gogcli-mcp 2.30.0 → 4.0.0

package/src/tools/drive.ts

@@ -1,5 +1,5 @@
-import { McpServer } from '@modelcontextprotocol/sdk/server/mcp.js';
-import type { CallToolResult } from '@modelcontextprotocol/sdk/types.js';
+import { McpServer } from '@modelcontextprotocol/server';
+import type { CallToolResult } from '@modelcontextprotocol/server';
 import { z } from 'zod';
 import { rawTextResult, viewParam, resolveView } from '@chrischall/mcp-utils';
 
@@ -38,7 +38,7 @@ export function registerDriveTools(server: McpServer): void {
   server.registerTool('gog_drive_ls', {
     description: 'List files in a Google Drive folder (default: root).',
     annotations: { readOnlyHint: true },
-    inputSchema: {
+    inputSchema: z.object({
       folderId: z.string().optional().describe('Folder ID to list (default: root)'),
       max: z.number().optional().describe('Max results (default: 20)'),
       pageToken: pageTokenParam,
@@ -50,7 +50,7 @@ export function registerDriveTools(server: McpServer): void {
           + 'near-constant across a listing and 48% of its bytes. Ask for full to get them.',
       }),
       account: accountParam,
-    },
+    }),
   }, async ({ folderId, max, pageToken, page, query, allDrives, view, account }) => {
     const args = ['drive', 'ls'];
     if (folderId) args.push(`--parent=${folderId}`);
@@ -69,14 +69,14 @@ export function registerDriveTools(server: McpServer): void {
   server.registerTool('gog_drive_search', {
     description: 'Search Google Drive files by full-text query.',
     annotations: { readOnlyHint: true },
-    inputSchema: {
+    inputSchema: z.object({
       query: z.string().describe('Search query'),
       // gog's `drive search` accepts no --fields mask, so unlike gog_drive_ls
       // this tool's compact rung is a LOCAL projection. Same vocabulary either
       // way: a caller does not need to know which lever is being pulled.
       view: viewParam(['compact', 'full'], { note: 'compact (the default) drops thumbnailLink — a URL a model cannot see, and 30%+ of a Drive file record. Ask for full to get it back.' }),
       account: accountParam,
-    },
+    }),
   }, async ({ query, view, account }) => {
     return runOrDiagnose(['drive', 'search', query], {
       account,
@@ -87,7 +87,7 @@ export function registerDriveTools(server: McpServer): void {
   server.registerTool('gog_drive_get', {
     description: 'Get metadata for a Google Drive file.',
     annotations: { readOnlyHint: true },
-    inputSchema: {
+    inputSchema: z.object({
       fileId: z.string().describe('File ID'),
       // A --fields mask saves only 7% here: the default set is already narrow,
       // which is why this tool takes no mask. The media strip saves 27.5% of
@@ -97,7 +97,7 @@ export function registerDriveTools(server: McpServer): void {
       // what the tool returns. The end-to-end figure is the one a caller sees.)
       view: viewParam(['compact', 'full'], { note: 'compact (the default) drops thumbnailLink — a URL a model cannot see, and 30%+ of a Drive file record. Ask for full to get it back.' }),
       account: accountParam,
-    },
+    }),
   }, async ({ fileId, view, account }) => {
     return runOrDiagnose(['drive', 'get', fileId], {
       account,
@@ -108,10 +108,10 @@ export function registerDriveTools(server: McpServer): void {
   server.registerTool('gog_drive_mkdir', {
     description: 'Create a new folder in Google Drive.',
     annotations: { destructiveHint: false },
-    inputSchema: {
+    inputSchema: z.object({
       name: z.string().describe('Folder name'),
       account: accountParam,
-    },
+    }),
   }, async ({ name, account }) => {
     return runOrDiagnose(['drive', 'mkdir', name], { account });
   });
@@ -119,11 +119,11 @@ export function registerDriveTools(server: McpServer): void {
   server.registerTool('gog_drive_rename', {
     description: 'Rename a file or folder in Google Drive.',
     annotations: { destructiveHint: true },
-    inputSchema: {
+    inputSchema: z.object({
       fileId: z.string().describe('File or folder ID'),
       newName: z.string().describe('New name'),
       account: accountParam,
-    },
+    }),
   }, async ({ fileId, newName, account }) => {
     return runOrDiagnose(['drive', 'rename', fileId, newName], { account });
   });
@@ -131,11 +131,11 @@ export function registerDriveTools(server: McpServer): void {
   server.registerTool('gog_drive_move', {
