gogcli-mcp 4.1.0 → 4.2.1

package/.claude-plugin/marketplace.json

@@ -7,7 +7,7 @@
   },
   "metadata": {
     "description": "Google Sheets (and more) for Claude via gogcli — read, write, and manage spreadsheets",
-    "version": "4.1.0"
+    "version": "4.2.1"
   },
   "plugins": [
     {
@@ -15,7 +15,7 @@
       "displayName": "gogcli",
       "source": "./",
       "description": "Google Sheets (and more) for Claude via gogcli — read, write, and manage spreadsheets",
-      "version": "4.1.0",
+      "version": "4.2.1",
       "author": {
         "name": "Chris Hall"
       },

package/.claude-plugin/plugin.json

@@ -1,7 +1,7 @@
 {
   "name": "gogcli-mcp",
   "displayName": "gogcli",
-  "version": "4.1.0",
+  "version": "4.2.1",
   "description": "Google Sheets (and more) for Claude via gogcli — read, write, and manage spreadsheets",
   "author": {
     "name": "Chris Hall",

package/dist/index.js

@@ -5,6 +5,66 @@ var __export = (target, all) => {
     __defProp(target, name, { get: all[name], enumerable: true });
 };
 
+// ../../node_modules/@chrischall/mcp-utils/dist/cancel/index.js
+import { AsyncLocalStorage } from "node:async_hooks";
+var storage = new AsyncLocalStorage();
+function withCallSignal(signal, fn, request) {
+  return signal ? storage.run({ signal, ...request ? { request } : {} }, fn) : fn();
+}
+function currentCallSignal() {
+  return storage.getStore()?.signal;
+}
+function killOnCancel(child, signal = "SIGTERM") {
+  const ambient = currentCallSignal();
+  if (!ambient)
+    return () => {
+    };
+  if (ambient.aborted) {
+    child.kill(signal);
+    return () => {
+    };
+  }
+  const onAbort = () => {
+    child.kill(signal);
+  };
+  ambient.addEventListener("abort", onAbort, { once: true });
+  return () => ambient.removeEventListener("abort", onAbort);
+}
+
+// ../../node_modules/@chrischall/mcp-utils/dist/caller/index.js
+import { AsyncLocalStorage as AsyncLocalStorage2 } from "node:async_hooks";
+var storage2 = new AsyncLocalStorage2();
+function withCallerCapabilities(capabilities, fn) {
+  return capabilities ? storage2.run(capabilities, fn) : fn();
+}
+function currentCallerCapabilities() {
+  return storage2.getStore();
+}
+var ENVELOPE_CAPABILITIES_KEY = "io.modelcontextprotocol/clientCapabilities";
+var ELICITATION_MODES = ["form", "url"];
+function isRecord(value) {
+  return typeof value === "object" && value !== null && !Array.isArray(value);
+}
+function callerCapabilities(ctx) {
+  const envelope = isRecord(ctx) && isRecord(ctx.mcpReq) ? ctx.mcpReq.envelope : void 0;
+  if (isRecord(envelope)) {
+    const declared = envelope[ENVELOPE_CAPABILITIES_KEY];
+    if (isRecord(declared))
+      return declared;
+  }
+  return currentCallerCapabilities();
+}
+function callerAcceptsFormElicitation(ctx) {
+  const capabilities = callerCapabilities(ctx);
+  if (!capabilities)
+    return void 0;
+  const elicitation = capabilities.elicitation;
+  if (!isRecord(elicitation))
+    return false;
+  const namedModes = ELICITATION_MODES.filter((mode) => mode in elicitation);
+  return namedModes.length === 0 || namedModes.includes("form");
+}
+
 // ../../node_modules/@modelcontextprotocol/server/dist/chunk-Br0eD_fh.mjs
 var __create = Object.create;
 var __defProp2 = Object.defineProperty;
@@ -34480,6 +34540,7 @@ function errorResult(message) {
 // ../../node_modules/@chrischall/mcp-utils/dist/server/confirmation.js
 var DEFAULT_REQUEST_KEY = "confirmation";
 var DEFAULT_CONFIRMATION_LABEL = "Confirm this action should proceed.";
+var UNSUPPORTED_NOTE = "Nothing was done because this client cannot show a confirmation prompt (it declares no MCP elicitation capability), and this action is never taken without one";
 function requireConfirmation(ctx, options) {
   const requestKey = options.requestKey ?? DEFAULT_REQUEST_KEY;
   const confirmationSchema = external_exports.object({
@@ -34488,6 +34549,15 @@ function requireConfirmation(ctx, options) {
   const response = inputResponse(ctx.mcpReq.inputResponses, requestKey);
   const accepted = acceptedContent(ctx.mcpReq.inputResponses, requestKey, confirmationSchema);
   if (response.kind === "missing") {
+    if (callerAcceptsFormElicitation(ctx) === false) {
+      return textResult({
+        confirmed: false,
+        dispatched: false,
+        action: options.action,
+        reason: "confirmation-unsupported",
+        note: options.unsupportedNote ? `${UNSUPPORTED_NOTE}. ${options.unsupportedNote}` : `${UNSUPPORTED_NOTE}.`
+      });
+    }
     const preview = {
       action: options.action,
       ...options.details === void 0 ? {} : { details: options.details }
@@ -34526,17 +34596,73 @@ Hint: ${err.hint}`);
   }
   throw err;
 }
+function mcpRequestFrom(args) {
+  const ctx = args.at(-1);
