gogcli-mcp 4.4.0 → 4.5.1

package/src/send-confirm-token.ts

@@ -1,167 +1,29 @@
-import { createHash, createHmac, randomBytes, timingSafeEqual } from 'node:crypto';
-import { readEnvVar } from '@chrischall/mcp-utils';
+import { createSpentTokenStore, type SpentTokenStore } from '@chrischall/mcp-utils';
 
 // ============================================================================
-// THE TOKEN FALLBACK for the Gmail dispatch rail (gmail-dispatch-guard.ts).
+// THE TOKEN FALLBACK's gogcli-mcp half, which is now only its spent-token store.
+// Everything else is the fleet's shared layer in @chrischall/mcp-utils
+// (`confirmationFromEnv` + `requireConfirmationWithFallback`), configured by the
+// same three variables as every other fleet server:
 //
-// A client with no MCP elicitation (claude.ai, measured) cannot be shown the
-// confirmation prompt, so every send is refused there. With
-// GOG_SEND_CONFIRM_FALLBACK=token the rail instead runs two phases: phase 1
-// returns the full preview plus a token and sends nothing; phase 2 presents the
-// token, the tool RE-READS what it would send, and dispatches only if that still
-// hashes to what the token was issued for.
+//   MCP_CONFIRM_MODE         ask-user (default) | auto | refuse
+//   MCP_CONFIRM_TTL_SECONDS  token lifetime, default 600
+//   MCP_CONFIRM_SECRET       HMAC key; default random per process
 //
-// WHAT THIS DOES AND DOES NOT PROVE. Unlike elicitation, the approval here is a
-// tool argument, so the gate is the model honouring "show this to the user and
-// wait". The token cannot make the model ask; what it guarantees is that what
-// is sent matches what was previewed — a draft edited in a mail client (its
-// messageId rotates), a changed recipient or body, or a swapped attachment
-// between the two calls all refuse. Caller-supplied files are bound by content
-// hash; a stored draft's attachments by name and size, since Gmail's
-// attachment ids are unstable and any edit rotates the messageId anyway. One
-// approval acts once, for one tool, account and target, within the TTL — per
-// PROCESS: spent tokens live in memory, so with a shared GOG_CONFIRM_SECRET a
-// restart or a second instance would accept a spent token again until it
-// expires. That is why the mode is opt-in.
+// WHAT THIS DOES AND DOES NOT PROVE: see mcp-utils' confirm-token module. The
+// approval is a tool argument, so under ask-user the gate is the model honouring
+// "show this to the user and wait"; the token guarantees what happens matches
+// what was previewed, once, for one tool, account and target.
 // ============================================================================
 
-export type ConfirmTokenError = 'DRAFT_CHANGED' | 'TOKEN_EXPIRED' | 'TOKEN_REUSED' | 'TOKEN_INVALID';
+const spent = createSpentTokenStore();
 
-/** What a token is bound to. Every field must match on phase 2. */
-export interface ConfirmBinding {
-  tool: string;
-  account: string;
-  /** The draftId / messageId / query the dispatch acts on. */
-  target: string;
-  /** A version of the target that rotates on edit — a draft's messageId. */
-  revision?: string;
-  /** {@link hashSendPayload} of the canonical send payload. */
-  payloadHash: string;
+/** This server's spent-token store (one per process). */
+export function confirmSpentStore(): SpentTokenStore {
+  return spent;
 }
 
