gogcli-mcp 2.30.0 → 4.0.0

package/src/blob-urls.ts

@@ -56,11 +56,9 @@ import { readEnvVar } from '@chrischall/mcp-utils';
  * that is easy to get wrong is exactly the part below — which bytes are signed,
  * and which of them are percent-encoded on the way into the URL.
  *
- * `node:crypto` rather than WebCrypto (which `google-token.ts` uses, for the
- * Worker build): HMAC through `crypto.subtle` is async, and a URL minter that
- * returns a promise infects every call site for no gain here. The Worker build
- * sets `nodejs_compat` (wrangler.jsonc), so `createHmac` resolves there too if
- * this module is ever pulled into that graph.
+ * `node:crypto` rather than WebCrypto: HMAC through `crypto.subtle` is async,
+ * and a URL minter that returns a promise infects every call site for no gain
+ * here.
  */
 
 /**

package/src/bootstrap-auth.ts

@@ -0,0 +1,97 @@
+import { join } from 'node:path';
+import { readEnvVar } from '@chrischall/mcp-utils';
+import { redactSecrets, run, type GogFileArg, type Spawner } from './runner.js';
+import { errorText } from './tools/utils.js';
+
+export type AuthBootstrapStatus = 'unconfigured' | 'incomplete' | 'present' | 'imported' | 'failed';
+
+export interface AuthBootstrapOptions {
+  spawner?: Spawner;
+  /** Where the marker lives. Defaults to the OS home dir, which is mcp-host's persistent dataDir. */
+  home?: string;
+}
+
+export const AUTH_BOOTSTRAP_MARKER = 'auth-bootstrap.sha256';
+
+const VARS = ['GOG_CLIENT_ID', 'GOG_CLIENT_SECRET', 'GOG_REFRESH_TOKEN', 'GOG_ACCOUNT'] as const;
+
+const log = (line: string): void => {
+  process.stderr.write(`[gogcli-mcp] auth bootstrap: ${line}\n`);
+};
+
+const jsonFile = (name: string, payload: unknown): GogFileArg => ({
+  kind: 'file',
+  flag: name,
+  ext: 'json',
+  contents: JSON.stringify(payload),
+  positional: true,
+});
+
+async function accountListed(account: string, spawner: Spawner | undefined): Promise<boolean> {
+  try {
+    const out = await run(['auth', 'list'], { spawner, account });
+    const accounts = (JSON.parse(out) as { accounts?: { email?: string }[] | null }).accounts ?? [];
+    return accounts.some((a) => a.email?.toLowerCase() === account.toLowerCase());
+  } catch {
+    return false;
+  }
+}
+
+/**
+ * Seed gog's keyring from GOG_CLIENT_ID / GOG_CLIENT_SECRET / GOG_REFRESH_TOKEN
+ * / GOG_ACCOUNT, for a host (mcp-host) that can inject secrets but cannot run
+ * `gog auth add` in a browser. Never throws: the server must still start so the
+ * auth tools stay reachable.
+ *
+ * The marker records WHICH secret was last imported, so a rotated secret is
+ * re-imported while an in-connector re-auth (gog_auth_add_url/complete) is left
+ * in effect until the secret itself changes.
+ */
+export async function bootstrapGogAuth(
+  env: NodeJS.ProcessEnv = process.env,
+  options: AuthBootstrapOptions = {},
+): Promise<AuthBootstrapStatus> {
+  const values = VARS.map((key) => readEnvVar(key, { env }));
+  const missing = VARS.filter((_key, i) => values[i] === undefined);
+  if (missing.length === VARS.length) return 'unconfigured';
+  if (missing.length > 0) {
+    log(`skipped, missing ${missing.join(', ')}`);
+    return 'incomplete';
+  }
+  const [clientId, clientSecret, refreshToken, account] = values as string[];
+  const { spawner } = options;
+
+  try {
+    const { createHash } = await import('node:crypto');
+    const { mkdir, readFile, writeFile, chmod } = await import('node:fs/promises');
+    const home = options.home ?? (await import('node:os')).homedir();
+    const dir = join(home, '.gogcli-mcp');
+    const marker = join(dir, AUTH_BOOTSTRAP_MARKER);
+    const fingerprint = createHash('sha256').update(values.join('\0')).digest('hex');
+
+    const previous = await readFile(marker, 'utf8').catch(() => undefined);
+    if (previous === fingerprint && (await accountListed(account, spawner))) return 'present';
+
+    await run(
+      ['auth', 'credentials', 'set', jsonFile('credentials', { installed: { client_id: clientId, client_secret: clientSecret } })],
+      { spawner, account },
+    );
+    await run(
+      ['auth', 'tokens', 'import', jsonFile('token', { email: account, refresh_token: refreshToken })],
+      { spawner, account },
+    );
+
+    await mkdir(dir, { recursive: true, mode: 0o700 });
+    await chmod(dir, 0o700);
+    await writeFile(marker, fingerprint, { mode: 0o600 });
+    await chmod(marker, 0o600);
+    return 'imported';
+  } catch (err) {
+    // run() already redacts; the literal values are scrubbed too in case a
+    // secret shape the redactor does not know (e.g. GOCSPX-…) was echoed.
+    let message = redactSecrets(errorText(err));
+    for (const value of [clientSecret, refreshToken]) message = message.split(value).join('[REDACTED]');
+    log(`failed, ${message}`);
+    return 'failed';
+  }
+}

