gogcli-mcp 2.19.2 → 2.20.0

package/.claude-plugin/marketplace.json

@@ -7,7 +7,7 @@
   },
   "metadata": {
     "description": "Google Sheets (and more) for Claude via gogcli — read, write, and manage spreadsheets",
-    "version": "2.19.2"
+    "version": "2.20.0"
   },
   "plugins": [
     {
@@ -15,7 +15,7 @@
       "displayName": "gogcli",
       "source": "./",
       "description": "Google Sheets (and more) for Claude via gogcli — read, write, and manage spreadsheets",
-      "version": "2.19.2",
+      "version": "2.20.0",
       "author": {
         "name": "Chris Hall"
       },

package/.claude-plugin/plugin.json

@@ -1,7 +1,7 @@
 {
   "name": "gogcli-mcp",
   "displayName": "gogcli",
-  "version": "2.19.2",
+  "version": "2.20.0",
   "description": "Google Sheets (and more) for Claude via gogcli — read, write, and manage spreadsheets",
   "author": {
     "name": "Chris Hall",

package/dist/index.js

@@ -33079,7 +33079,7 @@ function registerTasksTools(server) {
 }
 
 // src/server.ts
-var VERSION = true ? "2.19.2" : "0.0.0";
+var VERSION = true ? "2.20.0" : "0.0.0";
 var BASE_TOOL_REGISTRARS = [
   registerApiTools,
   registerAuthTools,
@@ -33099,9 +33099,10 @@ var DEFAULT_TIMEOUT_MS = 3e4;
 var DEADLINE_GRACE_MS = 5e3;
 var RUNNER_GOG_FAILED = 422;
 var RUNNER_DRAINING = 503;
-function makeFlyExecutor(endpoint, key) {
+function makeFlyExecutor(endpoint, key, readAccessToken) {
   return async (args, opts) => {
     const deadlineMs = (opts?.timeout ?? DEFAULT_TIMEOUT_MS) + DEADLINE_GRACE_MS;
+    const accessToken = readAccessToken?.();
     let res;
     try {
       res = await fetch(endpoint + "/run", {
@@ -33110,7 +33111,7 @@ function makeFlyExecutor(endpoint, key) {
           Authorization: "Bearer " + key,
           "Content-Type": "application/json"
         },
-        body: JSON.stringify({ args }),
+        body: JSON.stringify(accessToken ? { args, accessToken } : { args }),
         signal: AbortSignal.timeout(deadlineMs)
       });
     } catch (err) {
@@ -33151,7 +33152,9 @@ function useRemoteGogRunner(env = process.env) {
   const endpoint = readEnvVar("GOG_RUNNER_URL", { env });
   const key = readEnvVar("GOG_RUNNER_KEY", { env });
   if (!endpoint || !key) return false;
-  setDefaultGogExecutor(makeFlyExecutor(endpoint.replace(/\/+$/, ""), key));
+  setDefaultGogExecutor(
+    makeFlyExecutor(endpoint.replace(/\/+$/, ""), key, () => readEnvVar("GOG_ACCESS_TOKEN", { env }))
+  );
   return true;
 }
 

