gogcli-mcp 2.30.0 → 3.0.0

package/tests/connector-runtime.test.ts

@@ -1,7 +1,7 @@
 import { describe, it, expect, vi, afterEach } from 'vitest';
 import { run, runExecutor } from '../src/runner.js';
 import type { GogArg, GogExecutor, GogFileArg } from '../src/runner.js';
-import { makeFlyExecutor, wrapServer, RunnerTransportError, isRunnerTransportError } from '../src/connector-runtime.js';
+import { createFlyExecutorResolver, makeFlyExecutor, wrapServer, RunnerTransportError, isRunnerTransportError } from '../src/connector-runtime.js';
 import { runOrDiagnose } from '../src/tools/utils.js';
 import { makeAccessTokenSource, clearAccessTokenCache } from '../src/google-token.js';
 
@@ -11,6 +11,26 @@ afterEach(() => {
   vi.restoreAllMocks();
 });
 
+describe('createFlyExecutorResolver', () => {
+  it('reuses one executor for the same endpoint and key while isolating different credentials', () => {
+    const factory = vi.fn((_endpoint: string, _key: string): GogExecutor => vi.fn());
+    const resolve = createFlyExecutorResolver(factory);
+
+    const first = resolve('https://runner.example', 'key-a');
+    expect(resolve('https://runner.example', 'key-a')).toBe(first);
+    expect(resolve('https://runner.example', 'key-b')).not.toBe(first);
+    expect(resolve('https://other.example', 'key-a')).not.toBe(first);
+    expect(factory).toHaveBeenCalledTimes(3);
+  });
+
+  it('uses makeFlyExecutor by default', () => {
+    const resolve = createFlyExecutorResolver();
+    expect(resolve('https://runner.example', 'key-a')).toBe(
+      resolve('https://runner.example', 'key-a'),
+    );
+  });
+});
+
 describe('wrapServer', () => {
   // Neutralize ambient GOG_ACCOUNT / GOG_READONLY so run()'s assembled arg list
   // is deterministic regardless of the shell the suite runs in.