+  if (typeof ctx !== "object" || ctx === null)
+    return void 0;
+  const req = ctx.mcpReq;
+  if (typeof req !== "object" || req === null)
+    return void 0;
+  return typeof req.notify === "function" ? req : void 0;
+}
+function callSignalFrom(args) {
+  const ctx = args.at(-1);
+  if (typeof ctx !== "object" || ctx === null)
+    return void 0;
+  const req = ctx.mcpReq;
+  if (typeof req !== "object" || req === null)
+    return void 0;
+  const signal = req.signal;
+  return signal instanceof AbortSignal ? signal : void 0;
+}
+function declaredCapabilitiesFrom(server) {
+  const inner = server.server;
+  if (typeof inner !== "object" || inner === null)
+    return void 0;
+  const read = inner.getClientCapabilities;
+  if (typeof read !== "function")
+    return void 0;
+  try {
+    const declared = read.call(inner);
+    return typeof declared === "object" && declared !== null ? declared : void 0;
+  } catch {
+    return void 0;
+  }
+}
 function surfaceToolHints(server) {
   const register2 = server.registerTool.bind(server);
-  server.registerTool = (name, config2, cb) => register2(name, config2, (...args) => {
-    let result;
-    try {
-      result = cb(...args);
-    } catch (err) {
-      return hintResultOrRethrow(err);
-    }
-    return result instanceof Promise ? result.catch(hintResultOrRethrow) : result;
-  });
+  server.registerTool = (name, config2, cb) => register2(name, config2, (...args) => (
+    // THE CALLER'S CANCELLATION, made ambient for the whole handler
+    // (`cancel/index.ts`). The SDK delivers it and the fleet ignored it:
+    // measured against @modelcontextprotocol/server 2.0.0, a cancelled
+    // call aborts `ctx.mcpReq.signal` with the caller's reason and the
+    // handler runs to completion regardless — so the HTTP request stays
+    // in flight, the child keeps burning metered CPU, and the upstream
+    // keeps being hit for somebody who has gone. claude.ai sent 101
+    // cancellations in the week to 2026-09-20.
+    //
+    // Here because this is the one wrapper every tool already passes
+    // through: threading the signal by hand would mean editing several
+    // hundred handlers and missing exactly the ones nobody edits.
+    withCallSignal(callSignalFrom(args), () => (
+      // WHAT THE CALLER CAN DO, made ambient for the same reason and in
+      // the same place (`caller/index.ts`). Only the 2025-era half needs
+      // the wrapper — a 2026-07-28 request answers for itself off its own
+      // envelope — but a guarded tool that cannot tell whether the caller
+      // can be shown a prompt returns one the SDK then refuses to deliver,
+      // and that refusal reaches the caller as an unexplained protocol
+      // error it had no chance to catch.
+      withCallerCapabilities(declaredCapabilitiesFrom(server), () => {
+        let result;
+        try {
+          result = cb(...args);
+        } catch (err) {
+          return hintResultOrRethrow(err);
+        }
+        return result instanceof Promise ? result.catch(hintResultOrRethrow) : result;
+      })
+    ), mcpRequestFrom(args))
+  ));
 }
 async function createMcpServer(opts) {
   const server = new McpServer({ name: opts.name, version: opts.version }, { supportedProtocolVersions: [...SERVER_PROTOCOL_VERSIONS] });
@@ -34971,8 +35097,15 @@ async function spawnGog(fullArgs, opts) {
     const stdoutChunks = [];
     const stderrChunks = [];
     let settled = false;
+    const cancelled = currentCallSignal();
+    const stopWatchingCancel = killOnCancel(child);
+    const stopWatching = () => {
+      clearTimeout(timer);
+      stopWatchingCancel();
+    };
     const timer = setTimeout(() => {
       settled = true;
+      stopWatchingCancel();
       child.kill();
       reject(new Error(`gog timed out after ${formatTimeout(effectiveTimeout)}`));
     }, effectiveTimeout);
@@ -34983,9 +35116,13 @@ async function spawnGog(fullArgs, opts) {
       stderrChunks.push(chunk);
     });
     child.on("close", (code) => {
-      clearTimeout(timer);
+      stopWatching();
       if (settled) return;
       settled = true;
+      if (cancelled?.aborted) {
+        reject(cancelled.reason instanceof Error ? cancelled.reason : new Error("the caller cancelled this call"));
+        return;
+      }
       const stderr = Buffer.concat(stderrChunks).toString().trim();
       if (code === 0) {
         if (binary) {
@@ -35003,7 +35140,7 @@ async function spawnGog(fullArgs, opts) {
       }
     });
     child.on("error", (err) => {
-      clearTimeout(timer);
+      stopWatching();
       if (settled) return;
       settled = true;
       if (err.code === "ENOENT") {
@@ -36933,12 +37070,25 @@ function finish(base, itemsKey, merged, token) {
 }
 
