gogcli-mcp 2.24.0 → 2.26.0

package/dist/index.js

@@ -31000,9 +31000,82 @@ var StdioServerTransport = class {
   }
 };
 
+// ../../node_modules/@chrischall/mcp-utils/dist/errors/index.js
+var McpToolError = class extends Error {
+  /** Actionable remediation text, when one applies. */
+  hint;
+  constructor(message, opts) {
+    super(message, opts?.cause !== void 0 ? { cause: opts.cause } : void 0);
+    this.name = "McpToolError";
+    if (opts?.hint !== void 0)
+      this.hint = opts.hint;
+    Object.setPrototypeOf(this, new.target.prototype);
+  }
+};
+var BEARER_RE = /(bearer\s+)[A-Za-z0-9._~+/=-]{8,}/gi;
+var JWT_RE = /\b[A-Za-z0-9_-]{10,}\.[A-Za-z0-9_-]{10,}\.[A-Za-z0-9_-]{8,}\b/g;
+var BASIC_AUTH_RE = /(authorization\s*:\s*basic\s+)[A-Za-z0-9+/=_-]{6,}/gi;
+var SET_COOKIE_RE = /(\bset-cookie\s*:\s*)([^=;,\s]+)=[^;,\s]*/gi;
+var COOKIE_HEADER_RE = /((?<!set-)\bcookie\s*:\s*)((?:[^=;,\s]+=[^;,\s]*)(?:;\s*[^=;,\s]+=[^;,\s]*)*)/gi;
+var API_KEY_RE = new RegExp([
+  "sk-[A-Za-z0-9_-]{20,}(?![A-Za-z0-9_-])",
+  // OpenAI / Anthropic (incl. sk-ant-…)
+  "gh[pousr]_[A-Za-z0-9]{36,}\\b",
+  // GitHub ghp_/gho_/ghu_/ghs_/ghr_
+  "xox[baprs]-[A-Za-z0-9-]{10,}(?![A-Za-z0-9-])",
+  // Slack
+  "AIza[0-9A-Za-z_-]{35}(?![0-9A-Za-z_-])",
+  // Google API key (39 chars total)
+  "AKIA[0-9A-Z]{16}\\b",
+  // AWS access key id (20 chars total)
+  "whsec_[A-Za-z0-9]{16,}\\b"
+  // webhook signing secret (Stripe-style)
+].map((p) => `\\b${p}`).join("|"), "g");
+var QUERY_SECRET_RE = /([?&](?:access_token|refresh_token|client_secret|api_?key|signature|token|key|sig)=)[^&#\s"'<>`]+/gi;
+var AWS_SIGV4_RE = /([?&]X-Amz-(?:Signature|Security-Token|Credential)=)[^&#\s"'<>`]+/gi;
+var JSON_SECRET_KEYS = "access_token|refresh_token|client_secret|api_?key|password|passwd|secret|token";
+var JSON_SECRET_DQ_RE = new RegExp(`("(?:${JSON_SECRET_KEYS})"\\s*:\\s*")[^"]*(")`, "gi");
+var JSON_SECRET_SQ_RE = new RegExp(`('(?:${JSON_SECRET_KEYS})'\\s*:\\s*')[^']*(')`, "gi");
+function redactSecrets(text) {
+  return text.replace(BEARER_RE, "$1[REDACTED]").replace(BASIC_AUTH_RE, "$1[REDACTED]").replace(SET_COOKIE_RE, "$1$2=[REDACTED]").replace(COOKIE_HEADER_RE, (_m, prefix, pairs) => `${prefix}${pairs.replace(/=[^;,\s]*/g, "=[REDACTED]")}`).replace(API_KEY_RE, "[REDACTED]").replace(QUERY_SECRET_RE, "$1[REDACTED]").replace(AWS_SIGV4_RE, "$1[REDACTED]").replace(JSON_SECRET_DQ_RE, "$1[REDACTED]$2").replace(JSON_SECRET_SQ_RE, "$1[REDACTED]$2").replace(JWT_RE, "[REDACTED]");
+}
+
+// ../../node_modules/@chrischall/mcp-utils/dist/response/index.js
+function rawTextResult(text) {
+  return { content: [{ type: "text", text }] };
+}
+function errorResult(message) {
+  return {
+    content: [{ type: "text", text: redactSecrets(message) }],
+    isError: true
+  };
+}
+
 // ../../node_modules/@chrischall/mcp-utils/dist/server/index.js
+function hintResultOrRethrow(err) {
+  if (err instanceof McpToolError && err.hint) {
+    return errorResult(`${err.message}
+
+Hint: ${err.hint}`);
+  }
+  throw err;
+}
+function surfaceToolHints(server) {
+  const register = server.registerTool.bind(server);
+  server.registerTool = (name, config2, cb) => register(name, config2, (...args) => {
+    let result;
+    try {
+      result = cb(...args);
+    } catch (err) {
+      return hintResultOrRethrow(err);
+    }
+    return result instanceof Promise ? result.catch(hintResultOrRethrow) : result;
+  });
+}
 async function createMcpServer(opts) {
   const server = new McpServer({ name: opts.name, version: opts.version });
+  if (opts.surfaceHints !== false)
+    surfaceToolHints(server);
   if (opts.banner !== void 0) {
     console.error(opts.banner);
   }
@@ -31047,46 +31120,6 @@ async function runMcp(opts) {
   return server;
 }
 
-// ../../node_modules/@chrischall/mcp-utils/dist/errors/index.js
-var BEARER_RE = /(bearer\s+)[A-Za-z0-9._~+/=-]{8,}/gi;
-var JWT_RE = /\b[A-Za-z0-9_-]{10,}\.[A-Za-z0-9_-]{10,}\.[A-Za-z0-9_-]{8,}\b/g;
-var BASIC_AUTH_RE = /(authorization\s*:\s*basic\s+)[A-Za-z0-9+/=_-]{6,}/gi;
-var SET_COOKIE_RE = /(\bset-cookie\s*:\s*)([^=;,\s]+)=[^;,\s]*/gi;
-var COOKIE_HEADER_RE = /((?<!set-)\bcookie\s*:\s*)((?:[^=;,\s]+=[^;,\s]*)(?:;\s*[^=;,\s]+=[^;,\s]*)*)/gi;
-var API_KEY_RE = new RegExp([
-  "sk-[A-Za-z0-9_-]{20,}(?![A-Za-z0-9_-])",
-  // OpenAI / Anthropic (incl. sk-ant-…)
-  "gh[pousr]_[A-Za-z0-9]{36,}\\b",
-  // GitHub ghp_/gho_/ghu_/ghs_/ghr_
-  "xox[baprs]-[A-Za-z0-9-]{10,}(?![A-Za-z0-9-])",
-  // Slack
-  "AIza[0-9A-Za-z_-]{35}(?![0-9A-Za-z_-])",
-  // Google API key (39 chars total)
-  "AKIA[0-9A-Z]{16}\\b",
-  // AWS access key id (20 chars total)
-  "whsec_[A-Za-z0-9]{16,}\\b"
-  // webhook signing secret (Stripe-style)
-].map((p) => `\\b${p}`).join("|"), "g");
-var QUERY_SECRET_RE = /([?&](?:access_token|refresh_token|client_secret|api_?key|signature|token|key|sig)=)[^&#\s"'<>`]+/gi;