package/tests/gmail-dispatch-guard.test.ts

@@ -0,0 +1,132 @@
+import { describe, it, expect, vi, beforeEach, afterEach } from 'vitest';
+import { rawTextResult } from '@chrischall/mcp-utils';
+import {
+  extractEmails,
+  logGmailDispatch,
+  resultText,
+} from '../src/gmail-dispatch-guard.js';
+
+describe('extractEmails', () => {
+  it('extracts a bare address', () => {
+    expect(extractEmails('a@example.com')).toEqual(['a@example.com']);
+  });
+
+  it('extracts multiple addresses from a display-name header value', () => {
+    expect(extractEmails('"Alice" <alice@example.com>, "Bob" <bob@example.org>'))
+      .toEqual(['alice@example.com', 'bob@example.org']);
+  });
+
+  it('lowercases and dedupes across multiple arguments', () => {
+    expect(extractEmails('Alice@Example.com', 'bob@x.com, alice@example.com'))
+      .toEqual(['alice@example.com', 'bob@x.com']);
+  });
+
+  it('ignores undefined, null, and empty-string inputs', () => {
+    expect(extractEmails(undefined, null, '', 'a@b.com')).toEqual(['a@b.com']);
+  });
+
+  it('returns an empty array when nothing looks like an email', () => {
+    expect(extractEmails('no addresses here', undefined)).toEqual([]);
+  });
+});
+
+describe('resultText', () => {
+  it('reads the text out of a CallToolResult', () => {
+    expect(resultText(rawTextResult('{"a":1}'))).toBe('{"a":1}');
+  });
+
+  it('falls back to an empty object for a non-text content block', () => {
+    expect(resultText({ content: [{ type: 'image', data: 'x', mimeType: 'image/png' }] })).toBe('{}');
+  });
+
+  it('falls back to an empty object when content is empty', () => {
+    expect(resultText({ content: [] })).toBe('{}');
+  });
+});
+
+describe('logGmailDispatch', () => {
+  const ORIGINAL_ENV = { ...process.env };
+  let writeSpy: ReturnType<typeof vi.spyOn>;
+
+  beforeEach(() => {
+    process.env = { ...ORIGINAL_ENV };
+    delete process.env.GOG_GMAIL_TRUSTED_DOMAINS;
+    delete process.env.GOG_ACCOUNT;
+    writeSpy = vi.spyOn(process.stderr, 'write').mockImplementation(() => true);
+  });
+
+  afterEach(() => {
+    process.env = ORIGINAL_ENV;
+    writeSpy.mockRestore();
+  });
+
+  function loggedEvent(): Record<string, unknown> {
+    expect(writeSpy).toHaveBeenCalledTimes(1);
+    return JSON.parse((writeSpy.mock.calls[0][0] as string).trim());
+  }
+
+  it('logs a distinguishable gmail_dispatch event with the recipient count', () => {
+    logGmailDispatch('gog_gmail_send', ['a@example.com', 'b@example.com']);
+    const event = loggedEvent();
+    expect(event.event).toBe('gmail_dispatch');
+    expect(event.tool).toBe('gog_gmail_send');
+    expect(event.recipientCount).toBe(2);
+    expect(typeof event.timestamp).toBe('string');
+  });
+
+  it('treats the account\'s own domain as trusted by default', () => {
+    logGmailDispatch('gog_gmail_reply', ['me@example.com', 'outside@other.com'], 'me@example.com');
+    const event = loggedEvent();
+    expect(event.hasExternalRecipients).toBe(true);
+    expect(event.externalRecipients).toEqual(['outside@other.com']);
+    expect(event.externalRecipientCount).toBe(1);
+  });
+
+  it('falls back to GOG_ACCOUNT when no account param is passed', () => {
+    process.env.GOG_ACCOUNT = 'me@example.com';
+    logGmailDispatch('gog_gmail_send', ['me@example.com', 'outside@other.com']);
+    const event = loggedEvent();
+    expect(event.externalRecipients).toEqual(['outside@other.com']);
+  });
+
+  it('adds every domain in GOG_GMAIL_TRUSTED_DOMAINS on top of the account domain', () => {
+    process.env.GOG_GMAIL_TRUSTED_DOMAINS = 'law-firm.example, partner.example';
+    logGmailDispatch('gog_gmail_reply_all', ['counsel@law-firm.example', 'stranger@random.example'], 'me@example.com');
+    const event = loggedEvent();
+    expect(event.externalRecipients).toEqual(['stranger@random.example']);
+  });
+
+  it('reports no external recipients when every address is trusted', () => {
+    logGmailDispatch('gog_gmail_forward', ['me@example.com'], 'me@example.com');
+    const event = loggedEvent();
+    expect(event.hasExternalRecipients).toBe(false);
+    expect(event.externalRecipients).toEqual([]);
+  });
+
+  it('treats an account with no @ as contributing no trusted domain', () => {
+    logGmailDispatch('gog_gmail_send', ['a@example.com'], 'not-an-email');
+    const event = loggedEvent();
+    expect(event.externalRecipients).toEqual(['a@example.com']);
+  });
+
+  it('ignores an empty segment in GOG_GMAIL_TRUSTED_DOMAINS (e.g. a trailing comma)', () => {
+    process.env.GOG_GMAIL_TRUSTED_DOMAINS = 'law-firm.example,,';
+    logGmailDispatch('gog_gmail_send', ['counsel@law-firm.example'], 'me@example.com');
+    const event = loggedEvent();
+    expect(event.externalRecipients).toEqual([]);
+  });
+
+  it('treats unresolved desktop placeholders as unset env vars', () => {
+    process.env.GOG_GMAIL_TRUSTED_DOMAINS = '${user_config.trusted_domains}';
+    process.env.GOG_ACCOUNT = '${user_config.account}';
+    logGmailDispatch('gog_gmail_send', ['person@user_config.trusted_domains']);
+    const event = loggedEvent();
+    expect(event.externalRecipients).toEqual(['person@user_config.trusted_domains']);
+  });
+
+  it('treats a recipient with no @ as external, not a crash', () => {
+    logGmailDispatch('gog_gmail_send', ['not-an-email'], 'me@example.com');
+    const event = loggedEvent();
+    expect(event.externalRecipients).toEqual(['not-an-email']);
+  });
+});

