gogcli-mcp-drive 4.2.4 → 4.3.0

package/tests/tools/drive-extra.test.ts

@@ -3,6 +3,7 @@ import { registerExtraDriveTools } from '../../src/tools/drive-extra.js';
 import * as lib from '../../../gogcli-mcp/src/lib.js';
 import { createTestHarness, type TestHarness } from '@chrischall/mcp-utils/test';
 import { rawTextResult } from '@chrischall/mcp-utils';
+import { pos } from '../../../gogcli-mcp/src/argv.js';
 
 vi.mock('../../../gogcli-mcp/src/lib.js', async (importOriginal) => {
   const actual = await importOriginal<typeof lib>();
@@ -23,13 +24,13 @@ beforeEach(async () => {
 describe('gog_drive_download', () => {
   it('calls runOrDiagnose with fileId only', async () => {
     await harness.callTool('gog_drive_download', { fileId: 'f1' });
-    expect(lib.runOrDiagnose).toHaveBeenCalledWith(['drive', 'download', 'f1'], { account: undefined });
+    expect(lib.runOrDiagnose).toHaveBeenCalledWith(['drive', 'download', pos('f1')], { account: undefined });
   });
 
   it('passes --out and --format when provided', async () => {
     await harness.callTool('gog_drive_download', { fileId: 'f1', out: '/tmp/file.pdf', format: 'pdf', account: 'a@b.com' });
     expect(lib.runOrDiagnose).toHaveBeenCalledWith(
-      ['drive', 'download', 'f1', '--out=/tmp/file.pdf', '--format=pdf'],
+      ['drive', 'download', pos('f1'), '--out=/tmp/file.pdf', '--format=pdf'],
       { account: 'a@b.com' },
     );
   });
@@ -37,7 +38,7 @@ describe('gog_drive_download', () => {
   it('passes --overwrite when requested', async () => {
     await harness.callTool('gog_drive_download', { fileId: 'f1', out: '/tmp/file.pdf', overwrite: true });
     expect(lib.runOrDiagnose).toHaveBeenCalledWith(
-      ['drive', 'download', 'f1', '--out=/tmp/file.pdf', '--overwrite'],
+      ['drive', 'download', pos('f1'), '--out=/tmp/file.pdf', '--overwrite'],
       { account: undefined },
     );
   });
@@ -46,7 +47,7 @@ describe('gog_drive_download', () => {
 describe('gog_drive_upload', () => {
   it('calls runOrDiagnose with localPath only', async () => {
     await harness.callTool('gog_drive_upload', { localPath: '/tmp/x.txt' });
-    expect(lib.runOrDiagnose).toHaveBeenCalledWith(['drive', 'upload', '/tmp/x.txt'], { account: undefined });
+    expect(lib.runOrDiagnose).toHaveBeenCalledWith(['drive', 'upload', pos('/tmp/x.txt')], { account: undefined });
   });
 
   it('passes all upload flags', async () => {
@@ -62,7 +63,7 @@ describe('gog_drive_upload', () => {
     });
     expect(lib.runOrDiagnose).toHaveBeenCalledWith(
       [
-        'drive', 'upload', '/tmp/x.txt',
+        'drive', 'upload', pos('/tmp/x.txt'),
         '--name=renamed.txt',
         '--parent=folder1',
         '--replace=file2',
@@ -77,7 +78,7 @@ describe('gog_drive_upload', () => {
 
   it('omits boolean flags when false', async () => {
     await harness.callTool('gog_drive_upload', { localPath: '/tmp/x.txt', keepRevisionForever: false, convert: false });
-    expect(lib.runOrDiagnose).toHaveBeenCalledWith(['drive', 'upload', '/tmp/x.txt'], { account: undefined });
+    expect(lib.runOrDiagnose).toHaveBeenCalledWith(['drive', 'upload', pos('/tmp/x.txt')], { account: undefined });
   });
 
