gogcli-mcp 2.29.1 → 2.30.0

package/manifest.json

@@ -3,7 +3,7 @@
   "manifest_version": "0.3",
   "name": "gogcli-mcp",
   "display_name": "gogcli",
-  "version": "2.29.1",
+  "version": "2.30.0",
   "description": "Google Sheets (and more) for Claude via gogcli — read, write, and manage spreadsheets",
   "author": {
     "name": "Chris Hall",

package/mint.yaml

@@ -13,7 +13,7 @@ env:
     help: >-
       Google OAuth client id. NOTE: on the local-spawn path the child `gog`
       receives a sanitized env — runner.ts drops GOG_ACCESS_TOKEN and every
-      *_TOKEN / *_SECRET / *_API_KEY / *_PRIVATE_KEY variable — so the CLI
+      *_TOKEN / *_SECRET / *_KEY / *_CREDENTIALS variable — so the CLI
       authenticates from its own stored credentials under $HOME (see
       state.dataDir), not from these variables being passed through.
   - name: GOG_CLIENT_SECRET
@@ -86,7 +86,7 @@ dependencies:
   # nine pins too.
   - kind: github-release
     repo: openclaw/gogcli
-    tag: v0.39.1
+    tag: v0.40.0
     asset: "gogcli_*_linux_amd64.tar.gz"
     bin: [gog]
 state:

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "gogcli-mcp",
-  "version": "2.29.1",
+  "version": "2.30.0",
   "mcpName": "io.github.chrischall/gogcli-mcp",
   "description": "MCP server wrapping gogcli for Google service access",
   "author": "Claude Code (AI) <https://www.anthropic.com/claude>",
@@ -41,12 +41,12 @@
     "test:coverage": "vitest run --coverage"
   },
   "dependencies": {
-    "@chrischall/mcp-utils": "^0.23.0",
+    "@chrischall/mcp-utils": "^0.23.3",
     "@modelcontextprotocol/sdk": "^1.30.0",
-    "zod": "^4.5.4"
+    "zod": "^4.6.1"
   },
   "devDependencies": {
-    "@types/node": "^26.4.1",
+    "@types/node": "^26.5.1",
     "@vitest/coverage-v8": "^4.1.8",
     "esbuild": "^0.28.2",
     "typescript": "^7.0.2",

package/server.json

@@ -7,12 +7,12 @@
     "source": "github",
     "subfolder": "packages/gogcli-mcp"
   },
-  "version": "2.29.1",
+  "version": "2.30.0",
   "packages": [
     {
       "registryType": "npm",
       "identifier": "gogcli-mcp",
-      "version": "2.29.1",
+      "version": "2.30.0",
       "transport": {
         "type": "stdio"
       },