package/src/gmail-dispatch-guard.ts

@@ -0,0 +1,106 @@
+import type { CallToolResult, InputRequiredResult, ServerContext } from '@modelcontextprotocol/server';
+import { readEnvVar, requireConfirmation } from '@chrischall/mcp-utils';
+
+// ============================================================================
+// THE SAFETY RAIL. gog_gmail_reply / reply_all / send / forward / autoreply are
+// the only tools in this fleet that put a message irreversibly into someone
+// else's mailbox on the FIRST call. Every other Gmail write either stages
+// something (drafts) or acts on mail already in this account (labels,
+// archive, trash). A caller that meant "save a draft" and picked the wrong
+// tool — or an agent that inherited the wrong reply target — used to find out
+// only after the send API call already succeeded.
+//
+// MCP elicitation makes the first round inert: it returns an input_required
+// result containing the preview, and only the protocol retry carrying the
+// user's accepted confirmation dispatches. The confirmation is never a tool
+// argument, so a model cannot bypass the user by setting a boolean itself.
+// ============================================================================
+/** Apply the shared stateless confirmation flow with Gmail-specific copy. */
+export function requireGmailDispatchConfirmation(
+  ctx: ServerContext,
+  op: string,
+  details: Record<string, unknown>,
+): InputRequiredResult | CallToolResult | undefined {
+  return requireConfirmation(ctx, {
+    action: op,
+    message: 'Review and confirm this email dispatch:',
+    details,
+    confirmationLabel: 'Confirm that this email should be sent now.',
+  });
+}
+
+// Over-inclusive on purpose: this feeds an audit log and a caller-facing
+// preview, neither of which is the enforcement point (the protocol gate is).
+// Missing a real recipient would be the dangerous direction of error; catching
+// an extra email-shaped substring is not.
+const EMAIL_PATTERN = /[a-z0-9!#$%&'*+/=?^_`{|}~.-]+@[a-z0-9-]+(?:\.[a-z0-9-]+)+/gi;
+
+export function extractEmails(...values: Array<string | undefined | null>): string[] {
+  const seen = new Set<string>();
+  const out: string[] = [];
+  for (const value of values) {
+    if (!value) continue;
+    const matches = value.match(EMAIL_PATTERN);
+    if (!matches) continue;
+    for (const match of matches) {
+      const lower = match.toLowerCase();
+      if (!seen.has(lower)) {
+        seen.add(lower);
+        out.push(lower);
+      }
+    }
+  }
+  return out;
+}
+
+// GOG_GMAIL_TRUSTED_DOMAINS names domains that are never "external" — by
+// default just the sending account's own domain, so a reply-all that includes
+// the account itself never reads as a surprise. Comma-separated, additive.
+function trustedDomains(account: string | undefined): Set<string> {
+  const domains = new Set<string>();
+  const raw = readEnvVar('GOG_GMAIL_TRUSTED_DOMAINS');
+  if (raw) {
+    for (const part of raw.split(',')) {
+      const domain = part.trim().toLowerCase();
+      if (domain) domains.add(domain);
+    }
+  }
+  const acct = account ?? readEnvVar('GOG_ACCOUNT');
+  const at = acct?.indexOf('@') ?? -1;
+  if (acct && at > -1) domains.add(acct.slice(at + 1).toLowerCase());
+  return domains;
+}
+
+// A distinguishable, greppable event for every mail dispatch — recipient
+// count plus whichever recipients fall outside the trusted-domain list — so an
+// unexpected external send (outside counsel, a wrong-number alias) can be
+// caught after the fact even if the confirmation step above is somehow
+// bypassed by a future caller. stdout is the JSON-RPC channel, so this goes to
+// stderr like every other diagnostic in this repo.
+export function logGmailDispatch(tool: string, recipients: string[], account?: string): void {
+  const domains = trustedDomains(account);
+  const externalRecipients = recipients.filter((recipient) => {
+    const at = recipient.indexOf('@');
+    const domain = at > -1 ? recipient.slice(at + 1) : '';
+    return !domain || !domains.has(domain);
+  });
+  const event = {
+    event: 'gmail_dispatch',
+    tool,
+    recipientCount: recipients.length,
+    externalRecipientCount: externalRecipients.length,
+    hasExternalRecipients: externalRecipients.length > 0,
+    externalRecipients,
+    timestamp: new Date().toISOString(),
+  };
+  process.stderr.write(`${JSON.stringify(event)}\n`);
+}
+
+// The single place a CallToolResult's text is pulled back out, for the tools
+// here that need to read gog's own JSON before deciding what to preview or
+// log. Mirrors the shape every runOrDiagnose result actually returns
+// (content[0].text); never throws on an unexpected shape.
+export function resultText(result: CallToolResult): string {
+  const first = result.content[0];
+  return first && first.type === 'text' && typeof first.text === 'string' ? first.text : '{}';
+}

