gumfield manual
Referencegum v1.4.0 release notesGoogle APIs for agents and terminals

gum v1.4.0

Google Ads calls can omit customerId and loginCustomerId when a profile or environment sets a default account.

Highlights

  • Set a default Google Ads account once per profile with gum config set.
  • Override it per shell with GUM_GOOGLE_ADS_CUSTOMER_ID and

    • GUM_GOOGLE_ADS_LOGIN_CUSTOMER_ID.

  • The gum call wizard skips account ids that a default supplies.
  • A new Keyword Planner section explains why calls without

    • geoTargetConstants and language return worldwide figures.

  • gRPC v1.83.2 fixes an HTTP/2 memory exhaustion advisory on a call path in

    • gum.

Install

bash
brew install ehmo/tap/gum
# If already installed:
brew update
brew upgrade ehmo/tap/gum
gum --version

The standalone installer remains available:

bash
curl -fsSL https://raw.githubusercontent.com/ehmo/gum/main/install.sh | GUM_VERSION=v1.4.0 bash

Upgrade notes

None. Calls that pass customerId behave as before. To stop passing it, set a default in the profile that makes the calls:

bash
gum config set googleads.customer_id=<customer-id>
gum config set googleads.login_customer_id=<manager-customer-id>

Set loginCustomerId only when you reach the account through a manager account. To send one call without the manager default, pass "loginCustomerId":"". See the Google Ads guide.

Added

  • Default account values for every Google Ads operation that declares

    • customerId or loginCustomerId. A call argument wins over the environment, and the environment wins over the profile config.

  • Defaults accept 10 digits with optional dashes or spaces. A malformed value

    • fails the call with INVALID_ARGS and names the variable or config key that holds it.

  • The MCP server reads the profile config on every call, so a new default

    • applies without a restart.

  • Keyword Planner guidance with United States and English examples

    • (geoTargetConstants:["2840"], language:"1000").

Changed

  • A call that omits customerId with no default now fails with a hint that

    • names gum config set googleads.customer_id and GUM_GOOGLE_ADS_CUSTOMER_ID.

  • The resolved account is part of the canonical arguments. Two accounts never

    • share a cache entry, audit args hash, or confirmation binding.

Fixed

  • Specification rule 7 said request-field defaults were not injected. gum has

    • injected them since v1.0.2. The rule now describes the shipped behavior.

Security

  • google.golang.org/grpc moves from v1.83.0 to v1.83.2. It fixes

    • GO-2026-6348, an HTTP/2 memory exhaustion issue that govulncheck found on a call path in gum, and GO-2026-6441 and GO-2026-6443, which gum does not call.

  • golang.org/x/crypto moves from v0.54.0 to v0.56.0. It fixes GO-2026-6303,

    • GO-2026-6354, and GO-2026-6355, which gum does not call.

  • govulncheck now reports 0 vulnerabilities that gum's code calls. One

    • advisory remains in the module graph: GO-2026-5932 marks golang.org/x/crypto/openpgp unmaintained. gum imports no symbol from that package, and the advisory has no fixed version.

Known limitations

  • Defaults cover Google Ads customerId and loginCustomerId only. Data

    • Manager calls still need operatingAccount, and loginAccount when access goes through a manager, in each request body.

  • Keyword Planner does not mark a worldwide result. Check that the call passed

    • geoTargetConstants and language before comparing figures across countries.

  • macOS binaries are not notarized. The Homebrew formula clears quarantine

    • during installation. For standalone installs, inspect with spctl --assess --type execute --verbose gum and use xattr -d com.apple.quarantine gum if Gatekeeper rejects the binary.

Token savings

Measured with the release fixtures using a local build stamped 1.4.0. Run from the apps/gum directory of the matching source checkout:

bash
gum gain --fixture-replay --format=toon
gum gain --fixture-replay --format=json
Default format Total calls Total tokens in Total tokens saved Aggregate savings
toon 10 3,922 0 0 %
json 10 3,922 -12 0.31 % overhead

Verification

All seven jobs in the v1.4.0 release workflow passed, including tests, vulnerability checks, the independent four-platform rebuild, and provenance checks. Downloaded archive checksums and extracted binary hashes matched the published manifests. A local macOS ARM rebuild with the command below matched the published binary hash.

The Homebrew installation reports 1.4.0 and reproduces the token savings figures above. It completed a live Keyword Planner historical metrics call that set the account only through GUM_GOOGLE_ADS_CUSTOMER_ID and GUM_GOOGLE_ADS_LOGIN_CUSTOMER_ID, with no customerId argument. Homebrew's formula audit and package tests passed.

Reproducibility

bash
git checkout v1.4.0
cd apps/gum
GOTOOLCHAIN=go1.26.7 CGO_ENABLED=0 go build -trimpath -ldflags='-s -w -X main.version=1.4.0' ./cmd/gum
sha256sum gum