gogcli-mcp 3.0.0 → 4.0.0

package/src/google-probe.ts

@@ -1,113 +0,0 @@
-/**
- * How this side reads the runner's `GET /health/google` answer.
- *
- * ## Why this is a module and not two `if` statements
- *
- * There are two callers — the connect-time probe in `connector-auth.ts` and the
- * post-refusal probe in `connector-runtime.ts` — and they used to make this
- * judgement separately. That is exactly how the defect below survived review of
- * both: each site branched on `body.ok === true` alone, so both inherited the
- * same wrong reading, and fixing one would have left the other. The judgement
- * now exists once; the call sites only translate a verdict into their own event
- * names.
- *
- * ## The defect this deletes
- *
- * `ok` answers "is the Google layer healthy". It does NOT answer "did anything
- * find out" — and `server.mjs` reports `ok:false` for causes that are facts
- * about the PROBE rather than about Google: it timed out, it could not be run at
- * all (no `gog` on PATH, no `credentials.json` on the volume), its output could
- * not be parsed, or gog declined to state validity. Reading `ok !== true` as
- * "Google refused" filed every one of those at error level under an event whose
- * documented meaning is "Google was asked and **refused**". An operator grepping
- * event names would conclude the refresh token was dead and close the incident
- * on evidence that was never gathered — the original defect (status claiming
- * health nothing measured) with the alarm merely inverted.
- *
- * So the runner now states `measured` explicitly, and this module reads it
- * FIRST. `ok` is only consulted once a measurement is established.
- *
- * ## Which way "unknown" resolves
- *
- * Toward `unmeasured`, always. The two errors are not symmetrical: filing a real
- * refusal as unmeasured under-claims, and the runner's own cause string still
- * rides along on the same log line, so nothing is lost. Filing a non-measurement
- * as a refusal invents evidence. A runner that does not say whether it measured
- * therefore gets no verdict about Google extracted from it — including the
- * incoherent `ok:true, measured:false` and the merely silent `ok:true`, neither
- * of which can license a health claim.
- *
- * `ok:true` is worth spelling out, because it is where this rule is easiest to
- * talk yourself out of: an affirmative-sounding field feels self-licensing, and
- * the harm of believing it looks small. It is not. The GOOD verdict is what the
- * refusal path compares Google's live 401 against, so a `kind:'ok'` built on
- * silence becomes `refusal.google-ok` — the record documented as "the one
- * record that means we cannot explain this", logged at error level, and the
- * only evidence that could ever justify building automatic recovery on the
- * hosted path. Raised from a measurement nobody took, it is precisely the
- * defect this branch exists to delete: a health claim with nothing behind it.
- */
-
-/** The verdict, in the three states the log's event names already distinguish. */
-export type GoogleProbeVerdict =
-  /** Measured, and the credential works. */
-  | { kind: 'ok'; reason?: undefined }
-  /** Measured, and it does not. `reason` is the runner's classification. */
-  | { kind: 'unhealthy'; reason: string }
-  /** Nothing was learned about Google. Not evidence of anything. */
-  | { kind: 'unmeasured'; reason: string };
-
-/** Read a field only if it really is a boolean — a proxy may put anything here. */
-const bool = (value: unknown): boolean | undefined =>
-  typeof value === 'boolean' ? value : undefined;
-
-/**
- * The runner's cause, if it sent a usable one.
- *
- * Non-strings are dropped rather than stringified: this value reaches a log
- * aggregator, and `[object Object]` is worse than the honest fallback sentence.
- * Every legitimate value is a literal from `PROBE_CAUSES` in `server.mjs`.
- */
-const cause = (value: unknown): string | undefined =>
-  typeof value === 'string' && value.length > 0 ? value : undefined;
-
-/**
- * Turn a `/health/google` body into a verdict. Total: every input, including a
- * proxy's HTML page parsed into a string and a body of `null`, yields one of the
- * three kinds and never throws.
- */
-export function readGoogleProbe(body: unknown): GoogleProbeVerdict {
-  const record = (typeof body === 'object' && body !== null ? body : {}) as Record<string, unknown>;
-  const measured = bool(record.measured);
-  const reported = cause(record.error);
-
-  // FIRST, and before `ok` is consulted at all: a runner that says it could not
-  // measure has told us nothing about the credential, however alarming its cause
-  // string reads.
