gogcli-mcp 2.8.0 → 2.18.0

package/tests/tools/tasks.test.ts

@@ -1,26 +1,26 @@
 import { describe, it, expect, vi, beforeEach } from 'vitest';
 import { registerTasksTools } from '../../src/tools/tasks.js';
 import * as runner from '../../src/runner.js';
-import { setupHandlers as setupHandlersBase, type ToolHandler } from '../helpers/test-harness.js';
+import { createTestHarness } from '@chrischall/mcp-utils/test';
 
 vi.mock('../../src/runner.js');
 
-const setupHandlers = () => setupHandlersBase(registerTasksTools);
+const setupHandlers = () => createTestHarness(registerTasksTools);
 
 beforeEach(() => vi.clearAllMocks());
 
 describe('gog_tasks_lists', () => {
   it('calls run with tasks lists list', async () => {
     vi.mocked(runner.run).mockResolvedValue('{"items":[]}');
-    const handlers = setupHandlers();
-    await handlers.get('gog_tasks_lists')!({});
+    const harness = await setupHandlers();
+    await harness.callTool('gog_tasks_lists', {});
     expect(runner.run).toHaveBeenCalledWith(['tasks', 'lists', 'list'], { account: undefined });
   });
 
   it('returns error text on failure', async () => {
     vi.mocked(runner.run).mockRejectedValue(new Error('Lists failed'));
-    const handlers = setupHandlers();
-    const result = await handlers.get('gog_tasks_lists')!({});
+    const harness = await setupHandlers();
+    const result = await harness.callTool('gog_tasks_lists', {});
     expect(result.content[0].text).toBe('Error: Lists failed');
   });
 });
@@ -28,15 +28,15 @@ describe('gog_tasks_lists', () => {
 describe('gog_tasks_list', () => {
   it('calls run with tasklistId', async () => {
     vi.mocked(runner.run).mockResolvedValue('{"items":[]}');
-    const handlers = setupHandlers();
-    await handlers.get('gog_tasks_list')!({ tasklistId: 'list1' });
+    const harness = await setupHandlers();
+    await harness.callTool('gog_tasks_list', { tasklistId: 'list1' });
     expect(runner.run).toHaveBeenCalledWith(['tasks', 'list', 'list1'], { account: undefined });
   });
 
   it('returns error text on failure', async () => {
     vi.mocked(runner.run).mockRejectedValue(new Error('List failed'));
-    const handlers = setupHandlers();
-    const result = await handlers.get('gog_tasks_list')!({ tasklistId: 'bad' });
+    const harness = await setupHandlers();
+    const result = await harness.callTool('gog_tasks_list', { tasklistId: 'bad' });
     expect(result.content[0].text).toBe('Error: List failed');
   });
 });
@@ -44,15 +44,15 @@ describe('gog_tasks_list', () => {
 describe('gog_tasks_get', () => {
   it('calls run with tasklistId and taskId', async () => {
     vi.mocked(runner.run).mockResolvedValue('{"id":"task1"}');
-    const handlers = setupHandlers();
-    await handlers.get('gog_tasks_get')!({ tasklistId: 'list1', taskId: 'task1' });
+    const harness = await setupHandlers();
+    await harness.callTool('gog_tasks_get', { tasklistId: 'list1', taskId: 'task1' });
     expect(runner.run).toHaveBeenCalledWith(['tasks', 'get', 'list1', 'task1'], { account: undefined });
   });
 
   it('returns error text on failure', async () => {
     vi.mocked(runner.run).mockRejectedValue(new Error('Get failed'));
-    const handlers = setupHandlers();
-    const result = await handlers.get('gog_tasks_get')!({ tasklistId: 'l', taskId: 'bad' });
+    const harness = await setupHandlers();
+    const result = await harness.callTool('gog_tasks_get', { tasklistId: 'l', taskId: 'bad' });
     expect(result.content[0].text).toBe('Error: Get failed');
   });
 });
@@ -60,8 +60,8 @@ describe('gog_tasks_get', () => {
 describe('gog_tasks_add', () => {
   it('calls run with required args', async () => {
     vi.mocked(runner.run).mockResolvedValue('{"id":"task2"}');
-    const handlers = setupHandlers();
-    await handlers.get('gog_tasks_add')!({ tasklistId: 'list1', title: 'Buy milk' });
+    const harness = await setupHandlers();
+    await harness.callTool('gog_tasks_add', { tasklistId: 'list1', title: 'Buy milk' });
     expect(runner.run).toHaveBeenCalledWith(
       ['tasks', 'add', 'list1', '--title=Buy milk'],
       { account: undefined },
@@ -70,8 +70,8 @@ describe('gog_tasks_add', () => {
 