-export type ConfirmTokenVerdict =
-  | { ok: true }
-  | { ok: false; error: ConfirmTokenError; reason?: 'payload-changed' | 'message-id-rotated' };
-
-export const CONFIRM_TOKEN_TTL_DEFAULT_SECONDS = 600;
-
-const PREFIX = 'gct1';
-
-type Claims = { t: string; a: string; g: string; r?: string; h: string; iat: number; exp: number; n: string };
-
-let secret: Buffer | undefined;
-// nonce → expiry (ms). Entries are dropped once they would have expired
-// anyway, so the set is bounded by the tokens spent within one TTL. In memory
-// only: see the header on GOG_CONFIRM_SECRET and restarts.
-const spent = new Map<string, number>();
-
-/** GOG_SEND_CONFIRM_FALLBACK=token turns the fallback on. Anything else is off. */
-export function sendConfirmFallbackEnabled(): boolean {
-  return readEnvVar('GOG_SEND_CONFIRM_FALLBACK')?.trim().toLowerCase() === 'token';
-}
-
-export function confirmTokenTtlSeconds(): number {
-  const raw = readEnvVar('GOG_CONFIRM_TTL_SECONDS')?.trim();
-  if (raw && /^\d+$/.test(raw)) {
-    const n = Number(raw);
-    if (n > 0) return n;
-  }
-  return CONFIRM_TOKEN_TTL_DEFAULT_SECONDS;
-}
-
-// GOG_CONFIRM_SECRET ends in _SECRET, so runner.ts strips it from every gog
-// child — it never leaves this process.
-function hmacKey(): Buffer {
-  if (!secret) {
-    const configured = readEnvVar('GOG_CONFIRM_SECRET');
-    secret = configured ? Buffer.from(configured, 'utf8') : randomBytes(32);
-  }
-  return secret;
-}
-
-/** Test seam: forget the secret (a "restart") and every spent token. */
+/** Test seam: forget every spent token. */
 export function resetConfirmTokenState(): void {
-  secret = undefined;
   spent.clear();
 }
-
-// Sorted keys, undefined dropped: the same payload re-read on phase 2 must
-// hash identically however its object was assembled.
-function canonicalize(value: unknown): unknown {
-  if (Array.isArray(value)) return value.map(canonicalize);
-  if (value && typeof value === 'object') {
-    const out: Record<string, unknown> = {};
-    for (const key of Object.keys(value as Record<string, unknown>).sort()) {
-      const v = (value as Record<string, unknown>)[key];
-      if (v !== undefined) out[key] = canonicalize(v);
-    }
-    return out;
-  }
-  return value;
-}
-
-/** SHA-256 (hex) of the canonical JSON of a send payload. */
-export function hashSendPayload(payload: unknown): string {
-  return createHash('sha256').update(JSON.stringify(canonicalize(payload))).digest('hex');
-}
-
-function sign(body: string): string {
-  return createHmac('sha256', hmacKey()).update(`${PREFIX}.${body}`).digest('base64url');
-}
-
-export function issueConfirmToken(binding: ConfirmBinding, now = Date.now()): { token: string; expiresAt: string } {
-  const exp = now + confirmTokenTtlSeconds() * 1000;
-  const claims: Claims = {
-    t: binding.tool,
-    a: binding.account,
-    g: binding.target,
-    ...(binding.revision === undefined ? {} : { r: binding.revision }),
-    h: binding.payloadHash,
-    iat: now,
-    exp,
-    n: randomBytes(16).toString('base64url'),
-  };
-  const body = Buffer.from(JSON.stringify(claims), 'utf8').toString('base64url');
-  return { token: `${PREFIX}.${body}.${sign(body)}`, expiresAt: new Date(exp).toISOString() };
-}
-
-function signatureMatches(body: string, sig: string): boolean {
-  const expected = Buffer.from(sign(body), 'utf8');
-  const actual = Buffer.from(sig, 'utf8');
-  return expected.length === actual.length && timingSafeEqual(expected, actual);
-}
-
-function parseClaims(body: string): Claims | undefined {
-  try {
-    return JSON.parse(Buffer.from(body, 'base64url').toString('utf8')) as Claims;
-  } catch {
-    return undefined;
-  }
-}
-
-/**
- * Check a phase-2 token against the binding recomputed from a fresh re-read.
- * Only an `ok` verdict consumes the token; a DRAFT_CHANGED leaves it unspent,
- * because the approval it carries is still true of the content it names.
- */
-export function verifyConfirmToken(token: string, binding: ConfirmBinding, now = Date.now()): ConfirmTokenVerdict {
-  for (const [nonce, exp] of spent) if (exp < now) spent.delete(nonce);
-
-  const parts = token.split('.');
-  if (parts.length !== 3 || parts[0] !== PREFIX || !parts[1] || !parts[2]) return { ok: false, error: 'TOKEN_INVALID' };
-  const [, body, sig] = parts as [string, string, string];
-  if (!signatureMatches(body, sig)) return { ok: false, error: 'TOKEN_INVALID' };
-  const claims = parseClaims(body);
-  if (!claims) return { ok: false, error: 'TOKEN_INVALID' };
-
-  if (claims.t !== binding.tool || claims.a !== binding.account || claims.g !== binding.target) {
-    return { ok: false, error: 'TOKEN_INVALID' };
-  }
-  if (spent.has(claims.n)) return { ok: false, error: 'TOKEN_REUSED' };
-  if (now > claims.exp) return { ok: false, error: 'TOKEN_EXPIRED' };
-  if (claims.r !== binding.revision) return { ok: false, error: 'DRAFT_CHANGED', reason: 'message-id-rotated' };
-  if (claims.h !== binding.payloadHash) return { ok: false, error: 'DRAFT_CHANGED', reason: 'payload-changed' };
-
-  spent.set(claims.n, claims.exp);
-  return { ok: true };
-}

package/src/tools/api.ts

@@ -6,7 +6,7 @@ import { assertSafeForwardedArgs } from '../arg-guard.js';
 import { confineAtFile } from '../file-roots.js';
 import { pos } from '../argv.js';
 import type { GogArg } from '../runner.js';
-import { gatedElsewhere } from '../dispatch-confirmation.js';
+import { BODY_PREVIEW_MAX, bodyPreview, CONFIRM_FALLBACK_DESCRIPTION, confirmTokenParam, gatedElsewhere, requireDispatchConfirmation } from '../dispatch-confirmation.js';
 