     description: 'Move a file to a different folder in Google Drive.',
     annotations: { destructiveHint: true },
-    inputSchema: {
+    inputSchema: z.object({
       fileId: z.string().describe('File ID to move'),
       parentId: z.string().describe('Destination folder ID'),
       account: accountParam,
-    },
+    }),
   }, async ({ fileId, parentId, account }) => {
     return runOrDiagnose(['drive', 'move', fileId, `--parent=${parentId}`], { account });
   });
@@ -143,11 +143,11 @@ export function registerDriveTools(server: McpServer): void {
   server.registerTool('gog_drive_delete', {
     description: 'Move a Google Drive file to trash, or permanently delete it with permanent=true (irreversible).',
     annotations: { destructiveHint: true },
-    inputSchema: {
+    inputSchema: z.object({
       fileId: z.string().describe('File ID to delete'),
       permanent: z.boolean().optional().describe('Permanently delete instead of moving to trash (irreversible)'),
       account: accountParam,
-    },
+    }),
   }, async ({ fileId, permanent, account }) => {
     const args = ['drive', 'delete', fileId];
     if (permanent) args.push('--permanent');
@@ -160,14 +160,14 @@ export function registerDriveTools(server: McpServer): void {
   server.registerTool('gog_drive_share', {
     description: 'Share a Google Drive file or folder.',
     annotations: { destructiveHint: true },
-    inputSchema: {
+    inputSchema: z.object({
       fileId: z.string().describe('File or folder ID'),
       to: z.enum(['user', 'anyone', 'domain']).describe('Share target type'),
       email: z.string().optional().describe('User email (required when to=user)'),
       domain: z.string().optional().describe('Domain (required when to=domain)'),
       role: z.enum(['reader', 'writer']).optional().describe('Permission role (default: reader)'),
       account: accountParam,
-    },
+    }),
   }, async ({ fileId, to, email, domain, role, account }) => {
     const args = ['drive', 'share', fileId, `--to=${to}`];
     if (email) args.push(`--email=${email}`);
@@ -189,7 +189,7 @@ export function registerDriveTools(server: McpServer): void {
       'host filesystem, no scope widening. For a large file, page through with offset/maxChars.',
     // Creates and deletes a temporary Doc for non-native files, so not read-only.
     annotations: { destructiveHint: false },
-    inputSchema: {
+    inputSchema: z.object({
       fileId: z.string().describe('Drive file ID (e.g. the id returned by gog_gmail_attachment)'),
       ocrLanguage: z.string().optional().describe(
         'BCP-47 language hint for OCR of scanned/image PDFs (e.g. "en", "fr"). Optional.',
@@ -197,7 +197,7 @@ export function registerDriveTools(server: McpServer): void {
       offset: z.number().int().nonnegative().optional().describe('Character offset to start from (default: 0)'),
       maxChars: z.number().int().positive().optional().describe('Max characters to return (default: all from offset)'),
       account: accountParam,
-    },
+    }),
   }, async ({ fileId, ocrLanguage, offset = 0, maxChars, account }) => {
     let tempDocId: string | undefined;
     try {
@@ -251,14 +251,12 @@ export function registerDriveTools(server: McpServer): void {
     description:
       'Fetch a Drive file\'s raw bytes and return them base64-encoded as an embedded resource — the ' +
       'generic fallback for callers that want the file itself (to parse locally) rather than extracted ' +
-      'text. For readable text from a PDF, prefer gog_drive_extract_text. NOTE: only works on the local ' +
-      'stdio server; over the hosted connector the transport is text-only and this returns a clear error ' +
-      '(use gog_drive_extract_text there).',
+      'text. For readable text from a PDF, prefer gog_drive_extract_text.',
     annotations: { readOnlyHint: true },
-    inputSchema: {
+    inputSchema: z.object({
       fileId: z.string().describe('Drive file ID'),
       account: accountParam,
-    },
+    }),
   }, async ({ fileId, account }): Promise<CallToolResult> => {
     try {
       const { name, mimeType } = fileMeta(await run(['drive', 'get', fileId], { account }));

package/src/tools/gmail.ts

@@ -1,10 +1,11 @@
-import { McpServer } from '@modelcontextprotocol/sdk/server/mcp.js';
+import { McpServer, type ServerContext } from '@modelcontextprotocol/server';
 import { z } from 'zod';
