gogcli-mcp 4.2.0 → 4.2.2

package/.claude-plugin/marketplace.json

@@ -7,7 +7,7 @@
   },
   "metadata": {
     "description": "Google Sheets (and more) for Claude via gogcli — read, write, and manage spreadsheets",
-    "version": "4.2.0"
+    "version": "4.2.2"
   },
   "plugins": [
     {
@@ -15,7 +15,7 @@
       "displayName": "gogcli",
       "source": "./",
       "description": "Google Sheets (and more) for Claude via gogcli — read, write, and manage spreadsheets",
-      "version": "4.2.0",
+      "version": "4.2.2",
       "author": {
         "name": "Chris Hall"
       },

package/.claude-plugin/plugin.json

@@ -1,7 +1,7 @@
 {
   "name": "gogcli-mcp",
   "displayName": "gogcli",
-  "version": "4.2.0",
+  "version": "4.2.2",
   "description": "Google Sheets (and more) for Claude via gogcli — read, write, and manage spreadsheets",
   "author": {
     "name": "Chris Hall",

package/dist/index.js

@@ -8,8 +8,8 @@ var __export = (target, all) => {
 // ../../node_modules/@chrischall/mcp-utils/dist/cancel/index.js
 import { AsyncLocalStorage } from "node:async_hooks";
 var storage = new AsyncLocalStorage();
-function withCallSignal(signal, fn) {
-  return signal ? storage.run({ signal }, fn) : fn();
+function withCallSignal(signal, fn, request) {
+  return signal ? storage.run({ signal, ...request ? { request } : {} }, fn) : fn();
 }
 function currentCallSignal() {
   return storage.getStore()?.signal;
@@ -31,6 +31,40 @@ function killOnCancel(child, signal = "SIGTERM") {
   return () => ambient.removeEventListener("abort", onAbort);
 }
 