 // src/gmail-dispatch-guard.ts
+function replyDispatchOp(kind) {
+  return `gmail.${kind}`;
+}
+var STAGING_TWIN = {
+  "gmail.forward": "gog_gmail_drafts_forward",
+  "gmail.reply": "gog_gmail_drafts_reply",
+  "gmail.reply-all": "gog_gmail_drafts_reply_all",
+  "gmail.send": "gog_gmail_drafts_create"
+};
 function requireGmailDispatchConfirmation(ctx, op, details) {
+  const twin = STAGING_TWIN[op];
   return requireConfirmation(ctx, {
     action: op,
     message: "Review and confirm this email dispatch:",
     details,
-    confirmationLabel: "Confirm that this email should be sent now."
+    confirmationLabel: "Confirm that this email should be sent now.",
+    ...twin ? {
+      unsupportedNote: `Stage it with ${twin} instead, review the draft, and send it with gog_gmail_drafts_send.`
+    } : {}
   });
 }
 var EMAIL_PATTERN = /[a-z0-9!#$%&'*+/=?^_`{|}~.-]+@[a-z0-9-]+(?:\.[a-z0-9-]+)+/gi;
@@ -37067,7 +37217,7 @@ async function sendReply(kind, toolName, messageId, account, flags, ctx) {
   if (metaResult.isError) return metaResult;
   const headers = parseMetadataHeaders(resultText(metaResult));
   const recipients = computeReplyRecipients(kind, headers, flags);
-  const confirmation = requireGmailDispatchConfirmation(ctx, `gmail.${kind}`, {
+  const confirmation = requireGmailDispatchConfirmation(ctx, replyDispatchOp(kind), {
     messageId,
     recipients,
     recipientCount: recipients.length,
@@ -37521,7 +37671,7 @@ function registerTasksTools(server) {
 }
 
 // src/server.ts
-var VERSION = true ? "4.1.0" : "0.0.0";
+var VERSION = true ? "4.2.1" : "0.0.0";
 var BASE_TOOL_REGISTRARS = [
   registerApiTools,
   registerAppScriptTools,

package/dist/lib.js

@@ -19672,6 +19672,60 @@ function date4(params) {
   return _coercedDate(ZodDate, params);
 }
 
