gogcli-mcp 2.19.1 → 2.20.0

package/.claude-plugin/marketplace.json

@@ -7,7 +7,7 @@
   },
   "metadata": {
     "description": "Google Sheets (and more) for Claude via gogcli — read, write, and manage spreadsheets",
-    "version": "2.19.1"
+    "version": "2.20.0"
   },
   "plugins": [
     {
@@ -15,7 +15,7 @@
       "displayName": "gogcli",
       "source": "./",
       "description": "Google Sheets (and more) for Claude via gogcli — read, write, and manage spreadsheets",
-      "version": "2.19.1",
+      "version": "2.20.0",
       "author": {
         "name": "Chris Hall"
       },

package/.claude-plugin/plugin.json

@@ -1,7 +1,7 @@
 {
   "name": "gogcli-mcp",
   "displayName": "gogcli",
-  "version": "2.19.1",
+  "version": "2.20.0",
   "description": "Google Sheets (and more) for Claude via gogcli — read, write, and manage spreadsheets",
   "author": {
     "name": "Chris Hall",

package/dist/index.js

@@ -31119,6 +31119,13 @@ function isGogFileArg(arg) {
   return typeof arg !== "string";
 }
 var runExecutor = new AsyncLocalStorage();
+var defaultExecutor;
+function setDefaultGogExecutor(executor) {
+  defaultExecutor = executor ? { executor } : void 0;
+}
+function activeExecutor() {
+  return runExecutor.getStore() ?? defaultExecutor;
+}
 var TIMEOUT_MS = 3e4;
 function readonlyEnvEnabled() {
   return readEnvVar("GOG_READONLY") !== void 0 && parseBoolEnv("GOG_READONLY", { default: true });
@@ -31279,7 +31286,7 @@ async function run(args, options = {}) {
   const { account, spawner, interactive = false, timeout, readonly: readonly2 = false, redactMode = "full" } = options;
   const redact = redactMode === "tokens" ? redactGoogleTokens : redactSecrets2;
   const fullArgs = assembleArgs(args, { account, interactive, readonly: readonly2 });
-  const store = runExecutor.getStore();
+  const store = activeExecutor();
   try {
     let output;
     if (spawner) {
@@ -31296,7 +31303,7 @@ async function run(args, options = {}) {
 }
 async function runBinary(args, options = {}) {
   const { account, spawner, timeout, readonly: readonly2 = false } = options;
-  if (!spawner && runExecutor.getStore()) {
+  if (!spawner && activeExecutor()) {
     throw new Error(
       "Raw byte retrieval is not available over the hosted connector (its transport is text-only). Use the text-extraction path instead, or run the local stdio server to fetch bytes."
     );
@@ -33072,7 +33079,7 @@ function registerTasksTools(server) {
 }
 
 // src/server.ts
-var VERSION = true ? "2.19.1" : "0.0.0";
+var VERSION = true ? "2.20.0" : "0.0.0";
 var BASE_TOOL_REGISTRARS = [
   registerApiTools,
   registerAuthTools,
@@ -33092,9 +33099,10 @@ var DEFAULT_TIMEOUT_MS = 3e4;
 var DEADLINE_GRACE_MS = 5e3;
 var RUNNER_GOG_FAILED = 422;
 var RUNNER_DRAINING = 503;
-function makeFlyExecutor(endpoint, key) {
+function makeFlyExecutor(endpoint, key, readAccessToken) {
   return async (args, opts) => {
     const deadlineMs = (opts?.timeout ?? DEFAULT_TIMEOUT_MS) + DEADLINE_GRACE_MS;
+    const accessToken = readAccessToken?.();
     let res;
     try {
       res = await fetch(endpoint + "/run", {
@@ -33103,7 +33111,7 @@ function makeFlyExecutor(endpoint, key) {
           Authorization: "Bearer " + key,
           "Content-Type": "application/json"
         },
-        body: JSON.stringify({ args }),
+        body: JSON.stringify(accessToken ? { args, accessToken } : { args }),
         signal: AbortSignal.timeout(deadlineMs)
       });
     } catch (err) {
@@ -33144,7 +33152,9 @@ function useRemoteGogRunner(env = process.env) {
   const endpoint = readEnvVar("GOG_RUNNER_URL", { env });
   const key = readEnvVar("GOG_RUNNER_KEY", { env });
   if (!endpoint || !key) return false;
-  runExecutor.enterWith({ executor: makeFlyExecutor(endpoint.replace(/\/+$/, ""), key) });
+  setDefaultGogExecutor(
+    makeFlyExecutor(endpoint.replace(/\/+$/, ""), key, () => readEnvVar("GOG_ACCESS_TOKEN", { env }))
+  );
   return true;
 }
 

