gogcli-mcp 4.5.0 → 4.5.1

package/manifest.json

@@ -3,7 +3,7 @@
   "manifest_version": "0.3",
   "name": "gogcli-mcp",
   "display_name": "gogcli",
-  "version": "4.5.0",
+  "version": "4.5.1",
   "description": "Google Sheets (and more) for Claude via gogcli — read, write, and manage spreadsheets",
   "author": {
     "name": "Chris Hall",
@@ -73,7 +73,7 @@
     },
     {
       "name": "gog_api_call",
-      "description": "Call any Discovery-described Google API method (escape hatch; write opt-in + dry-run)."
+      "description": "Call any Discovery-described Google API method (escape hatch; every write asks the user to confirm; dry-run available)."
     },
     {
       "name": "gog_auth_add",
@@ -149,7 +149,7 @@
     },
     {
       "name": "gog_calendar_delete",
-      "description": "Delete a calendar event"
+      "description": "Delete a calendar event (asks the user to confirm when it has guests or recurs)"
     },
     {
       "name": "gog_calendar_respond",
@@ -209,7 +209,7 @@
     },
     {
       "name": "gog_classroom_submissions_return",
-      "description": "Return a graded submission"
+      "description": "Return a graded submission (asks the user to confirm)"
     },
     {
       "name": "gog_classroom_submissions_turn_in",
@@ -293,7 +293,7 @@
     },
     {
       "name": "gog_drive_delete",
-      "description": "Move a file to trash"
+      "description": "Move a file to trash (a permanent delete asks the user to confirm)"
     },
     {
       "name": "gog_drive_share",
@@ -449,7 +449,7 @@
     },
     {
       "name": "gog_chat_spaces_create",
-      "description": "Create a named Chat space, optionally seeding its membership"
+      "description": "Create a named Chat space, optionally seeding its membership (with members, asks the user to confirm)"
     },
     {
       "name": "gog_chat_threads_list",
@@ -517,7 +517,7 @@
     },
     {
       "name": "gog_appscript_run_function",
-      "description": "Execute a function in a deployed Apps Script project"
+      "description": "Execute a function in a deployed Apps Script project (asks the user to confirm)"
     },
     {
       "name": "gog_appscript_run",

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "gogcli-mcp",
-  "version": "4.5.0",
+  "version": "4.5.1",
   "mcpName": "io.github.chrischall/gogcli-mcp",
   "description": "MCP server wrapping gogcli for Google service access",
   "author": "Claude Code (AI) <https://www.anthropic.com/claude>",
@@ -46,7 +46,7 @@
     "zod": "^4.6.1"
   },
   "devDependencies": {
-    "@types/node": "^26.6.1",
+    "@types/node": "^26.6.2",
     "@vitest/coverage-v8": "^5.0.1",
     "esbuild": "^0.28.2",
     "typescript": "^7.0.2",

package/server.json

@@ -7,12 +7,12 @@
     "source": "github",
     "subfolder": "packages/gogcli-mcp"
   },
-  "version": "4.5.0",
+  "version": "4.5.1",
   "packages": [
     {
       "registryType": "npm",
       "identifier": "gogcli-mcp",
-      "version": "4.5.0",
+      "version": "4.5.1",
       "transport": {
         "type": "stdio"
       },

package/src/dispatch-confirmation.ts

@@ -134,11 +134,21 @@ export interface DispatchTokenFallback {
 
 /**
  * The refusal an escape hatch (`gog_<service>_run`, `gog_api_call`) gives for an
- * action a dedicated tool gates. Without it, the run tool is a way around the
- * rail: the model forwards the same subcommand and nobody is asked (#400).
+ * action it must not perform: the run tool cannot see the guests, the class or
+ * the folder tree a change reaches, so it cannot preview it. `instead` names
+ * the way through — the dedicated tool, or the user doing it in the product.
+ */
+export function refusedInRun(what: string, via: string, does: string, instead: string): string {
+  return `${what} ${does} and is not available through ${via}. ${instead}`;
+}
+
+/**
+ * {@link refusedInRun} for an action a dedicated tool gates. Without it, the
+ * run tool is a way around the rail: the model forwards the same subcommand
+ * and nobody is asked (#400).
  */
 export function gatedElsewhere(what: string, via: string, does: string, tool: string): string {
-  return `${what} ${does} and is not available through ${via}. Use ${tool}, which asks the user to confirm.`;
+  return refusedInRun(what, via, does, `Use ${tool}, which asks the user to confirm.`);
 }
 
 /** True when any forwarded token is one of `words` (kong lets flags precede the command word). */
@@ -146,6 +156,56 @@ export function hasCommandWord(args: readonly string[], words: ReadonlySet<strin
   return args.find((a) => words.has(a.toLowerCase()));
 }
 
