gogcli-mcp 2.29.0 → 2.29.1

package/manifest.json

@@ -3,7 +3,7 @@
   "manifest_version": "0.3",
   "name": "gogcli-mcp",
   "display_name": "gogcli",
-  "version": "2.29.0",
+  "version": "2.29.1",
   "description": "Google Sheets (and more) for Claude via gogcli — read, write, and manage spreadsheets",
   "author": {
     "name": "Chris Hall",

package/mint.yaml

@@ -86,7 +86,7 @@ dependencies:
   # nine pins too.
   - kind: github-release
     repo: openclaw/gogcli
-    tag: v0.39.0
+    tag: v0.39.1
     asset: "gogcli_*_linux_amd64.tar.gz"
     bin: [gog]
 state:

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "gogcli-mcp",
-  "version": "2.29.0",
+  "version": "2.29.1",
   "mcpName": "io.github.chrischall/gogcli-mcp",
   "description": "MCP server wrapping gogcli for Google service access",
   "author": "Claude Code (AI) <https://www.anthropic.com/claude>",
@@ -43,10 +43,10 @@
   "dependencies": {
     "@chrischall/mcp-utils": "^0.23.0",
     "@modelcontextprotocol/sdk": "^1.30.0",
-    "zod": "^4.4.3"
+    "zod": "^4.5.4"
   },
   "devDependencies": {
-    "@types/node": "^26.4.0",
+    "@types/node": "^26.4.1",
     "@vitest/coverage-v8": "^4.1.8",
     "esbuild": "^0.28.2",
     "typescript": "^7.0.2",

package/server.json

@@ -7,12 +7,12 @@
     "source": "github",
     "subfolder": "packages/gogcli-mcp"
   },
-  "version": "2.29.0",
+  "version": "2.29.1",
   "packages": [
     {
       "registryType": "npm",
       "identifier": "gogcli-mcp",
-      "version": "2.29.0",
+      "version": "2.29.1",
       "transport": {
         "type": "stdio"
       },

package/src/runner.ts

@@ -217,7 +217,7 @@ const TIMEOUT_MS = 30_000;
 // so the requirement change is surfaced in the release notes (see
 // .github/release.yml). This is the single source of truth for the required
 // version; keep the README/CLAUDE.md mention in sync.
-export const MIN_GOG_VERSION = '0.39.0';
+export const MIN_GOG_VERSION = '0.39.1';
 
 // Interpret the GOG_READONLY kill-switch. `readEnvVar` already treats blank
 // values, 'undefined'/'null' sentinels, and unresolved .mcpb placeholders

package/src/worker.ts

@@ -38,7 +38,7 @@ import { gogAuth, CONNECTOR_INSTRUCTIONS, type GogProps } from './connector-auth
 // connector with all ~360 tools at once. Add whichever paths you want as separate
 // connectors in claude.ai (each authorizes with the same connector key).
 
-const VERSION = '2.29.0'; // x-release-please-version
+const VERSION = '2.29.1'; // x-release-please-version
 
 // Build an McpAgent subclass whose init() registers `registrars` onto its server,
 // each handler wrapped in the ALS scope carrying the per-session Fly executor.

package/tests/zod-single-copy.test.ts

@@ -0,0 +1,56 @@
+import { describe, expect, it } from 'vitest';
+import { createRequire } from 'node:module';
+import { realpathSync } from 'node:fs';
+import { fileURLToPath } from 'node:url';
+
+// The zod counterpart of sdk-single-copy.test.ts, guarding the invariant that
+// broke dependabot #333: the whole monorepo must resolve ONE copy of zod.
+//
+// Same shape of failure, a different package. `@cloudflare/vitest-pool-workers`
+// (a root devDependency) declares zod as an **exact** pin, so it takes the
+// hoisted root slot that `@chrischall/mcp-utils` and the MCP SDK resolve their
+// zod peer from. The moment our workspaces ask for a newer zod than that pin,
+// each nests its own copy — and because a `ZodType` carries brand-bearing
+// internals, TypeScript compares the two NOMINALLY: every schema our tools hand
+// `registerTool` fails with `TS2322: Type 'ZodString' is not assignable to type
+// 'AnySchema'`, with no API change and nothing to fix in the source. #333 split
+// the tree exactly that way and produced 11,024 type errors from a bump of one
+// patch-level dependency.
+//
+// Read the resolved paths in such an error, not the signature.
+//
+// This asserts resolution identity rather than a version string: the failure is
+// "two copies", not "the wrong version", and pinning a version here would just
+// have to be edited on every future bump.
+describe('zod is installed exactly once', () => {
+  const here = createRequire(import.meta.url);
+
+  // `import.meta.resolve`, not `require.resolve`, to reach the dependency's own
+  // entry: these packages are ESM-only, so their `exports` maps carry no
+  // `require` condition and CJS resolution of the bare specifier throws.
+  const resolveFrom = (specifier: string): string =>
+    realpathSync(createRequire(fileURLToPath(import.meta.resolve(specifier))).resolve('zod'));
+
+  it('resolves to the same file for this package and for @chrischall/mcp-utils', () => {
+    // mcp-utils declares zod as a peer, and its `accountParam` / `viewParam` /
+    // `paginationParams` helpers build the very schemas our registrars pass to
+    // `registerTool`, so its copy is the one they must be typed against.
+    expect(resolveFrom('@chrischall/mcp-utils')).toBe(realpathSync(here.resolve('zod')));
+  });
+
+  it('resolves to the same file for the MCP SDK, which types every tool schema', () => {
+    // `registerTool` accepts the raw shape and infers the handler's argument
+    // types from it; a second copy makes every one of those schemas foreign.
+    expect(resolveFrom('@modelcontextprotocol/sdk/server/mcp.js')).toBe(
+      realpathSync(here.resolve('zod')),
+    );
+  });
+
+  it('resolves to the same file for @cloudflare/vitest-pool-workers, which exact-pins zod', () => {
+    // The exact pin here is what captured the root hoist slot in #333, and it
+    // is why the root `overrides` block carries a zod entry.
+    expect(resolveFrom('@cloudflare/vitest-pool-workers')).toBe(
+      realpathSync(here.resolve('zod')),
+    );
+  });
+});