package/tests/sdk-single-copy.test.ts

@@ -3,46 +3,28 @@ import { createRequire } from 'node:module';
 import { realpathSync } from 'node:fs';
 import { fileURLToPath } from 'node:url';
 
-// Guards the invariant that broke dependabot #220: the whole monorepo must
-// resolve ONE copy of @modelcontextprotocol/sdk.
-//
-// `McpServer` carries a `private _serverInfo`, so TypeScript compares it
-// NOMINALLY, not structurally. Two installed copies therefore become two
-// mutually-unassignable classes, and every `ToolRegistrar` in server.ts fails
-// with TS2322 — with no API change and no source change anywhere. #220 split
-// the tree exactly that way: `agents` (a root devDependency, the Worker
-// connector's McpAgent) exact-pins the SDK to 1.29.0 and so takes the hoisted
-// root slot that `@chrischall/mcp-utils` resolves its peer from, while the
-// workspaces asking for ^1.30.0 each nested their own copy.
-//
-// This asserts resolution identity rather than a version string: the failure is
-// "two copies", not "the wrong version", and pinning a version here would just
-// have to be edited on every future bump.
-describe('@modelcontextprotocol/sdk is installed exactly once', () => {
-  const here = createRequire(import.meta.url);
+// The Worker runtime still installs the legacy SDK through Cloudflare Agents,
+// while this project itself now uses the modular SDK v2 server.
+// Keep each lane on one physical copy: both server classes carry private state,
+// so duplicate copies produce nominal TypeScript failures that look like API
+// incompatibilities.
+const here = createRequire(import.meta.url);
 
-  // An exported subpath — the SDK's `exports` map does not expose package.json.
-  const SDK_SUBPATH = '@modelcontextprotocol/sdk/server/mcp.js';
+const resolveFrom = (specifier: string, target: string): string =>
+  realpathSync(createRequire(fileURLToPath(import.meta.resolve(specifier))).resolve(target));
 
-  // `import.meta.resolve`, not `require.resolve`, to reach the dependency's own
-  // entry: these packages are ESM-only, so their `exports` maps carry no
-  // `require` condition and CJS resolution of the bare specifier throws.
-  const resolveFrom = (specifier: string): string =>
-    realpathSync(
-      createRequire(fileURLToPath(import.meta.resolve(specifier))).resolve(SDK_SUBPATH),
-    );
+describe('MCP SDK packages are each installed exactly once', () => {
+  const LEGACY_SERVER = '@modelcontextprotocol/sdk/server/mcp.js';
+  const MODERN_SERVER = '@modelcontextprotocol/server';
 
-  it('resolves to the same file for this package and for @chrischall/mcp-utils', () => {
-    // mcp-utils declares the SDK as a peer and hands our registrars the
-    // McpServer it built, so its copy is the one they must be typed against.
-    expect(resolveFrom('@chrischall/mcp-utils')).toBe(
-      realpathSync(here.resolve(SDK_SUBPATH)),
-    );
+  it('keeps the retained legacy lane used by agents at the root', () => {
+    const root = realpathSync(here.resolve(LEGACY_SERVER));
+    expect(resolveFrom('agents', LEGACY_SERVER)).toBe(root);
   });
 