+/**
+ * The value of `--name=value` or `--name value` among forwarded args, `''` for
+ * a bare `--name`, undefined when the flag is absent. Kong accepts both
+ * spellings, so a vet that read only one of them would be a way around itself.
+ * Over-inclusive on a bare flag followed by another flag (it reads that flag
+ * as the value): a vet only ever asks whether the flag is present or names a
+ * specific value, and refusing is the safe direction of error.
+ */
+export function flagValue(args: readonly string[], name: string): string | undefined {
+  const flag = `--${name}`;
+  for (let i = 0; i < args.length; i++) {
+    const a = args[i]!;
+    if (a === flag) return args[i + 1] ?? '';
+    if (a.startsWith(`${flag}=`)) return a.slice(flag.length + 1);
+  }
+  return undefined;
+}
+
+// gog's spellings of `comments create|reply` under drive and docs (`gog schema` 0.41.0).
+const COMMENT_ADD_WORDS = new Set(['create', 'add', 'new']);
+const COMMENT_REPLY_WORDS = new Set(['reply', 'respond']);
+
+/** True when a forwarded flag list asks for `--<flag>` (bare, or =anything but false). */
+export function hasTrueFlag(args: readonly string[], flag: string): boolean {
+  const name = `--${flag}`;
+  return args.some((a) => {
+    const lower = a.toLowerCase();
+    if (lower === name) return true;
+    return lower.startsWith(`${name}=`) && lower.slice(name.length + 1) !== 'false';
+  });
+}
+
+/**
+ * gog_{drive,docs}_run must not post the comments gog_*_comments_add / _reply
+ * would ask about: a comment notifies the file's owner and everyone it +mentions.
+ */
+export function vetCommentsRun(service: 'drive' | 'docs', subcommand: string, args: readonly string[]): string | undefined {
+  if (subcommand.toLowerCase() !== 'comments') return undefined;
+  const reply = hasCommandWord(args, COMMENT_REPLY_WORDS);
+  if (reply) {
+    return gatedElsewhere(`gog ${service} comments ${reply.toLowerCase()}`, `gog_${service}_run`,
+      'notifies the comment thread', `gog_${service}_comments_reply`);
+  }
+  const add = hasCommandWord(args, COMMENT_ADD_WORDS);
+  return add
+    ? gatedElsewhere(`gog ${service} comments ${add.toLowerCase()}`, `gog_${service}_run`,
+      'notifies the file\'s owner and anyone it mentions', `gog_${service}_comments_add`)
+    : undefined;
+}
+
 export interface DispatchConfirmationOptions {
   /** Stable id of the dispatch, echoed in every result (`gmail.send`, `drive.share`, …). */
   action: string;

package/src/gmail-dispatch-guard.ts

@@ -196,25 +196,32 @@ function trustedDomains(account: string | undefined): Set<string> {
 }
 
 // A distinguishable, greppable event for every mail dispatch — recipient
-// count plus whichever recipients fall outside the trusted-domain list — so an
-// unexpected external send (outside counsel, a wrong-number alias) can be
-// caught after the fact even if the confirmation step above is somehow
-// bypassed by a future caller. stdout is the JSON-RPC channel, so this goes to
-// stderr like every other diagnostic in this repo.
+// count plus the DOMAINS of whichever recipients fall outside the trusted list
+// — so an unexpected external send (outside counsel, a wrong-number alias) can
+// be caught after the fact even if the confirmation step above is somehow
+// bypassed by a future caller. Never the addresses (PRIV-1, fleet-audit
+// #1012): on mcp-host this line is host log data the user never sees or
+// controls, and a third party's address is their identity where their domain
+// is the audit signal. stdout is the JSON-RPC channel, so this goes to stderr
+// like every other diagnostic in this repo.
 export function logGmailDispatch(tool: string, recipients: string[], account?: string): void {
   const domains = trustedDomains(account);
-  const externalRecipients = recipients.filter((recipient) => {
+  const externalDomains = new Set<string>();
+  let externalRecipientCount = 0;
+  for (const recipient of recipients) {
     const at = recipient.indexOf('@');
-    const domain = at > -1 ? recipient.slice(at + 1) : '';
-    return !domain || !domains.has(domain);
-  });
+    const domain = at > -1 ? recipient.slice(at + 1).toLowerCase() : '';
+    if (domain && domains.has(domain)) continue;
+    externalRecipientCount += 1;
+    externalDomains.add(domain || '(no domain)');
+  }
   const event = {
     event: 'gmail_dispatch',
     tool,
     recipientCount: recipients.length,
-    externalRecipientCount: externalRecipients.length,
-    hasExternalRecipients: externalRecipients.length > 0,
-    externalRecipients,
+    externalRecipientCount,
+    hasExternalRecipients: externalRecipientCount > 0,
+    externalDomains: [...externalDomains].sort(),
     timestamp: new Date().toISOString(),
   };
   process.stderr.write(`${JSON.stringify(event)}\n`);