-  if (measured === false) {
-    return {
-      kind: 'unmeasured',
-      reason: reported ?? 'the runner reported it could not measure the Google layer',
-    };
-  }
-  // `ok` is read ONLY here, inside the established measurement. Health is a
-  // claim, not a fact that states itself: `ok:true` on its own is a runner
-  // asserting a verdict about a credential without saying anything asked.
-  if (measured === true) {
-    if (bool(record.ok) === true) return { kind: 'ok' };
-    return {
-      kind: 'unhealthy',
-      reason: reported ?? 'the runner reported the Google layer unhealthy with no cause',
-    };
-  }
-  // No `measured` field at all — whatever `ok` says. Silence is not a
-  // measurement, so no claim about the credential may be built on it, in either
-  // direction; but whatever the runner did say is carried through, because the
-  // operator reading this line needs it.
-  return {
-    kind: 'unmeasured',
-    reason: reported
-      ? `the runner did not report whether it measured the Google layer; it said: ${reported}`
-      : 'the runner did not report whether it measured the Google layer',
-  };
-}

package/src/google-token.ts

@@ -1,391 +0,0 @@
-import { parseBoolEnv, readEnvVar } from '@chrischall/mcp-utils';
-import { credentialTag, logAuthTransition } from './auth-log.js';
-
-/**
- * Mint short-lived Google access tokens from a long-lived refresh token, so a
- * hosted gog's identity belongs to the REGISTRATION rather than to the machine
- * the binary runs on (#241).
- *
- * The shape of the problem: `gog` reads credentials from a keyring at
- * `GOG_HOME`, on the box where it executes — which is why one Fly volume ended
- * up being every registration's identity. But `gog --access-token` bypasses the
- * keyring entirely, and #235 already carries such a token to the box per
- * request. The only missing piece was that an access token lives about an hour,
- * so it cannot be the thing you STORE. A refresh token can.
- *
- * So the refresh token stays here, in the child's environment, and only a
- * one-hour access token ever crosses the wire. That is strictly better than the
- * arrangement it replaces, where a permanent credential sat on a shared volume.
- */
-
-const TOKEN_ENDPOINT = 'https://oauth2.googleapis.com/token';
-
-/**
- * Replace a token this long before it actually expires. A token that dies
- * mid-flight is a failure the caller can do nothing about, and the exchange is
- * cheap next to a failed tool call.
- */
-const EXPIRY_MARGIN_MS = 120_000;
-
-interface CachedToken {
-  accessToken: string;
-  expiresAt: number;
-}
-
-/**
- * Keyed by the CREDENTIAL, never a single "current token".
- *
- * A module-level current-token would be correct for one stdio process and
- * silently wrong everywhere else: a Worker isolate serves many callers, so the
- * first caller's identity would be handed to everyone after them. That is the
- * same failure as the captured executor in #235 and the ambient store in #233 —
- * three bugs, one shape, which is why this one is keyed from the start.
- *
- * The key is a hash rather than the token itself so that nothing which dumps or
- * iterates this map (a heap snapshot, a debugger, a future logging line) puts a
- * live credential in front of someone.
- */
-const cache = new Map<string, CachedToken>();
-
-/**
- * Exchanges currently in flight, so concurrent callers share ONE of them.
- *
- * Without this, `get` → `await exchange` → `set` has an await between the miss
- * and the fill: every caller that arrives during that window also misses, and
- * they all hit Google's token endpoint together. One process per caller hides
- * it, but a Worker isolate serving many callers — or simply several tool calls
- * in flight — turns a single refresh into a stampede, and being rate-limited
- * for it produces exactly the intermittent auth failures this was meant to end.
- *
- * Keyed identically to `cache`, so two different credentials never wait on each
- * other's exchange.
- */
-const inFlight = new Map<string, Promise<CachedToken>>();
-
-/** Test seam: both maps are process-wide, so they do not unwind between tests. */
-export function clearAccessTokenCache(): void {
-  cache.clear();
-  inFlight.clear();
-}
-
-/**
- * WebCrypto rather than `node:crypto`: this module is reachable from the Worker
- * build, which has no node builtins. Both runtimes expose `crypto.subtle`.
- */
-async function cacheKey(refreshToken: string, clientId: string): Promise<string> {
-  // NUL-separated, spelled as an escape so this source file stays text: it
-  // keeps a (clientId, refreshToken) pair from colliding with a different
-  // pair whose concatenation happens to match. Neither value can contain a
-  // NUL, which is what makes the boundary unambiguous.