 // Gmail methods gog_api_call refuses outright (audit SEC-2). `allowWrite` is a
 // boolean the MODEL sets, so it cannot stand in for the user's confirmation of
@@ -20,17 +20,38 @@ const GMAIL_API_BLOCKED = /(?:\.send$|forwarding|filters\.create|filters\.update
 // the dedicated tool asks the user, so the raw API method must not be a way
 // around it. Anchored on a `.` or the start so a Discovery id with the API
 // prefix (`chat.spaces.messages.create`) matches too.
+// Fleet audit 2026-09-24 SEC-6 added the methods that notify someone, grant
+// access or run code under the account's authority (moving an event with
+// sendUpdates, roster adds, returning work, posting coursework, comments,
+// send-as aliases, the vacation responder, member-seeded spaces, script runs).
 const DISPATCH_API_BLOCKED: Record<string, Array<{ method: RegExp; does: string; tool: string }>> = {
-  chat: [{ method: /(?:^|\.)spaces\.messages\.create$/i, does: 'posts a Chat message', tool: 'gog_chat_messages_send / gog_chat_dm_send' }],
-  drive: [{ method: /(?:^|\.)permissions\.(?:create|update)$/i, does: 'grants access to a file', tool: 'gog_drive_share' }],
+  chat: [
+    { method: /(?:^|\.)spaces\.messages\.create$/i, does: 'posts a Chat message', tool: 'gog_chat_messages_send / gog_chat_dm_send' },
+    { method: /(?:^|\.)spaces\.(?:setup|members\.create)$/i, does: 'adds people to a space', tool: 'gog_chat_spaces_create' },
+  ],
+  drive: [
+    { method: /(?:^|\.)permissions\.(?:create|update)$/i, does: 'grants access to a file', tool: 'gog_drive_share' },
+    { method: /(?:^|\.)comments\.create$/i, does: 'notifies the file\'s owner and anyone it mentions', tool: 'gog_drive_comments_add / gog_docs_comments_add' },
+    { method: /(?:^|\.)replies\.create$/i, does: 'notifies the comment thread', tool: 'gog_drive_comments_reply / gog_docs_comments_reply' },
+  ],
   classroom: [
     { method: /(?:^|\.)courses\.announcements\.create$/i, does: 'posts to a class', tool: 'gog_classroom_announcements_create' },
     { method: /(?:^|\.)invitations\.create$/i, does: 'invites someone to a class', tool: 'gog_classroom_invitations_create' },
+    { method: /(?:^|\.)courses\.students\.create$/i, does: 'adds someone to a class', tool: 'gog_classroom_students_add' },
+    { method: /(?:^|\.)courses\.teachers\.create$/i, does: 'gives someone teacher access to a class', tool: 'gog_classroom_teachers_add' },
+    { method: /(?:^|\.)courses\.coursework\.create$/i, does: 'posts coursework to a class', tool: 'gog_classroom_coursework_create' },
+    { method: /(?:^|\.)studentsubmissions\.return$/i, does: 'returns work to a student', tool: 'gog_classroom_submissions_return' },
   ],
   calendar: [
     { method: /(?:^|\.)events\.(?:insert|import|quickadd)$/i, does: 'can put an event on guests\' calendars', tool: 'gog_calendar_create' },
     { method: /(?:^|\.)events\.(?:update|patch)$/i, does: 'can change what guests see', tool: 'gog_calendar_update / gog_calendar_respond' },
+    { method: /(?:^|\.)events\.move$/i, does: 'can email every guest', tool: 'gog_calendar_move' },
   ],
+  gmail: [
+    { method: /(?:^|\.)settings\.sendas\.create$/i, does: 'makes Google email the address and adds a sending identity', tool: 'gog_gmail_sendas_create' },
+    { method: /(?:^|\.)settings\.updatevacation$/i, does: 'can turn on an auto-reply to every sender', tool: 'gog_gmail_vacation_update' },
+  ],
+  script: [{ method: /(?:^|\.)scripts\.run$/i, does: 'executes code with this account\'s authority', tool: 'gog_appscript_run_function' }],
 };
 
 export function refusedApiCall(api: string, method: string): string | undefined {
@@ -44,10 +65,25 @@ export function refusedApiCall(api: string, method: string): string | undefined
   return hit ? gatedElsewhere(`${name} ${m}`, 'gog_api_call', hit.does, hit.tool) : undefined;
 }
 