package/src/blob-upload.ts

@@ -0,0 +1,179 @@
+import { readEnvVar } from '@chrischall/mcp-utils';
+
+/**
+ * Ask the gog runner to stream a file off ITS disk to a signed blob-store URL.
+ *
+ * ## Why the runner and not this process
+ *
+ * Under the hosted connector this child is a FORWARDER: `run()` POSTs an
+ * arg-array to fly-gog-runner, the Google refresh token lives in that app's
+ * keyring, and `gog gmail attachment --out` writes the file to THAT box's disk.
+ * The child never sees a byte, so the runner is the only party that can send
+ * one anywhere. That is the same seam `deliverViaDrive` already uses — `gog
+ * drive upload <path>` pushes bytes from the runner's disk to a remote
+ * destination with the child out of the way — with a different destination.
+ *
+ * Routing them through the child instead would cap out near 24 MB against
+ * `/run`'s 32 MB body envelope and cost a ~31 MB base64 string plus a decoded
+ * copy, for bytes nobody here reads.
+ *
+ * ## What the runner does with it
+ *
+ * `POST /upload` (fly-gog-runner/server.mjs) confines `path` to the attachment
+ * directory, refuses anything past the blob store's own 100 MiB ceiling before
+ * dialling, and PUTs the file with `Content-Length` from its own size and the
+ * `Content-Type` header byte for byte as given — the PUT signature commits to
+ * it. Its statuses carry the classification: `422` is deterministic (re-mint,
+ * do not retry), `502` is the far side or the transfer, `400`/`404` are this
+ * request. All of them are failures here; none of them is retried from this
+ * side, because a fresh URL is the only repair for the common one.
+ */
+
+/**
+ * The deadline this side puts on the exchange.
+ *
+ * The runner has one of its own (`UPLOAD_TIMEOUT_MS`, 120 s) but it is an
+ * INACTIVITY timer spent through `req.setTimeout` — it bounds a socket that has
+ * gone quiet, never a transfer that keeps dribbling — so nothing else stands
+ * between a wedged upload and an MCP request that never answers.
+ *
+ * Longer than `/run`'s 30 s because this is not a `gog` invocation: it is up to
+ * 100 MiB leaving a Fly machine, and firing before the runner can report a real
+ * failure would turn "the blob store refused the signature" into an opaque
+ * timeout — the same reason `makeFlyExecutor` sits its deadline above the
+ * backend's.
+ *
+ * It is `120 s + 5 s`, and it was 90 s: the doc block above cited that rule
+ * while the number inverted it, so a socket that went quiet was aborted HERE
+ * 30 s before the runner's own timer could say "the upload timed out after
+ * 120000ms". Exactly the opaque client abort the rule exists to prevent, and
+ * the one shape where the runner has something useful to say. The grace is
+ * `DEADLINE_GRACE_MS`'s 5 s for `DEADLINE_GRACE_MS`'s reason: enough for the
+ * answer to travel, and not a second more, because every extra second is a
+ * second of opaque timeout replacing a real error.
+ *
+ * Restated rather than imported — `fly-gog-runner/server.mjs` must not be
+ * pulled into the Worker bundle, the same trade `attachments.ts` makes for the
+ * runner's size ceilings — so the two move by hand, and a test asserts the
+ * ordering rather than leaving it to this comment.
+ */
+export const RUNNER_UPLOAD_TIMEOUT_MS = 125_000;
+
+export interface BlobUploadRequest {
+  /** The file to send, resolved on the RUNNER's disk. */
+  path: string;
+  /** The signed PUT URL. A credential — never log it, never echo it. */
+  url: string;
+  /** Sent as `Content-Type` byte for byte; the PUT signature commits to it. */
+  contentType: string;
+}
+
+export interface BlobUploadOutcome {
+  /** Bytes the runner actually streamed — the file's own size, not a claim. */
+  bytes?: number;
+  /** The blob store's status, as the runner observed it. */
+  status?: number;
+}
+
+export interface BlobUploadOptions {
+  /** Where the runner's endpoint and key are read from. Injected by tests. */
+  env?: NodeJS.ProcessEnv;
+}
+
+/**
+ * Remove a signed URL, and the bare signature inside it, from a message.
+ *
+ * Everything this module throws is expected to be logged, and a failure's text