-var AWS_SIGV4_RE = /([?&]X-Amz-(?:Signature|Security-Token|Credential)=)[^&#\s"'<>`]+/gi;
-var JSON_SECRET_KEYS = "access_token|refresh_token|client_secret|api_?key|password|passwd|secret|token";
-var JSON_SECRET_DQ_RE = new RegExp(`("(?:${JSON_SECRET_KEYS})"\\s*:\\s*")[^"]*(")`, "gi");
-var JSON_SECRET_SQ_RE = new RegExp(`('(?:${JSON_SECRET_KEYS})'\\s*:\\s*')[^']*(')`, "gi");
-function redactSecrets(text) {
-  return text.replace(BEARER_RE, "$1[REDACTED]").replace(BASIC_AUTH_RE, "$1[REDACTED]").replace(SET_COOKIE_RE, "$1$2=[REDACTED]").replace(COOKIE_HEADER_RE, (_m, prefix, pairs) => `${prefix}${pairs.replace(/=[^;,\s]*/g, "=[REDACTED]")}`).replace(API_KEY_RE, "[REDACTED]").replace(QUERY_SECRET_RE, "$1[REDACTED]").replace(AWS_SIGV4_RE, "$1[REDACTED]").replace(JSON_SECRET_DQ_RE, "$1[REDACTED]$2").replace(JSON_SECRET_SQ_RE, "$1[REDACTED]$2").replace(JWT_RE, "[REDACTED]");
-}
-
-// ../../node_modules/@chrischall/mcp-utils/dist/response/index.js
-function rawTextResult(text) {
-  return { content: [{ type: "text", text }] };
-}
-function errorResult(message) {
-  return {
-    content: [{ type: "text", text: redactSecrets(message) }],
-    isError: true
-  };
-}
-
 // ../../node_modules/@chrischall/mcp-utils/dist/config/index.js
 var PLACEHOLDER_RE = /^\$\{[^}]*\}$/;
 function readEnvVar(key, opts = {}) {
@@ -31177,10 +31210,11 @@ function sanitizedEnv() {
   }
   return result;
 }
+var TOKEN_LEFT_BOUNDARY = "(?<![A-Za-z0-9+/])";
 var GOOGLE_TOKEN_PATTERNS = [
-  /ya29\.[A-Za-z0-9._\-]+/g,
+  new RegExp(`${TOKEN_LEFT_BOUNDARY}ya29\\.[A-Za-z0-9._\\-]+`, "g"),
   // OAuth2 access tokens
-  /1\/\/[A-Za-z0-9._\-]+/g
+  new RegExp(`${TOKEN_LEFT_BOUNDARY}1//[A-Za-z0-9._\\-]+`, "g")
   // OAuth2 refresh tokens
 ];
 function redactGoogleTokens(text) {
@@ -31193,6 +31227,26 @@ function redactGoogleTokens(text) {
 function redactSecrets2(text) {
   return redactGoogleTokens(redactSecrets(text));
 }
+var OPAQUE_FIELD_VALUE = "[A-Za-z0-9+/_-]{16,}={0,2}";
+var opaquePlaceholder = (i) => `\0gogOpaque${i}\0`;
+function redactPreservingOpaqueFields(text, fields, redact) {
+  const lifted = [];
+  let staged = text;
+  for (const field of fields) {
+    const escaped = field.replace(/[.*+?^${}()|[\]\\]/g, "\\$&");
+    const re = new RegExp(`("${escaped}"\\s*:\\s*")(${OPAQUE_FIELD_VALUE})(")`, "g");
+    staged = staged.replace(re, (_m, open, value, close) => {
+      lifted.push(value);
+      return `${open}${opaquePlaceholder(lifted.length - 1)}${close}`;
+    });
+  }
+  if (lifted.length === 0) return redact(text);
+  let redacted = redact(staged);
+  lifted.forEach((value, i) => {
+    redacted = redacted.split(opaquePlaceholder(i)).join(value);
+  });
+  return redacted;
+}
 function augmentedPath() {
   const home = process.env.HOME;
   const candidates = [
@@ -31223,19 +31277,24 @@ function formatTimeout(ms) {
   return `${ms}ms`;
 }
 async function spawnWithTempFiles(args, opts) {
-  const { mkdtemp, writeFile, rm } = await import("node:fs/promises");
+  const { mkdtemp, mkdir, writeFile, rm } = await import("node:fs/promises");
   const { tmpdir } = await import("node:os");
   const dir = await mkdtemp(join(tmpdir(), "gogcli-mcp-"));
   try {
     const argv = [];
+    let seq = 0;
     for (const arg of args) {
       if (!isGogFileArg(arg)) {
         argv.push(arg);
         continue;
       }
-      const path = join(dir, `${arg.flag}.${arg.ext ?? "txt"}`);
-      await writeFile(path, arg.contents, { encoding: "utf8", mode: 384 });
-      argv.push(`--${arg.flag}=${path}`);
+      const sub = join(dir, String(seq));
+      seq += 1;
+      await mkdir(sub, { recursive: true, mode: 448 });
+      const path = join(sub, arg.filename ?? `${arg.flag}.${arg.ext ?? "txt"}`);
+      const data = arg.encoding === "base64" ? Buffer.from(arg.contents, "base64") : Buffer.from(arg.contents, "utf8");
+      await writeFile(path, data, { mode: 384 });
+      argv.push(arg.positional ? path : `--${arg.flag}=${path}`);
     }
     return await spawnGog(argv, opts);
   } finally {
@@ -31320,8 +31379,9 @@ function assembleArgs(args, opts) {
   return fullArgs;
 }
 async function run(args, options = {}) {
-  const { account, spawner, interactive = false, timeout, readonly: readonly2 = false, redactMode = "full" } = options;
-  const redact = redactMode === "tokens" ? redactGoogleTokens : redactSecrets2;
+  const { account, spawner, interactive = false, timeout, readonly: readonly2 = false, redactMode = "full", opaqueFields } = options;
+  const base = redactMode === "tokens" ? redactGoogleTokens : redactSecrets2;
+  const redact = opaqueFields?.length ? (text) => redactPreservingOpaqueFields(text, opaqueFields, base) : base;
   const fullArgs = assembleArgs(args, { account, interactive, readonly: readonly2 });
   const store = activeExecutor();
   try {
@@ -31335,7 +31395,7 @@ async function run(args, options = {}) {
     }
     return redact(output);