   // gog 0.35.0 (openclaw/gogcli 1b26124) adds --if-version: an atomic
@@ -86,7 +87,7 @@ describe('gog_drive_upload', () => {
   it('passes --if-version alongside --replace for conditional replacement', async () => {
     await harness.callTool('gog_drive_upload', { localPath: '/tmp/x.txt', replace: 'file2', ifVersion: 7 });
     expect(lib.runOrDiagnose).toHaveBeenCalledWith(
-      ['drive', 'upload', '/tmp/x.txt', '--replace=file2', '--if-version=7'],
+      ['drive', 'upload', pos('/tmp/x.txt'), '--replace=file2', '--if-version=7'],
       { account: undefined },
     );
   });
@@ -179,7 +180,7 @@ describe('gog_drive_upload', () => {
     // positional, no file arg, for every local stdio caller that has one.
     it('leaves the localPath path unchanged', async () => {
       await harness.callTool('gog_drive_upload', { localPath: '/tmp/x.txt' });
-      expect(lib.runOrDiagnose).toHaveBeenCalledWith(['drive', 'upload', '/tmp/x.txt'], { account: undefined });
+      expect(lib.runOrDiagnose).toHaveBeenCalledWith(['drive', 'upload', pos('/tmp/x.txt')], { account: undefined });
     });
   });
 
@@ -208,7 +209,7 @@ describe('gog_drive_sync_push', () => {
   it('calls runOrDiagnose with localPath and required parent', async () => {
     await harness.callTool('gog_drive_sync_push', { localPath: '/tmp/dir', parent: 'folder1' });
     expect(lib.runOrDiagnose).toHaveBeenCalledWith(
-      ['drive', 'sync', 'push', '/tmp/dir', '--parent=folder1'],
+      ['drive', 'sync', 'push', pos('/tmp/dir'), '--parent=folder1'],
       { account: undefined },
     );
   });
@@ -218,7 +219,7 @@ describe('gog_drive_sync_push', () => {
       localPath: '/tmp/dir', parent: 'folder1', dryRun: true, allDrives: false,
     });
     expect(lib.runOrDiagnose).toHaveBeenCalledWith(
-      ['drive', 'sync', 'push', '/tmp/dir', '--parent=folder1', '--dry-run', '--no-all-drives'],
+      ['drive', 'sync', 'push', pos('/tmp/dir'), '--parent=folder1', '--dry-run', '--no-all-drives'],
       { account: undefined },
     );
   });
@@ -228,7 +229,7 @@ describe('gog_drive_sync_push', () => {
       localPath: '/tmp/dir', parent: 'folder1', dryRun: false, allDrives: true,
     });
     expect(lib.runOrDiagnose).toHaveBeenCalledWith(
-      ['drive', 'sync', 'push', '/tmp/dir', '--parent=folder1'],
+      ['drive', 'sync', 'push', pos('/tmp/dir'), '--parent=folder1'],
       { account: undefined },
     );
   });
@@ -237,13 +238,13 @@ describe('gog_drive_sync_push', () => {
 describe('gog_drive_copy', () => {
   it('calls runOrDiagnose with fileId and name', async () => {
     await harness.callTool('gog_drive_copy', { fileId: 'f1', name: 'Copy' });
-    expect(lib.runOrDiagnose).toHaveBeenCalledWith(['drive', 'copy', 'f1', 'Copy'], { account: undefined });
+    expect(lib.runOrDiagnose).toHaveBeenCalledWith(['drive', 'copy', pos('f1'), pos('Copy')], { account: undefined });
   });
 
   it('passes --parent when provided', async () => {
     await harness.callTool('gog_drive_copy', { fileId: 'f1', name: 'Copy', parent: 'folder1' });
     expect(lib.runOrDiagnose).toHaveBeenCalledWith(
-      ['drive', 'copy', 'f1', 'Copy', '--parent=folder1'],
+      ['drive', 'copy', pos('f1'), pos('Copy'), '--parent=folder1'],
       { account: undefined },
     );
   });
@@ -252,25 +253,25 @@ describe('gog_drive_copy', () => {
 describe('gog_drive_url', () => {
   it('calls runOrDiagnose with single fileId', async () => {
     await harness.callTool('gog_drive_url', { fileIds: ['f1'] });
-    expect(lib.runOrDiagnose).toHaveBeenCalledWith(['drive', 'url', 'f1'], { account: undefined });
+    expect(lib.runOrDiagnose).toHaveBeenCalledWith(['drive', 'url', pos('f1')], { account: undefined });
   });
 