package/dist/lib.js

@@ -23016,6 +23016,13 @@ function isGogFileArg(arg) {
   return typeof arg !== "string";
 }
 var runExecutor = new AsyncLocalStorage();
+var defaultExecutor;
+function setDefaultGogExecutor(executor) {
+  defaultExecutor = executor ? { executor } : void 0;
+}
+function activeExecutor() {
+  return runExecutor.getStore() ?? defaultExecutor;
+}
 var TIMEOUT_MS = 3e4;
 var MIN_GOG_VERSION = "0.34.1";
 function readonlyEnvEnabled() {
@@ -23177,7 +23184,7 @@ async function run(args, options = {}) {
   const { account, spawner, interactive = false, timeout, readonly: readonly2 = false, redactMode = "full" } = options;
   const redact = redactMode === "tokens" ? redactGoogleTokens : redactSecrets2;
   const fullArgs = assembleArgs(args, { account, interactive, readonly: readonly2 });
-  const store = runExecutor.getStore();
+  const store = activeExecutor();
   try {
     let output;
     if (spawner) {
@@ -23194,7 +23201,7 @@ async function run(args, options = {}) {
 }
 async function runBinary(args, options = {}) {
   const { account, spawner, timeout, readonly: readonly2 = false } = options;
-  if (!spawner && runExecutor.getStore()) {
+  if (!spawner && activeExecutor()) {
     throw new Error(
       "Raw byte retrieval is not available over the hosted connector (its transport is text-only). Use the text-extraction path instead, or run the local stdio server to fetch bytes."
     );
@@ -24978,7 +24985,7 @@ function registerTasksTools(server) {
 }
 
 // src/server.ts
-var VERSION = true ? "2.19.1" : "0.0.0";
+var VERSION = true ? "2.20.0" : "0.0.0";
 var BASE_TOOL_REGISTRARS = [
   registerApiTools,
   registerAuthTools,
@@ -24998,9 +25005,10 @@ var DEFAULT_TIMEOUT_MS = 3e4;
 var DEADLINE_GRACE_MS = 5e3;
 var RUNNER_GOG_FAILED = 422;
 var RUNNER_DRAINING = 503;
-function makeFlyExecutor(endpoint, key) {
+function makeFlyExecutor(endpoint, key, readAccessToken) {
   return async (args, opts) => {
     const deadlineMs = (opts?.timeout ?? DEFAULT_TIMEOUT_MS) + DEADLINE_GRACE_MS;
+    const accessToken = readAccessToken?.();
     let res;
     try {
       res = await fetch(endpoint + "/run", {
@@ -25009,7 +25017,7 @@ function makeFlyExecutor(endpoint, key) {
           Authorization: "Bearer " + key,
           "Content-Type": "application/json"
         },
-        body: JSON.stringify({ args }),
+        body: JSON.stringify(accessToken ? { args, accessToken } : { args }),
         signal: AbortSignal.timeout(deadlineMs)
       });
     } catch (err) {
@@ -25050,7 +25058,9 @@ function useRemoteGogRunner(env = process.env) {
   const endpoint = readEnvVar("GOG_RUNNER_URL", { env });
   const key = readEnvVar("GOG_RUNNER_KEY", { env });
   if (!endpoint || !key) return false;
-  runExecutor.enterWith({ executor: makeFlyExecutor(endpoint.replace(/\/+$/, ""), key) });
+  setDefaultGogExecutor(
+    makeFlyExecutor(endpoint.replace(/\/+$/, ""), key, () => readEnvVar("GOG_ACCESS_TOKEN", { env }))
+  );
   return true;
 }
 export {