+ * is routinely a third party's: the runner scrubs its own words, but the blob
+ * store's error is quoted through it and an HTTP client's rejection may name
+ * the URL it was dialling. Both shapes are removed, because either left
+ * standing is the whole credential — the signature is what `sig=` carries, and
+ * the rest of the URL is public.
+ *
+ * The empty needle is guarded rather than assumed away: `split('')` cuts a
+ * message into single characters and interleaves the replacement between every
+ * one of them.
+ */
+function withoutUrlSecrets(message: string, url: string): string {
+  let out = url ? message.split(url).join('<signed url>') : message;
+  const signature = /[?&]sig=([^&#]+)/.exec(url)?.[1];
+  if (signature) out = out.split(signature).join('<signature>');
+  return out;
+}
+
+/**
+ * Stream the file at `request.path` (on the runner) to `request.url`.
+ *
+ * Resolves with what the runner reported; THROWS on every failure, with a
+ * message safe to log. Both variables are required — the same both-or-neither
+ * rule `useRemoteGogRunner` applies, for the same reason: a URL with no key
+ * sends unauthenticated requests the runner rejects, and a key with no URL is a
+ * credential configured for nothing.
+ */
+export async function uploadToBlobStore(
+  request: BlobUploadRequest,
+  options: BlobUploadOptions = {},
+): Promise<BlobUploadOutcome> {
+  const env = options.env ?? process.env;
+  // The shared reader, as everywhere else: blanks, unexpanded `${...}`
+  // placeholders and the literal "undefined"/"null" are all unset.
+  const endpoint = readEnvVar('GOG_RUNNER_URL', { env });
+  const key = readEnvVar('GOG_RUNNER_KEY', { env });
+  if (!endpoint || !key) {
+    throw new Error(
+      'no gog runner is configured (GOG_RUNNER_URL + GOG_RUNNER_KEY, both or neither), and the ' +
+      'attachment bytes are on the runner\'s disk rather than here — so nothing on this side can send them',
+    );
+  }
+
+  let response: { ok: boolean; status: number; text(): Promise<string> };
+  try {
+    response = await fetch(`${endpoint.replace(/\/+$/, '')}/upload`, {
+      method: 'POST',
+      headers: { Authorization: `Bearer ${key}`, 'Content-Type': 'application/json' },
+      body: JSON.stringify({ path: request.path, url: request.url, contentType: request.contentType }),
+      signal: AbortSignal.timeout(RUNNER_UPLOAD_TIMEOUT_MS),
+    });
+  } catch (err) {
+    throw new Error(withoutUrlSecrets(
+      `the upload to the blob store did not complete: ${err instanceof Error ? err.message : String(err)}`,
+      request.url,
+    ));
+  }
+
+  // Inside a try of its own: the response ARRIVING is not the body arriving,
+  // and a severed or truncated one rejects here. That rejection is a transport
+  // failure like the dial above and is scrubbed like one — this module's
+  // contract is that nothing it throws carries the URL, and a guarantee with a
+  // hole in it is not one.
+  let raw: string;
+  try {
+    raw = await response.text();
+  } catch (err) {
+    throw new Error(withoutUrlSecrets(
+      `the upload to the blob store did not complete: the runner's answer could not be read: ` +
+      `${err instanceof Error ? err.message : String(err)}`,
+      request.url,
+    ));
+  }
+  let body: { error?: string; bytes?: number; status?: number } = {};
+  try {
+    body = JSON.parse(raw) as typeof body;
+  } catch {
+    // A proxy's HTML error page, or a truncated answer. Quoted, never parsed
+    // into a decision — the status is the part that classifies.
+    body = { error: raw };
+  }
+  if (!response.ok) {
+    // The runner's own status says which layer failed (422 refused / 502 far
+    // side / 400 this request); `body.status` is the blob store's verdict when
+    // there was one. Both are reported, because "403 inside a 422" is what
+    // tells a stale signature from a broken runner.
+    throw new Error(withoutUrlSecrets(
+      `the runner could not store the attachment (HTTP ${response.status}` +
+      `${body.status ? `, blob store ${body.status}` : ''}): ${body.error ?? 'no reason given'}`,
+      request.url,
+    ));
+  }
+  return { bytes: body.bytes, status: body.status };
+}

