gogcli-mcp 2.30.0 → 3.0.0

package/src/tools/sheets.ts

@@ -1,4 +1,4 @@
-import { McpServer } from '@modelcontextprotocol/sdk/server/mcp.js';
+import { McpServer } from '@modelcontextprotocol/server';
 import { z } from 'zod';
 import { run } from '../runner.js';
 import { rawTextResult } from '@chrischall/mcp-utils';
@@ -25,11 +25,11 @@ export function registerSheetsTools(server: McpServer): void {
   server.registerTool('gog_sheets_get', {
     description: 'Read values from a Google Sheets range. Returns a JSON object with a "values" array of rows.',
     annotations: { readOnlyHint: true },
-    inputSchema: {
+    inputSchema: z.object({
       spreadsheetId: z.string().describe('Spreadsheet ID (from the URL)'),
       range: z.string().describe('Range in A1 notation, e.g. Sheet1!A1:B10 or a named range'),
       account: accountParam,
-    },
+    }),
   }, async ({ spreadsheetId, range, account }) => {
     return runOrDiagnose(['sheets', 'get', spreadsheetId, range], { account });
   });
@@ -37,7 +37,7 @@ export function registerSheetsTools(server: McpServer): void {
   server.registerTool('gog_sheets_update', {
     description: 'Write values to a Google Sheets range, overwriting existing content. Values may be strings, numbers, booleans, or null. Strings starting with "=" are interpreted as formulas (e.g. "=SUM(A1:A10)").',
     annotations: { destructiveHint: true },
-    inputSchema: {
+    inputSchema: z.object({
       spreadsheetId: z.string().describe('Spreadsheet ID (from the URL)'),
       range: z.string().describe('Top-left cell or range in A1 notation, e.g. Sheet1!A1'),
       values: z.array(z.array(cellValueParam)).describe('2D array of values (rows of columns). Cells may be string/number/boolean/null; strings starting with "=" are formulas.'),
@@ -45,7 +45,7 @@ export function registerSheetsTools(server: McpServer): void {
       fail_if_not_empty: failIfNotEmptyParam,
       fail_on_formula_error: z.boolean().optional().describe('After writing, read the range back and fail if any cell holds a Sheets formula error (#REF!, #DIV/0!, etc.).'),
       account: accountParam,
-    },
+    }),
   }, async ({ spreadsheetId, range, values, account, dry_run, fail_if_not_empty, fail_on_formula_error }) => {
     const cols = values.reduce((max, row) => Math.max(max, row.length), 0);
     if (fail_if_not_empty && values.length > 0 && cols > 0) {
@@ -79,13 +79,13 @@ export function registerSheetsTools(server: McpServer): void {
   server.registerTool('gog_sheets_append', {
     description: 'Append rows to a Google Sheet after the last row with data in the given range. Values may be strings, numbers, booleans, or null. Strings starting with "=" are interpreted as formulas.',
     annotations: { destructiveHint: true },
-    inputSchema: {
+    inputSchema: z.object({
       spreadsheetId: z.string().describe('Spreadsheet ID (from the URL)'),
       range: z.string().describe('Range indicating which sheet/columns to append to, e.g. Sheet1!A:C'),
       values: z.array(z.array(cellValueParam)).describe('2D array of rows to append. Cells may be string/number/boolean/null; strings starting with "=" are formulas.'),
       dry_run: dryRunParam,
       account: accountParam,
-    },
+    }),
   }, async ({ spreadsheetId, range, values, account, dry_run }) => {
     const args = ['sheets', 'append', spreadsheetId, range, `--values-json=${JSON.stringify(values)}`];
     if (dry_run) args.push('--dry-run');
@@ -95,12 +95,12 @@ export function registerSheetsTools(server: McpServer): void {
   server.registerTool('gog_sheets_clear', {
     description: 'Clear all values in a Google Sheets range (formatting is preserved).',
     annotations: { destructiveHint: true },
-    inputSchema: {
+    inputSchema: z.object({
       spreadsheetId: z.string().describe('Spreadsheet ID'),
       range: z.string().describe('Range in A1 notation to clear'),
       dry_run: dryRunParam,
       account: accountParam,
-    },
+    }),
   }, async ({ spreadsheetId, range, account, dry_run }) => {
     const args = ['sheets', 'clear', spreadsheetId, range];
     if (dry_run) args.push('--dry-run');
@@ -110,10 +110,10 @@ export function registerSheetsTools(server: McpServer): void {
   server.registerTool('gog_sheets_metadata', {
     description: 'Get spreadsheet metadata: title, named ranges, and per-tab properties including grid dimensions (gridProperties.rowCount / columnCount). Use this to learn a sheet\'s current size before writing — a write outside the grid fails.',
     annotations: { readOnlyHint: true },
-    inputSchema: {
+    inputSchema: z.object({
       spreadsheetId: z.string().describe('Spreadsheet ID'),
       account: accountParam,
-    },
+    }),
   }, async ({ spreadsheetId, account }) => {
     return runOrDiagnose(['sheets', 'metadata', spreadsheetId], { account });
   });
@@ -121,10 +121,10 @@ export function registerSheetsTools(server: McpServer): void {
   server.registerTool('gog_sheets_create', {
     description: 'Create a new Google Spreadsheet. Returns JSON with the new spreadsheetId and URL.',
     annotations: { destructiveHint: false },
-    inputSchema: {
+    inputSchema: z.object({
       title: z.string().describe('Title for the new spreadsheet'),
       account: accountParam,
-    },
+    }),
   }, async ({ title, account }) => {
     return runOrDiagnose(['sheets', 'create', title], { account });
   });
@@ -132,12 +132,12 @@ export function registerSheetsTools(server: McpServer): void {
   server.registerTool('gog_sheets_find_replace', {
     description: 'Find and replace text across an entire Google Spreadsheet.',
     annotations: { destructiveHint: true },
-    inputSchema: {
+    inputSchema: z.object({
       spreadsheetId: z.string().describe('Spreadsheet ID'),
       find: z.string().describe('Text to find'),
       replace: z.string().describe('Replacement text'),
       account: accountParam,
-    },
+    }),
   }, async ({ spreadsheetId, find, replace, account }) => {
     return runOrDiagnose(['sheets', 'find-replace', spreadsheetId, find, replace], { account });
   });