   } catch (err) {
-    const message = redact(err instanceof Error ? err.message : String(err));
+    const message = base(err instanceof Error ? err.message : String(err));
     if (isRunnerTransportError(err)) {
       throw new RunnerTransportError(message, err.kind, err.status);
     }
@@ -31651,6 +31711,12 @@ var paginationParams = {
   page: pageAliasParam,
   all: external_exports.boolean().optional().describe("Fetch all pages")
 };
+function pushPaginationFlags(args, p) {
+  if (p.max !== void 0) args.push(`--max=${p.max}`);
+  const token = resolvePageToken(p);
+  if (token) args.push(`--page=${token}`);
+  if (p.all) args.push("--all");
+}
 function registerRunTool(server, options) {
   const { service, examples, omitAccount = false, note } = options;
   const baseDescription = `Run any gog ${service} subcommand not covered by the other tools. Run \`gog ${service} --help\` for the full list of subcommands, or \`gog ${service} <subcommand> --help\` for flags on a specific subcommand.`;
@@ -31824,6 +31890,117 @@ function registerApiTools(server) {
   });
 }
 
+// src/tools/appscript.ts
+function registerAppScriptTools(server) {
+  const scriptIdParam = external_exports.string().describe(
+    "Apps Script project ID \u2014 the long ID in script.google.com/\u2026/projects/<scriptId>/\u2026, NOT the Drive file ID of a container document"
+  );
+  const apiEnableNote = " Needs the Apps Script API enabled on the OAuth client's Google Cloud project; if it is not, gog says so and prints the console URL to enable it. That is a project setting, not a missing scope \u2014 re-authorizing will not fix it.";
+  server.registerTool("gog_appscript_get", {
+    description: "Get an Apps Script project's metadata: title, creator, create/update times, and the parent Drive file when the project is bound to a Sheet, Doc or Form. Use gog_appscript_content to read the actual code." + apiEnableNote,
+    annotations: { readOnlyHint: true },
+    inputSchema: {
+      scriptId: scriptIdParam,
+      account: accountParam
+    }
+  }, async ({ scriptId, account }) => {
+    return runOrDiagnose(["appscript", "get", scriptId], { account });
+  });
+  server.registerTool("gog_appscript_content", {
+    description: `Read a project's source \u2014 every .gs file and its appsscript.json manifest \u2014 INLINE in the response. This is the tool to reach for when the question is "what does this script do"; it needs no filesystem, so it works the same on a hosted deployment as it does locally, unlike gog_appscript_pull.` + apiEnableNote,
+    annotations: { readOnlyHint: true },
+    inputSchema: {
+      scriptId: scriptIdParam,
+      account: accountParam
+    }
+  }, async ({ scriptId, account }) => {
+    return runOrDiagnose(["appscript", "content", scriptId], { account });
+  });
+  server.registerTool("gog_appscript_pull", {
+    description: "Write a project's files into a local directory, for editing a script as ordinary files. THE DIRECTORY IS RESOLVED WHERE GOG RUNS, which is the caller's own machine only on a local (stdio) deployment: on the hosted connector, or any GOG_RUNNER_URL backend, the files land on that server where the caller cannot reach them. Use gog_appscript_content there instead \u2014 it returns the same source in the response. Existing files are left alone unless overwrite is set. Read-only as far as Google is concerned: nothing is pushed back." + apiEnableNote,
+    inputSchema: {
+      scriptId: scriptIdParam,
+      dir: external_exports.string().describe("Destination directory, resolved on the machine where gog runs"),
+      overwrite: external_exports.boolean().optional().describe("Overwrite files that already exist in dir"),
+      account: accountParam
+    }
+  }, async ({ scriptId, dir, overwrite, account }) => {
+    const args = ["appscript", "pull", scriptId, dir];
+    if (overwrite) args.push("--overwrite");
+    return runOrDiagnose(args, { account });
+  });
+  server.registerTool("gog_appscript_create", {
+    description: "Create a new, empty Apps Script project. Pass parentId to bind it to a Drive file (a Sheet, Doc or Form), which is what makes the script a container-bound script with access to that document; omit it for a standalone project. gog cannot upload code, so the project starts empty either way." + apiEnableNote,
+    inputSchema: {
+      title: external_exports.string().describe("Project title"),
+      parentId: external_exports.string().optional().describe("Drive file ID to bind the project to (Sheet, Doc or Form). Omit for a standalone project."),
+      account: accountParam
+    }
+  }, async ({ title, parentId, account }) => {
+    const args = ["appscript", "create", `--title=${title}`];
+    if (parentId) args.push(`--parent-id=${parentId}`);
+    return runOrDiagnose(args, { account });
+  });
+  server.registerTool("gog_appscript_deployments", {