 import { accountParam, runOrDiagnose, registerRunTool, payloadArg, pageTokenParam, pageAliasParam, resolvePageToken, assertNotBoth } from './utils.js';
 import { finalizeGmailSearch, fetchGmailPages } from '../gmail-results.js';
 import type { GogArg } from '../runner.js';
 import { attachInlineParam, inlineAttachmentArgs } from '../attachments.js';
 import type { InlineAttachmentInput } from '../attachments.js';
+import { extractEmails, logGmailDispatch, requireGmailDispatchConfirmation, resultText } from '../gmail-dispatch-guard.js';
 
 // gmail reply / reply-all share an identical flag set (gog 0.27+); they differ
 // only in the subcommand and default recipient set (reply → sender; reply-all
@@ -23,7 +24,7 @@ export const replySchema = {
   remove: z.array(z.string()).optional().describe('Remove these recipients from all fields (repeatable) — e.g. to drop someone from a reply-all.'),
   subject: z.string().optional().describe('Override reply subject (default: "Re: <original>"). A changed subject starts a NEW Gmail thread.'),
   noQuote: z.boolean().optional().describe('Do not include the original message quoted below the reply (default: the original is quoted)'),
-  attach: z.array(z.string()).optional().describe('File paths to attach (repeatable), resolved ON THE GOG SERVER\'s filesystem — NOT this client\'s. Only usable when gog runs on the same machine you do (local stdio); on the hosted connector or any GOG_RUNNER_URL backend these paths do not exist and the call fails with "no such file or directory" — use attachInline there. Read on the server, base64-encoded with a MIME type inferred from the extension.'),
+  attach: z.array(z.string()).optional().describe('File paths to attach (repeatable), resolved ON THE GOG SERVER\'s filesystem — NOT this client\'s. Only usable when gog runs on the same machine you do (local stdio); on a hosted deployment (e.g. mcp-host) these paths do not exist and the call fails with "no such file or directory" — use attachInline there. Read on the server, base64-encoded with a MIME type inferred from the extension.'),
   attachInline: attachInlineParam,
   from: z.string().optional().describe('Send from this email address (must be a verified send-as alias)'),
   autoFromAddressedAlias: z.boolean().optional().describe('When from is omitted, send from the verified send-as alias the original message was addressed TO, instead of the account\'s primary address — so a reply to mail sent to an alias goes back out from that alias. Ignored when from is set.'),
@@ -65,9 +66,9 @@ export function appendReplyFlags(args: GogArg[], f: ReplyFlags): void {
   if (f.noQuote) args.push('--no-quote');
   if (f.attach) for (const p of f.attach) args.push(`--attach=${p}`);
   // Same repeatable --attach flag, but the bytes travel with the call: the
-  // executor writes each one to a temp file beside gog and passes that path.
+  // runner writes each one to a temp file beside gog and passes that path.
   // This is the only attachment route that works when the caller and gog do not
-  // share a filesystem (hosted connector, GOG_RUNNER_URL backend). `args` is
+  // share a filesystem (a hosted deployment such as mcp-host). `args` is
   // passed so the size check sees the body too, which shares the same budget
   // once payloadArg has turned it into a file arg.
   args.push(...inlineAttachmentArgs('attach', f.attachInline, args));
@@ -77,11 +78,99 @@ export function appendReplyFlags(args: GogArg[], f: ReplyFlags): void {
   if (f.signatureFile) args.push(`--signature-file=${f.signatureFile}`);
   // PINNED, not conditional: GOG_GMAIL_AUTO_FROM_ADDRESSED_ALIAS in the host env
   // silently changes which address the mail goes out FROM, with nothing in the arg
-  // array to show for it — and the remote runner's backend env is not ours to set.
-  // An explicit flag is the only value authoritative on both transports.
+  // array to show for it — and a hosted deployment's env is not the caller's to set.
+  // An explicit flag is the only value authoritative everywhere.
   args.push(f.autoFromAddressedAlias ? '--auto-from-addressed-alias' : '--auto-from-addressed-alias=false');
 }
 
+// The send-side reply/reply-all schema, distinct from the shared replySchema
+// above. gog_gmail_drafts_reply / _reply_all (gogcli-mcp-gmail) reuse
+// replySchema verbatim and must never gain a send-confirmation input — draft
+// tools stage mail, while send tools request confirmation through MCP.
