autoResizeColumns currently mutates existing column widths with no read-before-write guard at all. The tool has no readHandle parameter, never calls guardMutation, and goes straight from resolving the sheet ID to spreadsheets.batchUpdate(autoResizeDimensions).
Failure mode
A client can call autoResizeColumns over the modern HTTP/stdio runtime without first observing the current column sizing. The call can overwrite deliberate manual widths across the requested columns, or every column when columns is omitted, even though the repository's mutation contract requires current state to be observed before an overwrite.
This exists independently of PR #172. PR #172 adds explicit resource handles for selected Sheets/Drive mutations but does not modify autoResizeColumns; tracing the neighboring Sheets mutation surfaces during that review exposed this pre-existing gap.
Evidence
Current implementation at the reviewed PR head:
https://github.com/karthikcsq/google-tools-mcp/blob/9fd5e8a831a8e2de681e23aedc93fd8efefa6c93/dist/tools/sheets/autoResizeColumns.js
Review context:
#172
Acceptance criteria
Before autoResizeDimensions can run on a modern transport, require authority derived from a caller-visible read of the column state the operation can replace. That likely means extending a bounded structure/format read to include the relevant column sizing and validating an explicit handle for the effective target columns. If no safe baseline exists yet, fail closed on modern transports rather than mutating unseen state. Preserve the direct/no-context tracker fallback only where that legacy contract is intentionally supported.
Found by an automated Adversarial Review on behalf of Elliot.
autoResizeColumnscurrently mutates existing column widths with no read-before-write guard at all. The tool has noreadHandleparameter, never callsguardMutation, and goes straight from resolving the sheet ID tospreadsheets.batchUpdate(autoResizeDimensions).Failure mode
A client can call
autoResizeColumnsover the modern HTTP/stdio runtime without first observing the current column sizing. The call can overwrite deliberate manual widths across the requested columns, or every column whencolumnsis omitted, even though the repository's mutation contract requires current state to be observed before an overwrite.This exists independently of PR #172. PR #172 adds explicit resource handles for selected Sheets/Drive mutations but does not modify
autoResizeColumns; tracing the neighboring Sheets mutation surfaces during that review exposed this pre-existing gap.Evidence
Current implementation at the reviewed PR head:
https://github.com/karthikcsq/google-tools-mcp/blob/9fd5e8a831a8e2de681e23aedc93fd8efefa6c93/dist/tools/sheets/autoResizeColumns.js
Review context:
#172
Acceptance criteria
Before
autoResizeDimensionscan run on a modern transport, require authority derived from a caller-visible read of the column state the operation can replace. That likely means extending a bounded structure/format read to include the relevant column sizing and validating an explicit handle for the effective target columns. If no safe baseline exists yet, fail closed on modern transports rather than mutating unseen state. Preserve the direct/no-context tracker fallback only where that legacy contract is intentionally supported.Found by an automated Adversarial Review on behalf of Elliot.