+    description: "List a project's deployments \u2014 the published web apps, add-ons and API executables, each pinned to a version. A deployment ID from here is what gog_appscript_run_function needs when a script is not running in dev mode." + apiEnableNote,
+    annotations: { readOnlyHint: true },
+    inputSchema: {
+      scriptId: scriptIdParam,
+      ...paginationParams,
+      account: accountParam
+    }
+  }, async ({ scriptId, max, pageToken, page, all, account }) => {
+    const args = ["appscript", "deployments", scriptId];
+    pushPaginationFlags(args, { max, pageToken, page, all });
+    return runOrDiagnose(args, { account });
+  });
+  server.registerTool("gog_appscript_versions", {
+    description: `List a project's saved versions \u2014 the immutable snapshots deployments point at, with their numbers and descriptions. Useful for answering "what is actually deployed" next to gog_appscript_deployments.` + apiEnableNote,
+    annotations: { readOnlyHint: true },
+    inputSchema: {
+      scriptId: scriptIdParam,
+      ...paginationParams,
+      account: accountParam
+    }
+  }, async ({ scriptId, max, pageToken, page, all, account }) => {
+    const args = ["appscript", "versions", scriptId];
+    pushPaginationFlags(args, { max, pageToken, page, all });
+    return runOrDiagnose(args, { account });
+  });
+  server.registerTool("gog_appscript_run_function", {
+    description: "Execute a function in a deployed Apps Script project. TREAT THIS AS ARBITRARY CODE EXECUTION: the script runs with this Google account's authority and can send mail, edit Drive files or call external services, and the wrapper cannot tell a read from a write \u2014 read the code with gog_appscript_content first if you did not write it. Requires the project to be deployed as an API executable and to share the OAuth client with the calling credentials, otherwise Google refuses regardless of scopes. devMode runs the latest saved code instead of the deployed version, and only works if the account owns the script. This is NOT the escape hatch \u2014 gog_appscript_run is that." + apiEnableNote,
+    annotations: { destructiveHint: true },
+    inputSchema: {
+      scriptId: scriptIdParam,
+      functionName: external_exports.string().describe('Name of the function to call, e.g. "doWork"'),
+      params: external_exports.string().optional().describe(`Function parameters as a JSON ARRAY of positional arguments, e.g. '["a", 1]' \u2014 not an object`),
+      devMode: external_exports.boolean().optional().describe("Run the latest saved code rather than the deployed version (owner only)"),
+      account: accountParam
+    }
+  }, async ({ scriptId, functionName, params, devMode, account }) => {
+    if (params !== void 0) {
+      let parsed;
+      try {
+        parsed = JSON.parse(params);
+      } catch {
+        throw new Error(`params must be a JSON array of positional arguments, e.g. '["a", 1]'. Received: ${params}`);
+      }
+      if (!Array.isArray(parsed)) {
+        throw new Error(`params must be a JSON ARRAY of positional arguments, e.g. '["a", 1]' \u2014 Apps Script takes positional arguments, not named ones. Received: ${params}`);
+      }
+    }
+    const args = ["appscript", "run", scriptId, functionName];
+    if (params !== void 0) args.push(`--params=${params}`);
+    if (devMode) args.push("--dev-mode");
+    return runOrDiagnose(args, { account });
+  });
+  registerRunTool(server, {
+    service: "appscript",
+    examples: '"get", "content", "deployments"',
+    note: "To execute a function, use gog_appscript_run_function \u2014 this tool is the generic escape hatch."
+  });
+}
+
 // src/tools/auth.ts
 function registerAuthToolsWith(server, defaultServices) {
   const servicesDescribe = `Services to authorize: "all" or comma-separated list (e.g. "sheets,gmail,calendar"). Default: "${defaultServices}". Prefer the narrowest set you need \u2014 requesting a service whose Google API is not enabled on the OAuth client's project makes Google reject the WHOLE request with invalid_scope.`;
@@ -31956,6 +32133,29 @@ function registerAuthTools(server) {
 }
 
 // src/tools/calendar.ts
+var reminderParams = {
+  reminders: external_exports.array(external_exports.string()).max(5).optional().describe(
+    `Reminders as method:duration, e.g. ["popup:30m", "email:1d"]. Method is popup or email; duration accepts m/h/d (max 40320 minutes = 4 weeks). Google allows at most 5. These REPLACE the event's reminders \u2014 on update, pass an EMPTY array to drop custom reminders and go back to the calendar's defaults. Cannot be combined with noReminders.`
+  ),
+  noReminders: external_exports.boolean().optional().describe(
+    "Give the event no reminders at all, overriding the calendar's defaults. Different from an empty reminders array, which RESTORES those defaults. Cannot be combined with reminders."