package/src/gmail-results.ts

@@ -1,4 +1,4 @@
-import type { CallToolResult } from '@modelcontextprotocol/sdk/types.js';
+import type { CallToolResult } from '@modelcontextprotocol/server';
 import { rawTextResult } from '@chrischall/mcp-utils';
 import { run } from './runner.js';
 import { annotateTruncation, hasMorePages } from './pagination.js';

package/src/index.ts

@@ -1,12 +1,11 @@
 #!/usr/bin/env node
 import { runMcp } from '@chrischall/mcp-utils';
 import { BASE_TOOL_REGISTRARS, VERSION } from './server.js';
-import { useRemoteGogRunner } from './remote-runner.js';
+import { bootstrapGogAuth } from './bootstrap-auth.js';
 
 
-// Execute `gog` on the Fly backend when the host points us at one; without
-// it, nothing changes and we spawn the local binary as before.
-useRemoteGogRunner();
+// Seed gog's keyring from GOG_CLIENT_ID/SECRET/REFRESH_TOKEN/ACCOUNT when the host injects them.
+await bootstrapGogAuth();
 
 await runMcp({
   name: 'gogcli',

package/src/lib.ts

@@ -21,7 +21,17 @@ export {
 // same tool name from both registrar lists would be a duplicate-name error.
 export { replySchema, appendReplyFlags } from './tools/gmail.js';
 export type { ReplyFlags } from './tools/gmail.js';
-export { run, runBinary, runExecutor, isGogFileArg, MIN_GOG_VERSION } from './runner.js';
+// The gmail confirmation gate — gog_gmail_reply/send/forward/autoreply are
+// the only tools that dispatch mail irreversibly on the first call. The
+// gmail sub-package's send-side forward/autoreply tools reuse these directly
+// rather than re-declaring the gate; the draft-side twins never import them.
+export {
+  extractEmails,
+  logGmailDispatch,
+  requireGmailDispatchConfirmation,
+  resultText,
+} from './gmail-dispatch-guard.js';
+export { run, runBinary, isGogFileArg, MIN_GOG_VERSION } from './runner.js';
 // Sub-package tools that read gog JSON through bare `run()` (rather than the
 // `runOrDiagnose` seam) must still apply this, or their timestamps skip the
 // offset repair and the `<field>Display` sibling every other tool returns.
@@ -32,11 +42,12 @@ export { annotateTruncatedList, stripConsumedPageToken } from './pagination.js';
 // guarantees the base gog_gmail_search makes.
 export { finalizeGmailSearch, fetchGmailPages } from './gmail-results.js';
 export type { FinalizeOptions, GmailListMethod } from './gmail-results.js';
-export { useRemoteGogRunner } from './remote-runner.js';
-export type { RunOptions, Spawner, GogExecutor, GogArg, GogFileArg } from './runner.js';
+export { bootstrapGogAuth, AUTH_BOOTSTRAP_MARKER } from './bootstrap-auth.js';
+export type { AuthBootstrapStatus, AuthBootstrapOptions } from './bootstrap-auth.js';
+export type { RunOptions, Spawner, GogArg, GogFileArg } from './runner.js';
 // Caller-supplied attachment bytes — the only outbound attachment path that
-// works when the caller and gog share no filesystem (hosted connector, or any
-// GOG_RUNNER_URL backend). See src/attachments.ts.
+// works when the caller and gog share no filesystem (a hosted deployment such
+// as mcp-host). See src/attachments.ts.
 export {
   attachInlineParam,
   inlineAttachmentSchema,
@@ -78,8 +89,12 @@ export {
   BLOB_URL_DEFAULT_TTL_MS,
 } from './blob-urls.js';
 export type { BlobStoreConfig, BlobUrlMinter, MintOptions } from './blob-urls.js';
-// The other half of that hop: under the hosted connector the bytes are on the
-// RUNNER's disk and this child never sees them, so the runner is asked to
-// stream them to the URL this process minted. See src/blob-upload.ts.
-export { uploadToBlobStore, RUNNER_UPLOAD_TIMEOUT_MS } from './blob-upload.js';
+// The other half of that hop: stream a downloaded attachment off this machine's
+// disk to the URL this process minted. See src/blob-upload.ts.
+export {
+  uploadToBlobStore,
+  ATTACHMENT_DOWNLOAD_ROOT,
+  BLOB_UPLOAD_TIMEOUT_MS,
+  MAX_BLOB_UPLOAD_BYTES,
+} from './blob-upload.js';
 export type { BlobUploadRequest, BlobUploadOutcome, BlobUploadOptions } from './blob-upload.js';

package/src/pagination.ts

@@ -1,4 +1,4 @@
-import type { CallToolResult } from '@modelcontextprotocol/sdk/types.js';
+import type { CallToolResult } from '@modelcontextprotocol/server';
 import { rawTextResult } from '@chrischall/mcp-utils';
 
 // gog reports an exhausted cursor as `"nextPageToken": ""` rather than omitting

package/src/runner.ts

@@ -1,4 +1,3 @@
-import { AsyncLocalStorage } from 'node:async_hooks';
 import type { ChildProcess } from 'node:child_process';
 import { delimiter, join } from 'node:path';
 import { parseBoolEnv, readEnvVar, redactSecrets as redactSharedSecrets } from '@chrischall/mcp-utils';
@@ -9,12 +8,11 @@ export type Spawner = (
   options: { env: NodeJS.ProcessEnv },
 ) => ChildProcess;
 