package/src/tools/slides.ts

@@ -1,4 +1,4 @@
-import { McpServer } from '@modelcontextprotocol/sdk/server/mcp.js';
+import { McpServer } from '@modelcontextprotocol/server';
 import { z } from 'zod';
 import { accountParam, runOrDiagnose, registerRunTool } from './utils.js';
 
@@ -6,13 +6,13 @@ export function registerSlidesTools(server: McpServer): void {
   server.registerTool('gog_slides_export', {
     description: 'Export a Google Slides presentation to a local file (pdf or pptx).',
     annotations: { readOnlyHint: true },
-    inputSchema: {
+    inputSchema: z.object({
       presentationId: z.string().describe('Presentation ID'),
       out: z.string().optional().describe('Output file path'),
       format: z.enum(['pdf', 'pptx']).optional().describe('Export format (default: pptx)'),
       overwrite: z.boolean().optional().describe('Overwrite the output file if it already exists (gog refuses otherwise)'),
       account: accountParam,
-    },
+    }),
   }, async ({ presentationId, out, format, overwrite, account }) => {
     const args = ['slides', 'export', presentationId];
     if (out) args.push(`--out=${out}`);
@@ -24,22 +24,22 @@ export function registerSlidesTools(server: McpServer): void {
   server.registerTool('gog_slides_info', {
     description: 'Get metadata for a Google Slides presentation (title, ID, slide count, etc.).',
     annotations: { readOnlyHint: true },
-    inputSchema: {
+    inputSchema: z.object({
       presentationId: z.string().describe('Presentation ID'),
       account: accountParam,
-    },
+    }),
   }, async ({ presentationId, account }) => {
     return runOrDiagnose(['slides', 'info', presentationId], { account });
   });
 