package/src/blob-urls.ts

@@ -0,0 +1,280 @@
+import { createHmac } from 'node:crypto';
+import { readEnvVar } from '@chrischall/mcp-utils';
+
+/**
+ * Signed URLs for mcp-host's per-registration blob store.
+ *
+ * ## Why this exists
+ *
+ * A hosted MCP has no HTTP surface of its own — mcp-host proxies MCP protocol
+ * to a stdio child and nothing else — so there is no way for a tool to hand an
+ * agent BYTES. `gog_gmail_attachment` works around that by uploading to the
+ * user's Drive and returning a `webViewLink`, which needs a Google session to
+ * open (so `curl` cannot), writes a file into the user's Drive as a side effect
+ * of reading mail, and is refused outright under `GOG_READONLY`.
+ *
+ * mcp-host answers this with a blob store at `/b/<registrationId>/<rest>` that
+ * sits OUTSIDE OAuth: a signed URL is the entire access control. A registration
+ * receives two variables at spawn —
+ *
+ *   MCP_BLOB_BASE_URL     https://<host>/b/<registrationId>
+ *   MCP_BLOB_SIGNING_KEY  that registration's derived key
+ *
+ * — and mints its own links. Neither exists on a local stdio install, which is
+ * why {@link blobStoreFromEnv} answers `undefined` rather than throwing: the
+ * absence is a fact about the host, and the CALLER is the one that knows
+ * whether the delivery mode the user asked for needs it.
+ *
+ * ## The payload shapes
+ *
+ * Transcribed from mcp-host's `gateway/src/blob-key.ts`, which is what verifies
+ * them:
+ *
+ *   GET    signs  `<key>\n<exp>`
+ *   PUT    signs  `put\0<key>\0<ct>\0<exp>`
+ *   PUT†   signs  `putp\0<key>\0<ct>\0<exp>`   (retention-exempt — not minted here)
+ *   DELETE signs  `del\0<key>\0<exp>`
+ *   LIST   signs  `list\0<relPrefix>\0<exp>`
+ *
+ * The shapes MUST NOT converge, which is why a read payload carries a newline
+ * and never a NUL while every other verb is NUL-separated behind a distinct
+ * leading word. A signature that lets someone READ an object can then never be
+ * replayed to overwrite or destroy it. The write payload commits to the content
+ * type as well, so a signature for a PDF cannot be spent storing a script at the
+ * same key — which in turn means the `Content-Type` header on the PUT must be
+ * byte-identical to the one signed, or the signature simply does not verify.
+ *
+ * Only the two verbs this repo needs are minted: a read and an ordinary write.
+ * Adding a third means adding its shape, not generalising these two.
+ *
+ * ## Where this belongs
+ *
+ * In `@chrischall/mcp-utils`, the moment a SECOND MCP needs it. It lives here
+ * now only to avoid a cross-repo release chain for one feature. mcp-host's own
+ * blob-store doc makes the argument for moving it: N MCPs re-implementing the
+ * signing is N chances to get the security-critical part wrong, and the part
+ * that is easy to get wrong is exactly the part below — which bytes are signed,
+ * and which of them are percent-encoded on the way into the URL.
+ *
+ * `node:crypto` rather than WebCrypto (which `google-token.ts` uses, for the
+ * Worker build): HMAC through `crypto.subtle` is async, and a URL minter that
+ * returns a promise infects every call site for no gain here. The Worker build
+ * sets `nodejs_compat` (wrangler.jsonc), so `createHmac` resolves there too if
+ * this module is ever pulled into that graph.
+ */
+
+/**
+ * The gateway refuses an `exp` more than 24 hours out (`MAX_TTL_MS` in
+ * `gateway/src/blob.ts`) — "a far-future exp is a signature that never stops
+ * working". Clamped rather than validated: the caller asking for a week should
+ * get a working day-long link, not a rejection they cannot act on.
+ */
+export const BLOB_URL_MAX_TTL_MS = 24 * 60 * 60 * 1000;
+
+/**
+ * How far UNDER that ceiling the longest link we will mint sits.
+ *
+ * The gateway's refusal is strict (`exp > Date.now() + MAX_TTL_MS`) and it is
+ * judged on the GATEWAY's clock against an `exp` computed on this child's, so
+ * landing exactly on the ceiling leaves no skew budget at all: one millisecond
+ * of this process running ahead is a hard 403 whose message names no cause the
+ * caller can act on. `BLOB_URL_MAX_TTL_MS` is exported, so `ttlMs:
+ * BLOB_URL_MAX_TTL_MS` is the natural way to ask for the longest legal link —