-// A payload too large to live in argv. Every argv element is capped — the Fly
-// runner rejects args over 4 KiB, and the Linux kernel hard-caps a single argv
-// string at MAX_ARG_STRLEN (128 KiB) regardless of ARG_MAX — so big values
-// (a long HTML mail body, slide notes) must leave argv entirely. gog exposes
-// `--x-file` companions for exactly these flags; the executor writes the
-// payload to a private temp file and passes the path instead.
+// A payload too large to live in argv. The Linux kernel hard-caps a single argv
+// string at MAX_ARG_STRLEN (128 KiB) regardless of ARG_MAX, so big values (a
+// long HTML mail body, slide notes) must leave argv entirely. gog exposes
+// `--x-file` companions for exactly these flags; the runner writes the payload
+// to a private temp file and passes the path instead.
 export interface GogFileArg {
   /** Discriminant separating this from a plain argv string. */
   kind: 'file';
@@ -50,9 +48,8 @@ export interface GogFileArg {
    * Emit the materialized path as a BARE argv element instead of `--flag=path`.
    *
    * For subcommands taking the file as a positional argument — `gog drive
-   * upload <localPath>` is the only one today. Argument ORDER is preserved by
-   * every executor, so a positional file arg lands exactly where it sat in the
-   * caller's array.
+   * upload <localPath>` is the only one today. Argument ORDER is preserved, so
+   * a positional file arg lands exactly where it sat in the caller's array.
    */
   positional?: boolean;
 }
@@ -63,114 +60,6 @@ export function isGogFileArg(arg: GogArg): arg is GogFileArg {
   return typeof arg !== 'string';
 }
 