   it('calls runOrDiagnose with multiple fileIds', async () => {
     await harness.callTool('gog_drive_url', { fileIds: ['f1', 'f2', 'f3'] });
-    expect(lib.runOrDiagnose).toHaveBeenCalledWith(['drive', 'url', 'f1', 'f2', 'f3'], { account: undefined });
+    expect(lib.runOrDiagnose).toHaveBeenCalledWith(['drive', 'url', pos('f1'), pos('f2'), pos('f3')], { account: undefined });
   });
 });
 
 describe('gog_drive_permissions', () => {
   it('calls runOrDiagnose with fileId', async () => {
     await harness.callTool('gog_drive_permissions', { fileId: 'f1' });
-    expect(lib.runOrDiagnose).toHaveBeenCalledWith(['drive', 'permissions', 'f1'], { account: undefined });
+    expect(lib.runOrDiagnose).toHaveBeenCalledWith(['drive', 'permissions', pos('f1')], { account: undefined });
   });
 
   it('passes --max and --page when provided', async () => {
     await harness.callTool('gog_drive_permissions', { fileId: 'f1', max: 50, page: 'tok' });
     expect(lib.runOrDiagnose).toHaveBeenCalledWith(
-      ['drive', 'permissions', 'f1', '--max=50', '--page=tok'],
+      ['drive', 'permissions', pos('f1'), '--max=50', '--page=tok'],
       { account: undefined },
     );
   });
@@ -280,7 +281,7 @@ describe('gog_drive_unshare', () => {
   it('calls runOrDiagnose with fileId and permissionId', async () => {
     await harness.callTool('gog_drive_unshare', { fileId: 'f1', permissionId: 'p1' });
     expect(lib.runOrDiagnose).toHaveBeenCalledWith(
-      ['drive', 'unshare', 'f1', 'p1', '--force'],
+      ['drive', 'unshare', pos('f1'), pos('p1'), '--force'],
       { account: undefined },
     );
   });
@@ -310,7 +311,7 @@ describe('gog_drive_comments_list', () => {
   it('calls runOrDiagnose with fileId', async () => {
     await harness.callTool('gog_drive_comments_list', { fileId: 'f1' });
     expect(lib.runOrDiagnose).toHaveBeenCalledWith(
-      ['drive', 'comments', 'list', 'f1'],
+      ['drive', 'comments', 'list', pos('f1')],
       { account: undefined },
     );
   });
@@ -321,7 +322,7 @@ describe('gog_drive_comments_list', () => {
       fileId: 'f1', since: '2026-06-01T00:00:00Z', includeQuoted: true, max: 5, page: 'tok', all: true,
     });
     expect(lib.runOrDiagnose).toHaveBeenCalledWith(
-      ['drive', 'comments', 'list', 'f1', '--since=2026-06-01T00:00:00Z', '--include-quoted', '--max=5', '--page=tok', '--all'],
+      ['drive', 'comments', 'list', pos('f1'), '--since=2026-06-01T00:00:00Z', '--include-quoted', '--max=5', '--page=tok', '--all'],
       { account: undefined },
     );
   });
@@ -331,7 +332,7 @@ describe('gog_drive_comments_get', () => {
   it('calls runOrDiagnose with fileId and commentId', async () => {
     await harness.callTool('gog_drive_comments_get', { fileId: 'f1', commentId: 'c1' });
     expect(lib.runOrDiagnose).toHaveBeenCalledWith(
-      ['drive', 'comments', 'get', 'f1', 'c1'],
+      ['drive', 'comments', 'get', pos('f1'), pos('c1')],
       { account: undefined },
     );
   });
@@ -341,7 +342,7 @@ describe('gog_drive_comments_add', () => {
   it('calls runOrDiagnose with fileId and content', async () => {
     await harness.callTool('gog_drive_comments_add', { fileId: 'f1', content: 'LGTM' });
     expect(lib.runOrDiagnose).toHaveBeenCalledWith(
-      ['drive', 'comments', 'create', 'f1', 'LGTM'],
+      ['drive', 'comments', 'create', pos('f1'), pos('LGTM')],
       { account: undefined },
     );
   });
@@ -351,7 +352,7 @@ describe('gog_drive_comments_update', () => {
   it('calls runOrDiagnose with fileId, commentId, and content', async () => {
     await harness.callTool('gog_drive_comments_update', { fileId: 'f1', commentId: 'c1', content: 'edited' });
     expect(lib.runOrDiagnose).toHaveBeenCalledWith(
-      ['drive', 'comments', 'update', 'f1', 'c1', 'edited'],