+ * the API would otherwise invite exactly the request that breaks.
+ *
+ * A minute: far more than two well-behaved clocks drift, and irrelevant
+ * against a 24-hour link.
+ */
+export const BLOB_URL_CEILING_MARGIN_MS = 60 * 1000;
+
+/**
+ * One hour.
+ *
+ * A signed URL IS a credential — anyone holding it reads the object, with no
+ * session and no bearer — so its lifetime is the window in which a leak is
+ * spendable, and the only reason to lengthen it is a consumer that comes back
+ * late. Nothing here does: an agent handed a download link fetches it within
+ * the same turn. An hour is far more than that needs while still surviving a
+ * slow client, a retry, and a person who copies the link into a terminal.
+ */
+export const BLOB_URL_DEFAULT_TTL_MS = 60 * 60 * 1000;
+
+/** The smallest link worth minting. A `ttlMs` of 0 would be dead on arrival. */
+const MIN_TTL_MS = 1000;
+
+/** The two variables mcp-host hands a child at spawn. */
+export interface BlobStoreConfig {
+  /** `https://<host>/b/<registrationId>` — MCP_BLOB_BASE_URL. */
+  baseUrl: string;
+  /** That registration's derived key — MCP_BLOB_SIGNING_KEY. */
+  signingKey: string;
+}
+
+export interface MintOptions {
+  /** Link lifetime, clamped into [1s, 24h]. Defaults to {@link BLOB_URL_DEFAULT_TTL_MS}. */
+  ttlMs?: number;
+  /** Epoch ms to measure the expiry from. Defaults to the clock; injected by tests. */
+  now?: number;
+}
+
+/**
+ * A signed write URL and the content type that URL's signature commits to.
+ *
+ * They travel together because they are only correct together — see
+ * `BlobUrlMinter.putUrl`.
+ */
+export interface BlobPutTarget {
+  readonly url: string;
+  readonly contentType: string;
+}
+
+export interface BlobUrlMinter {
+  /** The last path segment of the base URL — the prefix every object key sits under. */
+  readonly registrationId: string;
+  /**
+   * A URL that STORES bytes at `rest`, WITH the content type it was signed
+   * under.
+   *
+   * The pair rather than the URL alone, because the gateway rebuilds the write
+   * payload from the PUT's own `content-type` header: a caller that drops the
+   * header, lets an HTTP library default it, or re-cases it produces a
+   * signature that does not verify, and the refusal looks like a missing
+   * object rather than a wrong header. Returning the URL by itself makes that
+   * a thing the uploader has to remember; returning both makes it one it
+   * cannot drop.
+   *
+   * The PUT must also send `Content-Length` — the gateway answers 411 without
+   * one, and `Number(null)` is 0, so an absent length is not read as empty.
+   */
+  putUrl(rest: string, contentType: string, options?: MintOptions): BlobPutTarget;
+  /** A URL that READS the object at `rest`. */
+  getUrl(rest: string, options?: MintOptions): string;
+}
+
+/** `<key>\n<exp>` — the read shape. Newline, never a NUL. */
+export function readPayload(objectKey: string, exp: number): string {
+  return `${objectKey}\n${exp}`;
+}
+
+/** `put\0<key>\0<ct>\0<exp>` — the ordinary write shape. */
+export function writePayload(objectKey: string, contentType: string, exp: number): string {
+  return `put\0${objectKey}\0${contentType}\0${exp}`;
+}
+
+function sign(signingKey: string, payload: string): string {
+  return createHmac('sha256', signingKey).update(payload, 'utf8').digest('base64url');
+}
+
+/**
+ * Split `rest` into the segments the gateway will see, refusing the ones it
+ * refuses.
+ *
+ * `parsePath` in `gateway/src/blob.ts` decodes each segment and then rejects
+ * any that is empty, `.` or `..` — deliberately rejecting rather than
+ * normalising, "because normalising means the bytes signed and the bytes used
+ * are different strings". So a URL minted for one of these can never be spent;
+ * refusing here turns a silent 404 at the door into a message at the call site.
+ */
+function objectPathSegments(rest: string): string[] {
+  const segments = rest.split('/');
+  if (segments.some((seg) => seg === '' || seg === '.' || seg === '..')) {
+    // Names the offending path, never the key or the URL.
+    throw new Error(
+      `invalid blob object path ${JSON.stringify(rest)}: every segment must be non-empty and neither "." nor ".."`,
+    );
+  }
+  return segments;
+}
+