   it('appends optional flags when provided', async () => {
     vi.mocked(runner.run).mockResolvedValue('{}');
-    const handlers = setupHandlers();
-    await handlers.get('gog_tasks_add')!({ tasklistId: 'list1', title: 'Buy milk', notes: 'Whole milk', due: '2026-04-20' });
+    const harness = await setupHandlers();
+    await harness.callTool('gog_tasks_add', { tasklistId: 'list1', title: 'Buy milk', notes: 'Whole milk', due: '2026-04-20' });
     expect(runner.run).toHaveBeenCalledWith(
       ['tasks', 'add', 'list1', '--title=Buy milk', '--notes=Whole milk', '--due=2026-04-20'],
       { account: undefined },
@@ -80,8 +80,8 @@ describe('gog_tasks_add', () => {
 
   it('returns error text on failure', async () => {
     vi.mocked(runner.run).mockRejectedValue(new Error('Add failed'));
-    const handlers = setupHandlers();
-    const result = await handlers.get('gog_tasks_add')!({ tasklistId: 'l', title: 't' });
+    const harness = await setupHandlers();
+    const result = await harness.callTool('gog_tasks_add', { tasklistId: 'l', title: 't' });
     expect(result.content[0].text).toBe('Error: Add failed');
   });
 });
@@ -89,15 +89,15 @@ describe('gog_tasks_add', () => {
 describe('gog_tasks_done', () => {
   it('calls run with tasklistId and taskId', async () => {
     vi.mocked(runner.run).mockResolvedValue('{}');
-    const handlers = setupHandlers();
-    await handlers.get('gog_tasks_done')!({ tasklistId: 'list1', taskId: 'task1' });
+    const harness = await setupHandlers();
+    await harness.callTool('gog_tasks_done', { tasklistId: 'list1', taskId: 'task1' });
     expect(runner.run).toHaveBeenCalledWith(['tasks', 'done', 'list1', 'task1'], { account: undefined });
   });
 
   it('returns error text on failure', async () => {
     vi.mocked(runner.run).mockRejectedValue(new Error('Done failed'));
-    const handlers = setupHandlers();
-    const result = await handlers.get('gog_tasks_done')!({ tasklistId: 'l', taskId: 't' });
+    const harness = await setupHandlers();
+    const result = await harness.callTool('gog_tasks_done', { tasklistId: 'l', taskId: 't' });
     expect(result.content[0].text).toBe('Error: Done failed');
   });
 });
@@ -105,15 +105,15 @@ describe('gog_tasks_done', () => {
 describe('gog_tasks_delete', () => {
   it('calls run with tasklistId and taskId', async () => {
     vi.mocked(runner.run).mockResolvedValue('{}');
-    const handlers = setupHandlers();
-    await handlers.get('gog_tasks_delete')!({ tasklistId: 'list1', taskId: 'task1' });
-    expect(runner.run).toHaveBeenCalledWith(['tasks', 'delete', 'list1', 'task1'], { account: undefined });
+    const harness = await setupHandlers();
+    await harness.callTool('gog_tasks_delete', { tasklistId: 'list1', taskId: 'task1' });
+    expect(runner.run).toHaveBeenCalledWith(['tasks', 'delete', 'list1', 'task1', '--force'], { account: undefined });
   });
 