package/src/lib.ts

@@ -19,7 +19,7 @@ export {
 // The reply/reply-all schema and flag builder live in the base package so the
 // gmail sub-package's draft-side twins reuse ONE definition — registering the
 // same tool name from both registrar lists would be a duplicate-name error.
-export { replySchema, appendReplyFlags } from './tools/gmail.js';
+export { replySchema, appendReplyFlags, parseMetadataHeaders } from './tools/gmail.js';
 export type { ReplyFlags } from './tools/gmail.js';
 // The gmail confirmation gate — gog_gmail_reply/send/forward/autoreply are
 // the only tools that dispatch mail irreversibly on the first call. The
@@ -40,7 +40,11 @@ export {
 } from './gmail-dispatch-guard.js';
 // The service-neutral rail for every other tool that reaches another person.
 export { requireDispatchConfirmation } from './dispatch-confirmation.js';
-export { readCourse } from './tools/classroom.js';
+export { readCourse, readCoursework, readClassroomWork, studentLabel } from './tools/classroom.js';
+export type { ClassroomWork, ClassroomWorkKind } from './tools/classroom.js';
+// Pure parsers a sub-package's confirmation prompt reuses on its own reads.
+export { eventSnapshot } from './tools/calendar.js';
+export { commentMentions, commentSnapshot, shareTargetMeta } from './tools/drive.js';
 export type { AttachmentDetail, DispatchTokenFallback, TokenSubject } from './gmail-dispatch-guard.js';
 export { run, runBinary, isGogFileArg, MIN_GOG_VERSION } from './runner.js';
 // Sub-package tools that read gog JSON through bare `run()` (rather than the

package/src/tools/api.ts

@@ -6,7 +6,7 @@ import { assertSafeForwardedArgs } from '../arg-guard.js';
 import { confineAtFile } from '../file-roots.js';
 import { pos } from '../argv.js';
 import type { GogArg } from '../runner.js';
-import { gatedElsewhere } from '../dispatch-confirmation.js';
+import { BODY_PREVIEW_MAX, bodyPreview, CONFIRM_FALLBACK_DESCRIPTION, confirmTokenParam, gatedElsewhere, requireDispatchConfirmation } from '../dispatch-confirmation.js';
 
 // Gmail methods gog_api_call refuses outright (audit SEC-2). `allowWrite` is a
 // boolean the MODEL sets, so it cannot stand in for the user's confirmation of
@@ -20,17 +20,38 @@ const GMAIL_API_BLOCKED = /(?:\.send$|forwarding|filters\.create|filters\.update
 // the dedicated tool asks the user, so the raw API method must not be a way
 // around it. Anchored on a `.` or the start so a Discovery id with the API
 // prefix (`chat.spaces.messages.create`) matches too.
+// Fleet audit 2026-09-24 SEC-6 added the methods that notify someone, grant
+// access or run code under the account's authority (moving an event with
+// sendUpdates, roster adds, returning work, posting coursework, comments,
+// send-as aliases, the vacation responder, member-seeded spaces, script runs).
 const DISPATCH_API_BLOCKED: Record<string, Array<{ method: RegExp; does: string; tool: string }>> = {
-  chat: [{ method: /(?:^|\.)spaces\.messages\.create$/i, does: 'posts a Chat message', tool: 'gog_chat_messages_send / gog_chat_dm_send' }],
-  drive: [{ method: /(?:^|\.)permissions\.(?:create|update)$/i, does: 'grants access to a file', tool: 'gog_drive_share' }],
+  chat: [
+    { method: /(?:^|\.)spaces\.messages\.create$/i, does: 'posts a Chat message', tool: 'gog_chat_messages_send / gog_chat_dm_send' },
+    { method: /(?:^|\.)spaces\.(?:setup|members\.create)$/i, does: 'adds people to a space', tool: 'gog_chat_spaces_create' },
+  ],
+  drive: [
+    { method: /(?:^|\.)permissions\.(?:create|update)$/i, does: 'grants access to a file', tool: 'gog_drive_share' },
+    { method: /(?:^|\.)comments\.create$/i, does: 'notifies the file\'s owner and anyone it mentions', tool: 'gog_drive_comments_add / gog_docs_comments_add' },
+    { method: /(?:^|\.)replies\.create$/i, does: 'notifies the comment thread', tool: 'gog_drive_comments_reply / gog_docs_comments_reply' },
+  ],
   classroom: [
     { method: /(?:^|\.)courses\.announcements\.create$/i, does: 'posts to a class', tool: 'gog_classroom_announcements_create' },
     { method: /(?:^|\.)invitations\.create$/i, does: 'invites someone to a class', tool: 'gog_classroom_invitations_create' },
+    { method: /(?:^|\.)courses\.students\.create$/i, does: 'adds someone to a class', tool: 'gog_classroom_students_add' },
+    { method: /(?:^|\.)courses\.teachers\.create$/i, does: 'gives someone teacher access to a class', tool: 'gog_classroom_teachers_add' },
+    { method: /(?:^|\.)courses\.coursework\.create$/i, does: 'posts coursework to a class', tool: 'gog_classroom_coursework_create' },
+    { method: /(?:^|\.)studentsubmissions\.return$/i, does: 'returns work to a student', tool: 'gog_classroom_submissions_return' },
   ],
   calendar: [
     { method: /(?:^|\.)events\.(?:insert|import|quickadd)$/i, does: 'can put an event on guests\' calendars', tool: 'gog_calendar_create' },
     { method: /(?:^|\.)events\.(?:update|patch)$/i, does: 'can change what guests see', tool: 'gog_calendar_update / gog_calendar_respond' },
+    { method: /(?:^|\.)events\.move$/i, does: 'can email every guest', tool: 'gog_calendar_move' },
   ],
+  gmail: [
+    { method: /(?:^|\.)settings\.sendas\.create$/i, does: 'makes Google email the address and adds a sending identity', tool: 'gog_gmail_sendas_create' },
+    { method: /(?:^|\.)settings\.updatevacation$/i, does: 'can turn on an auto-reply to every sender', tool: 'gog_gmail_vacation_update' },
+  ],
+  script: [{ method: /(?:^|\.)scripts\.run$/i, does: 'executes code with this account\'s authority', tool: 'gog_appscript_run_function' }],
 };
 