+const sendReplySchema = z.object(replySchema);
+
+// gog's own `reply`/`reply-all` response never echoes the resolved
+// recipients when replying to a single message (the common case: gog only
+// includes `to` in its JSON when composing several messages at once, per
+// internal/cmd/gmail_compose.go's gmailMessageResultJSON). So the only way to
+// tell a caller — or the audit log below — who a reply is REALLY going to is
+// to read the original message's own headers, which is what the reply
+// inherits from. This makes the confirmation prompt accurate rather than a
+// restatement of the flags the caller already passed.
+export function parseMetadataHeaders(raw: string): Record<string, string> {
+  let parsed: unknown;
+  try {
+    parsed = JSON.parse(raw);
+  } catch {
+    return {};
+  }
+  const headers = (parsed as { headers?: unknown } | null)?.headers;
+  if (!headers || typeof headers !== 'object') return {};
+  const out: Record<string, string> = {};
+  for (const [key, value] of Object.entries(headers as Record<string, unknown>)) {
+    if (typeof value === 'string') out[key] = value;
+  }
+  return out;
+}
+
+// reply → sender only; reply-all → sender plus every To/Cc participant. Both
+// then apply the caller's own to/cc/bcc adds and remove drops, mirroring what
+// gog itself would compose. This is intentionally an approximation (it does
+// not, for instance, know about Reply-To or gog's self-exclusion rules) —
+// good enough for a confirmation prompt and an audit log, neither of which is the
+// enforcement point; the protocol confirmation gate is. Over-including a participant who
+// would not actually receive the reply is the safe direction of error here.
+export function computeReplyRecipients(
+  kind: 'reply' | 'reply-all',
+  headers: Record<string, string>,
+  flags: Pick<ReplyFlags, 'to' | 'cc' | 'bcc' | 'remove'>,
+): string[] {
+  const base = kind === 'reply'
+    ? [headers.from]
+    : [headers.from, headers.to, headers.cc];
+  let emails = extractEmails(...base, ...(flags.to ?? []), ...(flags.cc ?? []), ...(flags.bcc ?? []));
+  if (flags.remove?.length) {
+    const removed = new Set(extractEmails(...flags.remove));
+    emails = emails.filter((e) => !removed.has(e));
+  }
+  return emails;
+}
+
+// Shared by gog_gmail_reply and gog_gmail_reply_all: fetch the target
+// message's headers (always — the prompt needs them and so does the audit
+// log on the accepted path), then confirm and send.
+// assertNotBoth runs BEFORE the metadata fetch, in the caller, so a bad
+// bodyHtml/bodyHtmlFile pair fails with zero gog calls, same as before this
+// confirmation gate existed.
+async function sendReply(
+  kind: 'reply' | 'reply-all',
+  toolName: string,
+  messageId: string,
+  account: string | undefined,
+  flags: ReplyFlags,
+  ctx: ServerContext,
+) {
+  const metaResult = await runOrDiagnose(['gmail', 'get', messageId, '--format=metadata'], { account });
+  if (metaResult.isError) return metaResult;
+  const headers = parseMetadataHeaders(resultText(metaResult));
+  const recipients = computeReplyRecipients(kind, headers, flags);
+  const confirmation = requireGmailDispatchConfirmation(ctx, `gmail.${kind}`, {
+    messageId,
+    recipients,
+    recipientCount: recipients.length,
+    subject: flags.subject || (headers.subject ? `Re: ${headers.subject}` : undefined),
+    quoting: !flags.noQuote,
+    bodyLength: (flags.body ?? flags.bodyHtml ?? '').length,
+    attachmentCount: (flags.attach?.length ?? 0) + (flags.attachInline?.length ?? 0),
+  });
+  if (confirmation) return confirmation;
+  const args: GogArg[] = ['gmail', kind, messageId];
+  appendReplyFlags(args, flags);
+  const result = await runOrDiagnose(args, { account });
+  if (!result.isError) logGmailDispatch(toolName, recipients, account);
+  return result;
+}
+
 export function registerGmailTools(server: McpServer): void {
   server.registerTool('gog_gmail_search', {
     description: 'Search Gmail threads using Gmail query syntax (e.g. "from:alice subject:invoice is:unread"). The query is passed verbatim to Gmail; a bare name token (from:alison) matches per Gmail\'s own heuristics, a full address (from:alison@example.com) is exact. To match a contact across several addresses, OR them: from:(a@x.com OR b@y.com). '
@@ -89,7 +178,7 @@ export function registerGmailTools(server: McpServer): void {