package/manifest.json

@@ -3,7 +3,7 @@
   "manifest_version": "0.3",
   "name": "gogcli-mcp",
   "display_name": "gogcli",
-  "version": "2.19.1",
+  "version": "2.20.0",
   "description": "Google Sheets (and more) for Claude via gogcli — read, write, and manage spreadsheets",
   "author": {
     "name": "Chris Hall",

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "gogcli-mcp",
-  "version": "2.19.1",
+  "version": "2.20.0",
   "mcpName": "io.github.chrischall/gogcli-mcp",
   "description": "MCP server wrapping gogcli for Google service access",
   "author": "Claude Code (AI) <https://www.anthropic.com/claude>",

package/server.json

@@ -7,12 +7,12 @@
     "source": "github",
     "subfolder": "packages/gogcli-mcp"
   },
-  "version": "2.19.1",
+  "version": "2.20.0",
   "packages": [
     {
       "registryType": "npm",
       "identifier": "gogcli-mcp",
-      "version": "2.19.1",
+      "version": "2.20.0",
       "transport": {
         "type": "stdio"
       },

package/src/connector-runtime.ts

@@ -60,9 +60,29 @@ const RUNNER_DRAINING = 503;
 // clever here (flattening to `--flag=<inline>`, truncating, re-encoding) would
 // put the payload straight back into argv and re-create the size cap this whole
 // change exists to escape.
-export function makeFlyExecutor(endpoint: string, key: string): GogExecutor {
+// `readAccessToken` is how a hosted gog acts as its CALLER rather than as
+// whoever seeded the backend's volume (#230). The backend holds one Google
+// identity; a token supplied with the request overrides it for that one `gog`
+// invocation, and `gog` already prefers a directly-passed token over its store.
+//
+// A FUNCTION, read per call, not a string captured at construction. The whole
+// claim being made is "this token belongs to this request", and an executor
+// outlives any one request — on the Worker path a single isolate serves many
+// callers, so a captured token would pin the first caller's identity onto
+// everyone who followed. That is the same shared-identity bug this closes,
+// rebuilt one layer up.
+//
+// Absent when there is no token, rather than null or "": the backend has to
+// tell "act as this caller" from "act as the box", and an empty third state is
+// one neither side has a meaning for.
+export function makeFlyExecutor(
+  endpoint: string,
+  key: string,
+  readAccessToken?: () => string | undefined,
+): GogExecutor {
   return async (args: GogArg[], opts) => {
     const deadlineMs = (opts?.timeout ?? DEFAULT_TIMEOUT_MS) + DEADLINE_GRACE_MS;
+    const accessToken = readAccessToken?.();
     let res: Response;
     try {
       res = await fetch(endpoint + '/run', {
@@ -71,7 +91,7 @@ export function makeFlyExecutor(endpoint: string, key: string): GogExecutor {
           Authorization: 'Bearer ' + key,
           'Content-Type': 'application/json',
         },
-        body: JSON.stringify({ args }),
+        body: JSON.stringify(accessToken ? { args, accessToken } : { args }),
         signal: AbortSignal.timeout(deadlineMs),
       });
     } catch (err) {

package/src/remote-runner.ts

@@ -1,5 +1,5 @@
 import { readEnvVar } from '@chrischall/mcp-utils';
-import { runExecutor } from './runner.js';
+import { setDefaultGogExecutor } from './runner.js';
 import { makeFlyExecutor } from './connector-runtime.js';
 