   it('returns error text on failure', async () => {
     vi.mocked(runner.run).mockRejectedValue(new Error('Delete failed'));
-    const handlers = setupHandlers();
-    const result = await handlers.get('gog_tasks_delete')!({ tasklistId: 'l', taskId: 't' });
+    const harness = await setupHandlers();
+    const result = await harness.callTool('gog_tasks_delete', { tasklistId: 'l', taskId: 't' });
     expect(result.content[0].text).toBe('Error: Delete failed');
   });
 });
@@ -121,15 +121,15 @@ describe('gog_tasks_delete', () => {
 describe('gog_tasks_run', () => {
   it('passes subcommand and args to runner', async () => {
     vi.mocked(runner.run).mockResolvedValue('{}');
-    const handlers = setupHandlers();
-    await handlers.get('gog_tasks_run')!({ subcommand: 'update', args: ['list1', 'task1', '--title=New'] });
+    const harness = await setupHandlers();
+    await harness.callTool('gog_tasks_run', { subcommand: 'update', args: ['list1', 'task1', '--title=New'] });
     expect(runner.run).toHaveBeenCalledWith(['tasks', 'update', 'list1', 'task1', '--title=New'], { account: undefined });
   });
 
   it('returns error text on failure', async () => {
     vi.mocked(runner.run).mockRejectedValue(new Error('Run failed'));
-    const handlers = setupHandlers();
-    const result = await handlers.get('gog_tasks_run')!({ subcommand: 'clear', args: [] });
+    const harness = await setupHandlers();
+    const result = await harness.callTool('gog_tasks_run', { subcommand: 'clear', args: [] });
     expect(result.content[0].text).toBe('Error: Run failed');
   });
 });

package/tests/tools/utils.test.ts

@@ -1,6 +1,6 @@
 import { describe, it, expect, vi, beforeEach } from 'vitest';
 import * as runner from '../../src/runner.js';
-import { runOrDiagnose, pushPaginationFlags, formatAccountList } from '../../src/tools/utils.js';
+import { runOrDiagnose, pushPaginationFlags, formatAccountList, formatAuthHealth } from '../../src/tools/utils.js';
 
 vi.mock('../../src/runner.js');
 
@@ -88,10 +88,11 @@ describe('formatAccountList', () => {
 });
 
 describe('runOrDiagnose', () => {
-  it('returns output text on success', async () => {
+  it('returns output text on success (not flagged as an error)', async () => {
     vi.mocked(runner.run).mockResolvedValue('{"ok":true}');
     const result = await runOrDiagnose(['docs', 'cat', 'abc'], {});
     expect(result.content[0].text).toBe('{"ok":true}');
+    expect(result.isError).toBeUndefined();
   });
 
   it('appends auth list on non-auth failure', async () => {
@@ -102,6 +103,8 @@ describe('runOrDiagnose', () => {
     expect(result.content[0].text).toBe(
       'Error: Doc not found\n\nConfigured accounts:\nuser@gmail.com',
     );
+    // mcp-utils errorResult flags diagnosed failures for the client.
+    expect(result.isError).toBe(true);
     expect(result.content[0].text).not.toContain('gog_auth_add');
   });
 
@@ -168,6 +171,31 @@ describe('runOrDiagnose', () => {
     expect(result.content[0].text).toContain('gog_auth_add');
   });
 
+  it('gives invalid_grant a richer hint than a plain 401: cause + durable fix + both re-auth paths', async () => {
+    vi.mocked(runner.run)
+      .mockRejectedValueOnce(new Error('oauth2: "invalid_grant" "Token has been expired or revoked."'))
+      .mockResolvedValueOnce('user@gmail.com');
+    const result = await runOrDiagnose(['gmail', 'search', 'is:unread'], {});
+    const text = result.content[0].text as string;
+    // plain-English cause
+    expect(text).toContain('7-day');
+    expect(text).toContain('Testing');
+    // both re-auth paths
+    expect(text).toContain('gog_auth_add_url');
+    // durable fix
+    expect(text).toContain('In production');
+  });
+
+  it('does NOT give a plain 401 the invalid_grant durable-fix text', async () => {
+    vi.mocked(runner.run)
+      .mockRejectedValueOnce(new Error('Request failed with status 401'))
+      .mockResolvedValueOnce('user@gmail.com');
+    const result = await runOrDiagnose(['docs', 'cat', 'abc'], {});
+    const text = result.content[0].text as string;
+    expect(text).toContain('gog_auth_add');
+    expect(text).not.toContain('In production');
+  });
+
   it('returns plain error with auth hint when auth list also fails on auth error', async () => {
     vi.mocked(runner.run)
       .mockRejectedValueOnce(new Error('Request failed with status 401'))
@@ -184,6 +212,7 @@ describe('runOrDiagnose', () => {
       .mockRejectedValueOnce(new Error('auth list failed'));
     const result = await runOrDiagnose(['docs', 'cat', 'abc'], {});
     expect(result.content[0].text).toBe('Error: Doc not found');
+    expect(result.isError).toBe(true);
     expect(result.content[0].text).not.toContain('gog_auth_add');
   });
 