   server.registerTool('gog_slides_create', {
     description: 'Create a new Google Slides presentation, optionally in a folder or copying from a template.',
-    inputSchema: {
+    inputSchema: z.object({
       title: z.string().describe('Presentation title'),
       parent: z.string().optional().describe('Destination folder ID'),
       template: z.string().optional().describe('Template presentation ID to copy from'),
       account: accountParam,
-    },
+    }),
   }, async ({ title, parent, template, account }) => {
     const args = ['slides', 'create', title];
     if (parent) args.push(`--parent=${parent}`);
@@ -49,12 +49,12 @@ export function registerSlidesTools(server: McpServer): void {
 
   server.registerTool('gog_slides_copy', {
     description: 'Copy a Google Slides presentation to a new presentation with the given title.',
-    inputSchema: {
+    inputSchema: z.object({
       presentationId: z.string().describe('Presentation ID to copy'),
       title: z.string().describe('Title for the new copy'),
       parent: z.string().optional().describe('Destination folder ID'),
       account: accountParam,
-    },
+    }),
   }, async ({ presentationId, title, parent, account }) => {
     const args = ['slides', 'copy', presentationId, title];
     if (parent) args.push(`--parent=${parent}`);
@@ -64,10 +64,10 @@ export function registerSlidesTools(server: McpServer): void {
   server.registerTool('gog_slides_list_slides', {
     description: 'List slides in a Google Slides presentation.',
     annotations: { readOnlyHint: true },
-    inputSchema: {
+    inputSchema: z.object({
       presentationId: z.string().describe('Presentation ID'),
       account: accountParam,
-    },
+    }),
   }, async ({ presentationId, account }) => {
     return runOrDiagnose(['slides', 'list-slides', presentationId], { account });
   });
@@ -75,12 +75,12 @@ export function registerSlidesTools(server: McpServer): void {
   server.registerTool('gog_slides_read_slide', {
     description: 'Read the content of a slide (text, shapes, speaker notes). Set detail=true to also include normalized element geometry, styled text runs, paragraphs, table-cell content, and image source URLs.',
     annotations: { readOnlyHint: true },
-    inputSchema: {
+    inputSchema: z.object({
       presentationId: z.string().describe('Presentation ID'),
       slideId: z.string().describe('Slide ID to read'),
       detail: z.boolean().optional().describe('Include normalized element geometry, styled text runs, paragraphs, table-cell content, and image source URLs'),
       account: accountParam,
-    },
+    }),
   }, async ({ presentationId, slideId, detail, account }) => {
     const args = ['slides', 'read-slide', presentationId, slideId];
     if (detail) args.push('--detail');

package/src/tools/tasks.ts

@@ -1,4 +1,4 @@
-import { McpServer } from '@modelcontextprotocol/sdk/server/mcp.js';
+import { McpServer } from '@modelcontextprotocol/server';
 import { z } from 'zod';
 import { accountParam, runOrDiagnose, registerRunTool } from './utils.js';
 