+      ['drive', 'comments', 'update', pos('f1'), pos('c1'), pos('edited')],
       { account: undefined },
     );
   });
@@ -361,7 +362,7 @@ describe('gog_drive_comments_delete', () => {
   it('calls runOrDiagnose with fileId and commentId', async () => {
     await harness.callTool('gog_drive_comments_delete', { fileId: 'f1', commentId: 'c1' });
     expect(lib.runOrDiagnose).toHaveBeenCalledWith(
-      ['drive', 'comments', 'delete', 'f1', 'c1', '--force'],
+      ['drive', 'comments', 'delete', pos('f1'), pos('c1'), '--force'],
       { account: undefined },
     );
   });
@@ -371,7 +372,7 @@ describe('gog_drive_comments_reply', () => {
   it('calls runOrDiagnose with fileId, commentId, and content', async () => {
     await harness.callTool('gog_drive_comments_reply', { fileId: 'f1', commentId: 'c1', content: 'thanks' });
     expect(lib.runOrDiagnose).toHaveBeenCalledWith(
-      ['drive', 'comments', 'reply', 'f1', 'c1', 'thanks'],
+      ['drive', 'comments', 'reply', pos('f1'), pos('c1'), pos('thanks')],
       { account: undefined },
     );
   });
@@ -382,7 +383,7 @@ describe('gog_drive_comments_reply', () => {
       fileId: 'f1', commentId: 'c1', content: 'lgtm, resolving', action: 'resolve',
     });
     expect(lib.runOrDiagnose).toHaveBeenCalledWith(
-      ['drive', 'comments', 'reply', 'f1', 'c1', 'lgtm, resolving', '--action=resolve'],
+      ['drive', 'comments', 'reply', pos('f1'), pos('c1'), pos('lgtm, resolving'), '--action=resolve'],
       { account: undefined },
     );
   });
@@ -392,7 +393,7 @@ describe('gog_drive_comments_reply', () => {
       fileId: 'f1', commentId: 'c1', content: 'actually wait', action: 'reopen',
     });
     expect(lib.runOrDiagnose).toHaveBeenCalledWith(
-      ['drive', 'comments', 'reply', 'f1', 'c1', 'actually wait', '--action=reopen'],
+      ['drive', 'comments', 'reply', pos('f1'), pos('c1'), pos('actually wait'), '--action=reopen'],
       { account: undefined },
     );
   });
@@ -404,7 +405,7 @@ describe('gog_drive_comments_resolve', () => {
   it('calls runOrDiagnose with fileId and commentId', async () => {
     await harness.callTool('gog_drive_comments_resolve', { fileId: 'f1', commentId: 'c1' });
     expect(lib.runOrDiagnose).toHaveBeenCalledWith(
-      ['drive', 'comments', 'resolve', 'f1', 'c1'],
+      ['drive', 'comments', 'resolve', pos('f1'), pos('c1')],
       { account: undefined },
     );
   });
@@ -412,7 +413,7 @@ describe('gog_drive_comments_resolve', () => {
   it('forwards account', async () => {
     await harness.callTool('gog_drive_comments_resolve', { fileId: 'f1', commentId: 'c1', account: 'a@b.com' });
     expect(lib.runOrDiagnose).toHaveBeenCalledWith(
-      ['drive', 'comments', 'resolve', 'f1', 'c1'],
+      ['drive', 'comments', 'resolve', pos('f1'), pos('c1')],
       { account: 'a@b.com' },
     );
   });
@@ -422,7 +423,7 @@ describe('gog_drive_comments_reopen', () => {
   it('calls runOrDiagnose with fileId and commentId', async () => {
     await harness.callTool('gog_drive_comments_reopen', { fileId: 'f1', commentId: 'c1' });
     expect(lib.runOrDiagnose).toHaveBeenCalledWith(
-      ['drive', 'comments', 'reopen', 'f1', 'c1'],
+      ['drive', 'comments', 'reopen', pos('f1'), pos('c1')],
       { account: undefined },
     );
   });
@@ -559,7 +560,7 @@ describe('gog_drive_labels_list', () => {
 describe('gog_drive_labels_get', () => {
   it('calls runOrDiagnose with name only', async () => {
     await harness.callTool('gog_drive_labels_get', { name: 'labels/abc' });
-    expect(lib.runOrDiagnose).toHaveBeenCalledWith(['drive', 'labels', 'get', 'labels/abc'], { account: undefined });
+    expect(lib.runOrDiagnose).toHaveBeenCalledWith(['drive', 'labels', 'get', pos('labels/abc')], { account: undefined });
   });
 