+// ../../node_modules/@chrischall/mcp-utils/dist/cancel/index.js
+import { AsyncLocalStorage } from "node:async_hooks";
+var storage = new AsyncLocalStorage();
+function currentCallSignal() {
+  return storage.getStore()?.signal;
+}
+function killOnCancel(child, signal = "SIGTERM") {
+  const ambient = currentCallSignal();
+  if (!ambient)
+    return () => {
+    };
+  if (ambient.aborted) {
+    child.kill(signal);
+    return () => {
+    };
+  }
+  const onAbort = () => {
+    child.kill(signal);
+  };
+  ambient.addEventListener("abort", onAbort, { once: true });
+  return () => ambient.removeEventListener("abort", onAbort);
+}
+
+// ../../node_modules/@chrischall/mcp-utils/dist/caller/index.js
+import { AsyncLocalStorage as AsyncLocalStorage2 } from "node:async_hooks";
+var storage2 = new AsyncLocalStorage2();
+function currentCallerCapabilities() {
+  return storage2.getStore();
+}
+var ENVELOPE_CAPABILITIES_KEY = "io.modelcontextprotocol/clientCapabilities";
+var ELICITATION_MODES = ["form", "url"];
+function isRecord(value) {
+  return typeof value === "object" && value !== null && !Array.isArray(value);
+}
+function callerCapabilities(ctx) {
+  const envelope = isRecord(ctx) && isRecord(ctx.mcpReq) ? ctx.mcpReq.envelope : void 0;
+  if (isRecord(envelope)) {
+    const declared = envelope[ENVELOPE_CAPABILITIES_KEY];
+    if (isRecord(declared))
+      return declared;
+  }
+  return currentCallerCapabilities();
+}
+function callerAcceptsFormElicitation(ctx) {
+  const capabilities = callerCapabilities(ctx);
+  if (!capabilities)
+    return void 0;
+  const elicitation = capabilities.elicitation;
+  if (!isRecord(elicitation))
+    return false;
+  const namedModes = ELICITATION_MODES.filter((mode) => mode in elicitation);
+  return namedModes.length === 0 || namedModes.includes("form");
+}
+
 // ../../node_modules/@modelcontextprotocol/server/dist/chunk-Br0eD_fh.mjs
 var __create = Object.create;
 var __defProp2 = Object.defineProperty;
@@ -32949,6 +33003,7 @@ function errorResult(message) {
 // ../../node_modules/@chrischall/mcp-utils/dist/server/confirmation.js
 var DEFAULT_REQUEST_KEY = "confirmation";
 var DEFAULT_CONFIRMATION_LABEL = "Confirm this action should proceed.";
+var UNSUPPORTED_NOTE = "Nothing was done because this client cannot show a confirmation prompt (it declares no MCP elicitation capability), and this action is never taken without one";
 function requireConfirmation(ctx, options) {
   const requestKey = options.requestKey ?? DEFAULT_REQUEST_KEY;
   const confirmationSchema = external_exports.object({
@@ -32957,6 +33012,15 @@ function requireConfirmation(ctx, options) {
   const response = inputResponse(ctx.mcpReq.inputResponses, requestKey);
   const accepted = acceptedContent(ctx.mcpReq.inputResponses, requestKey, confirmationSchema);
   if (response.kind === "missing") {
+    if (callerAcceptsFormElicitation(ctx) === false) {
+      return textResult({
+        confirmed: false,
+        dispatched: false,
+        action: options.action,
+        reason: "confirmation-unsupported",
+        note: options.unsupportedNote ? `${UNSUPPORTED_NOTE}. ${options.unsupportedNote}` : `${UNSUPPORTED_NOTE}.`
+      });
+    }
     const preview = {
       action: options.action,
       ...options.details === void 0 ? {} : { details: options.details }
@@ -33364,8 +33428,15 @@ async function spawnGog(fullArgs, opts) {
     const stdoutChunks = [];
     const stderrChunks = [];
     let settled = false;
+    const cancelled = currentCallSignal();
+    const stopWatchingCancel = killOnCancel(child);
+    const stopWatching = () => {
+      clearTimeout(timer);
+      stopWatchingCancel();
+    };
     const timer = setTimeout(() => {
       settled = true;
+      stopWatchingCancel();
       child.kill();
       reject(new Error(`gog timed out after ${formatTimeout(effectiveTimeout)}`));
     }, effectiveTimeout);
@@ -33376,9 +33447,13 @@ async function spawnGog(fullArgs, opts) {
       stderrChunks.push(chunk);
     });
     child.on("close", (code) => {
-      clearTimeout(timer);
+      stopWatching();
       if (settled) return;
       settled = true;
+      if (cancelled?.aborted) {
+        reject(cancelled.reason instanceof Error ? cancelled.reason : new Error("the caller cancelled this call"));
+        return;
+      }
       const stderr = Buffer.concat(stderrChunks).toString().trim();
       if (code === 0) {
         if (binary) {
@@ -33396,7 +33471,7 @@ async function spawnGog(fullArgs, opts) {
       }
     });
     child.on("error", (err) => {
-      clearTimeout(timer);
+      stopWatching();
       if (settled) return;
       settled = true;
       if (err.code === "ENOENT") {
@@ -35329,12 +35404,25 @@ function finish(base, itemsKey, merged, token) {
 }
 
 // src/gmail-dispatch-guard.ts
+function replyDispatchOp(kind) {
+  return `gmail.${kind}`;
+}
+var STAGING_TWIN = {
+  "gmail.forward": "gog_gmail_drafts_forward",
+  "gmail.reply": "gog_gmail_drafts_reply",
+  "gmail.reply-all": "gog_gmail_drafts_reply_all",
+  "gmail.send": "gog_gmail_drafts_create"
+};
 function requireGmailDispatchConfirmation(ctx, op, details) {
+  const twin = STAGING_TWIN[op];
   return requireConfirmation(ctx, {
     action: op,
     message: "Review and confirm this email dispatch:",
     details,
-    confirmationLabel: "Confirm that this email should be sent now."
+    confirmationLabel: "Confirm that this email should be sent now.",
+    ...twin ? {
+      unsupportedNote: `Stage it with ${twin} instead, review the draft, and send it with gog_gmail_drafts_send.`
+    } : {}
   });
 }
 var EMAIL_PATTERN = /[a-z0-9!#$%&'*+/=?^_`{|}~.-]+@[a-z0-9-]+(?:\.[a-z0-9-]+)+/gi;
@@ -35463,7 +35551,7 @@ async function sendReply(kind, toolName, messageId, account, flags, ctx) {
   if (metaResult.isError) return metaResult;
   const headers = parseMetadataHeaders(resultText(metaResult));
   const recipients = computeReplyRecipients(kind, headers, flags);
-  const confirmation = requireGmailDispatchConfirmation(ctx, `gmail.${kind}`, {
+  const confirmation = requireGmailDispatchConfirmation(ctx, replyDispatchOp(kind), {
     messageId,
     recipients,
     recipientCount: recipients.length,
@@ -35917,7 +36005,7 @@ function registerTasksTools(server) {
 }
 