package/dist/lib.js

@@ -24985,7 +24985,7 @@ function registerTasksTools(server) {
 }
 
 // src/server.ts
-var VERSION = true ? "2.19.2" : "0.0.0";
+var VERSION = true ? "2.20.0" : "0.0.0";
 var BASE_TOOL_REGISTRARS = [
   registerApiTools,
   registerAuthTools,
@@ -25005,9 +25005,10 @@ var DEFAULT_TIMEOUT_MS = 3e4;
 var DEADLINE_GRACE_MS = 5e3;
 var RUNNER_GOG_FAILED = 422;
 var RUNNER_DRAINING = 503;
-function makeFlyExecutor(endpoint, key) {
+function makeFlyExecutor(endpoint, key, readAccessToken) {
   return async (args, opts) => {
     const deadlineMs = (opts?.timeout ?? DEFAULT_TIMEOUT_MS) + DEADLINE_GRACE_MS;
+    const accessToken = readAccessToken?.();
     let res;
     try {
       res = await fetch(endpoint + "/run", {
@@ -25016,7 +25017,7 @@ function makeFlyExecutor(endpoint, key) {
           Authorization: "Bearer " + key,
           "Content-Type": "application/json"
         },
-        body: JSON.stringify({ args }),
+        body: JSON.stringify(accessToken ? { args, accessToken } : { args }),
         signal: AbortSignal.timeout(deadlineMs)
       });
     } catch (err) {
@@ -25057,7 +25058,9 @@ function useRemoteGogRunner(env = process.env) {
   const endpoint = readEnvVar("GOG_RUNNER_URL", { env });
   const key = readEnvVar("GOG_RUNNER_KEY", { env });
   if (!endpoint || !key) return false;
-  setDefaultGogExecutor(makeFlyExecutor(endpoint.replace(/\/+$/, ""), key));
+  setDefaultGogExecutor(
+    makeFlyExecutor(endpoint.replace(/\/+$/, ""), key, () => readEnvVar("GOG_ACCESS_TOKEN", { env }))
+  );
   return true;
 }
 export {

package/manifest.json

@@ -3,7 +3,7 @@
   "manifest_version": "0.3",
   "name": "gogcli-mcp",
   "display_name": "gogcli",
-  "version": "2.19.2",
+  "version": "2.20.0",
   "description": "Google Sheets (and more) for Claude via gogcli — read, write, and manage spreadsheets",
   "author": {
     "name": "Chris Hall",

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "gogcli-mcp",
-  "version": "2.19.2",
+  "version": "2.20.0",
   "mcpName": "io.github.chrischall/gogcli-mcp",
   "description": "MCP server wrapping gogcli for Google service access",
   "author": "Claude Code (AI) <https://www.anthropic.com/claude>",

package/server.json

@@ -7,12 +7,12 @@
     "source": "github",
     "subfolder": "packages/gogcli-mcp"
   },
-  "version": "2.19.2",
+  "version": "2.20.0",
   "packages": [
     {
       "registryType": "npm",
       "identifier": "gogcli-mcp",
-      "version": "2.19.2",
+      "version": "2.20.0",
       "transport": {
         "type": "stdio"
       },

package/src/connector-runtime.ts

@@ -60,9 +60,29 @@ const RUNNER_DRAINING = 503;
 // clever here (flattening to `--flag=<inline>`, truncating, re-encoding) would
 // put the payload straight back into argv and re-create the size cap this whole
 // change exists to escape.
-export function makeFlyExecutor(endpoint: string, key: string): GogExecutor {
+// `readAccessToken` is how a hosted gog acts as its CALLER rather than as
+// whoever seeded the backend's volume (#230). The backend holds one Google
+// identity; a token supplied with the request overrides it for that one `gog`
+// invocation, and `gog` already prefers a directly-passed token over its store.
+//
+// A FUNCTION, read per call, not a string captured at construction. The whole
+// claim being made is "this token belongs to this request", and an executor
+// outlives any one request — on the Worker path a single isolate serves many
+// callers, so a captured token would pin the first caller's identity onto
+// everyone who followed. That is the same shared-identity bug this closes,
+// rebuilt one layer up.
+//
+// Absent when there is no token, rather than null or "": the backend has to
+// tell "act as this caller" from "act as the box", and an empty third state is
+// one neither side has a meaning for.
+export function makeFlyExecutor(
+  endpoint: string,
+  key: string,
+  readAccessToken?: () => string | undefined,
+): GogExecutor {
   return async (args: GogArg[], opts) => {
     const deadlineMs = (opts?.timeout ?? DEFAULT_TIMEOUT_MS) + DEADLINE_GRACE_MS;
+    const accessToken = readAccessToken?.();
     let res: Response;
     try {
       res = await fetch(endpoint + '/run', {
@@ -71,7 +91,7 @@ export function makeFlyExecutor(endpoint: string, key: string): GogExecutor {
           Authorization: 'Bearer ' + key,
           'Content-Type': 'application/json',
         },
-        body: JSON.stringify({ args }),
+        body: JSON.stringify(accessToken ? { args, accessToken } : { args }),
         signal: AbortSignal.timeout(deadlineMs),
       });
     } catch (err) {