       + 'IMPORTANT — a response carrying "truncated": true is an INCOMPLETE view of the matches: NEVER report that a message does not exist, or that there is no such mail, on the strength of one. Page through it (pass nextPageToken back as `pageToken`), set maxPages to walk several pages in one call, or narrow the query, and only then draw a conclusion. '
       + 'If you already know the thread, do not search for it at all — read it directly with gog_gmail_thread_get, which returns the whole thread and cannot be truncated or mis-ranked.',
     annotations: { readOnlyHint: true },
-    inputSchema: {
+    inputSchema: z.object({
       query: z.string().describe('Gmail search query'),
       max: z.number().int().optional().describe('Max results to return (default: 10)'),
       pageToken: pageTokenParam,
@@ -98,7 +187,7 @@ export function registerGmailTools(server: McpServer): void {
       all: z.boolean().optional().describe('Fetch every page instead of one. Removes truncation entirely, at the cost of one API round-trip per page — the reliable way to answer "does any message match?" for a query with few expected hits.'),
       fromContact: z.string().optional().describe('Resolve a Google Contact (name or email) to its addresses and AND a from:(addr OR addr) clause onto the query — saves looking the contact up first when you only know who, not which address.'),
       account: accountParam,
-    },
+    }),
   }, async ({ query, max, pageToken, page, maxPages, all, fromContact, account }) => {
     const args = ['gmail', 'search', query];
     if (max !== undefined) args.push(`--max=${max}`);
@@ -126,7 +215,7 @@ export function registerGmailTools(server: McpServer): void {
   server.registerTool('gog_gmail_get', {
     description: 'Get a Gmail message by ID. For a long message, sanitizeContent is the cheapest way to keep it in context: it drops the raw MIME payload and the HTML part, which are usually the bulk of the response.',
     annotations: { readOnlyHint: true },
-    inputSchema: {
+    inputSchema: z.object({
       messageId: z.string().describe('Message ID'),
       format: z.enum(['full', 'metadata', 'raw']).optional().describe('Message format (default: full)'),
       // Requires gog >= 0.37.0. Before that (openclaw/gogcli#992) the JSON
@@ -135,7 +224,7 @@ export function registerGmailTools(server: McpServer): void {
       // enlarged it. MIN_GOG_VERSION is the guard; there is no runtime check.
       sanitizeContent: z.boolean().optional().describe('Return agent-oriented sanitized content: HTML stripped, HTTP(S) URLs removed, raw Gmail payloads omitted from the JSON. The largest payload-size reduction available here. Note the URL removal is lossy — omit this when you need to follow a link out of the message.'),
       account: accountParam,
-    },
+    }),
   }, async ({ messageId, format, sanitizeContent, account }) => {
     const args = ['gmail', 'get', messageId];
     if (format) args.push(`--format=${format}`);
@@ -145,7 +234,9 @@ export function registerGmailTools(server: McpServer): void {
 
   server.registerTool('gog_gmail_send', {
     description:
-      'Send an email. Two ways to attach a file: `attach` takes paths READ ON THE GOG SERVER, and '
+      'SENDS MAIL — asks the MCP host to show a confirmation prompt with the recipients, subject, and body size. '
+      + 'Mail is sent only after the user accepts that prompt. '
+      + 'Two ways to attach a file: `attach` takes paths READ ON THE GOG SERVER, and '
       + '`attachInline` takes the bytes themselves. Use attachInline unless you know the file exists on '
       + 'the same machine gog runs on — on the hosted connector and any remote deployment there is no '
       + 'shared filesystem, so no path you can name resolves there and `attach` will fail with '
@@ -155,7 +246,7 @@ export function registerGmailTools(server: McpServer): void {
       + 'subject, recipients and body are entirely yours, and the original is not quoted unless you set '
       + 'quote. Use gog_gmail_reply / gog_gmail_reply_all instead, which inherit all three.',
     annotations: { destructiveHint: true },
-    inputSchema: {
+    inputSchema: z.object({
       to: z.string().describe('Recipient(s), comma-separated'),
       subject: z.string().describe('Subject line'),
       body: z.string().describe('Email body (plain text). Any size — a large body is written to a temp file on the gog server rather than inlined into the command line. Note gog strips trailing newlines from a file-delivered body.'),
@@ -164,14 +255,19 @@ export function registerGmailTools(server: McpServer): void {