+function expiryFor(options: MintOptions | undefined): number {
+  const now = options?.now ?? Date.now();
+  const requested = options?.ttlMs ?? BLOB_URL_DEFAULT_TTL_MS;
+  const ceiling = BLOB_URL_MAX_TTL_MS - BLOB_URL_CEILING_MARGIN_MS;
+  return now + Math.min(Math.max(requested, MIN_TTL_MS), ceiling);
+}
+
+/**
+ * A minter bound to one registration's base URL and key.
+ *
+ * Throws on a base URL it cannot read a registration id out of, or an empty
+ * key — both are configuration faults, and half-working here would mint links
+ * that 404 later with nothing to point at.
+ */
+export function createBlobUrlMinter(config: BlobStoreConfig): BlobUrlMinter {
+  if (!config.signingKey) {
+    throw new Error('MCP_BLOB_SIGNING_KEY is empty — cannot sign blob-store URLs');
+  }
+
+  let parsed: URL;
+  try {
+    parsed = new URL(config.baseUrl);
+  } catch {
+    // The value itself is not a secret, but it is not worth echoing either.
+    throw new Error('MCP_BLOB_BASE_URL is not a valid URL');
+  }
+
+  // `https://<host>/b/<registrationId>`, with or without a trailing slash. The
+  // registration id is the LAST path segment, and it is also the first segment
+  // of every object key — the gateway derives the signing key from the id in
+  // the PATH, so the two must be the same string.
+  //
+  // Two segments are required, not one. On "last segment" alone a base URL of
+  // `…/b/` — the store's mount with the id missing — reads as the id `b`, and
+  // is indistinguishable from a tolerated trailing slash. Since the store is
+  // always mounted under a prefix (`/b/<id>`; `handleBlob` matches nothing
+  // else), a single-segment path is a misconfiguration, and saying so here
+  // beats minting links that 404 at the door with nothing to point at.
+  const pathSegments = parsed.pathname.split('/').filter((seg) => seg !== '');
+  const registrationId = pathSegments.length >= 2 ? pathSegments[pathSegments.length - 1] : undefined;
+  if (!registrationId) {
+    throw new Error('MCP_BLOB_BASE_URL has no registration id in its path');
+  }
+
+  // Rebuilt rather than reused so a trailing slash on the configured value
+  // cannot become a double slash — an empty first segment the gateway refuses.
+  const basePrefix = `${parsed.origin}/${pathSegments.join('/')}`;
+
+  function mint(rest: string, exp: number, payload: (objectKey: string) => string): string {
+    const segments = objectPathSegments(rest);
+    // Signed DECODED, sent ENCODED. The gateway percent-decodes each segment
+    // before it builds the key it verifies against, so a key containing a space
+    // or a '+' signs one string and is checked as another unless the encoding
+    // happens ONLY on the wire. Per segment, never over the joined string: an
+    // encoded '/' would invent a separator the signed key does not have.
+    const url = `${basePrefix}/${segments.map(encodeURIComponent).join('/')}`;
+    const signature = sign(config.signingKey, payload(`${registrationId}/${segments.join('/')}`));
+    return `${url}?exp=${exp}&sig=${signature}`;
+  }
+
+  return {
+    registrationId,
+    putUrl(rest, contentType, options) {
+      const exp = expiryFor(options);
+      return {
+        url: mint(rest, exp, (key) => writePayload(key, contentType, exp)),
+        contentType,
+      };
+    },
+    getUrl(rest, options) {
+      const exp = expiryFor(options);
+      return mint(rest, exp, (key) => readPayload(key, exp));
+    },
+  };
+}
+
+/**
+ * The blob store as this process's environment describes it, or `undefined`
+ * when it is absent — a local stdio install, where mcp-host is not the host.
+ *
+ * `readEnvVar` rather than `process.env` directly: it already treats a blank
+ * value and an unresolved `.mcpb` placeholder (`${user_config.x}`) as unset,
+ * which is the same rule the rest of this package's configuration follows.
+ * BOTH or neither — a base URL with no key cannot sign anything, and a key with
+ * no base URL has nowhere to point.
+ */
+export function blobStoreFromEnv(): BlobStoreConfig | undefined {
+  const baseUrl = readEnvVar('MCP_BLOB_BASE_URL');
+  const signingKey = readEnvVar('MCP_BLOB_SIGNING_KEY');
+  if (!baseUrl || !signingKey) return undefined;
+  return { baseUrl, signingKey };
+}