-// An executor runs a FULLY-ASSEMBLED gog arg list (already including
-// --json/--no-input/--color=never, --account, --readonly, and the service
-// subcommand) and returns its stdout as a string (or throws). This is the
-// injection seam that lets the same tool registrars run either by spawning
-// `gog` (stdio transport) or by forwarding the arg list to a remote HTTP
-// backend (hosted Cloudflare-Worker connector, which cannot spawn processes).
-// Elements may be GogFileArgs; EVERY executor is responsible for materializing
-// them to a private temp file and removing that file afterwards.
-export type GogExecutor = (
-  args: GogArg[],
-  opts: { timeout?: number; interactive?: boolean },
-) => Promise<string>;
-
-// Which layer authored a failure, when the layer was OURS and not gog's.
-//
-// A remote executor (the Fly/Worker path) can fail in two categorically
-// different ways, and every consumer downstream needs to tell them apart:
-//
-//   - `gog` ran on the backend and failed. The message is gog's — or Google's,
-//     relayed by gog — so it is PROSE, and the only way to classify it is to
-//     read it. That failure is NOT a RunnerTransportError; it stays a plain
-//     Error so tools/utils.ts keeps applying its patterns to it.
-//   - The request never got that far: the runner rejected our bearer token,
-//     refused the request shape, was draining, or never answered. Nothing was
-//     ever shown to Google, so no amount of re-authorizing a Google account can
-//     help — and the runner's own words ("unauthorized") are indistinguishable
-//     from Google's when read as prose. That is what this type exists for.
-//
-// The kinds, and what each one asks of the caller:
-//   transport-auth      the runner rejected OUR bearer (GOG_RUNNER_KEY on the
-//                       Worker vs RUNNER_KEY on the Fly app). An operator has
-//                       to fix a key; the end user's Google grant is fine.
-//   transport-request   the runner refused the request shape (oversized arg,
-//                       malformed JSON). Deterministic; retrying is pointless.
-//   transport-retryable the runner is draining, could not reach its disk, or
-//                       never answered. The same call can succeed shortly.
-export type RunnerFailureKind = 'transport-auth' | 'transport-request' | 'transport-retryable';
-
-// `Symbol.for`, not a private symbol or a bare `instanceof`: the class can be
-// evaluated more than once in one process (the stdio bundle and the Worker
-// bundle are separate builds of the same source, and vitest can load a module
-// twice across pools), and a second copy of the class would make `instanceof`
-// answer false for an error that IS one. The registry symbol is the same value
-// in every copy, so the brand survives.
-const RUNNER_TRANSPORT_BRAND = Symbol.for('gogcli.RunnerTransportError');
-
-/**
- * A failure authored by the gog-runner itself (or by the hop to it) rather than
- * by `gog`/Google. Carries the runner's HTTP status when there was one.
- */
-export class RunnerTransportError extends Error {
-  readonly kind: RunnerFailureKind;
-  readonly status: number | undefined;
-
-  constructor(message: string, kind: RunnerFailureKind, status?: number) {
-    super(message);
-    this.name = 'RunnerTransportError';
-    this.kind = kind;
-    this.status = status;
-    // Non-enumerable so the brand never shows up in a serialized error body.
-    Object.defineProperty(this, RUNNER_TRANSPORT_BRAND, { value: true });
-  }
-}
-
-/** Structural check for the above — see RUNNER_TRANSPORT_BRAND on why not `instanceof`. */
-export function isRunnerTransportError(err: unknown): err is RunnerTransportError {
-  return err instanceof Error && (err as unknown as Record<symbol, unknown>)[RUNNER_TRANSPORT_BRAND] === true;
-}
-
-// Ambient override for the executor `run()` uses when no options.spawner is