 export function refusedApiCall(api: string, method: string): string | undefined {
@@ -44,10 +65,25 @@ export function refusedApiCall(api: string, method: string): string | undefined
   return hit ? gatedElsewhere(`${name} ${m}`, 'gog_api_call', hit.does, hit.tool) : undefined;
 }
 
+/**
+ * A params/body string as the confirmation prompt shows it: parsed, when it is
+ * JSON, so the user reads a structure rather than an escaped string; otherwise
+ * (an `@file` reference, a typo) the string itself. Bounded like every other
+ * body on the rail — the token binds the FULL string regardless.
+ */
+export function previewJson(text: string): unknown {
+  if (text.length > BODY_PREVIEW_MAX) return bodyPreview(text);
+  try {
+    return JSON.parse(text);
+  } catch {
+    return text;
+  }
+}
+
 // Generic Google Discovery API access (gog 0.31). gog_api_list / gog_api_describe
 // are read-only Discovery lookups; gog_api_call is a Discovery-backed escape
 // hatch for any method gog has no dedicated subcommand for — guarded by an
-// explicit write opt-in and a dry-run preview.
+// explicit write opt-in, a dry-run preview, and the dispatch rail.
 export function registerApiTools(server: McpServer): void {
   server.registerTool('gog_api_list', {
     description: 'List the Google Discovery APIs available for gog_api_call / gog_api_describe (name + version + title).',
@@ -78,7 +114,7 @@ export function registerApiTools(server: McpServer): void {
   });
 