   it('passes all flags', async () => {
@@ -567,14 +568,14 @@ describe('gog_drive_labels_get', () => {
       name: 'labels/abc', language: 'en', view: 'LABEL_VIEW_BASIC', adminAccess: true,
     });
     expect(lib.runOrDiagnose).toHaveBeenCalledWith(
-      ['drive', 'labels', 'get', 'labels/abc', '--language=en', '--view=LABEL_VIEW_BASIC', '--admin-access'],
+      ['drive', 'labels', 'get', pos('labels/abc'), '--language=en', '--view=LABEL_VIEW_BASIC', '--admin-access'],
       { account: undefined },
     );
   });
 
   it('omits --admin-access when false', async () => {
     await harness.callTool('gog_drive_labels_get', { name: 'labels/abc', adminAccess: false });
-    expect(lib.runOrDiagnose).toHaveBeenCalledWith(['drive', 'labels', 'get', 'labels/abc'], { account: undefined });
+    expect(lib.runOrDiagnose).toHaveBeenCalledWith(['drive', 'labels', 'get', pos('labels/abc')], { account: undefined });
   });
 });
 
@@ -582,7 +583,7 @@ describe('gog_drive_labels_file_list', () => {
   it('calls runOrDiagnose with fileId only', async () => {
     await harness.callTool('gog_drive_labels_file_list', { fileId: 'f1' });
     expect(lib.runOrDiagnose).toHaveBeenCalledWith(
-      ['drive', 'labels', 'file', 'list', 'f1'],
+      ['drive', 'labels', 'file', 'list', pos('f1')],
       { account: undefined },
     );
   });
@@ -590,7 +591,7 @@ describe('gog_drive_labels_file_list', () => {
   it('passes --max and --page when provided', async () => {
     await harness.callTool('gog_drive_labels_file_list', { fileId: 'f1', max: 25, page: 'tok' });
     expect(lib.runOrDiagnose).toHaveBeenCalledWith(
-      ['drive', 'labels', 'file', 'list', 'f1', '--max=25', '--page=tok'],
+      ['drive', 'labels', 'file', 'list', pos('f1'), '--max=25', '--page=tok'],
       { account: undefined },
     );
   });
@@ -600,7 +601,7 @@ describe('gog_drive_labels_file_apply', () => {
   it('calls runOrDiagnose with fileId and labelId only', async () => {
     await harness.callTool('gog_drive_labels_file_apply', { fileId: 'f1', labelId: 'l1' });
     expect(lib.runOrDiagnose).toHaveBeenCalledWith(
-      ['drive', 'labels', 'file', 'apply', 'f1', 'l1'],
+      ['drive', 'labels', 'file', 'apply', pos('f1'), pos('l1')],
       { account: undefined },
     );
   });
@@ -619,7 +620,7 @@ describe('gog_drive_labels_file_apply', () => {
     });
     expect(lib.runOrDiagnose).toHaveBeenCalledWith(
       [
-        'drive', 'labels', 'file', 'apply', 'f1', 'l1',
+        'drive', 'labels', 'file', 'apply', pos('f1'), pos('l1'),
         '--text=t1=hello', '--text=t2=world',
         '--selection=s1=c1,c2',
         '--integer=i1=42',
@@ -637,7 +638,7 @@ describe('gog_drive_labels_file_apply', () => {
       fileId: 'f1', labelId: 'l1', text: [], selection: [], integer: [], date: [], user: [], unset: [],
     });
     expect(lib.runOrDiagnose).toHaveBeenCalledWith(
-      ['drive', 'labels', 'file', 'apply', 'f1', 'l1'],
+      ['drive', 'labels', 'file', 'apply', pos('f1'), pos('l1')],
       { account: undefined },
     );
   });