-// given. The Worker/Fly path wraps request handling in
-// `runExecutor.run({ executor }, ...)`; unset, `run()` falls back to spawning.
-export const runExecutor = new AsyncLocalStorage<{ executor: GogExecutor }>();
-
-/**
- * The PROCESS-WIDE executor, for a host that has exactly one backend for the
- * whole process — a stdio bin pointed at a Fly runner (`useRemoteGogRunner`).
- *
- * It exists because AsyncLocalStorage cannot express that. `enterWith` sets the
- * store on the async resource that is current when it runs, and a bin runs it
- * during module evaluation; the tool calls arrive later as I/O events on the
- * transport's own resources, which are not descendants of that evaluation, so
- * `getStore()` is undefined exactly where it is needed. That is not a bug in
- * `enterWith` — a process-lifetime default is simply not a scoped value, and
- * storing it in a scope meant the seam silently reverted to spawning a binary
- * the host does not have.
- *
- * A per-request store still WINS over this (see `activeExecutor`), because the
- * Worker serves many callers from one isolate and each has its own backend
- * credential; this is the fallback for the one-backend case, never a second
- * answer to "whose backend is this".
- */
-let defaultExecutor: { executor: GogExecutor } | undefined;
-
-/** Install the process-wide executor. Passing undefined clears it (tests). */
-export function setDefaultGogExecutor(executor: GogExecutor | undefined): void {
-  defaultExecutor = executor ? { executor } : undefined;
-}
-
-/**
- * Whose executor applies right now: the request's, else the process's, else
- * none (meaning `run()` spawns the local binary). Both call sites ask through
- * here so they can never disagree about which of the three it is.
- */
-function activeExecutor(): { executor: GogExecutor } | undefined {
-  return runExecutor.getStore() ?? defaultExecutor;
-}
-
 export interface RunOptions {
   account?: string;
   spawner?: Spawner;
@@ -238,13 +127,11 @@ function readonlyEnvEnabled(): boolean {
 // cloud / API secrets in scope that the child has no business seeing.
 //
 // `_KEY`, not `_API_KEY|_PRIVATE_KEY`: those were four spellings of "a key"
-// with the bare one missing, and TWO credentials this repo hands its own
-// process fell in that gap. `MCP_BLOB_SIGNING_KEY` mints the signed blob URLs
-// a `deliver="url"` download is uploaded to — a signature IS the whole access
-// control on that store — and `GOG_RUNNER_KEY` is the bearer for the Fly
-// backend, where `POST /run` is arbitrary `gog` argv. Neither is read by the
-// child: both are spent HERE, and when `GOG_RUNNER_URL` is set nothing is
-// spawned at all. `_CREDENTIALS` generalises the named
+// with the bare one missing, and a credential this repo hands its own process
+// fell in that gap. `MCP_BLOB_SIGNING_KEY` mints the signed blob URLs a
+// `deliver="url"` download is uploaded to — a signature IS the whole access
+// control on that store — and it is spent HERE, never read by the child.
+// `_CREDENTIALS` generalises the named
 // GOOGLE_APPLICATION_CREDENTIALS above, which stays named because it is the
 // one gog itself would act on.
 //
@@ -411,10 +298,6 @@ function formatTimeout(ms: number): string {
 // Write every GogFileArg to a private temp file, run gog against the resulting
 // plain argv, and remove the temp dir afterwards — on success, on a non-zero
 // exit, and on timeout alike. A leaked temp file holds user email content.
-//
-// node:fs/promises and node:os are imported LAZILY (matching the lazy
-// node:child_process import below) so a Cloudflare Worker importing this module
-// doesn't eagerly pull node builtins, which would break the Worker bundle.
 async function spawnWithTempFiles(
   args: GogArg[],
   opts: { timeout?: number; interactive?: boolean; spawner?: Spawner; binary?: boolean },
@@ -460,7 +343,7 @@ async function spawnWithTempFiles(
   }
 }
 