+/**
+ * A params/body string as the confirmation prompt shows it: parsed, when it is
+ * JSON, so the user reads a structure rather than an escaped string; otherwise
+ * (an `@file` reference, a typo) the string itself. Bounded like every other
+ * body on the rail — the token binds the FULL string regardless.
+ */
+export function previewJson(text: string): unknown {
+  if (text.length > BODY_PREVIEW_MAX) return bodyPreview(text);
+  try {
+    return JSON.parse(text);
+  } catch {
+    return text;
+  }
+}
+
 // Generic Google Discovery API access (gog 0.31). gog_api_list / gog_api_describe
 // are read-only Discovery lookups; gog_api_call is a Discovery-backed escape
 // hatch for any method gog has no dedicated subcommand for — guarded by an
-// explicit write opt-in and a dry-run preview.
+// explicit write opt-in, a dry-run preview, and the dispatch rail.
 export function registerApiTools(server: McpServer): void {
   server.registerTool('gog_api_list', {
     description: 'List the Google Discovery APIs available for gog_api_call / gog_api_describe (name + version + title).',
@@ -78,7 +114,7 @@ export function registerApiTools(server: McpServer): void {
   });
 
   server.registerTool('gog_api_call', {
-    description: 'Call any Discovery-described Google API method directly — an escape hatch for endpoints gog has no dedicated tool for. Find the exact api/version/method/params with gog_api_describe first. Read methods (GET/LIST) run as-is. Mutating methods (POST/PUT/PATCH/DELETE) are refused unless you set allowWrite=true — keep it false to preview, or set dryRun=true to print the intended request without sending it. Gmail send and forwarding methods (users.messages.send, users.drafts.send, forwarding/auto-forwarding, filters, delegates) are refused — use the dedicated gog_gmail_* tools, which ask the user to confirm. So are the other methods a dedicated tool asks about: Chat spaces.messages.create, Drive permissions.create/update, Classroom courses.announcements.create and invitations.create, and Calendar events.insert/import/quickAdd/update/patch.',
+    description: 'Call any Discovery-described Google API method directly — an escape hatch for endpoints gog has no dedicated tool for. Find the exact api/version/method/params with gog_api_describe first. Read methods (GET/LIST) run as-is. Mutating methods (POST/PUT/PATCH/DELETE) are refused unless you set allowWrite=true, and every write then asks the MCP host to show the user a confirmation prompt with the exact api/version/method/params/body before anything is sent; set dryRun=true to print the intended request without sending it (no prompt, no changes). Gmail send and forwarding methods (users.messages.send, users.drafts.send, forwarding/auto-forwarding, filters, delegates) are refused outright — use the dedicated gog_gmail_* tools, which ask the user to confirm. So are the other methods a dedicated tool asks about with a better preview: Chat spaces.messages.create, Drive permissions.create/update, Classroom courses.announcements.create and invitations.create, and Calendar events.insert/import/quickAdd/update/patch.' + CONFIRM_FALLBACK_DESCRIPTION,
     annotations: { destructiveHint: true },
     inputSchema: z.object({
       api: z.string().describe('Discovery API name (e.g. drive, gmail, calendar)'),
@@ -87,11 +123,12 @@ export function registerApiTools(server: McpServer): void {
       params: z.string().optional().describe('Query/path parameters as a JSON object string (e.g. {"fileId":"abc","fields":"name"})'),
       body: z.string().optional().describe('Request body as a JSON string (for write methods)'),
       scope: z.string().optional().describe('Override the OAuth scope used for the call'),
-      allowWrite: z.boolean().optional().describe('Required to invoke a mutating method (POST/PUT/PATCH/DELETE). Without it, gog refuses write methods. Leave unset for read-only calls.'),
-      dryRun: z.boolean().optional().describe('Print the intended request and exit without sending it (no changes made)'),
+      allowWrite: z.boolean().optional().describe('Required to invoke a mutating method (POST/PUT/PATCH/DELETE); the user is asked to confirm the exact request first. Without it, gog refuses write methods. Leave unset for read-only calls.'),
+      dryRun: z.boolean().optional().describe('Print the intended request and exit without sending it (no changes made, no confirmation prompt)'),
       account: accountParam,
+      confirmToken: confirmTokenParam,
     }),
-  }, async ({ api, version, method, params, body, scope, allowWrite, dryRun, account }) => {
+  }, async ({ api, version, method, params, body, scope, allowWrite, dryRun, account, confirmToken }, ctx) => {
     try {
       assertSafeForwardedArgs([api, version, method]);
       const refusal = refusedApiCall(api, method);
@@ -103,6 +140,35 @@ export function registerApiTools(server: McpServer): void {
     } catch (err) {
       return errorResult(errorText(err));
     }
+    // SEC-2 (fleet-audit #931): allowWrite is a boolean the MODEL sets, and
+    // the --force below skips gog's own confirmation, so a method blocklist
+    // could never be complete (events.move/delete with sendUpdates=all,
+    // acl.insert, settings.sendAs.create, updateVacation, batchDelete, ...).
+    // Every write that will actually be sent asks the user first, about the
+    // exact api/method/params/body, through the same rail as the dedicated
+    // tools. A dry run sends nothing and is not gated; a write without
+    // allowWrite is refused by gog itself.
+    if (allowWrite && !dryRun) {
+      const request = { api, version, method, params, body, scope };
+      const view: Record<string, unknown> = { api, version, method };
+      if (params !== undefined) view.params = previewJson(params);
+      if (body !== undefined) view.body = previewJson(body);
+      if (scope !== undefined) view.scope = scope;
+      const confirmation = await requireDispatchConfirmation(ctx, {
+        action: 'api.call',
+        message: `Review and confirm this raw Google API write (${api} ${version} ${method}):`,
+        confirmationLabel: 'Confirm that this API method should be invoked with exactly these parameters.',
+        details: view,
+        unsupportedNote: 'Set dryRun=true to see the request gog would send without sending it, or use the dedicated gog_* tool for this operation.',
+        fallback: {
+          tool: 'gog_api_call',
+          account,
+          confirmToken,
+          subject: () => ({ target: `${api}/${version}/${method}`, payload: request, preview: view }),
+        },
+      });
+      if (confirmation) return confirmation;
+    }
     const args: GogArg[] = ['api', 'call', pos(api), pos(version), pos(method)];
     if (params) args.push(`--params=${params}`);
     if (body) args.push(`--body=${body}`);