@@ -278,3 +307,88 @@ describe('runOrDiagnose', () => {
     expect(result.content[0].text).not.toContain('Configured accounts');
   });
 });
+
+describe('formatAuthHealth', () => {
+  const NOW = Date.parse('2026-07-24T12:00:00.000Z');
+
+  it('flags a dead (invalid_grant) token with a mapped cause, age, and re-auth paths', () => {
+    const raw = JSON.stringify({
+      accounts: [{
+        email: 'chris.c.hall@gmail.com',
+        created_at: '2026-07-17T12:00:00.000Z',
+        valid: false,
+        error: 'refresh access token: oauth2: "invalid_grant" "Token has been expired or revoked."',
+      }],
+    });
+    const out = formatAuthHealth(raw, NOW);
+    expect(out).toContain('✗ chris.c.hall@gmail.com: NEEDS RE-AUTH');
+    expect(out).toContain('7-day limit');
+    expect(out).toContain('Authorized 7.0 day(s) ago');
+    expect(out).toContain('gog_auth_add_url');
+    // never echoes token material
+    expect(out).not.toContain('access token');
+  });
+
+  it('warns a still-valid token as it nears the 7-day testing cliff (with estimated expiry)', () => {
+    const raw = JSON.stringify({
+      accounts: [{ email: 'a@x.com', created_at: '2026-07-18T00:00:00.000Z', valid: true }],
+    });
+    const out = formatAuthHealth(raw, NOW);
+    expect(out).toContain('✓ a@x.com: token valid');
+    expect(out).toContain('⚠');
+    expect(out).toContain('Approaching the 7-day');
+    expect(out).toContain('2026-07-25'); // created_at + 7d
+    expect(out).toContain('In production');
+  });
+
+  it('does not warn a freshly authorized valid token', () => {
+    const raw = JSON.stringify({
+      accounts: [{ email: 'a@x.com', created_at: '2026-07-23T12:00:00.000Z', valid: true }],
+    });
+    const out = formatAuthHealth(raw, NOW);
+    expect(out).toContain('✓ a@x.com: token valid');
+    expect(out).toContain('Authorized 1.0 day(s) ago');
+    expect(out).not.toContain('⚠');
+  });
+
+  it('uses the raw error for a non-invalid_grant invalid token', () => {
+    const raw = JSON.stringify({
+      accounts: [{ email: 'a@x.com', created_at: '2026-07-23T12:00:00.000Z', valid: false, error: 'network unreachable' }],
+    });
+    expect(formatAuthHealth(raw, NOW)).toContain('NEEDS RE-AUTH — network unreachable.');
+  });
+
+  it('says "unknown error" for an invalid token with no error field', () => {
+    const raw = JSON.stringify({ accounts: [{ email: 'a@x.com', valid: false }] });
+    expect(formatAuthHealth(raw, NOW)).toContain('NEEDS RE-AUTH — unknown error.');
+  });
+
+  it('reports unknown validity when the --check field is absent', () => {
+    const raw = JSON.stringify({ accounts: [{ email: 'a@x.com', created_at: '2026-07-23T12:00:00.000Z' }] });
+    const out = formatAuthHealth(raw, NOW);
+    expect(out).toContain('? a@x.com: token validity unknown');
+    expect(out).toContain('Authorized 1.0 day(s) ago');
+  });
+
+  it('omits the age when created_at is missing or unparseable', () => {
+    expect(formatAuthHealth(JSON.stringify({ accounts: [{ email: 'a@x.com', valid: true }] }), NOW))
+      .not.toContain('Authorized');
+    expect(formatAuthHealth(JSON.stringify({ accounts: [{ email: 'a@x.com', created_at: 'not-a-date', valid: true }] }), NOW))
+      .not.toContain('Authorized');
+  });
+
+  it('falls back to a friendly line when no accounts are configured', () => {
+    expect(formatAuthHealth(JSON.stringify({ accounts: [] }), NOW))
+      .toBe('No Google accounts are configured. Use gog_auth_add to authorize one.');
+  });
+
+  it('labels an account with no email', () => {
+    expect(formatAuthHealth(JSON.stringify({ accounts: [{ valid: true }] }), NOW))
+      .toContain('✓ (unknown account): token valid');
+  });
+
+  it('falls back to trimmed raw text when the output is not the expected JSON', () => {
+    expect(formatAuthHealth('  not json\n', NOW)).toBe('not json');
+    expect(formatAuthHealth('{"foo":1}', NOW)).toBe('{"foo":1}');
+  });
+});