@@ -647,7 +648,7 @@ describe('gog_drive_labels_file_remove', () => {
   it('calls runOrDiagnose with fileId and labelId', async () => {
     await harness.callTool('gog_drive_labels_file_remove', { fileId: 'f1', labelId: 'l1' });
     expect(lib.runOrDiagnose).toHaveBeenCalledWith(
-      ['drive', 'labels', 'file', 'remove', 'f1', 'l1', '--force'],
+      ['drive', 'labels', 'file', 'remove', pos('f1'), pos('l1'), '--force'],
       { account: undefined },
     );
   });
@@ -732,7 +733,7 @@ describe('gog_drive_audit_user', () => {
   it('calls runOrDiagnose with user only', async () => {
     await harness.callTool('gog_drive_audit_user', { user: 'a@b.com' });
     expect(lib.runOrDiagnose).toHaveBeenCalledWith(
-      ['drive', 'audit', 'user', 'a@b.com'],
+      ['drive', 'audit', 'user', pos('a@b.com')],
       { account: undefined },
     );
   });
@@ -742,7 +743,7 @@ describe('gog_drive_audit_user', () => {
       user: 'a@b.com', file: 'f1', parent: 'fo1', depth: 3, max: 100, noAllDrives: true,
     });
     expect(lib.runOrDiagnose).toHaveBeenCalledWith(
-      ['drive', 'audit', 'user', 'a@b.com', '--file=f1', '--parent=fo1', '--depth=3', '--max=100', '--no-all-drives'],
+      ['drive', 'audit', 'user', pos('a@b.com'), '--file=f1', '--parent=fo1', '--depth=3', '--max=100', '--no-all-drives'],
       { account: undefined },
     );
   });
@@ -750,7 +751,7 @@ describe('gog_drive_audit_user', () => {
   it('handles depth/max=0 and omits noAllDrives when false', async () => {
     await harness.callTool('gog_drive_audit_user', { user: 'a@b.com', depth: 0, max: 0, noAllDrives: false });
     expect(lib.runOrDiagnose).toHaveBeenCalledWith(
-      ['drive', 'audit', 'user', 'a@b.com', '--depth=0', '--max=0'],
+      ['drive', 'audit', 'user', pos('a@b.com'), '--depth=0', '--max=0'],
       { account: undefined },
     );
   });
@@ -761,7 +762,7 @@ describe('gog_drive_revisions_list', () => {
   it('lists revisions with pagination', async () => {
     await harness.callTool('gog_drive_revisions_list', { fileId: 'f1', max: 10, page: 'tok', all: true });
     expect(lib.runOrDiagnose).toHaveBeenCalledWith(
-      ['drive', 'revisions', 'list', 'f1', '--max=10', '--page=tok', '--all'],
+      ['drive', 'revisions', 'list', pos('f1'), '--max=10', '--page=tok', '--all'],
       { account: undefined },
     );
   });
@@ -771,7 +772,7 @@ describe('gog_drive_revisions_get', () => {
   it('gets one revision', async () => {
     await harness.callTool('gog_drive_revisions_get', { fileId: 'f1', revisionId: 'r3', account: 'a@b.com' });
     expect(lib.runOrDiagnose).toHaveBeenCalledWith(
-      ['drive', 'revisions', 'get', 'f1', 'r3'],
+      ['drive', 'revisions', 'get', pos('f1'), pos('r3')],
       { account: 'a@b.com' },
     );
   });
@@ -782,7 +783,7 @@ describe('gog_drive_shortcut_create', () => {
   it('creates a shortcut to a target in a folder', async () => {
     await harness.callTool('gog_drive_shortcut_create', { targetId: 'f1', parent: 'folder9' });
     expect(lib.runOrDiagnose).toHaveBeenCalledWith(