-  it('resolves to the same file for `agents`, which exact-pins the SDK', () => {
-    // The Worker connector builds its McpServer via McpAgent from `agents`.
-    // An exact pin there is what captured the root hoist slot in #220.
-    expect(resolveFrom('agents')).toBe(realpathSync(here.resolve(SDK_SUBPATH)));
+  it('keeps the SDK v2 server shared by this package and mcp-utils', () => {
+    expect(resolveFrom('@chrischall/mcp-utils', MODERN_SERVER)).toBe(
+      realpathSync(here.resolve(MODERN_SERVER)),
+    );
   });
 });

package/tests/tools/appscript.test.ts

@@ -56,7 +56,7 @@ describe('gog_appscript_pull', () => {
   // hosted connector. A caller who does not know that gets a "success" whose
   // files they cannot reach.
   it('says in its description where the directory resolves', async () => {
-    const { McpServer } = await import('@modelcontextprotocol/sdk/server/mcp.js');
+    const { McpServer } = await import('@modelcontextprotocol/server');
     const server = new McpServer({ name: 'test', version: '0.0.0' });
     const configs = new Map<string, { description?: string }>();
     vi.spyOn(server, 'registerTool').mockImplementation((name, config) => {

package/tests/tools/chat.test.ts

@@ -38,7 +38,7 @@ describe('gog_chat_spaces_list', () => {
   // description a model reads — a source comment would not reach it. Every chat
   // tool carries the note, because any of them can be the first one called.
   it('warns in EVERY description that Chat is Workspace-only', async () => {
-    const { McpServer } = await import('@modelcontextprotocol/sdk/server/mcp.js');
+    const { McpServer } = await import('@modelcontextprotocol/server');
     const server = new McpServer({ name: 'test', version: '0.0.0' });
     const configs = new Map<string, { description?: string }>();
     vi.spyOn(server, 'registerTool').mockImplementation((name, config) => {

package/tests/tools/gmail.test.ts

@@ -3,10 +3,14 @@ import { registerGmailTools } from '../../src/tools/gmail.js';
 import * as runner from '../../src/runner.js';
 import { PAYLOAD_INLINE_MAX } from '../../src/tools/utils.js';
 import { createTestHarness } from '@chrischall/mcp-utils/test';
+import type { ElicitRequest, ElicitResult } from '@modelcontextprotocol/server';
 
 vi.mock('../../src/runner.js');
 
-const setupHandlers = () => createTestHarness(registerGmailTools);
+const setupHandlers = (
+  elicitation: (request: ElicitRequest) => ElicitResult | Promise<ElicitResult> =
+    async () => ({ action: 'accept', content: { confirmed: true } }),
+) => createTestHarness(registerGmailTools, { elicitation });
 
 beforeEach(() => vi.clearAllMocks());
 