 // src/server.ts
-var VERSION = true ? "4.1.0" : "0.0.0";
+var VERSION = true ? "4.2.1" : "0.0.0";
 var BASE_TOOL_REGISTRARS = [
   registerApiTools,
   registerAppScriptTools,

package/manifest.json

@@ -3,7 +3,7 @@
   "manifest_version": "0.3",
   "name": "gogcli-mcp",
   "display_name": "gogcli",
-  "version": "4.1.0",
+  "version": "4.2.1",
   "description": "Google Sheets (and more) for Claude via gogcli — read, write, and manage spreadsheets",
   "author": {
     "name": "Chris Hall",

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "gogcli-mcp",
-  "version": "4.1.0",
+  "version": "4.2.1",
   "mcpName": "io.github.chrischall/gogcli-mcp",
   "description": "MCP server wrapping gogcli for Google service access",
   "author": "Claude Code (AI) <https://www.anthropic.com/claude>",
@@ -41,12 +41,12 @@
     "test:coverage": "vitest run --coverage"
   },
   "dependencies": {
-    "@chrischall/mcp-utils": "^1.0.0",
+    "@chrischall/mcp-utils": "^2.1.0",
     "@modelcontextprotocol/server": "^2.0.0",
     "zod": "^4.6.1"
   },
   "devDependencies": {
-    "@types/node": "^26.5.1",
+    "@types/node": "^26.6.1",
     "@vitest/coverage-v8": "^5.0.1",
     "esbuild": "^0.28.2",
     "typescript": "^7.0.2",

package/server.json

@@ -7,12 +7,12 @@
     "source": "github",
     "subfolder": "packages/gogcli-mcp"
   },
-  "version": "4.1.0",
+  "version": "4.2.1",
   "packages": [
     {
       "registryType": "npm",
       "identifier": "gogcli-mcp",
-      "version": "4.1.0",
+      "version": "4.2.1",
       "transport": {
         "type": "stdio"
       },

package/src/gmail-dispatch-guard.ts

@@ -14,18 +14,93 @@ import { readEnvVar, requireConfirmation } from '@chrischall/mcp-utils';
 // result containing the preview, and only the protocol retry carrying the
 // user's accepted confirmation dispatches. The confirmation is never a tool
 // argument, so a model cannot bypass the user by setting a boolean itself.
+//
+// A CLIENT THAT CANNOT SHOW THAT PROMPT gets a sentence rather than a prompt
+// it will refuse to deliver (`unsupportedNote`, mcp-utils `requireConfirmation`).
+// Measured on the mcp-host fleet 2026-09-20: claude.ai declares no MCP
+// elicitation capability, so from the day this rail shipped every one of these
+// five tools answered it with a -32021 the surface renders as "Error occurred
+// during tool execution" — four `gog_gmail_forward` attempts in a row, 69-107ms
+// each, none of which reached `gog`. The rail is unchanged; what changes is that
+// the refusal now says what happened and names the way through.
 // ============================================================================
+
+/**
+ * The five dispatches this rail guards, spelled once.
+ *
+ * A UNION rather than `string`, because the staging-twin table below is keyed
+ * by these values and a key that matches no call site is silent: it costs the
+ * note, not the refusal, so nothing fails and no test that writes the op by
+ * hand can see it. `gmail.reply_all` shipped in the first cut of this file for
+ * exactly that reason — `sendReply` builds `gmail.${kind}` from
+ * `'reply' | 'reply-all'`, so the real op is HYPHENATED and the underscored key
+ * was never read. With the union in place that is a compile error at both ends.
+ */
+export type GmailDispatchOp =
+  | 'gmail.send'
+  | 'gmail.reply'
+  | 'gmail.reply-all'
+  | 'gmail.forward'
+  | 'gmail.autoreply';
+
+/** Every op, for tests that must cover the set rather than a chosen member. */
+export const GMAIL_DISPATCH_OPS: readonly GmailDispatchOp[] = [
+  'gmail.send',
+  'gmail.reply',
+  'gmail.reply-all',
+  'gmail.forward',
+  'gmail.autoreply',
+];
+
+/**
+ * The op a reply dispatch reports, derived from the same `kind` the command
+ * line is built from.
+ *
+ * Exported so the ONE place that interpolates a kind into an op is the one a
+ * test can call, rather than a template literal inside `sendReply` that a test
+ * can only imitate. Imitating it is what hid the hyphen.
+ */
+export function replyDispatchOp(kind: 'reply' | 'reply-all'): GmailDispatchOp {
+  return `gmail.${kind}`;
+}
+
+/**
+ * The staging twin of each dispatch, named in the refusal above. Every one of
+ * these saves without sending, and `gog_gmail_drafts_send` then dispatches it —
+ * which is the rail's own sanctioned two-step (staging is visible and
+ * inspectable, so the send is never the FIRST call), not a way around it.
+ *
+ * `Partial<Record<…>>` and not an index signature: a key outside the union is
+ * now rejected by the compiler, which is the whole point, while `autoreply`
+ * stays deliberately absent — a bulk auto-reply over a search has no draft
+ * twin, and naming a tool that does not exist would be worse than saying
+ * nothing.
+ */
+const STAGING_TWIN: Partial<Record<GmailDispatchOp, string>> = {
+  'gmail.forward': 'gog_gmail_drafts_forward',
+  'gmail.reply': 'gog_gmail_drafts_reply',
+  'gmail.reply-all': 'gog_gmail_drafts_reply_all',
+  'gmail.send': 'gog_gmail_drafts_create',
+};
+
 /** Apply the shared stateless confirmation flow with Gmail-specific copy. */
 export function requireGmailDispatchConfirmation(
   ctx: ServerContext,
-  op: string,
+  op: GmailDispatchOp,
   details: Record<string, unknown>,
 ): InputRequiredResult | CallToolResult | undefined {
+  const twin = STAGING_TWIN[op];
   return requireConfirmation(ctx, {
     action: op,
     message: 'Review and confirm this email dispatch:',
     details,
     confirmationLabel: 'Confirm that this email should be sent now.',
+    ...(twin
+      ? {
+          unsupportedNote: `Stage it with ${twin} instead, review the draft, `
+            + 'and send it with gog_gmail_drafts_send.',
+        }
+      : {}),
   });
 }
 