+  )
+};
+function pushReminderFlags(args, p) {
+  if (p.noReminders) {
+    if (p.reminders !== void 0) {
+      throw new Error("reminders and noReminders are mutually exclusive: pass reminders to set custom ones, noReminders for none, or an empty reminders array to restore the calendar defaults.");
+    }
+    args.push("--no-reminders");
+    return;
+  }
+  if (p.reminders === void 0) return;
+  if (p.reminders.length === 0) {
+    args.push("--reminder=");
+    return;
+  }
+  for (const reminder of p.reminders) args.push(`--reminder=${reminder}`);
+}
 function registerCalendarTools(server) {
   server.registerTool("gog_calendar_events", {
     description: 'List calendar events. Describe the window ONE way and one way only (gog >= 0.36.0 rejects the rest as ambiguous rather than silently discarding a flag): today on its own; or from + to; or from + days; or days on its own (a window of that many days starting today). today cannot be combined with from, to or days, and days cannot be combined with to. gog returns only 10 events by default, so a wide date range is USUALLY INCOMPLETE: raise max, or page with pageToken until the response carries no nextPageToken. A response carrying "truncated": true is an incomplete view \u2014 never conclude an event does not exist from one.',
@@ -32025,9 +32225,10 @@ function registerCalendarTools(server) {
       allDay: external_exports.boolean().optional().describe("All-day event (use date-only in from/to)"),
       timezone: external_exports.string().optional().describe("IANA timezone metadata applied to from/to (e.g. America/New_York). Sets both start and end timezone unless start/end timezone are overridden."),
       withZoom: external_exports.boolean().optional().describe("Create a Zoom video conference for this event (requires Zoom S2S OAuth setup)"),
+      ...reminderParams,
       account: accountParam
     }
-  }, async ({ calendarId, summary, from, to, description, location, attendees, allDay, timezone, withZoom, account }) => {
+  }, async ({ calendarId, summary, from, to, description, location, attendees, allDay, timezone, withZoom, reminders, noReminders, account }) => {
     const args = ["calendar", "create", calendarId, `--summary=${summary}`, `--from=${from}`, `--to=${to}`];
     if (description) args.push(`--description=${description}`);
     if (location) args.push(`--location=${location}`);
@@ -32035,6 +32236,7 @@ function registerCalendarTools(server) {
     if (allDay) args.push("--all-day");
     if (timezone) args.push(`--timezone=${timezone}`);
     if (withZoom) args.push("--with-zoom");
+    pushReminderFlags(args, { reminders, noReminders });
     return runOrDiagnose(args, { account });
   });
   server.registerTool("gog_calendar_update", {
@@ -32055,9 +32257,10 @@ function registerCalendarTools(server) {
       regenerateZoom: external_exports.boolean().optional().describe("Replace the event's existing Zoom video conference"),
       removeZoom: external_exports.boolean().optional().describe("Remove the event's Zoom video conference"),
       removeMeet: external_exports.boolean().optional().describe("Remove the event's Google Meet video conference (clears conference data only)"),
+      ...reminderParams,
       account: accountParam
     }
-  }, async ({ calendarId, eventId, summary, from, to, description, location, attendees, addAttendees, attachments, withZoom, regenerateZoom, removeZoom, removeMeet, account }) => {
+  }, async ({ calendarId, eventId, summary, from, to, description, location, attendees, addAttendees, attachments, withZoom, regenerateZoom, removeZoom, removeMeet, reminders, noReminders, account }) => {
     const args = ["calendar", "update", calendarId, eventId];
     if (summary !== void 0) args.push(`--summary=${summary}`);
     if (from !== void 0) args.push(`--from=${from}`);
@@ -32071,6 +32274,7 @@ function registerCalendarTools(server) {
     if (regenerateZoom) args.push("--regenerate-zoom");
     if (removeZoom) args.push("--remove-zoom");
     if (removeMeet) args.push("--remove-meet");
+    pushReminderFlags(args, { reminders, noReminders });
     return runOrDiagnose(args, { account });
   });
   server.registerTool("gog_calendar_delete", {
@@ -32102,6 +32306,255 @@ function registerCalendarTools(server) {
   registerRunTool(server, { service: "calendar", examples: '"calendars", "freebusy"' });
 }
 
+// src/attachments.ts
+var MAX_INLINE_ATTACHMENT_BYTES = 8 * 1024 * 1024;
+var RUNNER_MAX_BODY_BYTES = 32 * 1024 * 1024;
+var RUNNER_BODY_JSON_RESERVE_BYTES = 256 * 1024;
+var MAX_REQUEST_PAYLOAD_WIRE_BYTES = RUNNER_MAX_BODY_BYTES - RUNNER_BODY_JSON_RESERVE_BYTES;
+var MAX_INLINE_ATTACHMENT_TOTAL_BYTES = Math.floor(MAX_REQUEST_PAYLOAD_WIRE_BYTES * 3 / 4);
+function wireBytesOf(arg) {
+  if (typeof arg === "string") return Buffer.byteLength(arg, "utf8");
+  return arg.encoding === "base64" ? arg.contents.length : Buffer.byteLength(arg.contents, "utf8");
+}
+var formatMiB = (bytes) => `${Math.floor(bytes / (1024 * 1024))} MiB`;
+var INLINE_ATTACHMENT_LIMITS_TEXT = `up to ${formatMiB(MAX_INLINE_ATTACHMENT_BYTES)} per file and ${formatMiB(MAX_INLINE_ATTACHMENT_TOTAL_BYTES)} in total`;
+var inlineAttachmentSchema = external_exports.object({
+  filename: external_exports.string().min(1).describe(
+    `Filename the recipient will see, e.g. "pendant-layouts.png". gog infers the attachment's MIME type from this extension, so give it the right one \u2014 a .png sent as "layouts" arrives as an untyped blob. Must be a single filename, not a path.`
+  ),
+  contentBase64: external_exports.string().min(1).describe(
+    "The file's bytes, base64-encoded (standard alphabet, with padding). This is the whole point of this parameter: the bytes travel with the request, so nothing needs to exist on the gog server's filesystem."