@@ -425,6 +429,88 @@ describe('gog_gmail_send', () => {
     const result = await harness.callTool('gog_gmail_send', { to: 'x', subject: 'y', body: 'z' });
     expect(result.content[0].text).toBe('Error: Send failed');
   });
+
+  // ==========================================================================
+  // THE CONFIRMATION GATE. Unlike reply/reply-all, send's recipients are
+  // explicit params, so its preview needs no extra gog call at all.
+  // ==========================================================================
+  describe('confirmation gate', () => {
+    it('elicits a recipient preview and sends only after the user accepts it', async () => {
+      vi.mocked(runner.run).mockResolvedValue('{}');
+      let request: ElicitRequest | undefined;
+      const harness = await setupHandlers(async (value) => {
+        request = value;
+        return { action: 'accept', content: { confirmed: true } };
+      });
+      const result = await harness.callTool('gog_gmail_send', {
+        to: 'bob@example.com', cc: 'carol@example.com', subject: 'Hi', body: 'Hello',
+        replyToMessageId: 'm1', quote: true,
+      });
+      expect(request?.params.message).toContain('bob@example.com');
+      expect(request?.params.message).toContain('carol@example.com');
+      expect(request?.params.message).toContain('"threaded": true');
+      expect(request?.params.requestedSchema).toEqual(expect.objectContaining({ type: 'object' }));
+      expect(result.isError).not.toBe(true);
+      expect(runner.run).toHaveBeenCalledTimes(1);
+    });
+
+    it('sends nothing when the user declines the elicitation', async () => {
+      const harness = await setupHandlers(async () => ({ action: 'decline' }));
+      const result = await harness.callTool('gog_gmail_send', {
+        to: 'bob@example.com', subject: 'Hi', body: 'Hello',
+      });
+      expect(runner.run).not.toHaveBeenCalled();
+      expect(JSON.parse(result.content[0].text as string)).toEqual(expect.objectContaining({
+        confirmed: false,
+        cancelled: true,
+        action: 'gmail.send',
+      }));
+    });
+
+    it('sends nothing when the user accepts but leaves confirmation false', async () => {
+      const harness = await setupHandlers(async () => ({ action: 'accept', content: { confirmed: false } }));
+      const result = await harness.callTool('gog_gmail_send', {
+        to: 'bob@example.com', subject: 'Hi', body: 'Hello',
+      });
+      expect(runner.run).not.toHaveBeenCalled();
+      expect(JSON.parse(result.content[0].text as string).cancelled).toBe(true);
+    });
+
+    it('logs a gmail_dispatch event with the recipients after an accepted send', async () => {
+      vi.mocked(runner.run).mockResolvedValue('{}');
+      const writeSpy = vi.spyOn(process.stderr, 'write').mockImplementation(() => true);
+      const harness = await setupHandlers();
+      await harness.callTool('gog_gmail_send', {
+        to: 'bob@example.com', subject: 'Hi', body: 'Hello',
+      });
+      const event = JSON.parse((writeSpy.mock.calls.at(-1)?.[0] as string).trim());
+      expect(event.event).toBe('gmail_dispatch');
+      expect(event.tool).toBe('gog_gmail_send');
+      expect(event.recipientCount).toBe(1);
+      writeSpy.mockRestore();
+    });
+
+    it('does not log when the accepted send fails', async () => {
+      vi.mocked(runner.run).mockRejectedValue(new Error('Send failed'));
+      const writeSpy = vi.spyOn(process.stderr, 'write').mockImplementation(() => true);
+      const harness = await setupHandlers();
+      await harness.callTool('gog_gmail_send', {
+        to: 'bob@example.com', subject: 'Hi', body: 'Hello',
+      });
+      expect(writeSpy).not.toHaveBeenCalled();
+      writeSpy.mockRestore();
+    });
+
+    it('still validates attachments before either preview or send', async () => {
+      const harness = await setupHandlers();
+      const res = await harness.callTool('gog_gmail_send', {
+        to: 'bob@example.com', subject: 's', body: 'b',
+        attachInline: [{ filename: 'a.png', contentBase64: 'not!valid!base64!' }],
+      });
+      expect(res.isError).toBe(true);
+      expect(runner.run).not.toHaveBeenCalled();
+    });
+  });
 });
 