       replyToMessageId: z.string().optional().describe('Message ID to thread this message against — sets In-Reply-To/References only. It does NOT quote the original (pass quote for that), inherit its recipients, or prefix the subject with "Re:". For an actual reply use gog_gmail_reply.'),
       threadId: z.string().optional().describe('Thread ID to thread this message within. Same caveat as replyToMessageId: threading only, no quote and no inherited subject or recipients.'),
       quote: z.boolean().optional().describe('Include the original message quoted below the body. Requires replyToMessageId or threadId. gog quotes by DEFAULT on gmail reply but never on gmail send, so without this a threaded send arrives with the original nowhere in it.'),
-      attach: z.array(z.string()).optional().describe('File paths to attach (repeatable), resolved ON THE GOG SERVER\'s filesystem — NOT this client\'s. Only usable when gog runs on the same machine you do (local stdio); on the hosted connector or any GOG_RUNNER_URL backend these paths do not exist and the call fails with "no such file or directory" — use attachInline there. Each file is read on the server, base64-encoded with a MIME type inferred from its extension, and added as a multipart attachment.'),
+      attach: z.array(z.string()).optional().describe('File paths to attach (repeatable), resolved ON THE GOG SERVER\'s filesystem — NOT this client\'s. Only usable when gog runs on the same machine you do (local stdio); on a hosted deployment (e.g. mcp-host) these paths do not exist and the call fails with "no such file or directory" — use attachInline there. Each file is read on the server, base64-encoded with a MIME type inferred from its extension, and added as a multipart attachment.'),
       attachInline: attachInlineParam,
       account: accountParam,
-    },
-  }, async ({ to, subject, body, cc, bcc, replyToMessageId, threadId, quote, attach, attachInline, account }) => {
-    // A long body cannot ride in argv: the hosted runner caps a single arg and
-    // Linux caps MAX_ARG_STRLEN at 128 KiB. payloadArg swaps it for --body-file
-    // past the shared threshold; the executor materializes the temp file.
+    }),
+  }, async ({ to, subject, body, cc, bcc, replyToMessageId, threadId, quote, attach, attachInline, account }, ctx) => {
+    // Built (and validated — inlineAttachmentArgs throws on bad base64 or an
+    // oversize file) BEFORE the confirmation request, on both paths: a prompt that
+    // skipped this would tell a caller "looks fine, send it" about an
+    // attachment that was always going to fail.
+    //
+    // A long body cannot ride in argv: Linux caps MAX_ARG_STRLEN at 128 KiB.
+    // payloadArg swaps it for --body-file past the shared threshold; the runner
+    // materializes the temp file.
     const args: GogArg[] = ['gmail', 'send', `--to=${to}`, `--subject=${subject}`, payloadArg('body', 'body-file', body)];
     if (cc) args.push(`--cc=${cc}`);
     if (bcc) args.push(`--bcc=${bcc}`);
@@ -188,7 +284,19 @@ export function registerGmailTools(server: McpServer): void {
     // file arg once it passes payloadArg's threshold and spends the same budget.
     const inline = inlineAttachmentArgs('attach', attachInline, args);
     args.push(...inline);
-    return runOrDiagnose(args, { account });
+
+    const recipients = extractEmails(to, cc, bcc);
+    const confirmation = requireGmailDispatchConfirmation(ctx, 'gmail.send', {
+      to, cc, bcc, recipients, recipientCount: recipients.length, subject,
+      bodyLength: body.length,
+      threaded: Boolean(replyToMessageId || threadId),
+      quoting: Boolean(quote),
+      attachmentCount: (attach?.length ?? 0) + (attachInline?.length ?? 0),
+    });
+    if (confirmation) return confirmation;
+    const result = await runOrDiagnose(args, { account });
+    if (!result.isError) logGmailDispatch('gog_gmail_send', recipients, account);
+    return result;
   });
 
   // ==========================================================================
@@ -209,7 +317,10 @@ export function registerGmailTools(server: McpServer): void {
   // ==========================================================================
   server.registerTool('gog_gmail_reply', {
     description:
-      'Reply to a Gmail message (goes to the original sender only). USE THIS, not gog_gmail_send, whenever you are '
+      'SENDS MAIL — asks the MCP host to show a confirmation prompt with the resolved recipient, subject, and body size. '