+  )
+});
+var attachInlineParam = external_exports.array(inlineAttachmentSchema).optional().describe(
+  `Attachments supplied as BYTES rather than as server-side paths \u2014 use this whenever you hold a file and the gog server does not, which is always the case on the hosted connector and on any remote deployment. Each entry is {filename, contentBase64} (${INLINE_ATTACHMENT_LIMITS_TEXT}). Can be combined with \`attach\`: the two name disjoint files (paths read on the server vs. bytes sent with the call), and both end up as ordinary attachments on the message.`
+);
+function validateFilename(filename, where) {
+  if (/[/\\]/.test(filename)) {
+    throw new Error(
+      `${where}: filename ${JSON.stringify(filename)} must be a bare filename, not a path. Pass just the name the recipient should see, e.g. "report.pdf".`
+    );
+  }
+  if (/[\x00-\x1f]/.test(filename) || /^\.+$/.test(filename) || filename.length > 200) {
+    throw new Error(
+      `${where}: filename ${JSON.stringify(filename)} is not a usable filename (no control characters, not "."/"..", 200 characters max).`
+    );
+  }
+}
+function decodedLength(contentBase64) {
+  const buf = Buffer.from(contentBase64, "base64");
+  return buf.toString("base64") === contentBase64 ? buf.length : null;
+}
+function inlineFileArg(flag, attachment, opts = {}) {
+  const { filename, contentBase64 } = attachment;
+  const where = opts.where ?? `attachInline entry ${JSON.stringify(filename)}`;
+  validateFilename(filename, where);
+  const bytes = decodedLength(contentBase64);
+  if (bytes === null) {
+    throw new Error(
+      `${where}: contents are not valid base64. Send the standard alphabet with padding and no line breaks \u2014 the value must survive a decode/re-encode round trip unchanged.`
+    );
+  }
+  if (bytes > MAX_INLINE_ATTACHMENT_BYTES) {
+    throw new Error(
+      `${where}: ${bytes} bytes exceeds the ${MAX_INLINE_ATTACHMENT_BYTES}-byte (${formatMiB(MAX_INLINE_ATTACHMENT_BYTES)}) per-file limit for inline content. Upload it to Drive and link to it instead, or send it from a local (stdio) deployment using a real server-side path.`
+    );
+  }
+  const arg = { kind: "file", flag, contents: contentBase64, encoding: "base64", filename };
+  if (opts.positional) arg.positional = true;
+  return { arg, bytes };
+}
+function inlineAttachmentArgs(flag, attachments, siblingArgs = []) {
+  if (!attachments?.length) return [];
+  const args = [];
+  const siblingWire = siblingArgs.reduce((sum, arg) => sum + wireBytesOf(arg), 0);
+  let attachmentWire = 0;
+  let decodedTotal = 0;
+  for (const attachment of attachments) {
+    const { arg, bytes } = inlineFileArg(flag, attachment);
+    attachmentWire += arg.contents.length;
+    decodedTotal += bytes;
+    if (siblingWire + attachmentWire > MAX_REQUEST_PAYLOAD_WIRE_BYTES) {
+      const blame = attachmentWire <= MAX_REQUEST_PAYLOAD_WIRE_BYTES ? ` These attachments would fit on their own; the rest of the message (its body, mostly) spends ${siblingWire} bytes of the same budget.` : "";
+      throw new Error(
+        `This message is too large to send: ${decodedTotal} bytes of attachments (${attachmentWire} bytes once base64-encoded for transit) exceed the ${MAX_REQUEST_PAYLOAD_WIRE_BYTES}-byte request limit.${blame} The ceiling for attachments alone is ${MAX_INLINE_ATTACHMENT_TOTAL_BYTES} bytes (${formatMiB(MAX_INLINE_ATTACHMENT_TOTAL_BYTES)}); a long body lowers it. Send fewer or smaller files per message, shorten the body, or upload the large files to Drive and link them.`
+      );
+    }
+    args.push(arg);
+  }
+  return args;
+}
+
+// src/tools/chat.ts
+function registerChatTools(server) {
+  const workspaceOnlyNote = ' WORKSPACE ONLY: Google Chat has no API for consumer accounts, so this fails on an @gmail.com account with "chat requires a Google Workspace account". That is the ACCOUNT, not the token \u2014 re-authorizing or adding scopes will not help.';
+  const spaceParam = external_exports.string().describe(
+    'Space resource name, e.g. "spaces/AAAAsomeID" (from gog_chat_spaces_list, gog_chat_spaces_find or gog_chat_dm_space)'
+  );
+  const threadParam = external_exports.string().optional().describe(
+    'Thread resource name, e.g. "spaces/AAAA/threads/CCCC" \u2014 reply inside that thread instead of starting a new one'
+  );
+  server.registerTool("gog_chat_spaces_list", {
+    description: "List the Google Chat spaces the account belongs to \u2014 named rooms and DMs alike \u2014 with their resource names. Start here when you do not yet have a space name; gog_chat_spaces_find is faster when you know the room's title." + workspaceOnlyNote,
+    annotations: { readOnlyHint: true },
+    inputSchema: {
+      ...paginationParams,
+      account: accountParam
+    }
+  }, async ({ max, pageToken, page, all, account }) => {
+    const args = ["chat", "spaces", "list"];
+    pushPaginationFlags(args, { max, pageToken, page, all });
+    return runOrDiagnose(args, { account });
+  });
+  server.registerTool("gog_chat_spaces_find", {
+    description: 'Find spaces whose display name matches. Substring and case-insensitive by default, which is what you want when the user names a room approximately ("the launch room"); pass exact=true to require the whole title. DMs have no display name \u2014 use gog_chat_dm_space to reach a person.' + workspaceOnlyNote,
+    annotations: { readOnlyHint: true },
+    inputSchema: {
+      displayName: external_exports.string().describe("Space display name, or part of one"),
+      exact: external_exports.boolean().optional().describe("Require an exact (still case-insensitive) match on the whole display name"),
+      max: external_exports.number().int().optional().describe("Max results per page"),
+      account: accountParam
+    }
+  }, async ({ displayName, exact, max, account }) => {
+    const args = ["chat", "spaces", "find", displayName];
+    if (exact) args.push("--exact");
+    if (max !== void 0) args.push(`--max=${max}`);
+    return runOrDiagnose(args, { account });
+  });
+  server.registerTool("gog_chat_spaces_create", {
+    description: "Create a named Chat space, optionally seeding its membership. Members are added immediately and are notified \u2014 this is visible to other people the moment it runs, so confirm the member list before calling it." + workspaceOnlyNote,
+    inputSchema: {
+      displayName: external_exports.string().describe("Display name for the new space"),
+      members: external_exports.array(external_exports.string()).optional().describe('Initial members, as email addresses or "users/..." resource names'),
+      account: accountParam
+    }
+  }, async ({ displayName, members, account }) => {
+    const args = ["chat", "spaces", "create", displayName];
+    if (members) for (const member of members) args.push(`--member=${member}`);
+    return runOrDiagnose(args, { account });
+  });
+  server.registerTool("gog_chat_threads_list", {
+    description: "List the threads in a space, so a reply can be targeted at an existing conversation rather than starting a new one. Pass a thread name from here as `thread` to gog_chat_messages_send." + workspaceOnlyNote,
+    annotations: { readOnlyHint: true },
+    inputSchema: {
+      space: spaceParam,
+      ...paginationParams,
+      account: accountParam
+    }
+  }, async ({ space, max, pageToken, page, all, account }) => {
+    const args = ["chat", "threads", "list", space];