package/src/tools/appscript.ts

@@ -10,6 +10,41 @@ import {
 import { pos } from '../argv.js';
 import { confinePath } from '../file-roots.js';
 import type { GogArg } from '../runner.js';
+import {
+  CONFIRM_FALLBACK_DESCRIPTION,
+  confirmTokenParam,
+  gatedElsewhere,
+  requireDispatchConfirmation,
+  resultText,
+  senderPreview,
+} from '../dispatch-confirmation.js';
+
+/** gog_appscript_run must not execute code that gog_appscript_run_function would ask about. */
+export function vetAppScriptRun(subcommand: string, _args: readonly string[]): string | undefined {
+  return subcommand.toLowerCase() === 'run'
+    ? gatedElsewhere('gog appscript run', 'gog_appscript_run', 'executes code with this account\'s authority', 'gog_appscript_run_function')
+    : undefined;
+}
+
+/**
+ * The project a run executes, for its confirmation prompt: a title the user
+ * recognises beside the opaque id. `updateTime` is kept apart as the token's
+ * revision, so code saved between the two phases is DRAFT_CHANGED. Unreadable
+ * output names nothing rather than throwing.
+ */
+export function projectSnapshot(raw: string, scriptId: string): { scriptId: string; title?: string; updateTime?: string } {
+  let project: { title?: unknown; updateTime?: unknown } | undefined;
+  try {
+    project = (JSON.parse(raw) as { project?: typeof project } | null)?.project;
+  } catch {
+    project = undefined;
+  }
+  return {
+    scriptId,
+    ...(typeof project?.title === 'string' ? { title: project.title } : {}),
+    ...(typeof project?.updateTime === 'string' ? { updateTime: project.updateTime } : {}),
+  };
+}
 
 // Google Apps Script (gog >= 0.38.0 for pull/deployments/versions).
 //
@@ -140,7 +175,9 @@ export function registerAppScriptTools(server: McpServer): void {
       + 'Requires the project to be deployed as an API executable and to share the OAuth client with the calling '
       + 'credentials, otherwise Google refuses regardless of scopes. devMode runs the latest saved code instead of the '
       + 'deployed version, and only works if the account owns the script. '
-      + 'This is NOT the escape hatch — gog_appscript_run is that.' + apiEnableNote,
+      + 'This is NOT the escape hatch — gog_appscript_run is that. Because the wrapper cannot tell what the code will '
+      + 'do, it reads the project and asks the MCP host to show the user a confirmation prompt with the project, the '
+      + 'function and its arguments first; nothing runs unless they accept.' + CONFIRM_FALLBACK_DESCRIPTION + apiEnableNote,
     annotations: { destructiveHint: true },
     inputSchema: z.object({
       scriptId: scriptIdParam,
@@ -148,12 +185,14 @@ export function registerAppScriptTools(server: McpServer): void {
       params: z.string().optional().describe('Function parameters as a JSON ARRAY of positional arguments, e.g. \'["a", 1]\' — not an object'),
       devMode: z.boolean().optional().describe('Run the latest saved code rather than the deployed version (owner only)'),
       account: accountParam,
+      confirmToken: confirmTokenParam,
     }),
-  }, async ({ scriptId, functionName, params, devMode, account }) => {
+  }, async ({ scriptId, functionName, params, devMode, account, confirmToken }, ctx) => {
     // gog passes --params through to the API as-is, so a malformed value comes
     // back as a Google error about the request body rather than about the
     // argument the caller actually got wrong. Checking the shape here is what
     // turns "invalid argument" into "params must be a JSON array".
+    let parsedParams: unknown[] | undefined;
     if (params !== undefined) {
       let parsed: unknown;
       try {
@@ -164,7 +203,28 @@ export function registerAppScriptTools(server: McpServer): void {
       if (!Array.isArray(parsed)) {
         throw new Error(`params must be a JSON ARRAY of positional arguments, e.g. '["a", 1]' — Apps Script takes positional arguments, not named ones. Received: ${params}`);
       }
+      parsedParams = parsed;
     }
+    // Read on every call: the prompt names the project, and on the token
+    // fallback's phase 2 this is the re-read the token is checked against.
+    const got = await runOrDiagnose(['appscript', 'get', pos(scriptId)], { account });
+    if (got.isError) return got;
+    const { updateTime, ...project } = projectSnapshot(resultText(got), scriptId);
+    const execution = { project, functionName, params: parsedParams, devMode: Boolean(devMode), runsAs: senderPreview(account) };
+    const confirmation = await requireDispatchConfirmation(ctx, {
+      action: 'appscript.run-function',
+      message: 'Review and confirm running this Apps Script function with the account\'s full authority:',
+      confirmationLabel: 'Confirm that this code should run now.',
+      details: execution,
+      unsupportedNote: 'Ask the user to run it themselves from the Apps Script editor.',
+      fallback: {
+        tool: 'gog_appscript_run_function',
+        account,
+        confirmToken,
+        subject: () => ({ target: `${scriptId}/${functionName}`, revision: updateTime, payload: execution, preview: execution }),
+      },
+    });
+    if (confirmation) return confirmation;
     const args: GogArg[] = ['appscript', 'run', pos(scriptId), pos(functionName)];
     if (params !== undefined) args.push(`--params=${params}`);
     if (devMode) args.push('--dev-mode');
@@ -174,6 +234,7 @@ export function registerAppScriptTools(server: McpServer): void {
   registerRunTool(server, {
     service: 'appscript',
     examples: '"get", "content", "deployments"',
+    vet: vetAppScriptRun,
     note: 'To execute a function, use gog_appscript_run_function — this tool is the generic escape hatch.',
   });
 }