@@ -6,9 +6,9 @@ export function registerTasksTools(server: McpServer): void {
   server.registerTool('gog_tasks_lists', {
     description: 'List all Google Task lists.',
     annotations: { readOnlyHint: true },
-    inputSchema: {
+    inputSchema: z.object({
       account: accountParam,
-    },
+    }),
   }, async ({ account }) => {
     return runOrDiagnose(['tasks', 'lists', 'list'], { account });
   });
@@ -16,10 +16,10 @@ export function registerTasksTools(server: McpServer): void {
   server.registerTool('gog_tasks_list', {
     description: 'List tasks in a Google Task list.',
     annotations: { readOnlyHint: true },
-    inputSchema: {
+    inputSchema: z.object({
       tasklistId: z.string().describe('Task list ID (use gog_tasks_lists to find IDs)'),
       account: accountParam,
-    },
+    }),
   }, async ({ tasklistId, account }) => {
     return runOrDiagnose(['tasks', 'list', tasklistId], { account });
   });
@@ -27,11 +27,11 @@ export function registerTasksTools(server: McpServer): void {
   server.registerTool('gog_tasks_get', {
     description: 'Get a specific task by ID.',
     annotations: { readOnlyHint: true },
-    inputSchema: {
+    inputSchema: z.object({
       tasklistId: z.string().describe('Task list ID'),
       taskId: z.string().describe('Task ID'),
       account: accountParam,
-    },
+    }),
   }, async ({ tasklistId, taskId, account }) => {
     return runOrDiagnose(['tasks', 'get', tasklistId, taskId], { account });
   });
@@ -39,13 +39,13 @@ export function registerTasksTools(server: McpServer): void {
   server.registerTool('gog_tasks_add', {
     description: 'Add a task to a Google Task list.',
     annotations: { destructiveHint: false },
-    inputSchema: {
+    inputSchema: z.object({
       tasklistId: z.string().describe('Task list ID'),
       title: z.string().describe('Task title'),
       notes: z.string().optional().describe('Task notes/description'),
       due: z.string().optional().describe('Due date (YYYY-MM-DD or RFC3339)'),
       account: accountParam,
-    },
+    }),
   }, async ({ tasklistId, title, notes, due, account }) => {
     const args = ['tasks', 'add', tasklistId, `--title=${title}`];
     if (notes) args.push(`--notes=${notes}`);
@@ -56,11 +56,11 @@ export function registerTasksTools(server: McpServer): void {
   server.registerTool('gog_tasks_done', {
     description: 'Mark a task as completed.',
     annotations: { destructiveHint: true },
-    inputSchema: {
+    inputSchema: z.object({
       tasklistId: z.string().describe('Task list ID'),
       taskId: z.string().describe('Task ID'),
       account: accountParam,
-    },
+    }),
   }, async ({ tasklistId, taskId, account }) => {
     return runOrDiagnose(['tasks', 'done', tasklistId, taskId], { account });
   });
@@ -68,11 +68,11 @@ export function registerTasksTools(server: McpServer): void {
   server.registerTool('gog_tasks_delete', {
     description: 'Delete a task.',
     annotations: { destructiveHint: true },
-    inputSchema: {
+    inputSchema: z.object({
       tasklistId: z.string().describe('Task list ID'),
       taskId: z.string().describe('Task ID'),
       account: accountParam,
-    },
+    }),
   }, async ({ tasklistId, taskId, account }) => {
     // gog gates this delete behind a confirmation; the runner injects
     // --no-input, so without --force it refuses at runtime.

package/src/tools/utils.ts

@@ -1,6 +1,5 @@
 import { z } from 'zod';
-import type { McpServer } from '@modelcontextprotocol/sdk/server/mcp.js';
-import type { CallToolResult } from '@modelcontextprotocol/sdk/types.js';
+import type { McpServer, CallToolResult } from '@modelcontextprotocol/server';
 import { errorResult, rawTextResult, minifiedResult, stripMediaUrls } from '@chrischall/mcp-utils';
 import { run, isRunnerTransportError } from '../runner.js';
 import type { GogArg, RunnerFailureKind } from '../runner.js';
@@ -149,7 +148,7 @@ export function registerRunTool(
   server.registerTool(`gog_${service}_run`, {
     description,
     annotations: { destructiveHint: true },
-    inputSchema,
+    inputSchema: z.object(inputSchema),
   }, async (rawArgs) => {
     const { subcommand, args, account } = rawArgs as { subcommand: string; args: string[]; account?: string };
     return runOrDiagnose([service, subcommand, ...args], { account });