package/tests/worker.test.ts

@@ -0,0 +1,142 @@
+import { SELF } from 'cloudflare:test';
+import { describe, it, expect } from 'vitest';
+import { createTestHarness } from '@chrischall/mcp-utils/test';
+import type { ToolRegistrar } from '@chrischall/mcp-utils';
+import {
+  BASE_TOOL_REGISTRARS,
+  registerAuthTools,
+  registerSheetsTools,
+  registerGmailTools,
+  registerDriveTools,
+  registerDocsTools,
+} from '../src/lib.js';
+import { registerExtraSheetsTools } from '../../gogcli-mcp-sheets/src/tools/sheets-extra.js';
+import { registerExtraGmailTools } from '../../gogcli-mcp-gmail/src/tools/gmail-extra.js';
+import { registerExtraDriveTools } from '../../gogcli-mcp-drive/src/tools/drive-extra.js';
+import { registerExtraDocsTools } from '../../gogcli-mcp-docs/src/tools/docs-extra.js';
+
+// Each per-service MCP path exposes auth + <service> base + <service> extras —
+// the same tool set that sub-package's stdio server exposes. Mirror worker.ts's
+// wiring. Min counts are conservative floors (base+auth alone is ~13-15).
+const SERVICE_PATHS: Array<{
+  path: string;
+  regs: ToolRegistrar[];
+  baseTool: string;
+  minTools: number;
+}> = [
+  { path: '/mcp/sheets', regs: [registerAuthTools, registerSheetsTools, registerExtraSheetsTools], baseTool: 'gog_sheets_get', minTools: 40 },
+  { path: '/mcp/gmail', regs: [registerAuthTools, registerGmailTools, registerExtraGmailTools], baseTool: 'gog_gmail_search', minTools: 40 },
+  { path: '/mcp/drive', regs: [registerAuthTools, registerDriveTools, registerExtraDriveTools], baseTool: 'gog_drive_ls', minTools: 35 },
+  { path: '/mcp/docs', regs: [registerAuthTools, registerDocsTools, registerExtraDocsTools], baseTool: 'gog_docs_cat', minTools: 60 },
+];
+
+// Handshake + tool-surface test for the gogcli Cloudflare remote connector, run
+// inside the real Workers runtime (Miniflare) via `@cloudflare/vitest-pool-workers`
+// against `wrangler.jsonc`. It proves things that don't require a live Fly
+// backend or an authenticated session:
+//   1. the OAuth default handler serves discovery + the login page;
+//   2. an unauthenticated `/mcp` request is rejected before any tool code runs;
+//   3. the base registrars register the full gog tool surface.
+//
+// The full authenticated `initialize` + `tools/list` over `/mcp` requires a real
+// OAuth access token minted via `workers-oauth-provider`'s KV-backed grant flow
+// (POST /authorize with a real connector key → auth code → POST /token), which
+// would mean a live Fly login or extensive KV mocking — out of scope for a
+// hermetic in-process test. So #3 asserts tool registration through the same
+// in-memory MCP harness the stdio suite uses, wired exactly as `worker.ts` wires
+// it (BASE_TOOL_REGISTRARS), rather than through the token-gated `/mcp` route.
+
+describe('gogcli Cloudflare connector — OAuth surface', () => {
+  it('serves the OAuth authorization-server discovery document', async () => {
+    const res = await SELF.fetch('https://example.com/.well-known/oauth-authorization-server');
+    expect(res.status).toBe(200);
+    const meta = (await res.json()) as { authorization_endpoint?: string; token_endpoint?: string };
+    expect(meta.authorization_endpoint).toContain('/authorize');
+    expect(meta.token_endpoint).toContain('/token');
+  });
+
+  it('rejects an unauthenticated /mcp request', async () => {
+    const res = await SELF.fetch('https://example.com/mcp', {
+      method: 'POST',
+      headers: { 'content-type': 'application/json' },
+      body: JSON.stringify({ jsonrpc: '2.0', id: 1, method: 'initialize', params: {} }),
+    });
+    expect(res.status).toBe(401);
+  });
+