   server.registerTool('gog_api_call', {
-    description: 'Call any Discovery-described Google API method directly — an escape hatch for endpoints gog has no dedicated tool for. Find the exact api/version/method/params with gog_api_describe first. Read methods (GET/LIST) run as-is. Mutating methods (POST/PUT/PATCH/DELETE) are refused unless you set allowWrite=true — keep it false to preview, or set dryRun=true to print the intended request without sending it. Gmail send and forwarding methods (users.messages.send, users.drafts.send, forwarding/auto-forwarding, filters, delegates) are refused — use the dedicated gog_gmail_* tools, which ask the user to confirm. So are the other methods a dedicated tool asks about: Chat spaces.messages.create, Drive permissions.create/update, Classroom courses.announcements.create and invitations.create, and Calendar events.insert/import/quickAdd/update/patch.',
+    description: 'Call any Discovery-described Google API method directly — an escape hatch for endpoints gog has no dedicated tool for. Find the exact api/version/method/params with gog_api_describe first. Read methods (GET/LIST) run as-is. Mutating methods (POST/PUT/PATCH/DELETE) are refused unless you set allowWrite=true, and every write then asks the MCP host to show the user a confirmation prompt with the exact api/version/method/params/body before anything is sent; set dryRun=true to print the intended request without sending it (no prompt, no changes). Gmail send and forwarding methods (users.messages.send, users.drafts.send, forwarding/auto-forwarding, filters, delegates) are refused outright — use the dedicated gog_gmail_* tools, which ask the user to confirm. So are the other methods a dedicated tool asks about with a better preview: Chat spaces.messages.create, Drive permissions.create/update, Classroom courses.announcements.create and invitations.create, and Calendar events.insert/import/quickAdd/update/patch.' + CONFIRM_FALLBACK_DESCRIPTION,
     annotations: { destructiveHint: true },
     inputSchema: z.object({
       api: z.string().describe('Discovery API name (e.g. drive, gmail, calendar)'),
@@ -87,11 +123,12 @@ export function registerApiTools(server: McpServer): void {
       params: z.string().optional().describe('Query/path parameters as a JSON object string (e.g. {"fileId":"abc","fields":"name"})'),
       body: z.string().optional().describe('Request body as a JSON string (for write methods)'),
       scope: z.string().optional().describe('Override the OAuth scope used for the call'),
-      allowWrite: z.boolean().optional().describe('Required to invoke a mutating method (POST/PUT/PATCH/DELETE). Without it, gog refuses write methods. Leave unset for read-only calls.'),
-      dryRun: z.boolean().optional().describe('Print the intended request and exit without sending it (no changes made)'),
+      allowWrite: z.boolean().optional().describe('Required to invoke a mutating method (POST/PUT/PATCH/DELETE); the user is asked to confirm the exact request first. Without it, gog refuses write methods. Leave unset for read-only calls.'),
+      dryRun: z.boolean().optional().describe('Print the intended request and exit without sending it (no changes made, no confirmation prompt)'),
       account: accountParam,
+      confirmToken: confirmTokenParam,
     }),
-  }, async ({ api, version, method, params, body, scope, allowWrite, dryRun, account }) => {
+  }, async ({ api, version, method, params, body, scope, allowWrite, dryRun, account, confirmToken }, ctx) => {
     try {
       assertSafeForwardedArgs([api, version, method]);
       const refusal = refusedApiCall(api, method);
@@ -103,6 +140,35 @@ export function registerApiTools(server: McpServer): void {
     } catch (err) {
       return errorResult(errorText(err));
     }
+    // SEC-2 (fleet-audit #931): allowWrite is a boolean the MODEL sets, and
+    // the --force below skips gog's own confirmation, so a method blocklist
+    // could never be complete (events.move/delete with sendUpdates=all,
+    // acl.insert, settings.sendAs.create, updateVacation, batchDelete, ...).
+    // Every write that will actually be sent asks the user first, about the
+    // exact api/method/params/body, through the same rail as the dedicated
+    // tools. A dry run sends nothing and is not gated; a write without
+    // allowWrite is refused by gog itself.
+    if (allowWrite && !dryRun) {
+      const request = { api, version, method, params, body, scope };
+      const view: Record<string, unknown> = { api, version, method };
+      if (params !== undefined) view.params = previewJson(params);
+      if (body !== undefined) view.body = previewJson(body);
+      if (scope !== undefined) view.scope = scope;
+      const confirmation = await requireDispatchConfirmation(ctx, {
+        action: 'api.call',
+        message: `Review and confirm this raw Google API write (${api} ${version} ${method}):`,
+        confirmationLabel: 'Confirm that this API method should be invoked with exactly these parameters.',
+        details: view,
+        unsupportedNote: 'Set dryRun=true to see the request gog would send without sending it, or use the dedicated gog_* tool for this operation.',
+        fallback: {
+          tool: 'gog_api_call',
+          account,
+          confirmToken,
+          subject: () => ({ target: `${api}/${version}/${method}`, payload: request, preview: view }),
+        },
+      });
+      if (confirmation) return confirmation;
+    }
     const args: GogArg[] = ['api', 'call', pos(api), pos(version), pos(method)];
     if (params) args.push(`--params=${params}`);
     if (body) args.push(`--body=${body}`);