package/src/tools/calendar.ts

@@ -5,22 +5,60 @@ import { accountParam, runOrDiagnose, registerRunTool, pageTokenParam, pageAlias
 import { annotateTruncatedList } from '../pagination.js';
 import { pos } from '../argv.js';
 import type { GogArg } from '../runner.js';
-import { CONFIRM_FALLBACK_DESCRIPTION, confirmTokenParam, gatedElsewhere, requireDispatchConfirmation, resultText } from '../dispatch-confirmation.js';
+import { CONFIRM_FALLBACK_DESCRIPTION, confirmTokenParam, flagValue, gatedElsewhere, refusedInRun, requireDispatchConfirmation, resultText } from '../dispatch-confirmation.js';
 
-// gog's spellings (internal/cmd/calendar.go). The run tool cannot tell whether
-// an event has guests, so it refuses these outright; the dedicated tools ask
-// only when someone else would see the change.
-const CALENDAR_GATED: Record<string, string> = {
-  create: 'gog_calendar_create', add: 'gog_calendar_create', new: 'gog_calendar_create',
-  update: 'gog_calendar_update', edit: 'gog_calendar_update', set: 'gog_calendar_update',
-  respond: 'gog_calendar_respond', rsvp: 'gog_calendar_respond', reply: 'gog_calendar_respond',
+// gog's spellings (internal/cmd/calendar.go; aliases per `gog schema` 0.41.0).
+// The run tool cannot tell whether an event has guests, so it refuses these
+// outright; the dedicated tools ask only when someone else would see the
+// change. Move, delete, delete-calendar and out-of-office joined in the fleet
+// audit of 2026-09-24 (SEC-4 #933, SEC-6): --send-updates on a move emails
+// every guest, out-of-office auto-declines conflicting invitations by default,
+// and delete's --scope defaults to the whole recurring series.
+const ASKS = (tool: string) => `Use ${tool}, which asks the user to confirm.`;
+const CALENDAR_REFUSED: Record<string, { does: string; instead: string }> = {
+  create: { does: 'can change what guests see', instead: ASKS('gog_calendar_create') },
+  add: { does: 'can change what guests see', instead: ASKS('gog_calendar_create') },
+  new: { does: 'can change what guests see', instead: ASKS('gog_calendar_create') },
+  update: { does: 'can change what guests see', instead: ASKS('gog_calendar_update') },
+  edit: { does: 'can change what guests see', instead: ASKS('gog_calendar_update') },
+  set: { does: 'can change what guests see', instead: ASKS('gog_calendar_update') },
+  respond: { does: 'can change what guests see', instead: ASKS('gog_calendar_respond') },
+  rsvp: { does: 'can change what guests see', instead: ASKS('gog_calendar_respond') },
+  reply: { does: 'can change what guests see', instead: ASKS('gog_calendar_respond') },
+  move: { does: "moves an event off guests' calendars (and can email them)", instead: ASKS('gog_calendar_move') },
+  transfer: { does: "moves an event off guests' calendars (and can email them)", instead: ASKS('gog_calendar_move') },
+  delete: { does: "removes an event from every guest's calendar (the whole series by default)", instead: ASKS('gog_calendar_delete') },
+  del: { does: "removes an event from every guest's calendar (the whole series by default)", instead: ASKS('gog_calendar_delete') },
+  rm: { does: "removes an event from every guest's calendar (the whole series by default)", instead: ASKS('gog_calendar_delete') },
+  remove: { does: "removes an event from every guest's calendar (the whole series by default)", instead: ASKS('gog_calendar_delete') },
+  'delete-calendar': { does: 'deletes a calendar and every event on it', instead: ASKS('gog_calendar_delete_calendar') },
+  'out-of-office': { does: 'auto-declines invitations and notifies their organizers', instead: ASKS('gog_calendar_out_of_office') },
+  ooo: { does: 'auto-declines invitations and notifies their organizers', instead: ASKS('gog_calendar_out_of_office') },
 };
 