-// Spawn-based executor. Deliberately NOT async: when no element is a
+// Spawn gog, materializing GogFileArgs first. Deliberately NOT async: when no element is a
 // GogFileArg (the overwhelmingly common case) it must create no temp dir and
 // introduce no extra microtask tick before `spawn` is called — the spawn has
 // to happen synchronously within the `run()` call, which the fake-timer tests
@@ -477,11 +360,8 @@ function spawnExecutor(
 
 // Owns everything process-specific — building the sanitized child env, PATH
 // augmentation, spawning, collecting stdout/stderr, and the timeout kill. It
-// returns raw output (no redaction — `run()` wraps that around whichever
-// executor runs). The child_process import is LAZY so a Cloudflare Worker
-// importing this module doesn't eagerly pull node:child_process (which would
-// break the Worker bundle); the injected `spawner` bypasses it.
-
+// returns raw output (no redaction — `run()` wraps that around it). The
+// injected `spawner` bypasses the real child_process spawn.
 async function spawnGog(
   fullArgs: string[],
   opts: { timeout?: number; interactive?: boolean; spawner?: Spawner; binary?: boolean },
@@ -583,58 +463,26 @@ export async function run(args: GogArg[], options: RunOptions = {}): Promise<str
 
   const fullArgs = assembleArgs(args, { account, interactive, readonly });
 
-  // Pick the executor: an injected spawner keeps the stdio spawn path (and all
-  // its tests) intact and always wins; otherwise an ambient runExecutor store
-  // (the Worker/Fly HTTP-forward path) takes over; otherwise the default lazy
-  // real spawn. Redaction wraps the executor regardless of which one runs — a
-  // successful `gog auth tokens` (or any command echoing a credential) would
-  // otherwise return raw Google tokens (ya29.…/1//…) into model context, where
-  // a sibling tool (gog_gmail_send) could exfiltrate them.
-  const store = activeExecutor();
+  // Redaction wraps the spawn: a successful `gog auth tokens` (or any command
+  // echoing a credential) would otherwise return raw Google tokens (ya29.…/1//…)
+  // into model context, where a sibling tool (gog_gmail_send) could exfiltrate
+  // them.
   try {
-    let output: string;
-    if (spawner) {
-      output = await spawnExecutor(fullArgs, { timeout, interactive, spawner });
-    } else if (store) {
-      output = await store.executor(fullArgs, { timeout, interactive });
-    } else {
-      output = await spawnExecutor(fullArgs, { timeout, interactive });
-    }
-    return redact(output);
+    return redact(await spawnExecutor(fullArgs, { timeout, interactive, spawner }));
   } catch (err) {
     // A thrown non-Error would make `.message` undefined and redact() blow up
     // with a TypeError, masking the real failure. Same instanceof guard the
     // codebase already uses in errorText() (tools/utils.ts).
-    const message = base(err instanceof Error ? err.message : String(err));
-    // Redaction must not cost the error its TYPE. `RunnerTransportError` is the
-    // structural claim "this failure was ours, not Google's"; flattening it to a
-    // bare Error here would put diagnose() straight back to guessing from prose,
-    // which is the bug this type exists to close. Rebuilt rather than mutated so
-    // the un-redacted message never survives anywhere.
-    if (isRunnerTransportError(err)) {
-      throw new RunnerTransportError(message, err.kind, err.status);
-    }
-    throw new Error(message);
+    throw new Error(base(err instanceof Error ? err.message : String(err)));
   }
 }
 