package/src/tools/appscript.ts

@@ -10,6 +10,41 @@ import {
 import { pos } from '../argv.js';
 import { confinePath } from '../file-roots.js';
 import type { GogArg } from '../runner.js';
+import {
+  CONFIRM_FALLBACK_DESCRIPTION,
+  confirmTokenParam,
+  gatedElsewhere,
+  requireDispatchConfirmation,
+  resultText,
+  senderPreview,
+} from '../dispatch-confirmation.js';
+
+/** gog_appscript_run must not execute code that gog_appscript_run_function would ask about. */
+export function vetAppScriptRun(subcommand: string, _args: readonly string[]): string | undefined {
+  return subcommand.toLowerCase() === 'run'
+    ? gatedElsewhere('gog appscript run', 'gog_appscript_run', 'executes code with this account\'s authority', 'gog_appscript_run_function')
+    : undefined;
+}
+
+/**
+ * The project a run executes, for its confirmation prompt: a title the user
+ * recognises beside the opaque id. `updateTime` is kept apart as the token's
+ * revision, so code saved between the two phases is DRAFT_CHANGED. Unreadable
+ * output names nothing rather than throwing.
+ */
+export function projectSnapshot(raw: string, scriptId: string): { scriptId: string; title?: string; updateTime?: string } {
+  let project: { title?: unknown; updateTime?: unknown } | undefined;
+  try {
+    project = (JSON.parse(raw) as { project?: typeof project } | null)?.project;
+  } catch {
+    project = undefined;
+  }
+  return {
+    scriptId,
+    ...(typeof project?.title === 'string' ? { title: project.title } : {}),
+    ...(typeof project?.updateTime === 'string' ? { updateTime: project.updateTime } : {}),
+  };
+}
 
 // Google Apps Script (gog >= 0.38.0 for pull/deployments/versions).
 //
@@ -140,7 +175,9 @@ export function registerAppScriptTools(server: McpServer): void {
       + 'Requires the project to be deployed as an API executable and to share the OAuth client with the calling '
       + 'credentials, otherwise Google refuses regardless of scopes. devMode runs the latest saved code instead of the '
       + 'deployed version, and only works if the account owns the script. '
-      + 'This is NOT the escape hatch — gog_appscript_run is that.' + apiEnableNote,
+      + 'This is NOT the escape hatch — gog_appscript_run is that. Because the wrapper cannot tell what the code will '
+      + 'do, it reads the project and asks the MCP host to show the user a confirmation prompt with the project, the '
+      + 'function and its arguments first; nothing runs unless they accept.' + CONFIRM_FALLBACK_DESCRIPTION + apiEnableNote,
     annotations: { destructiveHint: true },
     inputSchema: z.object({
       scriptId: scriptIdParam,
@@ -148,12 +185,14 @@ export function registerAppScriptTools(server: McpServer): void {
       params: z.string().optional().describe('Function parameters as a JSON ARRAY of positional arguments, e.g. \'["a", 1]\' — not an object'),
       devMode: z.boolean().optional().describe('Run the latest saved code rather than the deployed version (owner only)'),
       account: accountParam,
+      confirmToken: confirmTokenParam,
     }),
-  }, async ({ scriptId, functionName, params, devMode, account }) => {
+  }, async ({ scriptId, functionName, params, devMode, account, confirmToken }, ctx) => {
     // gog passes --params through to the API as-is, so a malformed value comes
     // back as a Google error about the request body rather than about the
     // argument the caller actually got wrong. Checking the shape here is what
     // turns "invalid argument" into "params must be a JSON array".
+    let parsedParams: unknown[] | undefined;
     if (params !== undefined) {
       let parsed: unknown;
       try {
@@ -164,7 +203,28 @@ export function registerAppScriptTools(server: McpServer): void {
       if (!Array.isArray(parsed)) {
         throw new Error(`params must be a JSON ARRAY of positional arguments, e.g. '["a", 1]' — Apps Script takes positional arguments, not named ones. Received: ${params}`);
       }
+      parsedParams = parsed;
     }
+    // Read on every call: the prompt names the project, and on the token
+    // fallback's phase 2 this is the re-read the token is checked against.
+    const got = await runOrDiagnose(['appscript', 'get', pos(scriptId)], { account });
+    if (got.isError) return got;
+    const { updateTime, ...project } = projectSnapshot(resultText(got), scriptId);
+    const execution = { project, functionName, params: parsedParams, devMode: Boolean(devMode), runsAs: senderPreview(account) };
+    const confirmation = await requireDispatchConfirmation(ctx, {
+      action: 'appscript.run-function',
+      message: 'Review and confirm running this Apps Script function with the account\'s full authority:',
+      confirmationLabel: 'Confirm that this code should run now.',
+      details: execution,
+      unsupportedNote: 'Ask the user to run it themselves from the Apps Script editor.',
+      fallback: {
+        tool: 'gog_appscript_run_function',
+        account,
+        confirmToken,
+        subject: () => ({ target: `${scriptId}/${functionName}`, revision: updateTime, payload: execution, preview: execution }),
+      },
+    });
+    if (confirmation) return confirmation;
     const args: GogArg[] = ['appscript', 'run', pos(scriptId), pos(functionName)];
     if (params !== undefined) args.push(`--params=${params}`);
     if (devMode) args.push('--dev-mode');
@@ -174,6 +234,7 @@ export function registerAppScriptTools(server: McpServer): void {
   registerRunTool(server, {
     service: 'appscript',
     examples: '"get", "content", "deployments"',
+    vet: vetAppScriptRun,
     note: 'To execute a function, use gog_appscript_run_function — this tool is the generic escape hatch.',
   });
 }