 /** gog_calendar_run must not make the changes gog_calendar_create/update/respond would ask about. */
-export function vetCalendarRun(subcommand: string, _args: readonly string[]): string | undefined {
+export function vetCalendarRun(subcommand: string, args: readonly string[]): string | undefined {
   const sub = subcommand.toLowerCase();
-  const tool = Object.hasOwn(CALENDAR_GATED, sub) ? CALENDAR_GATED[sub] : undefined;
-  return tool ? gatedElsewhere(`gog calendar ${sub}`, 'gog_calendar_run', 'can change what guests see', tool) : undefined;
+  const what = `gog calendar ${sub}`;
+  const via = 'gog_calendar_run';
+  if (Object.hasOwn(CALENDAR_REFUSED, sub)) {
+    const { does, instead } = CALENDAR_REFUSED[sub]!;
+    return refusedInRun(what, via, does, instead);
+  }
+  // `propose-time` alone generates a URL. With --decline (or --comment, which
+  // implies it) it declines the event and notifies the organizer — exactly
+  // what gog_calendar_respond asks about (SEC-4, fleet-audit #933).
+  if (sub === 'propose-time' && (flagValue(args, 'decline') !== undefined || flagValue(args, 'comment') !== undefined)) {
+    return gatedElsewhere(`${what} --decline`, via, 'declines the event and notifies the organizer', 'gog_calendar_respond');
+  }
+  // A Focus Time block auto-declines every conflicting invitation by default
+  // (gog's --auto-decline defaults to all) and there is no dedicated tool for
+  // it; one that declines nobody is a private block and passes.
+  if ((sub === 'focus-time' || sub === 'focus') && flagValue(args, 'auto-decline')?.toLowerCase() !== 'none') {
+    return refusedInRun(what, via, 'auto-declines invitations and notifies their organizers (gog defaults --auto-decline to all)',
+      'Pass --auto-decline=none, or ask the user to create it from Google Calendar.');
+  }
+  return undefined;
 }
 
 // Reminder params, shared by create and update (gog >= 0.38.0 for
@@ -70,11 +108,13 @@ export function eventSnapshot(raw: string): {
   end?: string;
   organizer?: string;
   guests: string[];
+  recurring?: true;
   etag?: string;
 } {
   let event: {
     summary?: unknown; start?: EventTime; end?: EventTime; etag?: unknown;
     organizer?: { email?: unknown }; attendees?: EventAttendee[];
+    recurrence?: unknown; recurringEventId?: unknown;
   } | undefined;
   try {
     event = (JSON.parse(raw) as { event?: typeof event } | null)?.event;
@@ -91,6 +131,10 @@ export function eventSnapshot(raw: string): {
     guests: (Array.isArray(event?.attendees) ? event.attendees : [])
       .filter((a) => a.self !== true && a.resource !== true && typeof a.email === 'string')
       .map((a) => a.email as string),
+    // A series, or one instance of one: gog's delete --scope defaults to all.
+    ...((Array.isArray(event?.recurrence) && event.recurrence.length > 0) || typeof event?.recurringEventId === 'string'
+      ? { recurring: true as const }
+      : {}),
     etag: str(event?.etag),
   };
 }
@@ -357,14 +401,40 @@ export function registerCalendarTools(server: McpServer): void {
   });
 
