gmail.js';
 import { registerSheetsTools } from './tools/sheets.js';
 import { registerTasksTools } from './tools/tasks.js';
 
-const server = new McpServer({ name: 'gogcli', version: '1.0.4' });
+const server = new McpServer({ name: 'gogcli', version: '1.0.5' });
 
 registerAuthTools(server);
 registerCalendarTools(server);

package/src/runner.ts

@@ -42,7 +42,10 @@ export async function run(args: string[], options: RunOptions = {}): Promise<str
   const effectiveTimeout = timeout ?? TIMEOUT_MS;
 
   return new Promise((resolve, reject) => {
-    const child = spawner(process.env.GOG_PATH ?? 'gog', fullArgs, { env: process.env });
+    // Strip GOG_ACCESS_TOKEN so gogcli uses stored refresh tokens instead of
+    // a potentially stale direct access token passed through MCP env config.
+    const { GOG_ACCESS_TOKEN: _, ...cleanEnv } = process.env;
+    const child = spawner(process.env.GOG_PATH ?? 'gog', fullArgs, { env: cleanEnv });
     const stdoutChunks: Buffer[] = [];
     const stderrChunks: Buffer[] = [];
     let settled = false;

package/tests/runner.test.ts

@@ -300,6 +300,23 @@ describe('run', () => {
     vi.useRealTimers();
   });
 
+  it('strips GOG_ACCESS_TOKEN from child environment to force refresh-token auth', async () => {
+    const spawner = makeSpawner(0, '{}');
+    const originalToken = process.env.GOG_ACCESS_TOKEN;
+    process.env.GOG_ACCESS_TOKEN = 'stale-token-from-mcp-config';
+    try {
+      await run(['docs', 'comments', 'list', 'docId'], { spawner });
+      const envPassed = (spawner as ReturnType<typeof vi.fn>).mock.calls[0][2].env as NodeJS.ProcessEnv;
+      expect(envPassed.GOG_ACCESS_TOKEN).toBeUndefined();
+    } finally {
+      if (originalToken === undefined) {
+        delete process.env.GOG_ACCESS_TOKEN;
+      } else {
+        process.env.GOG_ACCESS_TOKEN = originalToken;
+      }
+    }
+  });
+
   it('ignores timeout if close event already settled the promise', async () => {
     vi.useFakeTimers();
     const spawner = vi.fn(() => {