 // Run gog and return its stdout as raw bytes, base64-encoded — for binary
 // payloads (a Drive file's bytes) that run()'s utf8 decode + secret redaction
-// would corrupt. Spawn path only: the hosted-connector executor forwards over
-// HTTP and hands back a decoded string, so binary cannot survive it — callers
-// on that path get a clear error instead of a mangled file. No redaction: the
-// base64 of a user's own binary file is opaque and has no token shapes to leak.
+// would corrupt. No redaction: the base64 of a user's own binary file is opaque
+// and has no token shapes to leak.
 export async function runBinary(args: GogArg[], options: RunOptions = {}): Promise<string> {
   const { account, spawner, timeout, readonly = false } = options;
-  // An injected spawner is the stdio/test path and always wins. Otherwise, if an
-  // ambient forward executor is installed (the Worker/Fly connector), refuse:
-  // its text-only transport can't carry bytes intact.
-  if (!spawner && activeExecutor()) {
-    throw new Error(
-      'Raw byte retrieval is not available over the hosted connector (its transport is text-only). ' +
-      'Use the text-extraction path instead, or run the local stdio server to fetch bytes.',
-    );
-  }
   const fullArgs = assembleArgs(args, { account, interactive: false, readonly });
   return spawnExecutor(fullArgs, { timeout, interactive: false, spawner, binary: true });
 }

package/src/tools/api.ts

@@ -1,4 +1,4 @@
-import { McpServer } from '@modelcontextprotocol/sdk/server/mcp.js';
+import { McpServer } from '@modelcontextprotocol/server';
 import { z } from 'zod';
 import { accountParam, runOrDiagnose } from './utils.js';
 
@@ -10,10 +10,10 @@ export function registerApiTools(server: McpServer): void {
   server.registerTool('gog_api_list', {
     description: 'List the Google Discovery APIs available for gog_api_call / gog_api_describe (name + version + title).',
     annotations: { readOnlyHint: true },
-    inputSchema: {
+    inputSchema: z.object({
       all: z.boolean().optional().describe('Include every Discovery API (including preview/less-common ones) instead of the curated default set'),
       account: accountParam,
-    },
+    }),
   }, async ({ all, account }) => {
     const args = ['api', 'list'];
     if (all) args.push('--all');
@@ -23,12 +23,12 @@ export function registerApiTools(server: McpServer): void {
   server.registerTool('gog_api_describe', {
     description: 'Describe a Google Discovery API, or a single method within it — its parameters, request/response schema, and required OAuth scopes. Use this to discover the exact api/version/method and params before calling gog_api_call.',
     annotations: { readOnlyHint: true },
-    inputSchema: {
+    inputSchema: z.object({
       api: z.string().describe('Discovery API name (e.g. drive, gmail, calendar)'),
       version: z.string().describe('API version (e.g. v3, v1)'),
       method: z.string().optional().describe('Optional method id to describe a single method (e.g. files.list); omit to describe the whole API'),
       account: accountParam,
-    },
+    }),
   }, async ({ api, version, method, account }) => {
     const args = ['api', 'describe', api, version];
     if (method) args.push(method);
@@ -38,7 +38,7 @@ export function registerApiTools(server: McpServer): void {
   server.registerTool('gog_api_call', {
     description: 'Call any Discovery-described Google API method directly — an escape hatch for endpoints gog has no dedicated tool for. Find the exact api/version/method/params with gog_api_describe first. Read methods (GET/LIST) run as-is. Mutating methods (POST/PUT/PATCH/DELETE) are refused unless you set allowWrite=true — keep it false to preview, or set dryRun=true to print the intended request without sending it.',
     annotations: { destructiveHint: true },
-    inputSchema: {
+    inputSchema: z.object({
       api: z.string().describe('Discovery API name (e.g. drive, gmail, calendar)'),
       version: z.string().describe('API version (e.g. v3, v1)'),
       method: z.string().describe('Method id to call (e.g. files.list, files.create)'),
@@ -48,7 +48,7 @@ export function registerApiTools(server: McpServer): void {
       allowWrite: z.boolean().optional().describe('Required to invoke a mutating method (POST/PUT/PATCH/DELETE). Without it, gog refuses write methods. Leave unset for read-only calls.'),
       dryRun: z.boolean().optional().describe('Print the intended request and exit without sending it (no changes made)'),
       account: accountParam,
-    },
+    }),
   }, async ({ api, version, method, params, body, scope, allowWrite, dryRun, account }) => {
     const args = ['api', 'call', api, version, method];
     if (params) args.push(`--params=${params}`);