+    pushPaginationFlags(args, { max, pageToken, page, all });
+    return runOrDiagnose(args, { account });
+  });
+  server.registerTool("gog_chat_messages_list", {
+    description: `Read messages in a space. The JSON carries each message's @-mentions and a summary of its emoji reactions (gog >= 0.38.0) alongside the text, so "who was tagged" and "did anyone react" are answerable without extra calls. unread=true returns only what arrived after the account last read the space \u2014 the cheap way to answer "what did I miss". Newest-first needs an explicit order="createTime desc"; Chat's own default is oldest-first.` + workspaceOnlyNote,
+    annotations: { readOnlyHint: true },
+    inputSchema: {
+      space: spaceParam,
+      thread: threadParam,
+      unread: external_exports.boolean().optional().describe("Only messages posted after the account last read this space"),
+      order: external_exports.enum(["createTime asc", "createTime desc", "lastUpdateTime asc", "lastUpdateTime desc"]).optional().describe('Sort order (Chat default: "createTime asc", i.e. OLDEST first \u2014 ask for "createTime desc" when you want the latest messages)'),
+      ...paginationParams,
+      account: accountParam
+    }
+  }, async ({ space, thread, unread, order, max, pageToken, page, all, account }) => {
+    const args = ["chat", "messages", "list", space];
+    if (thread) args.push(`--thread=${thread}`);
+    if (unread) args.push("--unread");
+    if (order) args.push(`--order=${order}`);
+    pushPaginationFlags(args, { max, pageToken, page, all });
+    return runOrDiagnose(args, { account });
+  });
+  server.registerTool("gog_chat_messages_send", {
+    description: "Post a message to a Chat space. THIS IS IMMEDIATELY VISIBLE TO EVERYONE IN THE SPACE and cannot be unsent through this tool, so treat it like sending mail, not like saving a draft. Pass `thread` to reply inside an existing conversation (from gog_chat_threads_list or a message's thread field); omit it to start a new one. Text supports Chat's markdown-ish formatting (*bold*, _italic_, `code`)." + workspaceOnlyNote,
+    inputSchema: {
+      space: spaceParam,
+      text: external_exports.string().optional().describe("Message text. Optional only when an attachment is supplied."),
+      thread: threadParam,
+      attach: external_exports.array(external_exports.string()).optional().describe(
+        "Attachment file paths, read WHERE GOG RUNS. On a hosted or remote deployment that is not your machine \u2014 use attachInline there instead."
+      ),
+      attachInline: attachInlineParam,
+      account: accountParam
+    }
+  }, async ({ space, text, thread, attach, attachInline, account }) => {
+    if (text === void 0 && !attach?.length && !attachInline?.length) {
+      throw new Error("A Chat message needs text, an attachment, or both.");
+    }
+    const args = ["chat", "messages", "send", space];
+    if (text !== void 0) args.push(`--text=${text}`);
+    if (thread) args.push(`--thread=${thread}`);
+    if (attach) for (const path of attach) args.push(`--attach=${path}`);
+    args.push(...inlineAttachmentArgs("attach", attachInline, args));
+    return runOrDiagnose(args, { account });
+  });
+  server.registerTool("gog_chat_dm_send", {
+    description: "Send a direct message to one person by email address, creating the DM space if this is the first message. Delivered immediately and cannot be unsent through this tool. For a room rather than a person, use gog_chat_messages_send." + workspaceOnlyNote,
+    inputSchema: {
+      email: external_exports.string().describe("Recipient email address"),
+      text: external_exports.string().describe("Message text"),
+      thread: threadParam,
+      account: accountParam
+    }
+  }, async ({ email: email3, text, thread, account }) => {
+    const args = ["chat", "dm", "send", email3, `--text=${text}`];
+    if (thread) args.push(`--thread=${thread}`);
+    return runOrDiagnose(args, { account });
+  });
+  server.registerTool("gog_chat_dm_space", {
+    description: 'Resolve the DM space for an email address \u2014 the bridge from a person to the "spaces/..." name the message tools want. Creates the space if none exists yet, which is silent: it does not message the person.' + workspaceOnlyNote,
+    inputSchema: {
+      email: external_exports.string().describe("The other person's email address"),
+      account: accountParam
+    }
+  }, async ({ email: email3, account }) => {
+    return runOrDiagnose(["chat", "dm", "space", email3], { account });
+  });
+  server.registerTool("gog_chat_reactions_list", {
+    description: "List the emoji reactions on one message, with who reacted. gog_chat_messages_list already returns a reaction SUMMARY per message; come here when you need the individual reactors, or the reaction resource names that gog_chat_reactions_delete takes." + workspaceOnlyNote,
+    annotations: { readOnlyHint: true },
+    inputSchema: {
+      message: external_exports.string().describe('Message resource name ("spaces/AAAA/messages/BBBB"), or a bare message ID together with `space`'),
+      space: external_exports.string().optional().describe("Space resource name \u2014 required only when `message` is a bare ID"),
+      ...paginationParams,
+      account: accountParam
+    }
+  }, async ({ message, space, max, pageToken, page, all, account }) => {
+    const args = ["chat", "messages", "reactions", "list", message];
+    if (space) args.push(`--space=${space}`);
+    pushPaginationFlags(args, { max, pageToken, page, all });
+    return runOrDiagnose(args, { account });
+  });
+  server.registerTool("gog_chat_reactions_create", {
+    description: 'React to a message with an emoji. Visible to the space immediately. Pass the emoji itself ("\u{1F44D}"), not a :shortcode:.' + workspaceOnlyNote,
+    inputSchema: {
+      message: external_exports.string().describe('Message resource name ("spaces/AAAA/messages/BBBB"), or a bare message ID together with `space`'),
+      emoji: external_exports.string().describe('The emoji character to react with, e.g. "\u{1F44D}"'),
+      space: external_exports.string().optional().describe("Space resource name \u2014 required only when `message` is a bare ID"),
+      account: accountParam
+    }
+  }, async ({ message, emoji: emoji3, space, account }) => {
+    const args = ["chat", "messages", "reactions", "create", message, emoji3];
+    if (space) args.push(`--space=${space}`);
+    return runOrDiagnose(args, { account });
+  });
+  server.registerTool("gog_chat_reactions_delete", {
+    description: `Remove one emoji reaction. Takes the REACTION's own resource name ("spaces/.../messages/.../reactions/..."), not the message's and not the emoji \u2014 get it from gog_chat_reactions_list. An account can only remove its own reaction.` + workspaceOnlyNote,
+    annotations: { destructiveHint: true },
+    inputSchema: {
+      reaction: external_exports.string().describe('Reaction resource name, e.g. "spaces/AAAA/messages/BBBB/reactions/CCCC"'),
+      account: accountParam
+    }
+  }, async ({ reaction, account }) => {
+    return runOrDiagnose(["chat", "messages", "reactions", "delete", reaction], { account });
+  });
+  registerRunTool(server, {
+    service: "chat",
+    examples: '"spaces", "messages", "dm"',
+    note: "Google Chat has no API for consumer accounts: every chat subcommand fails on an @gmail.com account regardless of scopes."