 describe('gog_gmail_run', () => {
@@ -630,7 +716,9 @@ describe('gog_gmail_reply — full flag set', () => {
   it('omits --no-quote and --signature when false', async () => {
     vi.mocked(runner.run).mockResolvedValue('{}');
     const harness = await setupHandlers();
-    await harness.callTool('gog_gmail_reply', { messageId: 'm1', body: 'Hi', noQuote: false, signature: false });
+    await harness.callTool('gog_gmail_reply', {
+      messageId: 'm1', body: 'Hi', noQuote: false, signature: false,
+    });
     expect(runner.run).toHaveBeenCalledWith(
       ['gmail', 'reply', 'm1', '--body=Hi', '--auto-from-addressed-alias=false'],
       { account: undefined },
@@ -672,6 +760,150 @@ describe('gog_gmail_reply_all — full flag set', () => {
     );
   });
 });
+
+// ============================================================================
+// THE CONFIRMATION GATE. The first protocol round returns input_required and
+// the harness routes its embedded elicitation through the handler supplied to
+// setupHandlers. Declining lets these tests inspect the prompt while proving
+// the send subcommand was never reached.
+// ============================================================================
+describe.each([
+  ['gog_gmail_reply', 'reply' as const],
+  ['gog_gmail_reply_all', 'reply-all' as const],
+])('%s — confirmation gate', (tool, subcommand) => {
+  const METADATA = JSON.stringify({
+    headers: { from: 'Alice <alice@example.com>', to: 'me@example.com', cc: 'Carol <carol@law-firm.example>', subject: 'Contract terms' },
+  });
+
+  const promptedDetails = async (args: Record<string, unknown>, metadata = METADATA) => {
+    vi.mocked(runner.run).mockResolvedValue(METADATA);
+    if (metadata !== METADATA) vi.mocked(runner.run).mockResolvedValue(metadata);
+    let request: ElicitRequest | undefined;
+    const harness = await setupHandlers(async (value) => {
+      request = value;
+      return { action: 'decline' };
+    });
+    const result = await harness.callTool(tool, { messageId: 'm1', ...args });
+    return {
+      result,
+      request,
+      details: (JSON.parse(request?.params.message.split('\n').slice(1).join('\n') ?? '{}') as {
+        details?: Record<string, unknown>;
+      }).details ?? {},
+    };
+  };
+
+  it('elicits the resolved recipients and sends nothing when the user declines', async () => {
+    const { result, request, details } = await promptedDetails({ body: 'Sounds good' });
+    expect(runner.run).toHaveBeenCalledTimes(2);
+    expect(runner.run).toHaveBeenCalledWith(['gmail', 'get', 'm1', '--format=metadata'], { account: undefined });
+    expect(request?.params.requestedSchema).toEqual(expect.objectContaining({ type: 'object' }));
+    expect(JSON.parse(result.content[0].text as string)).toEqual(expect.objectContaining({
+      confirmed: false,
+      cancelled: true,
+      action: `gmail.${subcommand}`,
+    }));
+    if (subcommand === 'reply') {
+      expect(details.recipients).toEqual(['alice@example.com']);
+    } else {
+      expect(details.recipients).toEqual(['alice@example.com', 'me@example.com', 'carol@law-firm.example']);
+    }
+  });
+
+  it('sends nothing when the user accepts but leaves confirmation false', async () => {
+    vi.mocked(runner.run).mockResolvedValue(METADATA);
+    const harness = await setupHandlers(async () => ({ action: 'accept', content: { confirmed: false } }));
+    const result = await harness.callTool(tool, { messageId: 'm1', body: 'x' });
+    expect(runner.run).toHaveBeenCalledTimes(2);
+    expect(JSON.parse(result.content[0].text as string).cancelled).toBe(true);
+  });
+
+  it('falls back to "Re: <original subject>" in the prompt when no subject override is given', async () => {
+    const { details } = await promptedDetails({ body: 'x' });
+    expect(details.subject).toBe('Re: Contract terms');
+  });
+
+  it('prefers an explicit subject override in the prompt over the inherited one', async () => {
+    const { details } = await promptedDetails({ body: 'x', subject: 'Custom subject' });
+    expect(details.subject).toBe('Custom subject');
+  });
+
+  it('actually sends and logs the resolved recipients after the user accepts', async () => {
+    vi.mocked(runner.run)
+      .mockResolvedValueOnce(METADATA)
+      .mockResolvedValueOnce(METADATA)
+      .mockResolvedValueOnce('{"id":"sent1"}');
+    const writeSpy = vi.spyOn(process.stderr, 'write').mockImplementation(() => true);
+    const harness = await setupHandlers();
+    const result = await harness.callTool(tool, { messageId: 'm1', body: 'Sounds good' });
+    expect(runner.run).toHaveBeenCalledTimes(3);
+    expect(runner.run).toHaveBeenNthCalledWith(1, ['gmail', 'get', 'm1', '--format=metadata'], { account: undefined });
+    expect(runner.run).toHaveBeenNthCalledWith(
+      3,
+      ['gmail', subcommand, 'm1', '--body=Sounds good', '--auto-from-addressed-alias=false'],
+      { account: undefined },
+    );