-  const data = new TextEncoder().encode(`${clientId}\u0000${refreshToken}`);
-  const digest = await crypto.subtle.digest('SHA-256', data);
-  return Array.from(new Uint8Array(digest), (b) => b.toString(16).padStart(2, '0')).join('');
-}
-
-/**
- * What a token source is: something that answers "who is this call acting as",
- * or throws trying. It never answers `undefined` after being configured —
- * see the failure note below.
- *
- * It also answers a second question, which is what makes a rejected token
- * recoverable: `invalidate(rejected)` drops that token if it is still the one
- * cached for this credential, and REPORTS whether it dropped anything.
- *
- * `true` means the next read mints something new, so a replay is worth making;
- * `false` means a concurrent caller has already replaced the entry. Those are
- * the only two answers, and a source with nothing to mint from gives neither —
- * it omits the method entirely (see below).
- */
-export interface AccessTokenSource {
-  (): Promise<string | undefined>;
-  /**
-   * Evict `rejected` if it is still this credential's cached token; answer
-   * whether anything was evicted.
-   *
-   * ABSENT exactly when this source holds nothing mintable — a directly-supplied
-   * GOG_ACCESS_TOKEN, or a refresh token with no OAuth client beside it. The
-   * absence has to be the signal, because an always-false return is not
-   * distinguishable from the false a real cache gives when a concurrent caller
-   * beat you to the refresh, and the connector records those as different
-   * causes: "nothing here can mint a replacement" is the one configuration
-   * where re-authorizing genuinely IS the repair, and it must not be logged as
-   * somebody else's concurrent write.
-   *
-   * Scoped to ONE credential on purpose. `clearAccessTokenCache()` drops every
-   * entry and exists only as a test seam — using it here would mean one
-   * caller's dead token forced a re-mint on every other caller sharing the
-   * isolate, which is the same shared-identity mistake this module is built
-   * around, wearing a different hat.
-   *
-   * Matched by VALUE, not just by key. A concurrent caller may already have
-   * replaced the entry while this call was in flight; evicting that fresh token
-   * would waste a mint and let two callers keep undoing each other's work.
-   */
-  invalidate?: (rejected: string) => Promise<boolean>;
-  /**
-   * The log-safe name of the credential behind this source, for correlating
-   * this module's records with the connector's (auth-log.ts).
-   *
-   * Optional, and absent exactly when there is no mintable credential to name.
-   * A directly-supplied GOG_ACCESS_TOKEN emits no records here at all — nothing
-   * is minted, cached or evicted — so a tag for it would identify a story that
-   * is never told. Answering `undefined` says that honestly rather than
-   * inventing an identifier for a credential this module does not hold.
-   */
-  credentialId?: () => Promise<string>;
-}
-
-export interface TokenEnv {
-  GOG_ACCESS_TOKEN?: string;
-  GOG_REFRESH_TOKEN?: string;
-  GOG_CLIENT_ID?: string;
-  GOG_CLIENT_SECRET?: string;
-  [key: string]: string | undefined;
-}
-
-/**
- * Build the token source for this environment, or `undefined` when nothing is
- * configured — which leaves the backend acting as itself, exactly as every
- * registration did before this existed.
- *
- * Precedence puts a directly-supplied `GOG_ACCESS_TOKEN` first: someone who
- * already holds a token should not need an OAuth client to use it, and it keeps
- * the #230 path working untouched.
- */
-export function makeAccessTokenSource(env: TokenEnv): AccessTokenSource | undefined {
-  // A token handed to us whole. Nothing minted it here, so nothing here can
-  // mint another — hence no `invalidate` at all, which is how the caller tells
-  // this apart from a cache that merely lost a race. When THIS is the token
-  // Google rejects, re-authorization really is the repair.
-  const direct = readEnvVar('GOG_ACCESS_TOKEN', { env });
-  if (direct) return async () => direct;
-
-  const refreshToken = readEnvVar('GOG_REFRESH_TOKEN', { env });
-  if (!refreshToken) return undefined;
-
-  const clientId = readEnvVar('GOG_CLIENT_ID', { env });
-  const clientSecret = readEnvVar('GOG_CLIENT_SECRET', { env });
-
-  // A refresh token with no OAuth client cannot mint anything, and the WRONG
-  // repair is to treat it as unconfigured: that falls back to the backend's own
-  // identity, which is the precise confusion this feature exists to remove. So
-  // the source exists and throws when used — `tools/list` still works, the
-  // server still starts, and the first tool call says what is missing.