+  });
+}
+
 // src/tools/classroom.ts
 function registerClassroomTools(server) {
   server.registerTool("gog_classroom_courses_list", {
@@ -32917,6 +33370,7 @@ async function fetchGmailPages(runPage, itemsKey, maxPages, startToken) {
   const merged = [];
   let base;
   let token = startToken;
+  const fetched = new Set(startToken === void 0 ? [] : [startToken]);
   for (let pages = 0; pages < maxPages; pages++) {
     const result = await runPage(token);
     const parsed = parsePage(result, itemsKey);
@@ -32925,8 +33379,17 @@ async function fetchGmailPages(runPage, itemsKey, maxPages, startToken) {
     }
     base = parsed;
     merged.push(...parsed[itemsKey]);
-    token = typeof parsed.nextPageToken === "string" && parsed.nextPageToken !== "" ? parsed.nextPageToken : void 0;
-    if (token === void 0) break;
+    const next = typeof parsed.nextPageToken === "string" && parsed.nextPageToken !== "" ? parsed.nextPageToken : void 0;
+    if (next === void 0) {
+      token = void 0;
+      break;
+    }
+    if (fetched.has(next)) {
+      token = next;
+      break;
+    }
+    fetched.add(next);
+    token = next;
   }
   return finish(base, itemsKey, merged, token);
 }
@@ -33003,7 +33466,7 @@ function registerGmailTools(server) {
     return runOrDiagnose(args, { account });
   });
   server.registerTool("gog_gmail_send", {
-    description: "Send an email. When attach is used, the JSON result echoes the attached filenames and byte sizes \u2014 check it to confirm the files were found and embedded.",
+    description: 'Send an email. Two ways to attach a file: `attach` takes paths READ ON THE GOG SERVER, and `attachInline` takes the bytes themselves. Use attachInline unless you know the file exists on the same machine gog runs on \u2014 on the hosted connector and any remote deployment there is no shared filesystem, so no path you can name resolves there and `attach` will fail with "no such file or directory". When either is used, the JSON result echoes the attached filenames and byte sizes \u2014 check it to confirm the files were embedded.',
     annotations: { destructiveHint: true },
     inputSchema: {
       to: external_exports.string().describe("Recipient(s), comma-separated"),
@@ -33013,16 +33476,19 @@ function registerGmailTools(server) {
       bcc: external_exports.string().optional().describe("BCC recipients, comma-separated"),
       replyToMessageId: external_exports.string().optional().describe("Message ID to reply to"),
       threadId: external_exports.string().optional().describe("Thread ID to reply within"),
-      attach: external_exports.array(external_exports.string()).optional().describe("Local file paths to attach (repeatable). Each file is read on the gog server (not this client), base64-encoded with a MIME type inferred from its extension, and added as a multipart attachment. Keep the total under Gmail's ~35 MB inline-upload limit."),
+      attach: external_exports.array(external_exports.string()).optional().describe(`File paths to attach (repeatable), resolved ON THE GOG SERVER's filesystem \u2014 NOT this client's. Only usable when gog runs on the same machine you do (local stdio); on the hosted connector or any GOG_RUNNER_URL backend these paths do not exist and the call fails with "no such file or directory" \u2014 use attachInline there. Each file is read on the server, base64-encoded with a MIME type inferred from its extension, and added as a multipart attachment.`),
+      attachInline: attachInlineParam,
       account: accountParam
     }
-  }, async ({ to, subject, body, cc, bcc, replyToMessageId, threadId, attach, account }) => {
+  }, async ({ to, subject, body, cc, bcc, replyToMessageId, threadId, attach, attachInline, account }) => {
     const args = ["gmail", "send", `--to=${to}`, `--subject=${subject}`, payloadArg("body", "body-file", body)];
     if (cc) args.push(`--cc=${cc}`);
     if (bcc) args.push(`--bcc=${bcc}`);
     if (replyToMessageId) args.push(`--reply-to-message-id=${replyToMessageId}`);
     if (threadId) args.push(`--thread-id=${threadId}`);
     if (attach) for (const path of attach) args.push(`--attach=${path}`);
+    const inline = inlineAttachmentArgs("attach", attachInline, args);
+    args.push(...inline);
     return runOrDiagnose(args, { account });
   });
   registerRunTool(server, { service: "gmail", examples: '"archive", "mark-read", "labels"' });
@@ -33352,11 +33818,13 @@ function registerTasksTools(server) {
 }
 
 // src/server.ts
-var VERSION = true ? "2.24.0" : "0.0.0";
+var VERSION = true ? "2.26.0" : "0.0.0";
 var BASE_TOOL_REGISTRARS = [
   registerApiTools,
+  registerAppScriptTools,
   registerAuthTools,
   registerCalendarTools,
+  registerChatTools,
   registerClassroomTools,
   registerContactsTools,
   registerDocsTools,