 /**
@@ -19,16 +19,26 @@ import { makeFlyExecutor } from './connector-runtime.js';
  * executes remotely; leave either unset and nothing changes, which is what
  * keeps every existing local install on the binary it already has.
  *
- * ## Why `enterWith` and not `run`
+ * ## Why a process-wide default and not the AsyncLocalStorage
  *
- * `runExecutor` is an AsyncLocalStorage. The Worker wraps each REQUEST in
- * `runExecutor.run(...)` because a Worker isolate serves many of them and the
- * executor differs per user. A stdio process is one user for its whole life,
- * and its tool calls arrive later as I/O callbacks — which would NOT inherit a
- * store established by a `run()` that had already returned. `enterWith` sets it
- * for the remainder of this execution and everything descending from it, which
- * is the whole process. Using `run()` here would look correct and then fall
- * back to spawning on the first actual tool call.
+ * `runExecutor` is an AsyncLocalStorage, and the Worker wraps each REQUEST in
+ * `runExecutor.run(...)` because one isolate serves many callers whose backend
+ * credentials differ. A stdio process is the opposite: one backend for its
+ * whole life.
+ *
+ * This used to reach for `enterWith` on the theory that it "sets the store for
+ * the whole process". It does not. `enterWith` sets the store on the async
+ * resource that is CURRENT when it runs — here, module evaluation — and the
+ * tool calls arrive later as I/O events on the transport's own resources, which
+ * do not descend from that. So `getStore()` was undefined at exactly the moment
+ * `run()` asked, and the seam reverted to spawning a binary the host does not
+ * have. Every hosted gog MCP answered "gog executable not found" while pointed
+ * at a healthy backend, and the unit test missed it because a test that calls
+ * this function itself awaits inside the resource it just mutated.
+ *
+ * A process-lifetime value is not a scoped value, so it does not live in a
+ * scope: `setDefaultGogExecutor` holds it, and a per-request store still beats
+ * it (runner.ts `activeExecutor`) so the Worker path is unchanged.
  *
  * Call before the server starts, so no tool can be serviced ahead of it.
  */
@@ -44,6 +54,17 @@ export function useRemoteGogRunner(env: NodeJS.ProcessEnv = process.env): boolea
   // nothing — either alone is a misconfiguration, and silently spawning
   // instead would hide it until someone wondered why the binary was needed.
   if (!endpoint || !key) return false;
-  runExecutor.enterWith({ executor: makeFlyExecutor(endpoint.replace(/\/+$/, ''), key) });
+  // Whose Google identity this process acts as (#230). The backend holds ONE
+  // identity on its volume, so without this every caller of a hosted gog acts
+  // as whoever seeded it. Under mcp-host's `perUserChild` this process belongs
+  // to a single caller and its environment carries that caller's token, so
+  // forwarding it is the whole of "act as the person calling you".
+  //
+  // Read per call rather than captured here, because the executor outlives any
+  // one request and the claim being made is about a request. Absent when unset,
+  // which is every registration that predates per-caller auth.
+  setDefaultGogExecutor(
+    makeFlyExecutor(endpoint.replace(/\/+$/, ''), key, () => readEnvVar('GOG_ACCESS_TOKEN', { env })),
+  );
   return true;
 }

package/src/runner.ts

@@ -50,6 +50,40 @@ export type GogExecutor = (
 // `runExecutor.run({ executor }, ...)`; unset, `run()` falls back to spawning.
 export const runExecutor = new AsyncLocalStorage<{ executor: GogExecutor }>();
 