+      + 'Mail is sent only after the user accepts that prompt. To STAGE a reply instead '
+      + 'of sending it, use gog_gmail_drafts_reply (gogcli-mcp-gmail only), which never needs confirmation. '
+      + 'Reply to a Gmail message (goes to the original sender only). USE THIS, not gog_gmail_send, whenever you are '
       + 'answering a message: it threads off the original AND inherits its "Re:" subject and quotes its body below '
       + 'yours, which gog_gmail_send does not — a send with replyToMessageId lands in the right thread but reads as a '
       + 'brand-new message, with the original nowhere in it. To answer every participant use gog_gmail_reply_all. '
@@ -217,24 +328,26 @@ export function registerGmailTools(server: McpServer): void {
       + 'across every message matching a query, and gog_gmail_drafts_reply to stage this exact reply as a draft '
       + 'instead of sending it.',
     annotations: { destructiveHint: true },
-    inputSchema: replySchema,
-  }, async ({ messageId, account, ...flags }) => {
-    const args: GogArg[] = ['gmail', 'reply', messageId];
-    appendReplyFlags(args, flags);
-    return runOrDiagnose(args, { account });
+    inputSchema: sendReplySchema,
+  }, async ({ messageId, account, ...flags }, ctx) => {
+    assertNotBoth('bodyHtml', 'bodyHtmlFile', flags.bodyHtml, flags.bodyHtmlFile);
+    return sendReply('reply', 'gog_gmail_reply', messageId, account, flags, ctx);
   });
 
   server.registerTool('gog_gmail_reply_all', {
     description:
-      'Reply to all participants of a Gmail message (the sender plus every To/Cc recipient). Same inherited "Re:" '
+      'SENDS MAIL — asks the MCP host to show a confirmation prompt with the resolved recipients, subject, and body size. '
+      + 'Mail is sent only after the user accepts that prompt. To STAGE a '
+      + 'reply-all instead of sending it, use gog_gmail_drafts_reply_all (gogcli-mcp-gmail only), which never needs '
+      + 'confirmation. '
+      + 'Reply to all participants of a Gmail message (the sender plus every To/Cc recipient). Same inherited "Re:" '
       + 'subject and quoted original as gog_gmail_reply. Use the remove flag to drop specific recipients from the '
-      + 'reply-all. To stage it as a draft rather than send it, use gog_gmail_drafts_reply_all (gogcli-mcp-gmail only).',
+      + 'reply-all.',
     annotations: { destructiveHint: true },
-    inputSchema: replySchema,
-  }, async ({ messageId, account, ...flags }) => {
-    const args: GogArg[] = ['gmail', 'reply-all', messageId];
-    appendReplyFlags(args, flags);
-    return runOrDiagnose(args, { account });
+    inputSchema: sendReplySchema,
+  }, async ({ messageId, account, ...flags }, ctx) => {
+    assertNotBoth('bodyHtml', 'bodyHtmlFile', flags.bodyHtml, flags.bodyHtmlFile);
+    return sendReply('reply-all', 'gog_gmail_reply_all', messageId, account, flags, ctx);
   });
 
   registerRunTool(server, { service: 'gmail', examples: '"archive", "mark-read", "labels"' });

package/src/tools/sheets.ts

@@ -1,4 +1,4 @@
-import { McpServer } from '@modelcontextprotocol/sdk/server/mcp.js';
+import { McpServer } from '@modelcontextprotocol/server';
 import { z } from 'zod';
 import { run } from '../runner.js';
 import { rawTextResult } from '@chrischall/mcp-utils';
@@ -25,11 +25,11 @@ export function registerSheetsTools(server: McpServer): void {
   server.registerTool('gog_sheets_get', {
     description: 'Read values from a Google Sheets range. Returns a JSON object with a "values" array of rows.',
     annotations: { readOnlyHint: true },
-    inputSchema: {
+    inputSchema: z.object({
       spreadsheetId: z.string().describe('Spreadsheet ID (from the URL)'),
       range: z.string().describe('Range in A1 notation, e.g. Sheet1!A1:B10 or a named range'),
       account: accountParam,
-    },
+    }),
   }, async ({ spreadsheetId, range, account }) => {
     return runOrDiagnose(['sheets', 'get', spreadsheetId, range], { account });
   });
@@ -37,7 +37,7 @@ export function registerSheetsTools(server: McpServer): void {
   server.registerTool('gog_sheets_update', {
     description: 'Write values to a Google Sheets range, overwriting existing content. Values may be strings, numbers, booleans, or null. Strings starting with "=" are interpreted as formulas (e.g. "=SUM(A1:A10)").',
     annotations: { destructiveHint: true },
-    inputSchema: {
+    inputSchema: z.object({
       spreadsheetId: z.string().describe('Spreadsheet ID (from the URL)'),
       range: z.string().describe('Top-left cell or range in A1 notation, e.g. Sheet1!A1'),