+// ../../node_modules/@chrischall/mcp-utils/dist/caller/index.js
+import { AsyncLocalStorage as AsyncLocalStorage2 } from "node:async_hooks";
+var storage2 = new AsyncLocalStorage2();
+function withCallerCapabilities(capabilities, fn) {
+  return capabilities ? storage2.run(capabilities, fn) : fn();
+}
+function currentCallerCapabilities() {
+  return storage2.getStore();
+}
+var ENVELOPE_CAPABILITIES_KEY = "io.modelcontextprotocol/clientCapabilities";
+var ELICITATION_MODES = ["form", "url"];
+function isRecord(value) {
+  return typeof value === "object" && value !== null && !Array.isArray(value);
+}
+function callerCapabilities(ctx) {
+  const envelope = isRecord(ctx) && isRecord(ctx.mcpReq) ? ctx.mcpReq.envelope : void 0;
+  if (isRecord(envelope)) {
+    const declared = envelope[ENVELOPE_CAPABILITIES_KEY];
+    if (isRecord(declared))
+      return declared;
+  }
+  return currentCallerCapabilities();
+}
+function callerAcceptsFormElicitation(ctx) {
+  const capabilities = callerCapabilities(ctx);
+  if (!capabilities)
+    return void 0;
+  const elicitation = capabilities.elicitation;
+  if (!isRecord(elicitation))
+    return false;
+  const namedModes = ELICITATION_MODES.filter((mode) => mode in elicitation);
+  return namedModes.length === 0 || namedModes.includes("form");
+}
+
 // ../../node_modules/@modelcontextprotocol/server/dist/chunk-Br0eD_fh.mjs
 var __create = Object.create;
 var __defProp2 = Object.defineProperty;
@@ -34506,6 +34540,7 @@ function errorResult(message) {
 // ../../node_modules/@chrischall/mcp-utils/dist/server/confirmation.js
 var DEFAULT_REQUEST_KEY = "confirmation";
 var DEFAULT_CONFIRMATION_LABEL = "Confirm this action should proceed.";
+var UNSUPPORTED_NOTE = "Nothing was done because this client cannot show a confirmation prompt (it declares no MCP elicitation capability), and this action is never taken without one";
 function requireConfirmation(ctx, options) {
   const requestKey = options.requestKey ?? DEFAULT_REQUEST_KEY;
   const confirmationSchema = external_exports.object({
@@ -34514,6 +34549,15 @@ function requireConfirmation(ctx, options) {
   const response = inputResponse(ctx.mcpReq.inputResponses, requestKey);
   const accepted = acceptedContent(ctx.mcpReq.inputResponses, requestKey, confirmationSchema);
   if (response.kind === "missing") {
+    if (callerAcceptsFormElicitation(ctx) === false) {
+      return textResult({
+        confirmed: false,
+        dispatched: false,
+        action: options.action,
+        reason: "confirmation-unsupported",
+        note: options.unsupportedNote ? `${UNSUPPORTED_NOTE}. ${options.unsupportedNote}` : `${UNSUPPORTED_NOTE}.`
+      });
+    }
     const preview = {
       action: options.action,
       ...options.details === void 0 ? {} : { details: options.details }
@@ -34552,6 +34596,15 @@ Hint: ${err.hint}`);
   }
   throw err;
 }
+function mcpRequestFrom(args) {
+  const ctx = args.at(-1);
+  if (typeof ctx !== "object" || ctx === null)
+    return void 0;
+  const req = ctx.mcpReq;
+  if (typeof req !== "object" || req === null)
+    return void 0;
+  return typeof req.notify === "function" ? req : void 0;
+}
 function callSignalFrom(args) {
   const ctx = args.at(-1);
   if (typeof ctx !== "object" || ctx === null)
@@ -34562,6 +34615,20 @@ function callSignalFrom(args) {
   const signal = req.signal;
   return signal instanceof AbortSignal ? signal : void 0;
 }
+function declaredCapabilitiesFrom(server) {
+  const inner = server.server;
+  if (typeof inner !== "object" || inner === null)
+    return void 0;
+  const read = inner.getClientCapabilities;
+  if (typeof read !== "function")
+    return void 0;
+  try {
+    const declared = read.call(inner);
+    return typeof declared === "object" && declared !== null ? declared : void 0;
+  } catch {
+    return void 0;
+  }
+}
 function surfaceToolHints(server) {
   const register2 = server.registerTool.bind(server);
   server.registerTool = (name, config2, cb) => register2(name, config2, (...args) => (
@@ -34577,15 +34644,24 @@ function surfaceToolHints(server) {
     // Here because this is the one wrapper every tool already passes
     // through: threading the signal by hand would mean editing several
     // hundred handlers and missing exactly the ones nobody edits.
-    withCallSignal(callSignalFrom(args), () => {
-      let result;
-      try {
-        result = cb(...args);
-      } catch (err) {
-        return hintResultOrRethrow(err);
-      }
-      return result instanceof Promise ? result.catch(hintResultOrRethrow) : result;
-    })
+    withCallSignal(callSignalFrom(args), () => (
+      // WHAT THE CALLER CAN DO, made ambient for the same reason and in
+      // the same place (`caller/index.ts`). Only the 2025-era half needs
+      // the wrapper — a 2026-07-28 request answers for itself off its own
+      // envelope — but a guarded tool that cannot tell whether the caller
+      // can be shown a prompt returns one the SDK then refuses to deliver,
+      // and that refusal reaches the caller as an unexplained protocol
+      // error it had no chance to catch.
+      withCallerCapabilities(declaredCapabilitiesFrom(server), () => {
+        let result;
+        try {
+          result = cb(...args);
+        } catch (err) {
+          return hintResultOrRethrow(err);
+        }
+        return result instanceof Promise ? result.catch(hintResultOrRethrow) : result;
+      })
+    ), mcpRequestFrom(args))
   ));
 }
 async function createMcpServer(opts) {
@@ -35594,6 +35670,7 @@ function registerAuthToolsWith(server, defaultServices) {
   });
   server.registerTool("gog_auth_add_url", {
     description: "Begin REMOTE/headless Google authorization (step 1 of 2). Returns a sign-in URL to open in any browser \u2014 no local server or terminal on the gogcli host is needed, so this works on a hosted deployment where the interactive gog_auth_add cannot. Hand the URL to the user; after they sign in, the browser is redirected to a localhost URL that fails to load \u2014 that is expected. They copy that full redirected URL (from the address bar) and you pass it to gog_auth_add_complete. The link is valid for 10 minutes. If you pass a custom `services` here, pass the SAME value to gog_auth_add_complete or the second step will not match this one.",
+    annotations: { readOnlyHint: true },
     inputSchema: external_exports.object({
       email: external_exports.string().describe("Google account email to authorize"),
       services: external_exports.string().optional().default(defaultServices).describe(servicesDescribe),
@@ -36994,12 +37071,25 @@ function finish(base, itemsKey, merged, token) {
 }
 