-  if (!clientId || !clientSecret) {
-    const missing = [!clientId && 'GOG_CLIENT_ID', !clientSecret && 'GOG_CLIENT_SECRET']
-      .filter(Boolean)
-      .join(' and ');
-    return async () => {
-      throw new Error(
-        `GOG_REFRESH_TOKEN is set but ${missing} is not, so no access token can be minted. ` +
-          'Set the OAuth client alongside the refresh token, or unset GOG_REFRESH_TOKEN to use the backend’s own identity.',
-      );
-    };
-  }
-
-  // Hashed ONCE per source rather than once per call. `read` and `invalidate`
-  // each used to recompute the SHA-256 on every invocation, which is work this
-  // module was already paying for on the request path; memoizing it also gives
-  // the log records a credential tag for free. Lazy rather than eager so a
-  // source that is never used never starts a promise nobody awaits.
-  let keyPromise: Promise<string> | undefined;
-  const key = (): Promise<string> => (keyPromise ??= cacheKey(refreshToken, clientId));
-
-  // Every other transition in the set is an EVENT; a cache hit is the absence
-  // of one. Narrating it writes a line per gog invocation — a Workers Logs line
-  // (and its cost) for every tool call in healthy operation on the Worker, and
-  // a stderr line per call in the MCP host's server log on stdio — which turns
-  // the `gog-auth` stream from a log of transitions into a request log.
-  //
-  // It stays available for the investigation that has to prove WHICH token a
-  // call was served (the shape the original incident took), behind a flag
-  // nobody sets in normal operation. Read once per source rather than per call:
-  // the env cannot change under a running process.
-  const logCacheHits = parseBoolEnv('GOG_AUTH_LOG_CACHE_HITS', { env });
-
-  const read = async (): Promise<string | undefined> => {
-    const k = await key();
-    const hit = cache.get(k);
-    if (hit && hit.expiresAt - EXPIRY_MARGIN_MS > Date.now()) {
-      if (logCacheHits) logAuthTransition('token.cache-hit', { credential: credentialTag(k) });
-      return hit.accessToken;
-    }
-
-    // Join the exchange already running for this credential, or start the one
-    // everyone else will join.
-    let pending = inFlight.get(k);
-    if (!pending) {
-      pending = exchange(refreshToken, clientId, clientSecret)
-        .then((minted) => {
-          cache.set(k, minted);
-          logAuthTransition('token.minted', {
-            credential: credentialTag(k),
-            reason: `valid for ${Math.round((minted.expiresAt - Date.now()) / 1000)}s`,
-          });
-          return minted;
-        })
-        // Only the caller that STARTED the exchange records it, because only one
-        // exchange happened; the callers that joined it would otherwise turn one
-        // mint into a burst of identical lines.
-        //
-        // Typed as TokenExchangeError rather than `unknown`: `exchange` catches
-        // the fetch rejection and the JSON parse itself, so this is the only
-        // thing that can arrive here, and pretending otherwise would add an arm
-        // no test could ever reach.
-        .catch((err: TokenExchangeError): never => {
-          logAuthTransition(err.grantDead ? 'grant.dead' : 'token.mint-failed', {
-            credential: credentialTag(k),
-            reason: err.message,
-          });
-          throw err;
-        })
-        // Dropped whether it resolved OR threw. Keeping a rejected promise here
-        // would make one transient failure permanent for every later caller —
-        // the opposite of the "failures are not cached" rule above.
-        .finally(() => inFlight.delete(k));
-      inFlight.set(k, pending);
-    }
-    const minted = await pending;
-    return minted.accessToken;
-  };
-
-  /**
-   * Google rejected `rejected`; make sure the next read does not serve it again.
-   *
-   * The read guard above is purely about TIME, so without this a token Google
-   * has already answered 401 to is re-served until its nominal expiry — up to
-   * ~58 minutes of every call failing identically, which is exactly the incident
-   * this closes. `inFlight` is deliberately untouched: an exchange that is
-   * already running was started to produce a NEW token, and cancelling it would
-   * only make the callers waiting on it mint again.
-   */
-  const invalidate = async (rejected: string): Promise<boolean> => {
-    const k = await key();
-    const hit = cache.get(k);
-    if (!hit || hit.accessToken !== rejected) {
-      // The two "nothing happened" cases are worth telling apart in a log: one
-      // says a concurrent caller has already repaired this credential, the
-      // other says the rejected token was never ours to begin with.