-      ['drive', 'shortcut', 'create', 'f1', '--parent=folder9'],
+      ['drive', 'shortcut', 'create', pos('f1'), '--parent=folder9'],
       { account: undefined },
     );
   });
@@ -790,7 +791,7 @@ describe('gog_drive_shortcut_create', () => {
   it('passes an explicit shortcut name', async () => {
     await harness.callTool('gog_drive_shortcut_create', { targetId: 'f1', parent: 'folder9', name: 'My Link', account: 'a@b.com' });
     expect(lib.runOrDiagnose).toHaveBeenCalledWith(
-      ['drive', 'shortcut', 'create', 'f1', '--parent=folder9', '--name=My Link'],
+      ['drive', 'shortcut', 'create', pos('f1'), '--parent=folder9', '--name=My Link'],
       { account: 'a@b.com' },
     );
   });
@@ -810,3 +811,40 @@ describe('gog_drive_upload ifVersion description', () => {
     expect(desc).toMatch(/number/i);
   });
 });
+
+// SEC-3/SEC-4: every model-supplied server path must resolve inside an
+// operator-configured root (GOG_FILE_ROOTS). The suite runs with '/' so the
+// arg-shape tests can use any path; these narrow it.
+async function withFileRoots<T>(roots: string, fn: () => Promise<T>): Promise<T> {
+  const prev = process.env.GOG_FILE_ROOTS;
+  process.env.GOG_FILE_ROOTS = roots;
+  try {
+    return await fn();
+  } finally {
+    process.env.GOG_FILE_ROOTS = prev;
+  }
+}
+
+describe('server paths are confined to GOG_FILE_ROOTS', () => {
+  it.each([
+    ['gog_drive_download', {"fileId": "f1", "out": "/Users/me/.zshrc", "overwrite": true}, 'out'],
+    ['gog_drive_upload', {"localPath": "/Users/me/.config/gogcli/credentials.json"}, 'localPath'],
+    ['gog_drive_sync_push', {"localPath": "/Users/me/.ssh", "parent": "p"}, 'localPath'],
+  ] as Array<[string, Record<string, unknown>, string]>)('%s refuses %j outside the roots', async (tool, args, param) => {
+    const h = harness;
+    const result = await withFileRoots('/srv/gog-files', () => h.callTool(tool, args));
+    expect(result.isError).toBe(true);
+    expect(result.content[0].text).toMatch(new RegExp(`${param} ".*" is outside the directories`));
+    expect(lib.runOrDiagnose).not.toHaveBeenCalled();
+  });
+
+  // Clients auto-approve readOnlyHint tools; these write (and can overwrite)
+  // files on the gog host, so they must not claim to be read-only.
+  it.each(["gog_drive_download"])('%s is not advertised as read-only and is marked destructive', async (name) => {
+    const h = harness;
+    const { tools } = await h.client.listTools();
+    const tool = tools.find((t) => t.name === name)!;
+    expect(tool.annotations?.readOnlyHint).not.toBe(true);
+    expect(tool.annotations?.destructiveHint).toBe(true);
+  });
+});

package/vitest.config.ts

@@ -2,6 +2,11 @@ import { defineConfig } from 'vitest/config';
 
 export default defineConfig({
   test: {
+    // The arg-shape tests pass arbitrary server paths; confinement is exercised
+    // explicitly by the tests that narrow GOG_FILE_ROOTS themselves.
+    env: {
+      GOG_FILE_ROOTS: '/',
+    },
     coverage: {
       provider: 'v8',
       include: ['src/**/*.ts'],