package/src/runner.ts

@@ -1,6 +1,6 @@
 import type { ChildProcess } from 'node:child_process';
 import { delimiter, join } from 'node:path';
-import { parseBoolEnv, readEnvVar, redactSecrets as redactSharedSecrets } from '@chrischall/mcp-utils';
+import { currentCallSignal, killOnCancel, parseBoolEnv, readEnvVar, redactSecrets as redactSharedSecrets } from '@chrischall/mcp-utils';
 import { naiveSourceTimeZone } from './timestamps.js';
 
 export type Spawner = (
@@ -380,8 +380,26 @@ async function spawnGog(
     const stderrChunks: Buffer[] = [];
     let settled = false;
 
+    // THE CALLER GIVING UP KILLS THE CHILD (mcp-utils `cancel`). Until this,
+    // a cancelled tool call left a whole `gog` process running to the
+    // timeout below — still talking to Google, still charged to the CPU a
+    // hosted child is metered on, for somebody who has gone. Measured on the
+    // mcp-host fleet: claude.ai sent 101 cancellations in the week to
+    // 2026-09-20, and every one of them was ignored here.
+    //
+    // The signal is ambient rather than passed: `surfaceToolHints` puts it
+    // in scope for the whole handler, so this works for every tool in every
+    // package without one of them threading it through.
+    const cancelled = currentCallSignal();
+    const stopWatchingCancel = killOnCancel(child);
+    const stopWatching = (): void => {
+      clearTimeout(timer);
+      stopWatchingCancel();
+    };
+
     const timer = setTimeout(() => {
       settled = true;
+      stopWatchingCancel();
       child.kill();
       reject(new Error(`gog timed out after ${formatTimeout(effectiveTimeout)}`));
     }, effectiveTimeout);
@@ -390,9 +408,17 @@ async function spawnGog(
     child.stderr!.on('data', (chunk: Buffer) => { stderrChunks.push(chunk); });
 
     child.on('close', (code: number | null) => {
-      clearTimeout(timer);
+      stopWatching();
       if (settled) return;
       settled = true;
+      // A child WE killed because the caller left exits with no code and no
+      // stderr, which the branch below would report as `gog exited with code
+      // null` — a sentence about gogcli for something gogcli did not do. The
+      // caller's own reason is the honest error.
+      if (cancelled?.aborted) {
+        reject(cancelled.reason instanceof Error ? cancelled.reason : new Error('the caller cancelled this call'));
+        return;
+      }
       const stderr = Buffer.concat(stderrChunks).toString().trim();
       if (code === 0) {
         // Binary mode: return the raw stdout bytes base64-encoded, never a utf8
@@ -413,7 +439,7 @@ async function spawnGog(
     });
 
     child.on('error', (err: Error) => {
-      clearTimeout(timer);
+      stopWatching();
       if (settled) return;
       settled = true;
       if ((err as NodeJS.ErrnoException).code === 'ENOENT') {

package/src/tools/gmail.ts

@@ -5,7 +5,7 @@ import { finalizeGmailSearch, fetchGmailPages } from '../gmail-results.js';
 import type { GogArg } from '../runner.js';
 import { attachInlineParam, inlineAttachmentArgs } from '../attachments.js';
 import type { InlineAttachmentInput } from '../attachments.js';
-import { extractEmails, logGmailDispatch, requireGmailDispatchConfirmation, resultText } from '../gmail-dispatch-guard.js';
+import { extractEmails, logGmailDispatch, replyDispatchOp, requireGmailDispatchConfirmation, resultText } from '../gmail-dispatch-guard.js';
 