-      logAuthTransition('token.evict-noop', {
-        credential: credentialTag(k),
-        reason: hit
-          ? 'a concurrent caller had already replaced this credential’s token'
-          : 'no token was cached for this credential',
-      });
-      return false;
-    }
-    cache.delete(k);
-    logAuthTransition('token.evicted', {
-      credential: credentialTag(k),
-      reason: 'Google rejected this access token; the next read will mint a new one',
-    });
-    return true;
-  };
-
-  return Object.assign(read, {
-    invalidate,
-    credentialId: async () => credentialTag(await key()),
-  });
-}
-
-/**
- * Exchange refresh -> access.
- *
- * THROWS on every failure, and never returns `undefined`. Returning nothing
- * would let the call proceed as the backend's identity, and the caller would
- * read someone else's mailbox while everything looked like success — the same
- * reasoning that made a malformed token a 400 rather than an ignore in #235.
- *
- * Nothing here is cached on failure either, so a transient Google outage does
- * not become a sticky one.
- */
-class TokenExchangeError extends Error {
-  /**
-   * The REFRESH token is dead (Google's `invalid_grant`), not merely the access
-   * token. Carried as a flag rather than re-read from the message, because
-   * inferring the author of a failure from prose several authors can produce is
-   * precisely the mistake this branch exists to undo. `instanceof` is safe: the
-   * class is thrown and caught inside this one module.
-   */
-  readonly grantDead: boolean;
-
-  constructor(message: string, grantDead: boolean) {
-    super(message);
-    this.grantDead = grantDead;
-  }
-}
-
-async function exchange(refreshToken: string, clientId: string, clientSecret: string): Promise<CachedToken> {
-  let res: Response;
-  try {
-    res = await fetch(TOKEN_ENDPOINT, {
-      method: 'POST',
-      headers: { 'Content-Type': 'application/x-www-form-urlencoded' },
-      body: new URLSearchParams({
-        grant_type: 'refresh_token',
-        refresh_token: refreshToken,
-        client_id: clientId,
-        client_secret: clientSecret,
-      }).toString(),
-    });
-  } catch (err) {
-    throw new TokenExchangeError(
-      `the Google token exchange could not be reached: ${err instanceof Error ? err.message : String(err)}`,
-      false,
-    );
-  }
-
-  const body = (await res.json().catch(() => ({}))) as {
-    access_token?: string;
-    expires_in?: number;
-    error?: string;
-    error_description?: string;
-  };
-
-  if (!res.ok) {
-    // invalid_grant is the one worth naming, because it is not a bug and not
-    // transient: the credential is gone and a human has to enrol again. Google
-    // expires refresh tokens after 7 days while a consent screen is still in
-    // "Testing" mode, which is how this fleet has usually met it.
-    //
-    // The literal `invalid_grant` is in the message ON PURPOSE, and is load
-    // bearing rather than decoration. This mint is a first-class error surface
-    // — it propagates in place of gog's 401 (connector-runtime.ts) — and
-    // tools/utils.ts picks INVALID_GRANT_HINT, the one that names the 7-day
-    // Testing-mode cause and the gog_auth_add_url/gog_auth_add_complete pair,
-    // by matching that exact token. Prose alone does not qualify: the previous
-    // wording ("token has expired or been revoked") missed
-    // INVALID_GRANT_PATTERN's second alternative ("token has been expired or
-    // revoked") by one word, so a dead refresh token surfaced here earned only
-    // the generic "authentication may have expired" advice while the identical
-    // failure reported BY gog earned the specific guidance.
-    if (body.error === 'invalid_grant') {
-      throw new TokenExchangeError(
-        'the stored refresh token was rejected (invalid_grant): it has expired or been revoked, so ' +
-          'this account must be re-authorized ' +
-          '(commonly the 7-day limit on OAuth consent screens still in "Testing" mode). ' +
-          'Re-enrol with gog_auth_add_url + gog_auth_add_complete and store the new refresh token.',
-        true,
-      );
-    }
-    // The refresh token is deliberately absent from this message — it is a
-    // long-lived credential and an error string travels into logs and model
-    // context.
-    throw new TokenExchangeError(
-      `the access token could not be refreshed (HTTP ${res.status}${body.error ? `, ${body.error}` : ''})`,
-      false,
-    );
-  }
-
-  if (!body.access_token) {
-    throw new TokenExchangeError(
-      'the access token could not be refreshed: Google returned no access_token',
-      false,
-    );
-  }
-
-  // Default to an hour if Google omits expires_in; the margin above covers the
-  // difference between that guess and reality.