package/src/worker.ts

@@ -1,7 +1,6 @@
-import { McpServer } from '@modelcontextprotocol/sdk/server/mcp.js';
-import { McpAgent } from 'agents/mcp';
+import { McpServer } from '@modelcontextprotocol/server';
+import { createMcpHandler, getMcpAuthContext } from 'agents/mcp/server';
 import { OAuthProvider } from '@cloudflare/workers-oauth-provider';
-import { handleAuthorize } from '@chrischall/mcp-connector';
 import type { ToolRegistrar } from '@chrischall/mcp-utils';
 import {
   BASE_TOOL_REGISTRARS,
@@ -15,8 +14,9 @@ import { registerExtraSheetsTools } from '../../gogcli-mcp-sheets/src/tools/shee
 import { registerExtraGmailTools } from '../../gogcli-mcp-gmail/src/tools/gmail-extra.js';
 import { registerExtraDriveTools } from '../../gogcli-mcp-drive/src/tools/drive-extra.js';
 import { registerExtraDocsTools } from '../../gogcli-mcp-docs/src/tools/docs-extra.js';
-import { makeFlyExecutor, wrapServer } from './connector-runtime.js';
+import { createFlyExecutorResolver, wrapServer } from './connector-runtime.js';
 import { gogAuth, CONNECTOR_INSTRUCTIONS, type GogProps } from './connector-auth.js';
+import { handleAuthorize } from './connector-login.js';
 
 // The Cloudflare remote-connector entrypoint for gogcli-mcp.
 //
@@ -24,10 +24,9 @@ import { gogAuth, CONNECTOR_INSTRUCTIONS, type GogProps } from './connector-auth
 // every assembled `gog` arg-array by forwarding it to a Fly.io backend (a Worker
 // cannot spawn processes). The bridge is the `runExecutor` AsyncLocalStorage seam
 // in `runner.ts`: `wrapServer` scopes each tool handler in `runExecutor.run(...)`
-// so the handler's `run()` forwards to the per-session Fly executor.
+// so the handler's `run()` forwards to the authenticated caller's Fly executor.
 //
-// One Worker serves several MCP endpoints under one OAuth login, each a distinct
-// tool set backed by its own Durable Object:
+// One stateless Worker serves several MCP endpoints under one OAuth login:
 //   /mcp          all-services base (BASE_TOOL_REGISTRARS)
 //   /mcp/sheets   auth + Sheets base + Sheets extras
 //   /mcp/gmail    auth + Gmail base + Gmail extras
@@ -38,52 +37,48 @@ import { gogAuth, CONNECTOR_INSTRUCTIONS, type GogProps } from './connector-auth
 // connector with all ~360 tools at once. Add whichever paths you want as separate
 // connectors in claude.ai (each authorizes with the same connector key).
 
-const VERSION = '2.30.0'; // x-release-please-version
+const VERSION = '3.0.0'; // x-release-please-version
 