       values: z.array(z.array(cellValueParam)).describe('2D array of values (rows of columns). Cells may be string/number/boolean/null; strings starting with "=" are formulas.'),
@@ -45,7 +45,7 @@ export function registerSheetsTools(server: McpServer): void {
       fail_if_not_empty: failIfNotEmptyParam,
       fail_on_formula_error: z.boolean().optional().describe('After writing, read the range back and fail if any cell holds a Sheets formula error (#REF!, #DIV/0!, etc.).'),
       account: accountParam,
-    },
+    }),
   }, async ({ spreadsheetId, range, values, account, dry_run, fail_if_not_empty, fail_on_formula_error }) => {
     const cols = values.reduce((max, row) => Math.max(max, row.length), 0);
     if (fail_if_not_empty && values.length > 0 && cols > 0) {
@@ -79,13 +79,13 @@ export function registerSheetsTools(server: McpServer): void {
   server.registerTool('gog_sheets_append', {
     description: 'Append rows to a Google Sheet after the last row with data in the given range. Values may be strings, numbers, booleans, or null. Strings starting with "=" are interpreted as formulas.',
     annotations: { destructiveHint: true },
-    inputSchema: {
+    inputSchema: z.object({
       spreadsheetId: z.string().describe('Spreadsheet ID (from the URL)'),
       range: z.string().describe('Range indicating which sheet/columns to append to, e.g. Sheet1!A:C'),
       values: z.array(z.array(cellValueParam)).describe('2D array of rows to append. Cells may be string/number/boolean/null; strings starting with "=" are formulas.'),
       dry_run: dryRunParam,
       account: accountParam,
-    },
+    }),
   }, async ({ spreadsheetId, range, values, account, dry_run }) => {
     const args = ['sheets', 'append', spreadsheetId, range, `--values-json=${JSON.stringify(values)}`];
     if (dry_run) args.push('--dry-run');
@@ -95,12 +95,12 @@ export function registerSheetsTools(server: McpServer): void {
   server.registerTool('gog_sheets_clear', {
     description: 'Clear all values in a Google Sheets range (formatting is preserved).',
     annotations: { destructiveHint: true },
-    inputSchema: {
+    inputSchema: z.object({
       spreadsheetId: z.string().describe('Spreadsheet ID'),
       range: z.string().describe('Range in A1 notation to clear'),
       dry_run: dryRunParam,
       account: accountParam,
-    },
+    }),
   }, async ({ spreadsheetId, range, account, dry_run }) => {
     const args = ['sheets', 'clear', spreadsheetId, range];
     if (dry_run) args.push('--dry-run');
@@ -110,10 +110,10 @@ export function registerSheetsTools(server: McpServer): void {
   server.registerTool('gog_sheets_metadata', {
     description: 'Get spreadsheet metadata: title, named ranges, and per-tab properties including grid dimensions (gridProperties.rowCount / columnCount). Use this to learn a sheet\'s current size before writing — a write outside the grid fails.',
     annotations: { readOnlyHint: true },
-    inputSchema: {
+    inputSchema: z.object({
       spreadsheetId: z.string().describe('Spreadsheet ID'),
       account: accountParam,
-    },
+    }),
   }, async ({ spreadsheetId, account }) => {
     return runOrDiagnose(['sheets', 'metadata', spreadsheetId], { account });
   });
@@ -121,10 +121,10 @@ export function registerSheetsTools(server: McpServer): void {
   server.registerTool('gog_sheets_create', {
     description: 'Create a new Google Spreadsheet. Returns JSON with the new spreadsheetId and URL.',
     annotations: { destructiveHint: false },
-    inputSchema: {
+    inputSchema: z.object({
       title: z.string().describe('Title for the new spreadsheet'),
       account: accountParam,
-    },
+    }),
   }, async ({ title, account }) => {
     return runOrDiagnose(['sheets', 'create', title], { account });
   });
@@ -132,12 +132,12 @@ export function registerSheetsTools(server: McpServer): void {
   server.registerTool('gog_sheets_find_replace', {
     description: 'Find and replace text across an entire Google Spreadsheet.',
     annotations: { destructiveHint: true },
-    inputSchema: {
+    inputSchema: z.object({
       spreadsheetId: z.string().describe('Spreadsheet ID'),
       find: z.string().describe('Text to find'),
       replace: z.string().describe('Replacement text'),
       account: accountParam,
-    },
+    }),
   }, async ({ spreadsheetId, find, replace, account }) => {
     return runOrDiagnose(['sheets', 'find-replace', spreadsheetId, find, replace], { account });
   });