package/src/remote-runner.ts

@@ -54,6 +54,17 @@ export function useRemoteGogRunner(env: NodeJS.ProcessEnv = process.env): boolea
   // nothing — either alone is a misconfiguration, and silently spawning
   // instead would hide it until someone wondered why the binary was needed.
   if (!endpoint || !key) return false;
-  setDefaultGogExecutor(makeFlyExecutor(endpoint.replace(/\/+$/, ''), key));
+  // Whose Google identity this process acts as (#230). The backend holds ONE
+  // identity on its volume, so without this every caller of a hosted gog acts
+  // as whoever seeded it. Under mcp-host's `perUserChild` this process belongs
+  // to a single caller and its environment carries that caller's token, so
+  // forwarding it is the whole of "act as the person calling you".
+  //
+  // Read per call rather than captured here, because the executor outlives any
+  // one request and the claim being made is about a request. Absent when unset,
+  // which is every registration that predates per-caller auth.
+  setDefaultGogExecutor(
+    makeFlyExecutor(endpoint.replace(/\/+$/, ''), key, () => readEnvVar('GOG_ACCESS_TOKEN', { env })),
+  );
   return true;
 }

package/src/worker.ts

@@ -38,7 +38,7 @@ import { gogAuth, type GogProps } from './connector-auth.js';
 // connector with all ~360 tools at once. Add whichever paths you want as separate
 // connectors in claude.ai (each authorizes with the same connector key).
 
-const VERSION = '2.19.2'; // x-release-please-version
+const VERSION = '2.20.0'; // x-release-please-version
 
 // Build an McpAgent subclass whose init() registers `registrars` onto its server,
 // each handler wrapped in the ALS scope carrying the per-session Fly executor.

package/tests/connector-runtime.test.ts

@@ -120,6 +120,57 @@ describe('makeFlyExecutor', () => {
     expect(init.body).toBe(JSON.stringify({ args: ['sheets', 'get', 'A1'] }));
   });
 
+  // A hosted gog authenticates as whoever seeded the Fly volume, not as the
+  // person calling it (#230). mcp-host can give each caller their own child
+  // carrying their own GOG_ACCESS_TOKEN, so the missing link is the child
+  // handing that token to the backend for ITS call only — never as something
+  // ambient on the box, which would be the same shared identity from the other
+  // direction.
+  describe('per-request access token', () => {
+    function okFetch() {
+      const fetchMock = vi.fn(async () => ({ ok: true, json: async () => ({ stdout: 'ok' }) }));
+      vi.stubGlobal('fetch', fetchMock);
+      return fetchMock;
+    }
+    function bodyOf(fetchMock: { mock: { calls: unknown[][] } }, i = 0): Record<string, unknown> {
+      const [, init] = fetchMock.mock.calls[i] as [string, RequestInit];
+      return JSON.parse(init.body as string) as Record<string, unknown>;
+    }
+
+    it('sends the token with the request when one is available', async () => {
+      const fetchMock = okFetch();
+      const exec = makeFlyExecutor(ENDPOINT, KEY, () => 'ya29.caller-token');
+      await exec(['auth', 'status'], {});
+      expect(bodyOf(fetchMock)).toEqual({ args: ['auth', 'status'], accessToken: 'ya29.caller-token' });
+    });
+
+    it('omits the field entirely when there is no token', async () => {
+      // Absent, not null or "": the backend distinguishes "act as the caller"
+      // from "act as the box", and a present-but-empty field would be a third
+      // state neither side has a meaning for.
+      const fetchMock = okFetch();
+      for (const provider of [undefined, () => undefined, () => '']) {
+        vi.clearAllMocks();
+        const exec = makeFlyExecutor(ENDPOINT, KEY, provider as (() => string | undefined) | undefined);
+        await exec(['auth', 'status'], {});
+        expect(bodyOf(fetchMock)).toEqual({ args: ['auth', 'status'] });
+      }
+    });
+
+    it('reads the token per CALL, not once when the executor is built', async () => {
+      // The whole contract is "this token belongs to this request". Reading it
+      // once at construction would pin the first caller's identity onto an
+      // executor that outlives them — exactly the bug this closes, rebuilt.
+      const fetchMock = okFetch();
+      const tokens = ['first', 'second'];
+      const exec = makeFlyExecutor(ENDPOINT, KEY, () => tokens.shift());
+      await exec(['auth', 'status'], {});
+      await exec(['auth', 'status'], {});
+      expect(bodyOf(fetchMock, 0).accessToken).toBe('first');
+      expect(bodyOf(fetchMock, 1).accessToken).toBe('second');
+    });
+  });
+
   // Everything below is the file-arg wire contract. The Worker has no filesystem
   // and no gog binary, so a GogFileArg must cross the wire STRUCTURED and be
   // materialized on the Fly runner. If this layer ever flattened it back into an