-// Build an McpAgent subclass whose init() registers `registrars` onto its server,
-// each handler wrapped in the ALS scope carrying the per-session Fly executor.
-// (Kept in worker.ts, not connector-runtime.ts, because it imports the Worker-only
-// `agents` runtime; the node-testable helpers stay in connector-runtime.ts.)
-function makeAgent(registrars: ToolRegistrar[]): typeof McpAgent {
-  class GogAgent extends McpAgent<unknown, unknown, GogProps> {
-    // `instructions` is the connector's only channel to the model that is not a
-    // tool description, and it carries the one thing the client UI gets wrong:
-    // "connected"/"refreshed" is a statement about the connector key, not about
-    // Google. See CONNECTOR_INSTRUCTIONS for why that has to be said out loud.
-    server = new McpServer(
-      { name: 'gogcli-mcp', version: VERSION },
-      { instructions: CONNECTOR_INSTRUCTIONS },
-    );
-    async init() {
-      // NO third argument, deliberately: the hosted connector supplies no
-      // per-caller access token, so `gog` runs as the Fly volume's own identity
-      // and refreshes from its own keyring. That is what makes the eviction +
-      // replay machinery in connector-runtime.ts INERT here — with no token
-      // source there is no module-level cache that can go stale, so a Google
-      // 401 on this path stops at the `no access token was supplied` guard and
-      // logs `replay.declined`. That record is the expected outcome for a
-      // hosted connector, not a bug; the transport-failure classification and
-      // the auth log itself do apply here.
-      //
-      // Inert is not the same as unobserved. Because `gog` is spawned fresh per
-      // /run and re-reads the keyring each time, a Google 401 here means the
-      // STORED credential was refused — which no retry can repair, so no retry
-      // is built. Instead that same guard first takes one live reading of the
-      // Google layer (`GET /health/google` on the runner) and records it as
-      // `refusal.google-ok` / `-unhealthy` / `-unmeasured`. It is throttled,
-      // deadline-bounded, cannot throw, and leaves the caller's error
-      // byte-identical; its whole job is to answer, in the log, the question
-      // that could not be answered after the incident: at the moment Google
-      // refused, was the refresh token on the volume alive or dead?
-      // (docs/DEPLOY-CONNECTOR.md, "Reading the auth log" and "Why a hosted
-      // Google 401 is measured rather than retried", says this for whoever is
-      // reading logs rather than code.)
-      const executor = makeFlyExecutor((this.env as { FLY_ENDPOINT: string }).FLY_ENDPOINT, this.props.key);
-      const wrapped = wrapServer(this.server, executor);
-      for (const register of registrars) register(wrapped);
-    }
-  }
-  return GogAgent as unknown as typeof McpAgent;
+type WorkerEnv = { FLY_ENDPOINT: string };
+
+// One resolver per Worker isolate. Reusing an executor for the same backend
+// credential preserves makeFlyExecutor's refusal-probe throttle across
+// stateless requests; different credentials retain independent throttles.
+const resolveFlyExecutor = createFlyExecutorResolver();
+
+// Build a fresh SDK v2 server for every HTTP request. That is the transport
+// model required by MCP 2026-07-28 multi round-trip requests: input_required
+// returns to the client, and the later request reconstructs the server from
+// the tool arguments plus protocol-managed inputResponses.
+function makeHandler(route: string, registrars: ToolRegistrar[]) {
+  return {
+    fetch(request: Request, env: WorkerEnv, ctx: ExecutionContext) {
+      const handler = createMcpHandler(() => {
+        // Resolve the OAuth props lazily while the tool runs. OAuthProvider
+        // establishes this request context before calling the MCP handler.
+        const executor = ((args, options) => {
+          const props = getMcpAuthContext()?.props as GogProps | undefined;
+          if (!props?.key) throw new Error('Missing authenticated gogcli connector key');
+          return resolveFlyExecutor(env.FLY_ENDPOINT, props.key)(args, options);
+        }) satisfies ReturnType<typeof resolveFlyExecutor>;
+
+        // `instructions` is the connector's only channel to the model that is
+        // not a tool description. It explains that connector authentication
+        // does not prove the Google credential itself is healthy.
+        const server = new McpServer(
+          { name: 'gogcli-mcp', version: VERSION },
+          { instructions: CONNECTOR_INSTRUCTIONS },
+        );
+        const wrapped = wrapServer(server, executor);
+        for (const register of registrars) register(wrapped);
+        return server;
+      }, {
+        route,
+        allowedHostnames: ['connector.gogcli.nullnet.app'],
+      });
+      return handler(request, env, ctx);
+    },
+  };
 }
 
 // auth + <service> base + <service> extras — the exact set each sub-package's
@@ -94,12 +89,6 @@ function makeAgent(registrars: ToolRegistrar[]): typeof McpAgent {
 const svc = (service: string, base: ToolRegistrar, extra: ToolRegistrar): ToolRegistrar[] =>
   [authToolsFor(service), base, extra];
 