+    expect(result.content[0].text).toBe('{"id":"sent1"}');
+    const event = JSON.parse((writeSpy.mock.calls.at(-1)?.[0] as string).trim());
+    expect(event.event).toBe('gmail_dispatch');
+    expect(event.tool).toBe(tool);
+    expect(event.recipientCount).toBeGreaterThan(0);
+    writeSpy.mockRestore();
+  });
+
+  it('does not log when the accepted send itself fails', async () => {
+    vi.mocked(runner.run)
+      .mockResolvedValueOnce(METADATA)
+      .mockResolvedValueOnce(METADATA)
+      .mockRejectedValueOnce(new Error('quota exceeded'));
+    const writeSpy = vi.spyOn(process.stderr, 'write').mockImplementation(() => true);
+    const harness = await setupHandlers();
+    const result = await harness.callTool(tool, { messageId: 'm1', body: 'x' });
+    expect(result.isError).toBe(true);
+    expect(writeSpy).not.toHaveBeenCalled();
+    writeSpy.mockRestore();
+  });
+
+  it('surfaces a bad messageId as a diagnosed error, without ever building a preview', async () => {
+    vi.mocked(runner.run).mockRejectedValue(new Error('message not found'));
+    const harness = await setupHandlers();
+    const result = await harness.callTool(tool, { messageId: 'bad', body: 'x' });
+    expect(result.isError).toBe(true);
+    expect(result.content[0].text).toContain('message not found');
+  });
+
+  it('measures bodyLength from bodyHtml when no plain body is given', async () => {
+    const { details } = await promptedDetails({ bodyHtml: '<p>Hi</p>' });
+    expect(details.bodyLength).toBe('<p>Hi</p>'.length);
+  });
+
+  it('measures bodyLength as zero when neither body nor bodyHtml is given', async () => {
+    const { details } = await promptedDetails({});
+    expect(details.bodyLength).toBe(0);
+  });
+
+  it('ignores a non-string header value in the metadata response', async () => {
+    const { details } = await promptedDetails({ body: 'x' }, JSON.stringify({
+      headers: { from: 'alice@example.com', subject: 42 },
+    }));
+    expect(details.recipients).toEqual(['alice@example.com']);
+    expect(details.subject).toBeUndefined();
+  });
+
+  it('treats an unparseable metadata response as empty headers rather than crashing', async () => {
+    const { details } = await promptedDetails({ body: 'x' }, 'not json at all');
+    expect(details.recipients).toEqual([]);
+  });
+
+  it('applies to/cc/bcc adds and remove drops on top of the inherited recipients in the prompt', async () => {
+    const { details } = await promptedDetails({
+      body: 'x', to: ['dave@example.com'], remove: ['carol@law-firm.example'],
+    });
+    expect(details.recipients).not.toContain('carol@law-firm.example');
+    expect(details.recipients).toContain('dave@example.com');
+  });
+});
+
 describe('gog_gmail_reply body-vs-file conflicts', () => {
   it('rejects bodyHtml plus bodyHtmlFile before gog runs', async () => {
     vi.mocked(runner.run).mockResolvedValue('{}');
@@ -699,7 +931,9 @@ describe('gog_gmail_reply body-vs-file conflicts', () => {
   it('passes bodyHtmlFile alone through as --body-html-file', async () => {
     vi.mocked(runner.run).mockResolvedValue('{}');
     const harness = await setupHandlers();
-    await harness.callTool('gog_gmail_reply', { messageId: 'm1', body: 'Hi', bodyHtmlFile: '/tmp/b.html' });
+    await harness.callTool('gog_gmail_reply', {
+      messageId: 'm1', body: 'Hi', bodyHtmlFile: '/tmp/b.html',
+    });
     expect(runner.run).toHaveBeenCalledWith(
       ['gmail', 'reply', 'm1', '--body=Hi', '--body-html-file=/tmp/b.html', '--auto-from-addressed-alias=false'],
       { account: undefined },
@@ -729,17 +963,13 @@ describe('gog_gmail_reply body-vs-file conflicts', () => {
 // timeout. No file param may advertise it as usable.
 describe('reply file params never advertise stdin as usable', () => {
   it.each(['gog_gmail_reply', 'gog_gmail_reply_all'])('%s.bodyHtmlFile warns that stdin hangs', async (tool) => {
-    const { McpServer } = await import('@modelcontextprotocol/sdk/server/mcp.js');
-    const server = new McpServer({ name: 'test', version: '0.0.0' });
-    const configs = new Map<string, Record<string, { description?: string }>>();
-    vi.spyOn(server, 'registerTool').mockImplementation((name, config) => {
-      configs.set(name, (config as { inputSchema: Record<string, { description?: string }> }).inputSchema);
-      return undefined as never;
-    });
-    registerGmailTools(server);
-    const desc = configs.get(tool)?.bodyHtmlFile?.description ?? '';
+    const harness = await setupHandlers();
+    const listed = (await harness.client.listTools()).tools.find((candidate) => candidate.name === tool);
+    const properties = listed?.inputSchema.properties as Record<string, { description?: string }> | undefined;
+    const desc = properties?.bodyHtmlFile?.description ?? '';
     expect(desc).not.toBe('');
     expect(desc).not.toMatch(/(?:or|use)\s+"?-"?\s+(?:for|to read)/i);
     expect(desc).toMatch(/stdin/i);
+    expect(properties).not.toHaveProperty('confirmed');
   });
 });