   server.registerTool('gog_calendar_delete', {
-    description: 'Delete a calendar event.',
+    description: 'Delete a calendar event. It disappears from every guest\'s calendar too, and for a recurring event gog '
+      + 'deletes the WHOLE series, so when the event has guests or recurs this reads it and asks the MCP host to show '
+      + 'the user a confirmation prompt with the event as it stands; a guest-free, one-off event is deleted without asking.'
+      + CONFIRM_FALLBACK_DESCRIPTION,
     annotations: { destructiveHint: true },
     inputSchema: z.object({
       calendarId: z.string().describe('Calendar ID'),
       eventId: z.string().describe('Event ID'),
       account: accountParam,
+      confirmToken: confirmTokenParam,
     }),
-  }, async ({ calendarId, eventId, account }) => {
+  }, async ({ calendarId, eventId, account, confirmToken }, ctx) => {
+    const read = await readEvent(calendarId, eventId, account);
+    if (read.error) return read.error;
+    const { etag, ...event } = read.event;
+    if (event.guests.length > 0 || event.recurring) {
+      const view = { calendarId, eventId, event, scope: event.recurring ? 'the whole recurring series' : 'this event' };
+      const confirmation = await requireDispatchConfirmation(ctx, {
+        action: 'calendar.delete',
+        message: event.recurring
+          ? 'Review and confirm deleting this ENTIRE recurring series:'
+          : 'Review and confirm deleting this event from every guest\'s calendar:',
+        confirmationLabel: 'Confirm that this event should be deleted now.',
+        details: view,
+        unsupportedNote: 'Ask the user to delete it from Google Calendar.',
+        fallback: {
+          tool: 'gog_calendar_delete',
+          account,
+          confirmToken,
+          subject: () => ({ target: `${calendarId}/${eventId}`, revision: etag, payload: view, preview: view }),
+        },
+      });
+      if (confirmation) return confirmation;
+    }
     // gog gates this delete behind a confirmation; the runner injects
     // --no-input, so without --force it refuses at runtime.
     return runOrDiagnose(['calendar', 'delete', pos(calendarId), pos(eventId), '--force'], { account });

package/src/tools/chat.ts

@@ -27,9 +27,20 @@ import {
 // gog's spellings of `send` under `messages` and `dm` (internal/cmd/chat_messages.go, chat_dm.go).
 const CHAT_SEND_WORDS = new Set(['send', 'create', 'post']);
 
-/** gog_chat_run must not post what gog_chat_messages_send / gog_chat_dm_send would ask about. */
+// gog's spellings of `spaces create` (`gog schema` 0.41.0).
+const CHAT_SPACE_CREATE_WORDS = new Set(['create', 'add', 'new']);
+
+/** gog_chat_run must not post, or add people to a space, where the dedicated tools would ask. */
 export function vetChatRun(subcommand: string, args: readonly string[]): string | undefined {
   const sub = subcommand.toLowerCase();
+  if (sub === 'spaces') {
+    // A member-less space reaches nobody; one seeded with --member adds and notifies them.
+    const word = hasCommandWord(args, CHAT_SPACE_CREATE_WORDS);
+    const withMembers = args.some((a) => /^--members?(?:=|$)/i.test(a));
+    return word && withMembers
+      ? gatedElsewhere(`gog chat spaces ${word.toLowerCase()} --member`, 'gog_chat_run', 'adds people to a space', 'gog_chat_spaces_create')
+      : undefined;
+  }
   if (sub !== 'messages' && sub !== 'dm') return undefined;
   const word = hasCommandWord(args, CHAT_SEND_WORDS);
   if (!word) return undefined;
@@ -114,17 +125,37 @@ export function registerChatTools(server: McpServer): void {
 
   server.registerTool('gog_chat_spaces_create', {
     description:
-      'Create a named Chat space, optionally seeding its membership. Members are added immediately and are notified — this '
-      + 'is visible to other people the moment it runs, so confirm the member list before calling it.' + workspaceOnlyNote,
+      'Create a named Chat space, optionally seeding its membership. Members are added immediately and are notified, so '
+      + 'with members this asks the MCP host to show the user a confirmation prompt with the space name and every member '
+      + 'first; nothing is created unless they accept. A space with no members reaches nobody and is created without '
+      + 'asking.' + CONFIRM_FALLBACK_DESCRIPTION + workspaceOnlyNote,
     annotations: { destructiveHint: true },
     inputSchema: z.object({
       displayName: z.string().describe('Display name for the new space'),
       members: z.array(z.string()).optional().describe('Initial members, as email addresses or "users/..." resource names'),
       account: accountParam,
+      confirmToken: confirmTokenParam,
     }),
-  }, async ({ displayName, members, account }) => {
+  }, async ({ displayName, members, account, confirmToken }, ctx) => {
     const args: GogArg[] = ['chat', 'spaces', 'create', pos(displayName)];
     if (members) for (const member of members) args.push(`--member=${member}`);
+    if (members?.length) {
+      const space = { displayName, members };
+      const confirmation = await requireDispatchConfirmation(ctx, {
+        action: 'chat.space-create',
+        message: 'Review and confirm this Chat space — every member is added and notified:',
+        confirmationLabel: 'Confirm that these people should be added to a new space now.',
+        details: space,
+        unsupportedNote: 'Create the space without members instead; the user can add people from Google Chat.',
+        fallback: {
+          tool: 'gog_chat_spaces_create',
+          account,
+          confirmToken,
+          subject: () => ({ target: displayName, payload: space, preview: space }),
+        },
+      });
+      if (confirmation) return confirmation;
+    }
     return runOrDiagnose(args, { account });
   });