+/**
+ * The PROCESS-WIDE executor, for a host that has exactly one backend for the
+ * whole process — a stdio bin pointed at a Fly runner (`useRemoteGogRunner`).
+ *
+ * It exists because AsyncLocalStorage cannot express that. `enterWith` sets the
+ * store on the async resource that is current when it runs, and a bin runs it
+ * during module evaluation; the tool calls arrive later as I/O events on the
+ * transport's own resources, which are not descendants of that evaluation, so
+ * `getStore()` is undefined exactly where it is needed. That is not a bug in
+ * `enterWith` — a process-lifetime default is simply not a scoped value, and
+ * storing it in a scope meant the seam silently reverted to spawning a binary
+ * the host does not have.
+ *
+ * A per-request store still WINS over this (see `activeExecutor`), because the
+ * Worker serves many callers from one isolate and each has its own backend
+ * credential; this is the fallback for the one-backend case, never a second
+ * answer to "whose backend is this".
+ */
+let defaultExecutor: { executor: GogExecutor } | undefined;
+
+/** Install the process-wide executor. Passing undefined clears it (tests). */
+export function setDefaultGogExecutor(executor: GogExecutor | undefined): void {
+  defaultExecutor = executor ? { executor } : undefined;
+}
+
+/**
+ * Whose executor applies right now: the request's, else the process's, else
+ * none (meaning `run()` spawns the local binary). Both call sites ask through
+ * here so they can never disagree about which of the three it is.
+ */
+function activeExecutor(): { executor: GogExecutor } | undefined {
+  return runExecutor.getStore() ?? defaultExecutor;
+}
+
 export interface RunOptions {
   account?: string;
   spawner?: Spawner;
@@ -328,7 +362,7 @@ export async function run(args: GogArg[], options: RunOptions = {}): Promise<str
   // successful `gog auth tokens` (or any command echoing a credential) would
   // otherwise return raw Google tokens (ya29.…/1//…) into model context, where
   // a sibling tool (gog_gmail_send) could exfiltrate them.
-  const store = runExecutor.getStore();
+  const store = activeExecutor();
   try {
     let output: string;
     if (spawner) {
@@ -358,7 +392,7 @@ export async function runBinary(args: GogArg[], options: RunOptions = {}): Promi
   // An injected spawner is the stdio/test path and always wins. Otherwise, if an
   // ambient forward executor is installed (the Worker/Fly connector), refuse:
   // its text-only transport can't carry bytes intact.
-  if (!spawner && runExecutor.getStore()) {
+  if (!spawner && activeExecutor()) {
     throw new Error(
       'Raw byte retrieval is not available over the hosted connector (its transport is text-only). ' +
       'Use the text-extraction path instead, or run the local stdio server to fetch bytes.',

package/src/worker.ts

@@ -38,7 +38,7 @@ import { gogAuth, type GogProps } from './connector-auth.js';
 // connector with all ~360 tools at once. Add whichever paths you want as separate
 // connectors in claude.ai (each authorizes with the same connector key).
 
-const VERSION = '2.19.1'; // x-release-please-version
+const VERSION = '2.20.0'; // x-release-please-version
 
 // Build an McpAgent subclass whose init() registers `registrars` onto its server,
 // each handler wrapped in the ALS scope carrying the per-session Fly executor.

package/tests/connector-runtime.test.ts

@@ -120,6 +120,57 @@ describe('makeFlyExecutor', () => {
     expect(init.body).toBe(JSON.stringify({ args: ['sheets', 'get', 'A1'] }));
   });
 
