fix: meet scope mapping and reply QP soft-wrap corruption

.changeset/auth-tui-no-cloud-platform-inject.md

@@ -0,0 +1,7 @@
+---
+"@googleworkspace/cli": patch
+---
+
+fix(auth): stop auto-injecting cloud-platform scope after TUI scope picker selection. This scope is restricted by Google and blocked by some Workspace admin policies, which caused `admin_policy_enforced` login failures for users who picked narrower, permitted scopes (upstream #562). Users who need cloud-platform (e.g. for the modelarmor helper) can tick it in the picker or pass `--full` / `--scopes https://www.googleapis.com/auth/cloud-platform`.
+
+Behavior change: existing users who relied on the silent cloud-platform injection to run the modelarmor helper must re-authenticate with one of the explicit paths above on their next `gws auth login`.

.changeset/clippy-script-collapsible-match.md

@@ -0,0 +1,5 @@
+---
+"@googleworkspace/cli": patch
+---
+
+chore(clippy): collapse nested `if` inside the `"json"` arm of the Apps Script file classifier into a match guard. No behavior change — only satisfies `clippy::collapsible_match` which is now enforced in CI.

.changeset/gmail-profile-userinfo-endpoint.md

@@ -0,0 +1,5 @@
+---
+"@googleworkspace/cli": patch
+---
+
+fix(gmail): switch display-name lookup in `gmail +send` from People API to the OIDC userinfo endpoint (`https://openidconnect.googleapis.com/v1/userinfo`). The People API path returned 403 on some personal Gmail accounts even when `userinfo.profile` was granted, which made the "grant the profile scope" tip fire for users who already had the scope, and sent messages with a null From display name (upstream #644). The userinfo endpoint accepts the same `userinfo.profile` scope and behaves uniformly across Workspace and personal accounts. The 401/403 fallback message was also reworded so it no longer misdiagnoses transient permission denials as a missing scope.

.changeset/mcp-helper-tools.md

@@ -0,0 +1,5 @@
+---
+"@googleworkspace/cli": minor
+---
+
+Add MCP helper tools: gmail_send convenience wrapper that reuses CLI helper logic for RFC 2822 formatting and base64 encoding

.github/workflows/auto-tag.yml

@@ -0,0 +1,45 @@
+name: Auto Tag
+
+on:
+  push:
+    branches:
+      - main
+    paths:
+      - 'crates/**/*.rs'
+      - 'crates/**/Cargo.toml'
+      - 'Cargo.lock'
+  workflow_dispatch:
+
+permissions:
+  contents: write
+
+jobs:
+  tag:
+    name: Create fork tag
+    runs-on: ubuntu-latest
+    steps:
+      - uses: actions/checkout@34e114876b0b11c390a56381ad16ebd13914f8d5 # v4
+        with:
+          fetch-depth: 0
+          token: ${{ secrets.GH_PAT }}
+
+      - name: Compute and push next tag
+        run: |
+          VERSION=$(grep '^version' crates/google-workspace-cli/Cargo.toml \
+            | head -1 | grep -oP '[\d]+\.[\d]+\.[\d]+')
+
+          LAST=$(git tag -l "fork/v${VERSION}-mcp.*" | sort -V | tail -1)
+          if [ -z "$LAST" ]; then
+            N=1
+          else
+            N=$(echo "$LAST" | grep -oP '\d+$')
+            N=$((N + 1))
+          fi
+
+          NEW_TAG="fork/v${VERSION}-mcp.${N}"
+          echo "Creating tag: $NEW_TAG"
+
+          git config user.name "github-actions[bot]"
+          git config user.email "github-actions[bot]@users.noreply.github.com"
+          git tag "$NEW_TAG"
+          git push origin "$NEW_TAG"

.github/workflows/ci.yml

@@ -276,7 +276,7 @@ jobs:
 
   build:
     name: Build
-    needs: [smoketest, changes]
+    needs: [build-linux, changes]
     if: |
       always() && !cancelled() && !failure()
       && (needs.changes.outputs.rust == 'true' || github.event_name == 'push')
@@ -339,91 +339,3 @@ jobs:
         env:
           CARGO_TARGET_AARCH64_UNKNOWN_LINUX_GNU_LINKER: aarch64-linux-gnu-gcc
 