 // src/gmail-dispatch-guard.ts
+function replyDispatchOp(kind) {
+  return `gmail.${kind}`;
+}
+var STAGING_TWIN = {
+  "gmail.forward": "gog_gmail_drafts_forward",
+  "gmail.reply": "gog_gmail_drafts_reply",
+  "gmail.reply-all": "gog_gmail_drafts_reply_all",
+  "gmail.send": "gog_gmail_drafts_create"
+};
 function requireGmailDispatchConfirmation(ctx, op, details) {
+  const twin = STAGING_TWIN[op];
   return requireConfirmation(ctx, {
     action: op,
     message: "Review and confirm this email dispatch:",
     details,
-    confirmationLabel: "Confirm that this email should be sent now."
+    confirmationLabel: "Confirm that this email should be sent now.",
+    ...twin ? {
+      unsupportedNote: `Stage it with ${twin} instead, review the draft, and send it with gog_gmail_drafts_send.`
+    } : {}
   });
 }
 var EMAIL_PATTERN = /[a-z0-9!#$%&'*+/=?^_`{|}~.-]+@[a-z0-9-]+(?:\.[a-z0-9-]+)+/gi;
@@ -37128,7 +37218,7 @@ async function sendReply(kind, toolName, messageId, account, flags, ctx) {
   if (metaResult.isError) return metaResult;
   const headers = parseMetadataHeaders(resultText(metaResult));
   const recipients = computeReplyRecipients(kind, headers, flags);
-  const confirmation = requireGmailDispatchConfirmation(ctx, `gmail.${kind}`, {
+  const confirmation = requireGmailDispatchConfirmation(ctx, replyDispatchOp(kind), {
     messageId,
     recipients,
     recipientCount: recipients.length,
@@ -37582,7 +37672,7 @@ function registerTasksTools(server) {
 }
 
 // src/server.ts
-var VERSION = true ? "4.2.0" : "0.0.0";
+var VERSION = true ? "4.2.2" : "0.0.0";
 var BASE_TOOL_REGISTRARS = [
   registerApiTools,
   registerAppScriptTools,

package/dist/lib.js

@@ -19695,6 +19695,37 @@ function killOnCancel(child, signal = "SIGTERM") {
   return () => ambient.removeEventListener("abort", onAbort);
 }
 