 // gmail reply / reply-all share an identical flag set (gog 0.27+); they differ
 // only in the subcommand and default recipient set (reply → sender; reply-all
@@ -154,7 +154,7 @@ async function sendReply(
   if (metaResult.isError) return metaResult;
   const headers = parseMetadataHeaders(resultText(metaResult));
   const recipients = computeReplyRecipients(kind, headers, flags);
-  const confirmation = requireGmailDispatchConfirmation(ctx, `gmail.${kind}`, {
+  const confirmation = requireGmailDispatchConfirmation(ctx, replyDispatchOp(kind), {
     messageId,
     recipients,
     recipientCount: recipients.length,

package/tests/gmail-dispatch-guard.test.ts

@@ -1,10 +1,15 @@
 import { describe, it, expect, vi, beforeEach, afterEach } from 'vitest';
 import { rawTextResult } from '@chrischall/mcp-utils';
+import type { CallToolResult, ServerContext } from '@modelcontextprotocol/server';
 import {
+  GMAIL_DISPATCH_OPS,
   extractEmails,
   logGmailDispatch,
+  replyDispatchOp,
+  requireGmailDispatchConfirmation,
   resultText,
 } from '../src/gmail-dispatch-guard.js';
+import type { GmailDispatchOp } from '../src/gmail-dispatch-guard.js';
 
 describe('extractEmails', () => {
   it('extracts a bare address', () => {
@@ -130,3 +135,91 @@ describe('logGmailDispatch', () => {
     expect(event.externalRecipients).toEqual(['not-an-email']);
   });
 });
+
+// ============================================================================
+// The refusal a client that cannot be asked gets. From #358 until this landed
+// it got a protocol -32021 instead, which claude.ai — which declares no MCP
+// elicitation capability — rendered as "Error occurred during tool execution".
+// ============================================================================
+/** A 2026-07-28 request whose envelope declares the CALLER's capabilities. */
+function ctxDeclaring(capabilities: unknown): ServerContext {
+  return {
+    mcpReq: {
+      envelope: {
+        'io.modelcontextprotocol/protocolVersion': '2026-07-28',
+        'io.modelcontextprotocol/clientCapabilities': capabilities,
+      },
+    },
+  } as unknown as ServerContext;
+}
+
+/** claude.ai's measured shape: extensions and nothing else. */
+const CANNOT_BE_ASKED = ctxDeclaring({ extensions: {} });
+
+function refusalNote(op: GmailDispatchOp): string {
+  const result = requireGmailDispatchConfirmation(CANNOT_BE_ASKED, op, {}) as CallToolResult;
+  return JSON.parse(resultText(result)).note as string;
+}
+
+/**
+ * The twin each op must name. Written against `GMAIL_DISPATCH_OPS` rather than
+ * as a list of its own, so a sixth dispatch added later fails here until
+ * somebody decides whether it stages — `null` being the deliberate "it does
+ * not" that `gmail.autoreply` is the only member of today.
+ */
+const EXPECTED_TWIN: Record<GmailDispatchOp, string | null> = {
+  'gmail.send': 'gog_gmail_drafts_create',
+  'gmail.reply': 'gog_gmail_drafts_reply',
+  'gmail.reply-all': 'gog_gmail_drafts_reply_all',
+  'gmail.forward': 'gog_gmail_drafts_forward',
+  'gmail.autoreply': null,
+};
+
+describe('requireGmailDispatchConfirmation on a client that cannot be asked', () => {
+  it.each(GMAIL_DISPATCH_OPS.map((op) => [op, EXPECTED_TWIN[op]] as const))(
+    'answers %s with its staging twin %s',
+    (op, twin) => {
+      const note = refusalNote(op);
+      expect(note).toContain('cannot show a confirmation prompt');
+      if (twin === null) {
+        // A bulk auto-reply over a search has no draft twin, and naming a tool
+        // that does not exist would be worse than saying nothing.
+        expect(note).not.toContain('Stage it with');
+      } else {
+        expect(note).toContain(`Stage it with ${twin} instead`);
+        expect(note).toContain('gog_gmail_drafts_send');
+      }
+    },
+  );
+
+  // THE OP COMES FROM THE CALL PATH, NOT FROM THIS FILE. `sendReply` builds it
+  // as `gmail.${kind}` off the same `'reply' | 'reply-all'` union the command
+  // line uses, so the first cut's `gmail.reply_all` key matched nothing and
+  // reply-all silently lost its note — invisible to a test that spelled the op
+  // itself. Going through the helper the call site now calls is what closes it.
+  it.each([
+    ['reply', 'gog_gmail_drafts_reply'],
+    ['reply-all', 'gog_gmail_drafts_reply_all'],
+  ] as const)('derives the %s op from the real call path', (kind, twin) => {
+    expect(refusalNote(replyDispatchOp(kind))).toContain(`Stage it with ${twin} instead`);
+  });
+
+  it('refuses rather than dispatching, and says so in the payload', () => {
+    const result = requireGmailDispatchConfirmation(CANNOT_BE_ASKED, 'gmail.forward', {
+      messageId: 'm1',
+      to: 'someone@example.com',
+    }) as CallToolResult;
+
+    expect(JSON.parse(resultText(result))).toMatchObject({
+      confirmed: false,
+      dispatched: false,
+      action: 'gmail.forward',
+      reason: 'confirmation-unsupported',
+    });
+  });
+
+  it('still asks a client that declares form elicitation', () => {
+    expect(requireGmailDispatchConfirmation(ctxDeclaring({ elicitation: { form: {} } }), 'gmail.forward', {}))
+      .toMatchObject({ resultType: 'input_required' });
+  });
+});

