v2.8.0

Stops a stalled OAuth token refresh from hanging every call on the server. The proactive refresh that runs five minutes before an access token expires awaited Google's token endpoint with no timeout, and because concurrent refreshes of the same account are deduplicated, one stalled request silently froze every tool call behind it. Refreshes now run under the shared retry helper with a per-attempt deadline that actually aborts the underlying token POST, and a refresh that stalls through both attempts fails the call with an explicit error instead of waiting. Minor rather than patch because the bound is configurable: the new --token-refresh-timeout / GOOGLE_DRIVE_MCP_TOKEN_REFRESH_TIMEOUT sets the per-attempt limit (default 15000, 0 disables). No tools or tool parameters were added, removed, or renamed.

Fixed

• auth: an OAuth token refresh that stalls no longer hangs every call on the server. The proactive refresh that runs five minutes before an access token expires awaited Google's token endpoint with no timeout, and because concurrent refreshes of the same account are deduplicated, every tool call waited on the same never-settling request — four-minute hangs that started on an ordinary unrelated call, raised no error, and cleared on restart only because the restart moved the token clock away from the boundary. Refreshes now run under the shared retry helper with a per-attempt deadline and at most one retry, and the deadline actually aborts the underlying token POST (through a gaxios request interceptor scoped to the token endpoint) rather than merely abandoning the wait — without that, the library's own refresh deduplication would pin every retry, and the next API call's implicit refresh, to the stalled request. A refresh that stalls through both attempts fails the current call with an explicit error naming the account and the limit; requests the library issues on its own get the same bound; invalid_grant still surfaces on the first attempt with the existing reconnect message; other transient refresh failures behave as before. Team members' per-user refreshes and an external-token refresh get the same treatment. New --token-refresh-timeout=<ms> / GOOGLE_DRIVE_MCP_TOKEN_REFRESH_TIMEOUT (default 15000, 0 disables) sets the per-attempt limit; --retry-base-delay governs the backoff and --retry-max=0 disables the retry (#169, #194)

Upgrading

npm i -g @piotr-agier/google-drive-mcp@2.8.0, or restart an npx client to pick it up.

• If calls have been hanging for minutes with no error and clearing on restart, this release is the fix. The symptom started on an ordinary, unrelated call — whichever one happened to land in the five-minute window before an access token expired.
• Token refresh is now bounded by default. Each attempt gets 15 seconds, with at most one retry; previously it waited indefinitely. A refresh that exhausts both attempts now fails the current call with an explicit error naming the account and the limit, where 2.7.1 would have waited. Tune it with --token-refresh-timeout=<ms> or GOOGLE_DRIVE_MCP_TOKEN_REFRESH_TIMEOUT, and set 0 to restore unbounded behavior.
• The retry knobs apply here too. --retry-base-delay governs the backoff between the two attempts, and --retry-max=0 disables the retry.
• No configuration is required. invalid_grant still surfaces on the first attempt with the existing reconnect message, and other transient refresh failures behave as before.

Full Changelog: v2.7.1...v2.8.0