+// ../../node_modules/@chrischall/mcp-utils/dist/caller/index.js
+import { AsyncLocalStorage as AsyncLocalStorage2 } from "node:async_hooks";
+var storage2 = new AsyncLocalStorage2();
+function currentCallerCapabilities() {
+  return storage2.getStore();
+}
+var ENVELOPE_CAPABILITIES_KEY = "io.modelcontextprotocol/clientCapabilities";
+var ELICITATION_MODES = ["form", "url"];
+function isRecord(value) {
+  return typeof value === "object" && value !== null && !Array.isArray(value);
+}
+function callerCapabilities(ctx) {
+  const envelope = isRecord(ctx) && isRecord(ctx.mcpReq) ? ctx.mcpReq.envelope : void 0;
+  if (isRecord(envelope)) {
+    const declared = envelope[ENVELOPE_CAPABILITIES_KEY];
+    if (isRecord(declared))
+      return declared;
+  }
+  return currentCallerCapabilities();
+}
+function callerAcceptsFormElicitation(ctx) {
+  const capabilities = callerCapabilities(ctx);
+  if (!capabilities)
+    return void 0;
+  const elicitation = capabilities.elicitation;
+  if (!isRecord(elicitation))
+    return false;
+  const namedModes = ELICITATION_MODES.filter((mode) => mode in elicitation);
+  return namedModes.length === 0 || namedModes.includes("form");
+}
+
 // ../../node_modules/@modelcontextprotocol/server/dist/chunk-Br0eD_fh.mjs
 var __create = Object.create;
 var __defProp2 = Object.defineProperty;
@@ -32972,6 +33003,7 @@ function errorResult(message) {
 // ../../node_modules/@chrischall/mcp-utils/dist/server/confirmation.js
 var DEFAULT_REQUEST_KEY = "confirmation";
 var DEFAULT_CONFIRMATION_LABEL = "Confirm this action should proceed.";
+var UNSUPPORTED_NOTE = "Nothing was done because this client cannot show a confirmation prompt (it declares no MCP elicitation capability), and this action is never taken without one";
 function requireConfirmation(ctx, options) {
   const requestKey = options.requestKey ?? DEFAULT_REQUEST_KEY;
   const confirmationSchema = external_exports.object({
@@ -32980,6 +33012,15 @@ function requireConfirmation(ctx, options) {
   const response = inputResponse(ctx.mcpReq.inputResponses, requestKey);
   const accepted = acceptedContent(ctx.mcpReq.inputResponses, requestKey, confirmationSchema);
   if (response.kind === "missing") {
+    if (callerAcceptsFormElicitation(ctx) === false) {
+      return textResult({
+        confirmed: false,
+        dispatched: false,
+        action: options.action,
+        reason: "confirmation-unsupported",
+        note: options.unsupportedNote ? `${UNSUPPORTED_NOTE}. ${options.unsupportedNote}` : `${UNSUPPORTED_NOTE}.`
+      });
+    }
     const preview = {
       action: options.action,
       ...options.details === void 0 ? {} : { details: options.details }
@@ -33960,6 +34001,7 @@ function registerAuthToolsWith(server, defaultServices) {
   });
   server.registerTool("gog_auth_add_url", {
     description: "Begin REMOTE/headless Google authorization (step 1 of 2). Returns a sign-in URL to open in any browser \u2014 no local server or terminal on the gogcli host is needed, so this works on a hosted deployment where the interactive gog_auth_add cannot. Hand the URL to the user; after they sign in, the browser is redirected to a localhost URL that fails to load \u2014 that is expected. They copy that full redirected URL (from the address bar) and you pass it to gog_auth_add_complete. The link is valid for 10 minutes. If you pass a custom `services` here, pass the SAME value to gog_auth_add_complete or the second step will not match this one.",
+    annotations: { readOnlyHint: true },
     inputSchema: external_exports.object({
       email: external_exports.string().describe("Google account email to authorize"),
       services: external_exports.string().optional().default(defaultServices).describe(servicesDescribe),
@@ -35363,12 +35405,25 @@ function finish(base, itemsKey, merged, token) {
 }
 
 // src/gmail-dispatch-guard.ts
+function replyDispatchOp(kind) {
+  return `gmail.${kind}`;
+}
+var STAGING_TWIN = {
+  "gmail.forward": "gog_gmail_drafts_forward",
+  "gmail.reply": "gog_gmail_drafts_reply",
+  "gmail.reply-all": "gog_gmail_drafts_reply_all",
+  "gmail.send": "gog_gmail_drafts_create"
+};
 function requireGmailDispatchConfirmation(ctx, op, details) {
+  const twin = STAGING_TWIN[op];
   return requireConfirmation(ctx, {
     action: op,
     message: "Review and confirm this email dispatch:",
     details,
-    confirmationLabel: "Confirm that this email should be sent now."
+    confirmationLabel: "Confirm that this email should be sent now.",
+    ...twin ? {
+      unsupportedNote: `Stage it with ${twin} instead, review the draft, and send it with gog_gmail_drafts_send.`
+    } : {}
   });
 }
 var EMAIL_PATTERN = /[a-z0-9!#$%&'*+/=?^_`{|}~.-]+@[a-z0-9-]+(?:\.[a-z0-9-]+)+/gi;
@@ -35497,7 +35552,7 @@ async function sendReply(kind, toolName, messageId, account, flags, ctx) {
   if (metaResult.isError) return metaResult;
   const headers = parseMetadataHeaders(resultText(metaResult));
   const recipients = computeReplyRecipients(kind, headers, flags);
-  const confirmation = requireGmailDispatchConfirmation(ctx, `gmail.${kind}`, {
+  const confirmation = requireGmailDispatchConfirmation(ctx, replyDispatchOp(kind), {
     messageId,
     recipients,
     recipientCount: recipients.length,
@@ -35951,7 +36006,7 @@ function registerTasksTools(server) {
 }
 