-  const expiresInMs = (body.expires_in ?? 3600) * 1000;
-  return { accessToken: body.access_token, expiresAt: Date.now() + expiresInMs };
-}

package/src/remote-runner.ts

@@ -1,77 +0,0 @@
-import { readEnvVar } from '@chrischall/mcp-utils';
-import { setDefaultGogExecutor } from './runner.js';
-import { makeAccessTokenSource } from './google-token.js';
-import { makeFlyExecutor } from './connector-runtime.js';
-
-/**
- * Let a stdio server run `gog` on the Fly backend instead of spawning it.
- *
- * The default stdio path shells out to the `gog` binary (`runner.ts`,
- * `spawn(GOG_PATH ?? 'gog')`), which is right on a laptop and impossible
- * anywhere the binary is not installed — notably mcp-host, whose runner image
- * is deliberately Node + git + tar and nothing else. Baking a Go binary into a
- * generic runner for one MCP's sake, or curling an unpinned release tarball
- * inside an install, are both worse than using the seam that already exists:
- * `makeFlyExecutor` has forwarded arg-arrays to `<runner>/run` for the
- * Cloudflare connector since that connector shipped, and it touches nothing
- * Worker-only.
- *
- * So this is wiring, not new machinery. Set both variables and the process
- * executes remotely; leave either unset and nothing changes, which is what
- * keeps every existing local install on the binary it already has.
- *
- * ## Why a process-wide default and not the AsyncLocalStorage
- *
- * `runExecutor` is an AsyncLocalStorage, and the Worker wraps each REQUEST in
- * `runExecutor.run(...)` because one isolate serves many callers whose backend
- * credentials differ. A stdio process is the opposite: one backend for its
- * whole life.
- *
- * This used to reach for `enterWith` on the theory that it "sets the store for
- * the whole process". It does not. `enterWith` sets the store on the async
- * resource that is CURRENT when it runs — here, module evaluation — and the
- * tool calls arrive later as I/O events on the transport's own resources, which
- * do not descend from that. So `getStore()` was undefined at exactly the moment
- * `run()` asked, and the seam reverted to spawning a binary the host does not
- * have. Every hosted gog MCP answered "gog executable not found" while pointed
- * at a healthy backend, and the unit test missed it because a test that calls
- * this function itself awaits inside the resource it just mutated.
- *
- * A process-lifetime value is not a scoped value, so it does not live in a
- * scope: `setDefaultGogExecutor` holds it, and a per-request store still beats
- * it (runner.ts `activeExecutor`) so the Worker path is unchanged.
- *
- * Call before the server starts, so no tool can be serviced ahead of it.
- */
-export function useRemoteGogRunner(env: NodeJS.ProcessEnv = process.env): boolean {
-  // The shared reader, not a local trim: it already treats blanks, unexpanded
-  // `${...}` placeholders AND the literal strings "undefined"/"null" as unset.
-  // Those last two are what a hand-rolled check misses, and they arrive whenever
-  // a host stringifies a missing value into an env block.
-  const endpoint = readEnvVar('GOG_RUNNER_URL', { env });
-  const key = readEnvVar('GOG_RUNNER_KEY', { env });
-  // Both or neither. A URL with no key would send unauthenticated requests the
-  // runner rejects, and a key with no URL is a credential configured for
-  // nothing — either alone is a misconfiguration, and silently spawning
-  // instead would hide it until someone wondered why the binary was needed.
-  if (!endpoint || !key) return false;
-  // Whose Google identity this process acts as (#230). The backend holds ONE
-  // identity on its volume, so without this every caller of a hosted gog acts
-  // as whoever seeded it. Under mcp-host's `perUserChild` this process belongs
-  // to a single caller and its environment carries that caller's token, so
-  // forwarding it is the whole of "act as the person calling you".
-  //
-  // Read per call rather than captured here, because the executor outlives any
-  // one request and the claim being made is about a request. Absent when unset,
-  // which is every registration that predates per-caller auth.
-  //
-  // The source also covers the case where the registration stores a REFRESH
-  // token instead (#241) — the identity then belongs to the registration rather
-  // than to the backend's volume, and the short-lived token it mints is the
-  // only thing that crosses the wire. `undefined` when neither is configured,
-  // which leaves the backend acting as itself exactly as before.
-  setDefaultGogExecutor(
-    makeFlyExecutor(endpoint.replace(/\/+$/, ''), key, makeAccessTokenSource(env)),
-  );
-  return true;
-}