package/src/lib.ts

@@ -64,3 +64,22 @@ export {
   registerRunTool,
   assertNotBoth,
 } from './tools/utils.js';
+// Signed URLs for mcp-host's per-registration blob store — the only way a
+// hosted child can hand an agent BYTES it can fetch with `curl`. Exported from
+// the base package so the gmail sub-package (and any later one) shares ONE
+// implementation of the signing; see src/blob-urls.ts for why that matters.
+// Deliberately NOT re-exporting the payload builders: a caller outside this
+// module has no business assembling a payload and signing it by hand, which is
+// the mistake the shared minter exists to prevent.
+export {
+  blobStoreFromEnv,
+  createBlobUrlMinter,
+  BLOB_URL_MAX_TTL_MS,
+  BLOB_URL_DEFAULT_TTL_MS,
+} from './blob-urls.js';
+export type { BlobStoreConfig, BlobUrlMinter, MintOptions } from './blob-urls.js';
+// The other half of that hop: under the hosted connector the bytes are on the
+// RUNNER's disk and this child never sees them, so the runner is asked to
+// stream them to the URL this process minted. See src/blob-upload.ts.
+export { uploadToBlobStore, RUNNER_UPLOAD_TIMEOUT_MS } from './blob-upload.js';
+export type { BlobUploadRequest, BlobUploadOutcome, BlobUploadOptions } from './blob-upload.js';

package/src/runner.ts

@@ -217,7 +217,7 @@ const TIMEOUT_MS = 30_000;
 // so the requirement change is surfaced in the release notes (see
 // .github/release.yml). This is the single source of truth for the required
 // version; keep the README/CLAUDE.md mention in sync.
-export const MIN_GOG_VERSION = '0.39.1';
+export const MIN_GOG_VERSION = '0.40.0';
 
 // Interpret the GOG_READONLY kill-switch. `readEnvVar` already treats blank
 // values, 'undefined'/'null' sentinels, and unresolved .mcpb placeholders
@@ -236,12 +236,29 @@ function readonlyEnvEnabled(): boolean {
 // instead of the stored refresh token. The broader patterns are
 // defense-in-depth — the parent process's shell may have other Google /
 // cloud / API secrets in scope that the child has no business seeing.
+//
+// `_KEY`, not `_API_KEY|_PRIVATE_KEY`: those were four spellings of "a key"
+// with the bare one missing, and TWO credentials this repo hands its own
+// process fell in that gap. `MCP_BLOB_SIGNING_KEY` mints the signed blob URLs
+// a `deliver="url"` download is uploaded to — a signature IS the whole access
+// control on that store — and `GOG_RUNNER_KEY` is the bearer for the Fly
+// backend, where `POST /run` is arbitrary `gog` argv. Neither is read by the
+// child: both are spent HERE, and when `GOG_RUNNER_URL` is set nothing is
+// spawned at all. `_CREDENTIALS` generalises the named
+// GOOGLE_APPLICATION_CREDENTIALS above, which stays named because it is the
+// one gog itself would act on.
+//
+// The list is bounded by what the child LEGITIMATELY READS, which is why
+// `_PASSWORD` is deliberately NOT on it: `GOG_KEYRING_PASSWORD` decrypts gog's
+// own file keyring (`GOG_KEYRING_BACKEND=file`), so that rule would strip the
+// one credential the child needs and turn every call into an auth failure.
+// Both directions are tested — a widening with no control case is a guess.
 function sanitizedEnv(): NodeJS.ProcessEnv {
   const result: NodeJS.ProcessEnv = {};
   for (const [key, value] of Object.entries(process.env)) {
     if (key === 'GOG_ACCESS_TOKEN') continue;
     if (key === 'GOOGLE_APPLICATION_CREDENTIALS') continue;
-    if (/(_TOKEN|_SECRET|_API_KEY|_PRIVATE_KEY)$/.test(key)) continue;
+    if (/(_TOKEN|_SECRET|_KEY|_CREDENTIALS)$/.test(key)) continue;
     result[key] = value;
   }
   return result;

package/src/worker.ts

@@ -38,7 +38,7 @@ import { gogAuth, CONNECTOR_INSTRUCTIONS, type GogProps } from './connector-auth
 // connector with all ~360 tools at once. Add whichever paths you want as separate
 // connectors in claude.ai (each authorizes with the same connector key).
 
-const VERSION = '2.29.1'; // x-release-please-version
+const VERSION = '2.30.0'; // x-release-please-version
 
 // Build an McpAgent subclass whose init() registers `registrars` onto its server,
 // each handler wrapped in the ALS scope carrying the per-session Fly executor.