 // src/server.ts
-var VERSION = true ? "4.2.0" : "0.0.0";
+var VERSION = true ? "4.2.2" : "0.0.0";
 var BASE_TOOL_REGISTRARS = [
   registerApiTools,
   registerAppScriptTools,

package/manifest.json

@@ -3,7 +3,7 @@
   "manifest_version": "0.3",
   "name": "gogcli-mcp",
   "display_name": "gogcli",
-  "version": "4.2.0",
+  "version": "4.2.2",
   "description": "Google Sheets (and more) for Claude via gogcli — read, write, and manage spreadsheets",
   "author": {
     "name": "Chris Hall",

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "gogcli-mcp",
-  "version": "4.2.0",
+  "version": "4.2.2",
   "mcpName": "io.github.chrischall/gogcli-mcp",
   "description": "MCP server wrapping gogcli for Google service access",
   "author": "Claude Code (AI) <https://www.anthropic.com/claude>",
@@ -41,7 +41,7 @@
     "test:coverage": "vitest run --coverage"
   },
   "dependencies": {
-    "@chrischall/mcp-utils": "^2.0.0",
+    "@chrischall/mcp-utils": "^2.1.0",
     "@modelcontextprotocol/server": "^2.0.0",
     "zod": "^4.6.1"
   },

package/server.json

@@ -7,12 +7,12 @@
     "source": "github",
     "subfolder": "packages/gogcli-mcp"
   },
-  "version": "4.2.0",
+  "version": "4.2.2",
   "packages": [
     {
       "registryType": "npm",
       "identifier": "gogcli-mcp",
-      "version": "4.2.0",
+      "version": "4.2.2",
       "transport": {
         "type": "stdio"
       },

package/src/gmail-dispatch-guard.ts

@@ -14,18 +14,93 @@ import { readEnvVar, requireConfirmation } from '@chrischall/mcp-utils';
 // result containing the preview, and only the protocol retry carrying the
 // user's accepted confirmation dispatches. The confirmation is never a tool
 // argument, so a model cannot bypass the user by setting a boolean itself.
+//
+// A CLIENT THAT CANNOT SHOW THAT PROMPT gets a sentence rather than a prompt
+// it will refuse to deliver (`unsupportedNote`, mcp-utils `requireConfirmation`).
+// Measured on the mcp-host fleet 2026-09-20: claude.ai declares no MCP
+// elicitation capability, so from the day this rail shipped every one of these
+// five tools answered it with a -32021 the surface renders as "Error occurred
+// during tool execution" — four `gog_gmail_forward` attempts in a row, 69-107ms
+// each, none of which reached `gog`. The rail is unchanged; what changes is that
+// the refusal now says what happened and names the way through.
 // ============================================================================
+
+/**
+ * The five dispatches this rail guards, spelled once.
+ *
+ * A UNION rather than `string`, because the staging-twin table below is keyed
+ * by these values and a key that matches no call site is silent: it costs the
+ * note, not the refusal, so nothing fails and no test that writes the op by
+ * hand can see it. `gmail.reply_all` shipped in the first cut of this file for
+ * exactly that reason — `sendReply` builds `gmail.${kind}` from
+ * `'reply' | 'reply-all'`, so the real op is HYPHENATED and the underscored key
+ * was never read. With the union in place that is a compile error at both ends.
+ */
+export type GmailDispatchOp =
+  | 'gmail.send'
+  | 'gmail.reply'
+  | 'gmail.reply-all'
+  | 'gmail.forward'
+  | 'gmail.autoreply';
+
+/** Every op, for tests that must cover the set rather than a chosen member. */
+export const GMAIL_DISPATCH_OPS: readonly GmailDispatchOp[] = [
+  'gmail.send',
+  'gmail.reply',
+  'gmail.reply-all',
+  'gmail.forward',
+  'gmail.autoreply',
+];
+
+/**
+ * The op a reply dispatch reports, derived from the same `kind` the command
+ * line is built from.
+ *
+ * Exported so the ONE place that interpolates a kind into an op is the one a
+ * test can call, rather than a template literal inside `sendReply` that a test
+ * can only imitate. Imitating it is what hid the hyphen.
+ */
+export function replyDispatchOp(kind: 'reply' | 'reply-all'): GmailDispatchOp {
+  return `gmail.${kind}`;
+}
+
+/**
+ * The staging twin of each dispatch, named in the refusal above. Every one of
+ * these saves without sending, and `gog_gmail_drafts_send` then dispatches it —
+ * which is the rail's own sanctioned two-step (staging is visible and
+ * inspectable, so the send is never the FIRST call), not a way around it.
+ *
+ * `Partial<Record<…>>` and not an index signature: a key outside the union is
+ * now rejected by the compiler, which is the whole point, while `autoreply`
+ * stays deliberately absent — a bulk auto-reply over a search has no draft
+ * twin, and naming a tool that does not exist would be worse than saying
+ * nothing.
+ */
+const STAGING_TWIN: Partial<Record<GmailDispatchOp, string>> = {
+  'gmail.forward': 'gog_gmail_drafts_forward',
+  'gmail.reply': 'gog_gmail_drafts_reply',
+  'gmail.reply-all': 'gog_gmail_drafts_reply_all',
+  'gmail.send': 'gog_gmail_drafts_create',
+};
+
 /** Apply the shared stateless confirmation flow with Gmail-specific copy. */
 export function requireGmailDispatchConfirmation(
   ctx: ServerContext,
-  op: string,
+  op: GmailDispatchOp,
   details: Record<string, unknown>,
 ): InputRequiredResult | CallToolResult | undefined {
+  const twin = STAGING_TWIN[op];
   return requireConfirmation(ctx, {
     action: op,
     message: 'Review and confirm this email dispatch:',
     details,
     confirmationLabel: 'Confirm that this email should be sent now.',
+    ...(twin
+      ? {
+          unsupportedNote: `Stage it with ${twin} instead, review the draft, `
+            + 'and send it with gog_gmail_drafts_send.',
+        }
+      : {}),
   });
 }
 