package/tests/runner.test.ts

@@ -1,6 +1,7 @@
 import { describe, it, expect, vi, beforeEach, afterEach } from 'vitest';
 import { EventEmitter } from 'node:events';
 import { spawn as mockedSpawn } from 'node:child_process';
+import { withCallSignal } from '@chrischall/mcp-utils';
 import { run, runBinary } from '../src/runner.js';
 import type { Spawner } from '../src/runner.js';
 
@@ -949,3 +950,74 @@ describe('run executor', () => {
     );
   });
 });
+
+/**
+ * The caller giving up kills the `gog` child (mcp-utils `cancel`).
+ *
+ * Until this, a cancelled tool call left a whole process running to the
+ * runner's own timeout — still talking to Google, still charged to the CPU a
+ * hosted child is metered on, for somebody who has gone. Measured on the
+ * mcp-host fleet: claude.ai sent 101 cancellations in the week to
+ * 2026-09-20, and every one of them was ignored here.
+ */
+describe('cancellation', () => {
+  /** A child that never finishes on its own — only a kill ends it. */
+  function hangingProc(): ReturnType<Spawner> & { killed: unknown[] } {
+    const proc = new EventEmitter() as ReturnType<Spawner> & { killed: unknown[] };
+    const io = proc as unknown as { stdout: EventEmitter; stderr: EventEmitter };
+    io.stdout = new EventEmitter();
+    io.stderr = new EventEmitter();
+    proc.killed = [];
+    proc.kill = vi.fn((sig?: unknown) => {
+      proc.killed.push(sig);
+      // A killed child closes with no code and no stderr, which is exactly
+      // the shape the error path has to tell apart from a gog failure.
+      setTimeout(() => proc.emit('close', null), 0);
+      return true;
+    }) as unknown as ReturnType<Spawner>['kill'];
+    return proc;
+  }
+
+  it('kills the child and rejects with the caller’s own reason', async () => {
+    const proc = hangingProc();
+    const controller = new AbortController();
+    const reason = new Error('caller went away');
+
+    const call = withCallSignal(controller.signal, () =>
+      run(['sheets', 'get', 'id1', 'A1'], { spawner: (() => proc) as unknown as Spawner }),
+    );
+    controller.abort(reason);
+
+    // Not `gog exited with code null`, which is what the ordinary close path
+    // would have said — a sentence about gogcli for something gogcli did not
+    // do.
+    await expect(call).rejects.toThrow(reason);
+    expect(proc.killed, 'the gog child was left running').toEqual(['SIGTERM']);
+  });
+
+  it('names the cancellation when the reason is not an Error', async () => {
+    // `AbortController.abort()` takes ANY value — a string, a DOMException,
+    // undefined — so the reason is not guaranteed to be throwable. Rejecting
+    // with a raw string would surface as an error with no message at the
+    // tool boundary, which is the shape this whole change exists to avoid.
+    const proc = hangingProc();
+    const controller = new AbortController();
+
+    const call = withCallSignal(controller.signal, () =>
+      run(['sheets', 'get', 'id1', 'A1'], { spawner: (() => proc) as unknown as Spawner }),
+    );
+    controller.abort('the caller went away');
+
+    await expect(call).rejects.toThrow(/cancelled/i);
+    expect(proc.killed).toEqual(['SIGTERM']);
+  });
+
+  it('leaves an ordinary call alone, and stops listening when it finishes', async () => {
+    const controller = new AbortController();
+    const spawner = makeSpawner(0, '{"ok":true}');
+    await withCallSignal(controller.signal, () => run(['sheets', 'get', 'id1', 'A1'], { spawner }));
+    // Aborting AFTER the call settled must reach nothing: a listener that
+    // outlives its call is a leak per invocation.
+    expect(() => controller.abort(new Error('too late'))).not.toThrow();
+  });
+});