-export class GogcliMcpAgent extends makeAgent(BASE_TOOL_REGISTRARS) {}
-export class GogcliSheetsAgent extends makeAgent(svc('sheets', registerSheetsTools, registerExtraSheetsTools)) {}
-export class GogcliGmailAgent extends makeAgent(svc('gmail', registerGmailTools, registerExtraGmailTools)) {}
-export class GogcliDriveAgent extends makeAgent(svc('drive,driveactivity,drivelabels', registerDriveTools, registerExtraDriveTools)) {}
-export class GogcliDocsAgent extends makeAgent(svc('docs', registerDocsTools, registerExtraDocsTools)) {}
-
 const defaultHandler = {
   fetch(request: Request, env: unknown): Response | Promise<Response> {
     const url = new URL(request.url);
@@ -113,12 +102,11 @@ const defaultHandler = {
 // (otherwise `/mcp` greedily swallows `/mcp/sheets`).
 const handler = new OAuthProvider({
   apiHandlers: {
-    '/mcp/sheets': GogcliSheetsAgent.serve('/mcp/sheets', { binding: 'SHEETS_MCP' }) as never,
-    '/mcp/gmail': GogcliGmailAgent.serve('/mcp/gmail', { binding: 'GMAIL_MCP' }) as never,
-    '/mcp/drive': GogcliDriveAgent.serve('/mcp/drive', { binding: 'DRIVE_MCP' }) as never,
-    '/mcp/docs': GogcliDocsAgent.serve('/mcp/docs', { binding: 'DOCS_MCP' }) as never,
-    '/mcp': GogcliMcpAgent.serve('/mcp') as never,
-    '/sse': GogcliMcpAgent.serveSSE('/sse') as never,
+    '/mcp/sheets': makeHandler('/mcp/sheets', svc('sheets', registerSheetsTools, registerExtraSheetsTools)) as never,
+    '/mcp/gmail': makeHandler('/mcp/gmail', svc('gmail', registerGmailTools, registerExtraGmailTools)) as never,
+    '/mcp/drive': makeHandler('/mcp/drive', svc('drive,driveactivity,drivelabels', registerDriveTools, registerExtraDriveTools)) as never,
+    '/mcp/docs': makeHandler('/mcp/docs', svc('docs', registerDocsTools, registerExtraDocsTools)) as never,
+    '/mcp': makeHandler('/mcp', BASE_TOOL_REGISTRARS) as never,
   },
   defaultHandler: defaultHandler as never,
   authorizeEndpoint: '/authorize',