package/src/tools/calendar.ts

@@ -5,22 +5,60 @@ import { accountParam, runOrDiagnose, registerRunTool, pageTokenParam, pageAlias
 import { annotateTruncatedList } from '../pagination.js';
 import { pos } from '../argv.js';
 import type { GogArg } from '../runner.js';
-import { CONFIRM_FALLBACK_DESCRIPTION, confirmTokenParam, gatedElsewhere, requireDispatchConfirmation, resultText } from '../dispatch-confirmation.js';
+import { CONFIRM_FALLBACK_DESCRIPTION, confirmTokenParam, flagValue, gatedElsewhere, refusedInRun, requireDispatchConfirmation, resultText } from '../dispatch-confirmation.js';
 
-// gog's spellings (internal/cmd/calendar.go). The run tool cannot tell whether
-// an event has guests, so it refuses these outright; the dedicated tools ask
-// only when someone else would see the change.
-const CALENDAR_GATED: Record<string, string> = {
-  create: 'gog_calendar_create', add: 'gog_calendar_create', new: 'gog_calendar_create',
-  update: 'gog_calendar_update', edit: 'gog_calendar_update', set: 'gog_calendar_update',
-  respond: 'gog_calendar_respond', rsvp: 'gog_calendar_respond', reply: 'gog_calendar_respond',
+// gog's spellings (internal/cmd/calendar.go; aliases per `gog schema` 0.41.0).
+// The run tool cannot tell whether an event has guests, so it refuses these
+// outright; the dedicated tools ask only when someone else would see the
+// change. Move, delete, delete-calendar and out-of-office joined in the fleet
+// audit of 2026-09-24 (SEC-4 #933, SEC-6): --send-updates on a move emails
+// every guest, out-of-office auto-declines conflicting invitations by default,
+// and delete's --scope defaults to the whole recurring series.
+const ASKS = (tool: string) => `Use ${tool}, which asks the user to confirm.`;
+const CALENDAR_REFUSED: Record<string, { does: string; instead: string }> = {
+  create: { does: 'can change what guests see', instead: ASKS('gog_calendar_create') },
+  add: { does: 'can change what guests see', instead: ASKS('gog_calendar_create') },
+  new: { does: 'can change what guests see', instead: ASKS('gog_calendar_create') },
+  update: { does: 'can change what guests see', instead: ASKS('gog_calendar_update') },
+  edit: { does: 'can change what guests see', instead: ASKS('gog_calendar_update') },
+  set: { does: 'can change what guests see', instead: ASKS('gog_calendar_update') },
+  respond: { does: 'can change what guests see', instead: ASKS('gog_calendar_respond') },
+  rsvp: { does: 'can change what guests see', instead: ASKS('gog_calendar_respond') },
+  reply: { does: 'can change what guests see', instead: ASKS('gog_calendar_respond') },
+  move: { does: "moves an event off guests' calendars (and can email them)", instead: ASKS('gog_calendar_move') },
+  transfer: { does: "moves an event off guests' calendars (and can email them)", instead: ASKS('gog_calendar_move') },
+  delete: { does: "removes an event from every guest's calendar (the whole series by default)", instead: ASKS('gog_calendar_delete') },
+  del: { does: "removes an event from every guest's calendar (the whole series by default)", instead: ASKS('gog_calendar_delete') },
+  rm: { does: "removes an event from every guest's calendar (the whole series by default)", instead: ASKS('gog_calendar_delete') },
+  remove: { does: "removes an event from every guest's calendar (the whole series by default)", instead: ASKS('gog_calendar_delete') },
+  'delete-calendar': { does: 'deletes a calendar and every event on it', instead: ASKS('gog_calendar_delete_calendar') },
+  'out-of-office': { does: 'auto-declines invitations and notifies their organizers', instead: ASKS('gog_calendar_out_of_office') },
+  ooo: { does: 'auto-declines invitations and notifies their organizers', instead: ASKS('gog_calendar_out_of_office') },
 };
 