package/src/tools/auth.ts

@@ -135,6 +135,7 @@ function registerAuthToolsWith(server: McpServer, defaultServices: string): void
       'full redirected URL (from the address bar) and you pass it to gog_auth_add_complete. The link is ' +
       'valid for 10 minutes. If you pass a custom `services` here, pass the SAME value to ' +
       'gog_auth_add_complete or the second step will not match this one.',
+    annotations: { readOnlyHint: true },
     inputSchema: z.object({
       email: z.string().describe('Google account email to authorize'),
       services: z.string().optional().default(defaultServices).describe(servicesDescribe),

package/src/tools/gmail.ts

@@ -5,7 +5,7 @@ import { finalizeGmailSearch, fetchGmailPages } from '../gmail-results.js';
 import type { GogArg } from '../runner.js';
 import { attachInlineParam, inlineAttachmentArgs } from '../attachments.js';
 import type { InlineAttachmentInput } from '../attachments.js';
-import { extractEmails, logGmailDispatch, requireGmailDispatchConfirmation, resultText } from '../gmail-dispatch-guard.js';
+import { extractEmails, logGmailDispatch, replyDispatchOp, requireGmailDispatchConfirmation, resultText } from '../gmail-dispatch-guard.js';
 
 // gmail reply / reply-all share an identical flag set (gog 0.27+); they differ
 // only in the subcommand and default recipient set (reply → sender; reply-all
@@ -154,7 +154,7 @@ async function sendReply(
   if (metaResult.isError) return metaResult;
   const headers = parseMetadataHeaders(resultText(metaResult));
   const recipients = computeReplyRecipients(kind, headers, flags);
-  const confirmation = requireGmailDispatchConfirmation(ctx, `gmail.${kind}`, {
+  const confirmation = requireGmailDispatchConfirmation(ctx, replyDispatchOp(kind), {
     messageId,
     recipients,
     recipientCount: recipients.length,

package/tests/gmail-dispatch-guard.test.ts

@@ -1,10 +1,15 @@
 import { describe, it, expect, vi, beforeEach, afterEach } from 'vitest';
 import { rawTextResult } from '@chrischall/mcp-utils';
+import type { CallToolResult, ServerContext } from '@modelcontextprotocol/server';
 import {
+  GMAIL_DISPATCH_OPS,
   extractEmails,
   logGmailDispatch,
+  replyDispatchOp,
+  requireGmailDispatchConfirmation,
   resultText,
 } from '../src/gmail-dispatch-guard.js';
+import type { GmailDispatchOp } from '../src/gmail-dispatch-guard.js';
 