package/tests/connector-login.test.ts

@@ -0,0 +1,151 @@
+import { describe, expect, it, vi } from 'vitest';
+import { handleAuthorize } from '../src/connector-login.js';
+import type { ConnectorAuth } from '../src/connector-auth.js';
+
+function encoded(value: unknown): string {
+  return btoa(JSON.stringify(value));
+}
+
+function envFor(oauthReq: unknown = { clientId: 'client-1' }) {
+  return {
+    OAUTH_PROVIDER: {
+      parseAuthRequest: vi.fn(async () => oauthReq),
+      completeAuthorization: vi.fn(async () => ({ redirectTo: 'https://client.example/callback?code=ok' })),
+    },
+  };
+}
+
+const auth: ConnectorAuth<{ key: string }> = {
+  service: 'gogcli <Workspace>',
+  accent: '#4285F4',
+  privacyNote: 'Stored & encrypted.',
+  fields: [
+    { name: 'key', label: 'Connector "key"', type: 'password' },
+    { name: 'account', label: 'Account' },
+  ],
+  async login(fields) {
+    return { key: fields.key };
+  },
+};
+
+describe('connector login', () => {
+  it('renders the parsed OAuth request in an escaped credential form', async () => {
+    const env = envFor();
+    const response = await handleAuthorize(new Request('https://connector.example/authorize'), env, auth);
+
+    expect(response.status).toBe(200);
+    expect(response.headers.get('content-type')).toContain('text/html');
+    expect(env.OAUTH_PROVIDER.parseAuthRequest).toHaveBeenCalledOnce();
+    const html = await response.text();
+    expect(html).toContain('gogcli &lt;Workspace&gt;');
+    expect(html).toContain('Connector &quot;key&quot;');
+    expect(html).toContain('type="password"');
+    expect(html).toContain('Stored &amp; encrypted.');
+    expect(html).toContain(encoded({ clientId: 'client-1' }));
+  });
+
+  it('verifies submitted fields and completes authorization with an explicit user id', async () => {
+    const env = envFor();
+    const login = vi.fn(async () => ({ key: 'secret' }));
+    const form = new FormData();
+    form.set('oauthReq', encoded({ clientId: 'client-1' }));
+    form.set('key', 'secret');
+    form.set('account', 'person@example.com');
+
+    const response = await handleAuthorize(
+      new Request('https://connector.example/authorize', { method: 'POST', body: form }),
+      env,
+      { ...auth, userId: 'fixed-user', login },
+    );
+
+    expect(login).toHaveBeenCalledWith(
+      { key: 'secret', account: 'person@example.com' },
+      env,
+    );
+    expect(env.OAUTH_PROVIDER.completeAuthorization).toHaveBeenCalledWith({
+      request: { clientId: 'client-1' },
+      userId: 'fixed-user',
+      scope: [],
+      metadata: {},
+      props: { key: 'secret' },
+    });
+    expect(response.status).toBe(302);
+    expect(response.headers.get('location')).toBe('https://client.example/callback?code=ok');
+  });
+
+  it('uses the first credential as the user id and treats non-text fields as empty', async () => {
+    const env = envFor();
+    const login = vi.fn(async () => ({ key: 'secret' }));
+    const form = new FormData();
+    form.set('oauthReq', encoded({ clientId: 'client-1' }));
+    form.set('key', 'secret');
+    form.set('account', new Blob(['ignored']));
+
+    await handleAuthorize(
+      new Request('https://connector.example/authorize', { method: 'POST', body: form }),
+      env,
+      { ...auth, login },
+    );
+
+    expect(login).toHaveBeenCalledWith({ key: 'secret', account: '' }, env);
+    expect(env.OAUTH_PROVIDER.completeAuthorization).toHaveBeenCalledWith(
+      expect.objectContaining({ userId: 'secret' }),
+    );
+  });
+
+  it('uses the public identity when there are no credential fields', async () => {
+    const env = envFor();
+    const form = new FormData();
+    const login = vi.fn(async () => ({ key: 'public' }));
+
+    await handleAuthorize(
+      new Request('https://connector.example/authorize', { method: 'POST', body: form }),
+      env,
+      { service: 'Public', fields: [], login },
+    );
+
+    expect(env.OAUTH_PROVIDER.completeAuthorization).toHaveBeenCalledWith(
+      expect.objectContaining({ request: undefined, userId: 'public' }),
+    );
+  });
+
+  it('re-renders a safely escaped Error without completing authorization', async () => {
+    const env = envFor();
+    const form = new FormData();
+    form.set('oauthReq', encoded({ clientId: 'client-1' }));
+    form.set('key', 'bad');
+    const response = await handleAuthorize(
+      new Request('https://connector.example/authorize', { method: 'POST', body: form }),
+      env,
+      {
+        service: 'gogcli',
+        fields: [{ name: 'key', label: 'Key' }],
+        async login() {
+          throw new Error('bad <key>');
+        },
+      },
+    );
+
+    expect(response.status).toBe(200);
+    expect(await response.text()).toContain('bad &lt;key&gt;');
+    expect(env.OAUTH_PROVIDER.completeAuthorization).not.toHaveBeenCalled();
+  });
+
+  it('renders a non-Error rejection as text', async () => {
+    const env = envFor();
+    const form = new FormData();
+    const response = await handleAuthorize(
+      new Request('https://connector.example/authorize', { method: 'POST', body: form }),
+      env,
+      {
+        service: 'gogcli',
+        fields: [],
+        async login() {
+          throw 'try again';
+        },
+      },
+    );
+
+    expect(await response.text()).toContain('try again');
+  });
+});