+  // Each per-service path is wired as an auth-gated API route (→ 401), not a
+  // 404 from the default handler. (A 401 confirms the path is registered and
+  // token-gated; correct routing to the SERVICE agent vs the base agent is
+  // verified live post-deploy via an authenticated tools/list.)
+  for (const { path } of SERVICE_PATHS) {
+    it(`rejects an unauthenticated ${path} request`, async () => {
+      const res = await SELF.fetch(`https://example.com${path}`, {
+        method: 'POST',
+        headers: { 'content-type': 'application/json' },
+        body: JSON.stringify({ jsonrpc: '2.0', id: 1, method: 'initialize', params: {} }),
+      });
+      expect(res.status).toBe(401);
+    });
+  }
+
+  it('GET /authorize renders the gogcli login page with the connector-key field', async () => {
+    // No `client_id` query param: the login page renders without needing a
+    // registered OAuth client, which is all we verify here.
+    // `redirect_uri` IS required, though — do not remove it. workers-oauth-provider
+    // 0.8.x calls validateRedirectUriScheme() unconditionally from parseAuthRequest,
+    // and it rejects any value with no scheme — including the empty string an ABSENT
+    // `redirect_uri` becomes ("Invalid redirect URI"). client_id stays omitted, so no
+    // client lookup happens and the assertion below is unchanged.
+    const res = await SELF.fetch(
+      'https://example.com/authorize?response_type=code&state=abc' +
+        `&redirect_uri=${encodeURIComponent('https://example.com/callback')}`,
+    );
+    expect(res.status).toBe(200);
+    expect(res.headers.get('content-type')).toContain('text/html');
+    const html = await res.text();
+    expect(html).toContain('gogcli');
+    expect(html).toContain('gogcli connector key');
+    expect(html).toContain('type="password"');
+  });
+});
+
+describe('gogcli Cloudflare connector — tool surface', () => {
+  it('registers the base gog tool set via the same registrars as worker.ts', async () => {
+    // Mirror src/worker.ts's `tools` wiring: register every BASE_TOOL_REGISTRARS
+    // onto the in-memory harness server (no executor needed just to list tools).
+    const harness = await createTestHarness((server) => {
+      for (const register of BASE_TOOL_REGISTRARS) register(server);
+    });
+
+    try {
+      const names = (await harness.listTools()).map((t) => t.name);
+      // Spot-check representative tools from multiple services + a run escape hatch.
+      expect(names).toContain('gog_sheets_get');
+      expect(names).toContain('gog_gmail_search');
+      expect(names).toContain('gog_drive_ls');
+      expect(names).toContain('gog_sheets_run');
+      // The base package exposes a broad multi-service surface.
+      expect(names.length).toBeGreaterThan(50);
+    } finally {
+      await harness.close();
+    }
+  });
+
+  // Each per-service path registers auth + that service's base + its EXTRAS —
+  // proving the extended tool set is wired (well past the ~13 base+auth tools).
+  for (const { path, regs, baseTool, minTools } of SERVICE_PATHS) {
+    it(`${path} registers the extended ${baseTool.split('_')[1]} tool set (base + extras)`, async () => {
+      const harness = await createTestHarness((server) => {
+        for (const register of regs) register(server);
+      });
+      try {
+        const names = (await harness.listTools()).map((t) => t.name);
+        expect(names).toContain(baseTool); // the service's base op
+        expect(names).toContain('gog_auth_list'); // auth tools included
+        expect(names.length).toBeGreaterThan(minTools); // extras present, not just base
+      } finally {
+        await harness.close();
+      }
+    });
+  }
+});