+  // A hosted gog authenticates as whoever seeded the Fly volume, not as the
+  // person calling it (#230). mcp-host can give each caller their own child
+  // carrying their own GOG_ACCESS_TOKEN, so the missing link is the child
+  // handing that token to the backend for ITS call only — never as something
+  // ambient on the box, which would be the same shared identity from the other
+  // direction.
+  describe('per-request access token', () => {
+    function okFetch() {
+      const fetchMock = vi.fn(async () => ({ ok: true, json: async () => ({ stdout: 'ok' }) }));
+      vi.stubGlobal('fetch', fetchMock);
+      return fetchMock;
+    }
+    function bodyOf(fetchMock: { mock: { calls: unknown[][] } }, i = 0): Record<string, unknown> {
+      const [, init] = fetchMock.mock.calls[i] as [string, RequestInit];
+      return JSON.parse(init.body as string) as Record<string, unknown>;
+    }
+
+    it('sends the token with the request when one is available', async () => {
+      const fetchMock = okFetch();
+      const exec = makeFlyExecutor(ENDPOINT, KEY, () => 'ya29.caller-token');
+      await exec(['auth', 'status'], {});
+      expect(bodyOf(fetchMock)).toEqual({ args: ['auth', 'status'], accessToken: 'ya29.caller-token' });
+    });
+
+    it('omits the field entirely when there is no token', async () => {
+      // Absent, not null or "": the backend distinguishes "act as the caller"
+      // from "act as the box", and a present-but-empty field would be a third
+      // state neither side has a meaning for.
+      const fetchMock = okFetch();
+      for (const provider of [undefined, () => undefined, () => '']) {
+        vi.clearAllMocks();
+        const exec = makeFlyExecutor(ENDPOINT, KEY, provider as (() => string | undefined) | undefined);
+        await exec(['auth', 'status'], {});
+        expect(bodyOf(fetchMock)).toEqual({ args: ['auth', 'status'] });
+      }
+    });
+
+    it('reads the token per CALL, not once when the executor is built', async () => {
+      // The whole contract is "this token belongs to this request". Reading it
+      // once at construction would pin the first caller's identity onto an
+      // executor that outlives them — exactly the bug this closes, rebuilt.
+      const fetchMock = okFetch();
+      const tokens = ['first', 'second'];
+      const exec = makeFlyExecutor(ENDPOINT, KEY, () => tokens.shift());
+      await exec(['auth', 'status'], {});
+      await exec(['auth', 'status'], {});
+      expect(bodyOf(fetchMock, 0).accessToken).toBe('first');
+      expect(bodyOf(fetchMock, 1).accessToken).toBe('second');
+    });
+  });
+
   // Everything below is the file-arg wire contract. The Worker has no filesystem
   // and no gog binary, so a GogFileArg must cross the wire STRUCTURED and be
   // materialized on the Fly runner. If this layer ever flattened it back into an

package/tests/remote-runner.test.ts

@@ -3,16 +3,30 @@ import { join } from 'node:path';
 import { fileURLToPath } from 'node:url';
 import { describe, it, expect, vi, afterEach } from 'vitest';
 import { useRemoteGogRunner } from '../src/remote-runner.js';
-import { runExecutor } from '../src/runner.js';
+import { run, runBinary, runExecutor, setDefaultGogExecutor } from '../src/runner.js';
 
 /**
  * The whole point of this seam is that a host without the `gog` binary can
- * still serve. Two ways it silently fails: a half-configured env that falls
- * back to spawning, and using `run()` instead of `enterWith()` so the store is
- * gone by the time a tool call arrives.
+ * still serve. Every way it has silently failed so far: a half-configured env
+ * that falls back to spawning; a bin that never calls `useRemoteGogRunner()`;
+ * and — the one that shipped in 2.19.x — parking the executor in an
+ * AsyncLocalStorage that the tool calls never inherit, so the seam reported
+ * success and then spawned anyway.
+ *
+ * They share a shape worth naming: every one of them fails by falling back to
+ * the local binary, which on a laptop is invisible and on a host is total. So
+ * these tests assert on where a call ACTUALLY went, never on whether the wiring
+ * step was performed.
  */
 
-afterEach(() => vi.unstubAllGlobals());
+afterEach(() => {
+  vi.unstubAllGlobals();
+  vi.unstubAllEnvs();
+  // The executor is process-wide BY DESIGN now, so unlike an ALS store it does
+  // not unwind when a test ends — without this, the first test to install one
+  // would silently hand it to every test that ran after it.
+  setDefaultGogExecutor(undefined);
+});
 
 describe('useRemoteGogRunner', () => {
   it('does nothing unless BOTH variables are set, so local installs are untouched', () => {
@@ -33,26 +47,124 @@ describe('useRemoteGogRunner', () => {
     expect(useRemoteGogRunner({ GOG_RUNNER_URL: 'null', GOG_RUNNER_KEY: 'k' })).toBe(false);
   });
 