-  smoketest:
-    name: API Smoketest
-    needs: build-linux
-    if: github.event.pull_request.head.repo.full_name == github.repository || github.event_name != 'pull_request'
-    runs-on: ubuntu-latest
-    steps:
-      - uses: actions/checkout@34e114876b0b11c390a56381ad16ebd13914f8d5 # v4
-
-      - name: Download binary
-        uses: actions/download-artifact@d3f86a106a0bac45b974a628896c90dbdf5c8093 # v4
-        with:
-          name: gws-linux-x86_64
-          path: ./bin
-
-      - name: Make binary executable
-        run: chmod +x ./bin/gws
-
-      - name: Decode credentials
-        env:
-          GOOGLE_CREDENTIALS_JSON: ${{ secrets.GOOGLE_CREDENTIALS_JSON }}
-        run: |
-          if [ -z "$GOOGLE_CREDENTIALS_JSON" ]; then
-            echo "::error::GOOGLE_CREDENTIALS_JSON secret is not set"
-            exit 1
-          fi
-          echo "$GOOGLE_CREDENTIALS_JSON" | base64 -d > /tmp/credentials.json
-
-      - name: Smoketest — help
-        run: ./bin/gws --help
-
-      - name: Smoketest — schema introspection
-        run: ./bin/gws schema drive.files.list | jq -e '.httpMethod'
-
-      - name: Smoketest — Drive files list
-        env:
-          GOOGLE_WORKSPACE_CLI_CREDENTIALS_FILE: /tmp/credentials.json
-        run: |
-          ./bin/gws drive files list \
-            --params '{"pageSize": 1, "fields": "files(id,mimeType)"}' \
-            | jq -e '.files'
-
-      - name: Smoketest — Gmail messages
-        env:
-          GOOGLE_WORKSPACE_CLI_CREDENTIALS_FILE: /tmp/credentials.json
-        run: |
-          ./bin/gws gmail users messages list \
-            --params '{"userId": "me", "maxResults": 1, "fields": "messages(id)"}' \
-            | jq -e '.messages'
-
-      - name: Smoketest — Calendar events
-        env:
-          GOOGLE_WORKSPACE_CLI_CREDENTIALS_FILE: /tmp/credentials.json
-        run: |
-          ./bin/gws calendar events list \
-            --params '{"calendarId": "primary", "maxResults": 1, "fields": "kind,items(id,status)"}' \
-            | jq -e '.kind'
-
-      - name: Smoketest — Slides presentation
-        env:
-          GOOGLE_WORKSPACE_CLI_CREDENTIALS_FILE: /tmp/credentials.json
-        run: |
-          ./bin/gws slides presentations get \
-            --params '{"presentationId": "1knOKD_87JWE4qsEbO4r5O91IxTER5ybBBhOJgZ1yLFI", "fields": "presentationId,slides(objectId)"}' \
-            | jq -e '.presentationId'
-
-      - name: Smoketest — pagination
-        env:
-          GOOGLE_WORKSPACE_CLI_CREDENTIALS_FILE: /tmp/credentials.json
-        run: |
-          LINES=$(./bin/gws drive files list \
-            --params '{"pageSize": 1, "fields": "nextPageToken,files(id)"}' \
-            --page-all --page-limit 2 \
-            | wc -l)
-          if [ "$LINES" -lt 2 ]; then
-            echo "::error::Expected at least 2 NDJSON lines from pagination, got $LINES"
-            exit 1
-          fi
-
-      - name: Smoketest — error handling
-        run: |
-          if ./bin/gws fakeservice list 2>&1; then
-            echo "::error::Expected exit code 1 for unknown service"
-            exit 1
-          fi
-
-      - name: Cleanup credentials
-        if: always()
-        run: rm -f /tmp/credentials.json