fix: support Gmail OAuth refresh on Node 24

.changeset/fresh-mails-refresh.md

@@ -0,0 +1,7 @@
+---
+"@razroo/gmail-mcp": patch
+---
+
+Restore complete file-based OAuth credentials, prefer user-provided OAuth client files over the embedded default, and update the Google auth/API transport for Node.js 24. This fixes Gmail authorization and automatic token refresh while preserving owner-only credential permissions.
+
+Users who already have `gcp-oauth.keys.json` but originally authorized with the embedded client should run `npx @razroo/gmail-mcp auth` once so the stored refresh token matches their custom OAuth client.

.github/workflows/on-pr-feature-branch.yml

@@ -51,3 +51,24 @@ jobs:
         run: npm install -g pnpm
       - name: Run validation script
         run: .github/scripts/validate-build.sh
+
+  test-node:
+    name: Test on Node.js ${{ matrix.node-version }}
+    runs-on: ubuntu-latest
+    strategy:
+      fail-fast: false
+      matrix:
+        node-version: ['22', '24.17.0', '24']
+    steps:
+      - name: Checkout code
+        uses: actions/checkout@v4
+      - name: Set up Node.js
+        uses: actions/setup-node@v4
+        with:
+          node-version: ${{ matrix.node-version }}
+      - name: Install pnpm
+        run: npm install -g pnpm
+      - name: Install dependencies
+        run: pnpm install --frozen-lockfile
+      - name: Run tests
+        run: pnpm test:ci

.github/workflows/on-push-main.yml

@@ -52,6 +52,9 @@ jobs:
     runs-on: ubuntu-latest
     needs: [check-version, check-changesets]
     if: needs.check-changesets.outputs.hasChangesets == 'true' && needs.check-version.outputs.version_changed == 'false'
+    permissions:
+      contents: write
+      pull-requests: write
     steps:
       - name: Checkout code
         uses: actions/checkout@v4
@@ -77,31 +80,6 @@ jobs:
         env:
           PATH_TO_FILE: 'src/index.ts'
 
-  gh-release:
-    name: GH Release
-    runs-on: ubuntu-latest
-    needs: check-version
-    if: needs.check-version.outputs.version_changed == 'true'
-    env:
-      GITHUB_TOKEN: ${{ secrets.GITHUB_TOKEN }}
-    steps:
-      - name: Checkout Repo
-        uses: actions/checkout@v4
-      - name: Get release version
-        id: get-version
-        run: |
-          echo "result=$(jq -r '.version' package.json)" >> $GITHUB_OUTPUT
-      - name: Get release body
-        run: |
-          # Get the PR body to use in the GH release body
-          # Use empty body if no merged PR found (e.g. direct push to main)
-          gh pr list --search "$(git rev-parse HEAD)" --state merged --json number,body --jq '"This release was merged in PR #" + (.[0].number | tostring) + "\n\n" + (.[0].body | split("# Releases")[1:] | join("# Releases"))' > pr_body.tmp 2>/dev/null || echo "Direct push to main" > pr_body.tmp
-      - name: Create release
-        uses: softprops/action-gh-release@c95fe1489396fe8a9eb87c0abf8aa5b2ef267fda # v2.2.1
-        with:
-          tag_name: v${{ steps.get-version.outputs.result }}
-          name: Release v${{ steps.get-version.outputs.result }}
-          body_path: pr_body.tmp
-
-  # npm publishing is handled by .github/workflows/publish.yml
-  # which triggers on GitHub releases created by the gh-release job above
+  # Releases are created explicitly with `gh release create`. The release event
+  # then triggers publish.yml, whose npm provenance job cannot be triggered by a
+  # release created with this workflow's GITHUB_TOKEN.

package.json

@@ -10,13 +10,21 @@
     "build": "tsc -p tsconfig.json",
     "start": "node ./dist/index.js",
     "auth": "node ./dist/index.js auth",
-    "test": "jest"
+    "test": "jest",
+    "test:unit": "jest test/oauth2.test.ts test/auth-error.test.ts --runInBand",
+    "test:oauth": "node --test test/oauth2.node.test.mjs",
+    "test:ci": "pnpm build && pnpm test:unit && pnpm test:oauth"
+  },
+  "jest": {
+    "moduleNameMapper": {
+      "^(\\.{1,2}/.*)\\.js$": "$1"
+    }
   },
   "dependencies": {
     "@modelcontextprotocol/sdk": "1.16.0",
     "@smithery/sdk": "1.4.3",
-    "google-auth-library": "9.15.1",
-    "googleapis": "129.0.0",
+    "google-auth-library": "10.5.0",
+    "googleapis": "173.0.0",
     "open": "9.1.0",
     "ts-node": "10.9.2",
     "zod": "3.22.4"