-  it('installs an executor that survives into a LATER async callback', async () => {
-    // The real failure mode this guards: with `run()` the store would be gone
-    // by the time a tool call arrives as an I/O callback, and the server would
-    // quietly go back to spawning a binary that is not installed.
+  it('addresses and authenticates the backend correctly', async () => {
+    // Asserted THROUGH run(), not by reading whichever slot the executor is
+    // parked in. The previous version of this test fetched
+    // `runExecutor.getStore()` and called what it found, so it was really a
+    // test that `enterWith` had been called — which stayed green while the
+    // shipped bins routed every call to a local binary (see the next test).
     const fetchMock = vi.fn(async () => new Response(JSON.stringify({ stdout: 'ok' }), { status: 200 }));
     vi.stubGlobal('fetch', fetchMock);
+    vi.stubEnv('GOG_PATH', '/nonexistent/gog');
 
     expect(useRemoteGogRunner({ GOG_RUNNER_URL: 'https://r.test/', GOG_RUNNER_KEY: 'secret' })).toBe(true);
 
     // Cross a macrotask boundary, the way a stdio tool call does.
     await new Promise((r) => setTimeout(r, 0));
-    const store = runExecutor.getStore();
-    expect(store?.executor).toBeTypeOf('function');
+    expect(await run(['--version'])).toBe('ok');
 