 describe('extractEmails', () => {
   it('extracts a bare address', () => {
@@ -130,3 +135,91 @@ describe('logGmailDispatch', () => {
     expect(event.externalRecipients).toEqual(['not-an-email']);
   });
 });
+
+// ============================================================================
+// The refusal a client that cannot be asked gets. From #358 until this landed
+// it got a protocol -32021 instead, which claude.ai — which declares no MCP
+// elicitation capability — rendered as "Error occurred during tool execution".
+// ============================================================================
+/** A 2026-07-28 request whose envelope declares the CALLER's capabilities. */
+function ctxDeclaring(capabilities: unknown): ServerContext {
+  return {
+    mcpReq: {
+      envelope: {
+        'io.modelcontextprotocol/protocolVersion': '2026-07-28',
+        'io.modelcontextprotocol/clientCapabilities': capabilities,
+      },
+    },
+  } as unknown as ServerContext;
+}
+
+/** claude.ai's measured shape: extensions and nothing else. */
+const CANNOT_BE_ASKED = ctxDeclaring({ extensions: {} });
+
+function refusalNote(op: GmailDispatchOp): string {
+  const result = requireGmailDispatchConfirmation(CANNOT_BE_ASKED, op, {}) as CallToolResult;
+  return JSON.parse(resultText(result)).note as string;
+}
+
+/**
+ * The twin each op must name. Written against `GMAIL_DISPATCH_OPS` rather than
+ * as a list of its own, so a sixth dispatch added later fails here until
+ * somebody decides whether it stages — `null` being the deliberate "it does
+ * not" that `gmail.autoreply` is the only member of today.
+ */
+const EXPECTED_TWIN: Record<GmailDispatchOp, string | null> = {
+  'gmail.send': 'gog_gmail_drafts_create',
+  'gmail.reply': 'gog_gmail_drafts_reply',
+  'gmail.reply-all': 'gog_gmail_drafts_reply_all',
+  'gmail.forward': 'gog_gmail_drafts_forward',
+  'gmail.autoreply': null,
+};
+
+describe('requireGmailDispatchConfirmation on a client that cannot be asked', () => {
+  it.each(GMAIL_DISPATCH_OPS.map((op) => [op, EXPECTED_TWIN[op]] as const))(
+    'answers %s with its staging twin %s',
+    (op, twin) => {
+      const note = refusalNote(op);
+      expect(note).toContain('cannot show a confirmation prompt');
+      if (twin === null) {
+        // A bulk auto-reply over a search has no draft twin, and naming a tool
+        // that does not exist would be worse than saying nothing.
+        expect(note).not.toContain('Stage it with');
+      } else {
+        expect(note).toContain(`Stage it with ${twin} instead`);
+        expect(note).toContain('gog_gmail_drafts_send');
+      }
+    },
+  );
+
+  // THE OP COMES FROM THE CALL PATH, NOT FROM THIS FILE. `sendReply` builds it
+  // as `gmail.${kind}` off the same `'reply' | 'reply-all'` union the command
+  // line uses, so the first cut's `gmail.reply_all` key matched nothing and
+  // reply-all silently lost its note — invisible to a test that spelled the op
+  // itself. Going through the helper the call site now calls is what closes it.
+  it.each([
+    ['reply', 'gog_gmail_drafts_reply'],
+    ['reply-all', 'gog_gmail_drafts_reply_all'],
+  ] as const)('derives the %s op from the real call path', (kind, twin) => {
+    expect(refusalNote(replyDispatchOp(kind))).toContain(`Stage it with ${twin} instead`);
+  });
+
+  it('refuses rather than dispatching, and says so in the payload', () => {
+    const result = requireGmailDispatchConfirmation(CANNOT_BE_ASKED, 'gmail.forward', {
+      messageId: 'm1',
+      to: 'someone@example.com',
+    }) as CallToolResult;
+
+    expect(JSON.parse(resultText(result))).toMatchObject({
+      confirmed: false,
+      dispatched: false,
+      action: 'gmail.forward',
+      reason: 'confirmation-unsupported',
+    });
+  });
+
+  it('still asks a client that declares form elicitation', () => {
+    expect(requireGmailDispatchConfirmation(ctxDeclaring({ elicitation: { form: {} } }), 'gmail.forward', {}))
+      .toMatchObject({ resultType: 'input_required' });
+  });
+});