package/tsconfig.json

@@ -5,5 +5,8 @@
     "rootDir": "./src"
   },
   "include": ["src/**/*"],
-  "exclude": ["node_modules", "dist"]
+  // src/worker.ts is the Cloudflare-Worker entry: it imports
+  // @chrischall/mcp-connector (which pulls the `agents` runtime + Cloudflare
+  // types) and is compiled by wrangler/esbuild, not by this stdio tsc build.
+  "exclude": ["node_modules", "dist", "src/worker.ts"]
 }

package/vitest.config.ts

@@ -1,11 +1,42 @@
-import { defineConfig } from 'vitest/config';
+import { configDefaults, defineConfig } from 'vitest/config';
 
 export default defineConfig({
   test: {
+    // `tests/worker.test.ts` only runs under the Workers runtime pool
+    // (root `vitest.workers.config.mts` / `npm run worker:test`), which provides
+    // the virtual `cloudflare:test` module it imports. The node pool must skip it.
+    exclude: [...configDefaults.exclude, 'tests/worker.test.ts'],
+    // Neutralize the gog env vars for the whole suite.
+    //
+    // THE BUG THIS FIXES: the runner tests assert the exact argv `run()` builds,
+    // but `run()` reads GOG_ACCOUNT/GOG_PATH/GOG_READONLY from the ambient
+    // environment. Anyone whose shell exports them — which is normal for a
+    // machine that also *uses* these MCP servers — got 10+ failures on an
+    // untouched working tree, and the vitest diff dumped the entire process.env
+    // (live API keys included) into the terminal. CI passed only because its
+    // environment happens to be bare.
+    //
+    // Empty string rather than deletion: vitest's `env` merges into process.env
+    // and cannot unset a key, but `readEnvVar` already treats '' as unset (the
+    // same rule that makes blank .mcpb user-config fields behave as absent), so
+    // this is exactly equivalent to running with the vars removed.
+    env: {
+      GOG_ACCOUNT: '',
+      GOG_PATH: '',
+      GOG_READONLY: '',
+    },
     coverage: {
       provider: 'v8',
       include: ['src/**/*.ts'],
-      exclude: ['src/index.ts'],
+      exclude: [
+        'src/index.ts',
+        // src/worker.ts is the only Worker-path file that can't load under the
+        // node pool (it imports the `@chrischall/mcp-connector`/`agents` runtime);
+        // it's exercised by the Workers pool suite (`npm run worker:test`). Its
+        // testable helpers live in src/connector-runtime.ts, and src/connector-auth.ts
+        // is node-loadable — both are unit-tested here and stay in the 100% gate.
+        'src/worker.ts',
+      ],
       thresholds: {
         lines: 100,
         functions: 100,

package/tests/helpers/test-harness.ts

@@ -1,27 +0,0 @@
-// Shared test harness for tool registrars across base + sub-packages.
-//
-// `vi.mock(...)` must stay in the caller's test file because vitest hoists
-// it at module scope, but the boilerplate around it lives here.
-import { vi } from 'vitest';
-import { McpServer } from '@modelcontextprotocol/sdk/server/mcp.js';
-
-export type ToolHandler = (
-  args: Record<string, unknown>,
-) => Promise<{ content: Array<{ type: string; text: string }> }>;
-
-export function toText(text: string): { content: Array<{ type: string; text: string }> } {
-  return { content: [{ type: 'text', text }] };
-}
-
-export function setupHandlers(
-  register: (server: McpServer) => void,
-): Map<string, ToolHandler> {
-  const server = new McpServer({ name: 'test', version: '0.0.0' });
-  const handlers = new Map<string, ToolHandler>();
-  vi.spyOn(server, 'registerTool').mockImplementation((name, _config, cb) => {
-    handlers.set(name, cb as ToolHandler);
-    return undefined as never;
-  });
-  register(server);
-  return handlers;
-}