 /** gog_calendar_run must not make the changes gog_calendar_create/update/respond would ask about. */
-export function vetCalendarRun(subcommand: string, _args: readonly string[]): string | undefined {
+export function vetCalendarRun(subcommand: string, args: readonly string[]): string | undefined {
   const sub = subcommand.toLowerCase();
-  const tool = Object.hasOwn(CALENDAR_GATED, sub) ? CALENDAR_GATED[sub] : undefined;
-  return tool ? gatedElsewhere(`gog calendar ${sub}`, 'gog_calendar_run', 'can change what guests see', tool) : undefined;
+  const what = `gog calendar ${sub}`;
+  const via = 'gog_calendar_run';
+  if (Object.hasOwn(CALENDAR_REFUSED, sub)) {
+    const { does, instead } = CALENDAR_REFUSED[sub]!;
+    return refusedInRun(what, via, does, instead);
+  }
+  // `propose-time` alone generates a URL. With --decline (or --comment, which
+  // implies it) it declines the event and notifies the organizer — exactly
+  // what gog_calendar_respond asks about (SEC-4, fleet-audit #933).
+  if (sub === 'propose-time' && (flagValue(args, 'decline') !== undefined || flagValue(args, 'comment') !== undefined)) {
+    return gatedElsewhere(`${what} --decline`, via, 'declines the event and notifies the organizer', 'gog_calendar_respond');
+  }
+  // A Focus Time block auto-declines every conflicting invitation by default
+  // (gog's --auto-decline defaults to all) and there is no dedicated tool for
+  // it; one that declines nobody is a private block and passes.
+  if ((sub === 'focus-time' || sub === 'focus') && flagValue(args, 'auto-decline')?.toLowerCase() !== 'none') {
+    return refusedInRun(what, via, 'auto-declines invitations and notifies their organizers (gog defaults --auto-decline to all)',
+      'Pass --auto-decline=none, or ask the user to create it from Google Calendar.');
+  }
+  return undefined;
 }
 
 // Reminder params, shared by create and update (gog >= 0.38.0 for
@@ -70,11 +108,13 @@ export function eventSnapshot(raw: string): {
   end?: string;
   organizer?: string;
   guests: string[];
+  recurring?: true;
   etag?: string;
 } {
   let event: {
     summary?: unknown; start?: EventTime; end?: EventTime; etag?: unknown;
     organizer?: { email?: unknown }; attendees?: EventAttendee[];
+    recurrence?: unknown; recurringEventId?: unknown;
   } | undefined;
   try {
     event = (JSON.parse(raw) as { event?: typeof event } | null)?.event;
@@ -91,6 +131,10 @@ export function eventSnapshot(raw: string): {
     guests: (Array.isArray(event?.attendees) ? event.attendees : [])
       .filter((a) => a.self !== true && a.resource !== true && typeof a.email === 'string')
       .map((a) => a.email as string),
+    // A series, or one instance of one: gog's delete --scope defaults to all.
+    ...((Array.isArray(event?.recurrence) && event.recurrence.length > 0) || typeof event?.recurringEventId === 'string'
+      ? { recurring: true as const }
+      : {}),
     etag: str(event?.etag),
   };
 }
@@ -357,14 +401,40 @@ export function registerCalendarTools(server: McpServer): void {
   });
 
   server.registerTool('gog_calendar_delete', {
-    description: 'Delete a calendar event.',
+    description: 'Delete a calendar event. It disappears from every guest\'s calendar too, and for a recurring event gog '
+      + 'deletes the WHOLE series, so when the event has guests or recurs this reads it and asks the MCP host to show '
+      + 'the user a confirmation prompt with the event as it stands; a guest-free, one-off event is deleted without asking.'
+      + CONFIRM_FALLBACK_DESCRIPTION,
     annotations: { destructiveHint: true },
     inputSchema: z.object({
       calendarId: z.string().describe('Calendar ID'),
       eventId: z.string().describe('Event ID'),
       account: accountParam,
+      confirmToken: confirmTokenParam,
     }),
-  }, async ({ calendarId, eventId, account }) => {
+  }, async ({ calendarId, eventId, account, confirmToken }, ctx) => {
+    const read = await readEvent(calendarId, eventId, account);
+    if (read.error) return read.error;
+    const { etag, ...event } = read.event;
+    if (event.guests.length > 0 || event.recurring) {
+      const view = { calendarId, eventId, event, scope: event.recurring ? 'the whole recurring series' : 'this event' };
+      const confirmation = await requireDispatchConfirmation(ctx, {
+        action: 'calendar.delete',
+        message: event.recurring
+          ? 'Review and confirm deleting this ENTIRE recurring series:'
+          : 'Review and confirm deleting this event from every guest\'s calendar:',
+        confirmationLabel: 'Confirm that this event should be deleted now.',
+        details: view,
+        unsupportedNote: 'Ask the user to delete it from Google Calendar.',
+        fallback: {
+          tool: 'gog_calendar_delete',
+          account,
+          confirmToken,
+          subject: () => ({ target: `${calendarId}/${eventId}`, revision: etag, payload: view, preview: view }),
+        },
+      });
+      if (confirmation) return confirmation;
+    }
     // gog gates this delete behind a confirmation; the runner injects
     // --no-input, so without --force it refuses at runtime.
     return runOrDiagnose(['calendar', 'delete', pos(calendarId), pos(eventId), '--force'], { account });