package/tests/tools/sheets.test.ts

@@ -1,5 +1,5 @@
 import { describe, it, expect, vi, beforeEach } from 'vitest';
-import { McpServer } from '@modelcontextprotocol/sdk/server/mcp.js';
+import { McpServer } from '@modelcontextprotocol/server';
 import { registerSheetsTools } from '../../src/tools/sheets.js';
 import * as runner from '../../src/runner.js';
 import { createTestHarness } from '@chrischall/mcp-utils/test';

package/tests/zod-single-copy.test.ts

@@ -38,10 +38,10 @@ describe('zod is installed exactly once', () => {
     expect(resolveFrom('@chrischall/mcp-utils')).toBe(realpathSync(here.resolve('zod')));
   });
 
-  it('resolves to the same file for the MCP SDK, which types every tool schema', () => {
+  it('resolves to the same file for the MCP server SDK, which types every tool schema', () => {
     // `registerTool` accepts the raw shape and infers the handler's argument
     // types from it; a second copy makes every one of those schemas foreign.
-    expect(resolveFrom('@modelcontextprotocol/sdk/server/mcp.js')).toBe(
+    expect(resolveFrom('@modelcontextprotocol/server')).toBe(
       realpathSync(here.resolve('zod')),
     );
   });

package/tsconfig.json

@@ -5,8 +5,6 @@
     "rootDir": "./src"
   },
   "include": ["src/**/*"],
-  // src/worker.ts is the Cloudflare-Worker entry: it imports
-  // @chrischall/mcp-connector (which pulls the `agents` runtime + Cloudflare
-  // types) and is compiled by wrangler/esbuild, not by this stdio tsc build.
+  // The Worker entry is compiled by wrangler/esbuild, not the stdio build.
   "exclude": ["node_modules", "dist", "src/worker.ts"]
 }

package/vitest.config.ts

@@ -30,11 +30,9 @@ export default defineConfig({
       include: ['src/**/*.ts'],
       exclude: [
         'src/index.ts',
-        // src/worker.ts is the only Worker-path file that can't load under the
-        // node pool (it imports the `@chrischall/mcp-connector`/`agents` runtime);
-        // it's exercised by the Workers pool suite (`npm run worker:test`). Its
-        // testable helpers live in src/connector-runtime.ts, and src/connector-auth.ts
-        // is node-loadable — both are unit-tested here and stay in the 100% gate.
+        // The Worker-only entry is exercised by the Workers pool suite
+        // (`npm run worker:test`). Its node-loadable helpers stay in this
+        // suite and its 100% gate.
         'src/worker.ts',
       ],
       thresholds: {