-    await store!.executor(['--version'], {});
     const [url, init] = fetchMock.mock.calls[0] as unknown as [string, RequestInit];
     // Trailing slash trimmed, so the endpoint is never `…//run`.
     expect(url).toBe('https://r.test/run');
     expect((init.headers as Record<string, string>).Authorization).toBe('Bearer secret');
   });
+
+  it('still routes remotely from a context the store never reached', async () => {
+    // THE ONE THE TEST ABOVE CANNOT CATCH, and it shipped broken.
+    //
+    // `enterWith` mutates the store of the async resource that is current when
+    // it runs. The test above calls useRemoteGogRunner() itself, so everything
+    // it awaits afterwards is a descendant of that resource and inherits the
+    // store — it passes whether or not the seam works where it matters.
+    //
+    // A bin does something different: it calls useRemoteGogRunner() while the
+    // ES module is evaluating, and then `await runMcp(...)` starts serving. The
+    // tool calls arrive later as I/O events on the transport's own async
+    // resources, which are NOT descendants of module evaluation, so
+    // `getStore()` is undefined by the time `run()` asks. Verified against the
+    // published 2.19.1 bin: `useRemoteGogRunner()` returned true, and at call
+    // time the store was undefined — every hosted gog MCP answered
+    // "gog executable not found" while pointed at a healthy backend.
+    //
+    // `runExecutor.exit()` is that condition exactly, and deterministically:
+    // run the call where the ALS store does not apply.
+    const fetchMock = vi.fn(async () => new Response(JSON.stringify({ stdout: 'remote' }), { status: 200 }));
+    vi.stubGlobal('fetch', fetchMock);
+    // So the spawn fallback cannot accidentally succeed on a machine that has
+    // gog installed and make this pass for the wrong reason.
+    vi.stubEnv('GOG_PATH', '/nonexistent/gog');
+
+    expect(useRemoteGogRunner({ GOG_RUNNER_URL: 'https://r.test', GOG_RUNNER_KEY: 'secret' })).toBe(true);
+
+    const output = await runExecutor.exit(() => run(['auth', 'status']));
+    expect(output).toBe('remote');
+    expect(fetchMock).toHaveBeenCalledTimes(1);
+  });
+
+  it('forwards its own GOG_ACCESS_TOKEN so a hosted gog acts as its caller', async () => {
+    // Under mcp-host's perUserChild, THIS PROCESS belongs to one caller and
+    // holds their token (#230). The backend has one Google identity on its
+    // volume, so without forwarding, every caller of a hosted gog acts as
+    // whoever seeded it.
+    const fetchMock = vi.fn(async () => new Response(JSON.stringify({ stdout: 'ok' }), { status: 200 }));
+    vi.stubGlobal('fetch', fetchMock);
+    vi.stubEnv('GOG_PATH', '/nonexistent/gog');
+
+    expect(
+      useRemoteGogRunner({
+        GOG_RUNNER_URL: 'https://r.test',
+        GOG_RUNNER_KEY: 'secret',
+        GOG_ACCESS_TOKEN: 'ya29.the-caller',
+      }),
+    ).toBe(true);
+
+    await runExecutor.exit(() => run(['auth', 'status']));
+    const [, init] = fetchMock.mock.calls[0] as unknown as [string, RequestInit];
+    expect(JSON.parse(init.body as string).accessToken).toBe('ya29.the-caller');
+  });
+
+  it('sends no token when the caller has not supplied one', async () => {
+    // Absent, not empty: the backend distinguishes "act as this caller" from
+    // "act as the box", and every registration that predates per-caller auth is
+    // the second case.
+    const fetchMock = vi.fn(async () => new Response(JSON.stringify({ stdout: 'ok' }), { status: 200 }));
+    vi.stubGlobal('fetch', fetchMock);
+    vi.stubEnv('GOG_PATH', '/nonexistent/gog');
+
+    expect(useRemoteGogRunner({ GOG_RUNNER_URL: 'https://r.test', GOG_RUNNER_KEY: 'secret' })).toBe(true);
+
+    await runExecutor.exit(() => run(['auth', 'status']));
+    const [, init] = fetchMock.mock.calls[0] as unknown as [string, RequestInit];
+    // The KEY must be absent, not present-and-empty. Asserted on its own rather
+    // than by matching the whole body: `assembleArgs` folds in ambient settings
+    // like GOG_ACCOUNT, so a whole-body match passes or fails depending on the
+    // developer's shell.
+    expect(JSON.parse(init.body as string)).not.toHaveProperty('accessToken');
+  });
+
+  it('lets a per-request store beat the process-wide default', async () => {
+    // The Worker path scopes every request in `runExecutor.run({ executor })`
+    // because one isolate serves many callers (connector-runtime.ts). A
+    // process-wide default must never shadow that: it is the fallback for a
+    // stdio bin, not a second answer to "whose backend is this".
+    const perRequest = vi.fn(async () => 'per-request');
+    vi.stubGlobal('fetch', vi.fn(async () => new Response(JSON.stringify({ stdout: 'default' }), { status: 200 })));
+    expect(useRemoteGogRunner({ GOG_RUNNER_URL: 'https://r.test', GOG_RUNNER_KEY: 'secret' })).toBe(true);
+
+    const output = await runExecutor.run({ executor: perRequest }, () => run(['auth', 'status']));
+    expect(output).toBe('per-request');
+    expect(perRequest).toHaveBeenCalledTimes(1);
+  });
+
+  it('still refuses binary retrieval when the default is a remote executor', async () => {
+    // runBinary's guard asks the same question ("is a text-only forward
+    // installed?") and must read the same answer, or a hosted bin would fall
+    // through to spawning for bytes while every text call went remote.
+    vi.stubEnv('GOG_PATH', '/nonexistent/gog');
+    expect(useRemoteGogRunner({ GOG_RUNNER_URL: 'https://r.test', GOG_RUNNER_KEY: 'secret' })).toBe(true);
+
+    await expect(runExecutor.exit(() => runBinary(['drive', 'read']))).rejects.toThrow(/text-only/);
+  });
 });
 
 /**