package/tests/remote-runner.test.ts

@@ -101,6 +101,47 @@ describe('useRemoteGogRunner', () => {
     expect(fetchMock).toHaveBeenCalledTimes(1);
   });
 
+  it('forwards its own GOG_ACCESS_TOKEN so a hosted gog acts as its caller', async () => {
+    // Under mcp-host's perUserChild, THIS PROCESS belongs to one caller and
+    // holds their token (#230). The backend has one Google identity on its
+    // volume, so without forwarding, every caller of a hosted gog acts as
+    // whoever seeded it.
+    const fetchMock = vi.fn(async () => new Response(JSON.stringify({ stdout: 'ok' }), { status: 200 }));
+    vi.stubGlobal('fetch', fetchMock);
+    vi.stubEnv('GOG_PATH', '/nonexistent/gog');
+
+    expect(
+      useRemoteGogRunner({
+        GOG_RUNNER_URL: 'https://r.test',
+        GOG_RUNNER_KEY: 'secret',
+        GOG_ACCESS_TOKEN: 'ya29.the-caller',
+      }),
+    ).toBe(true);
+
+    await runExecutor.exit(() => run(['auth', 'status']));
+    const [, init] = fetchMock.mock.calls[0] as unknown as [string, RequestInit];
+    expect(JSON.parse(init.body as string).accessToken).toBe('ya29.the-caller');
+  });
+
+  it('sends no token when the caller has not supplied one', async () => {
+    // Absent, not empty: the backend distinguishes "act as this caller" from
+    // "act as the box", and every registration that predates per-caller auth is
+    // the second case.
+    const fetchMock = vi.fn(async () => new Response(JSON.stringify({ stdout: 'ok' }), { status: 200 }));
+    vi.stubGlobal('fetch', fetchMock);
+    vi.stubEnv('GOG_PATH', '/nonexistent/gog');
+
+    expect(useRemoteGogRunner({ GOG_RUNNER_URL: 'https://r.test', GOG_RUNNER_KEY: 'secret' })).toBe(true);
+
+    await runExecutor.exit(() => run(['auth', 'status']));
+    const [, init] = fetchMock.mock.calls[0] as unknown as [string, RequestInit];
+    // The KEY must be absent, not present-and-empty. Asserted on its own rather
+    // than by matching the whole body: `assembleArgs` folds in ambient settings
+    // like GOG_ACCOUNT, so a whole-body match passes or fails depending on the
+    // developer's shell.
+    expect(JSON.parse(init.body as string)).not.toHaveProperty('accessToken');
+  });
+
   it('lets a per-request store beat the process-wide default', async () => {
     // The Worker path scopes every request in `runExecutor.run({ executor })`
     // because one isolate serves many callers (connector-runtime.ts). A