gogcli-mcp 2.24.0 → 2.25.0

package/tests/attachments.test.ts

@@ -0,0 +1,227 @@
+import { describe, it, expect } from 'vitest';
+import {
+  inlineFileArg,
+  inlineAttachmentArgs,
+  inlineAttachmentSchema,
+  MAX_INLINE_ATTACHMENT_BYTES,
+  MAX_INLINE_ATTACHMENT_TOTAL_BYTES,
+  MAX_REQUEST_PAYLOAD_WIRE_BYTES,
+  INLINE_ATTACHMENT_LIMITS_TEXT,
+} from '../src/attachments.js';
+import type { GogFileArg } from '../src/runner.js';
+
+const b64 = (s: string): string => Buffer.from(s, 'utf8').toString('base64');
+const PNG = Buffer.from([0x89, 0x50, 0x4e, 0x47, 0x0d, 0x0a, 0x1a, 0x0a]);
+
+describe('inlineFileArg', () => {
+  it('turns bytes into a base64 GogFileArg carrying the caller filename', () => {
+    const { arg, bytes } = inlineFileArg('attach', {
+      filename: 'pendant-layouts.png',
+      contentBase64: PNG.toString('base64'),
+    });
+    expect(arg).toEqual<GogFileArg>({
+      kind: 'file',
+      flag: 'attach',
+      contents: PNG.toString('base64'),
+      encoding: 'base64',
+      filename: 'pendant-layouts.png',
+    });
+    expect(bytes).toBe(PNG.length);
+  });
+
+  it('marks a positional arg so the path is emitted bare, not as --flag=path', () => {
+    const { arg } = inlineFileArg('localPath', { filename: 'notes.md', contentBase64: b64('hi') }, { positional: true });
+    expect(arg.positional).toBe(true);
+  });
+
+  it('leaves positional unset by default, preserving the --flag=path shape', () => {
+    const { arg } = inlineFileArg('attach', { filename: 'a.txt', contentBase64: b64('hi') });
+    expect(arg.positional).toBeUndefined();
+  });
+
+  // Filenames with spaces and non-ASCII characters are the shapes the original
+  // report blamed for the inline-delivery failure. They must pass through here
+  // completely untouched — the name is what the recipient sees.
+  it.each([
+    'Screenshot 2026-06-13 152500.png',
+    'Reçu — étude, final (v2).pdf',
+    'ファイル 名前.png',
+    "quote'and\"double.txt",
+  ])('accepts %j verbatim', (filename) => {
+    const { arg } = inlineFileArg('attach', { filename, contentBase64: b64('x') });
+    expect(arg.filename).toBe(filename);
+  });
+
+  it('rejects a filename that is a path rather than a bare name', () => {
+    expect(() => inlineFileArg('attach', { filename: '../../etc/passwd', contentBase64: b64('x') }))
+      .toThrow(/must be a bare filename, not a path/);
+    expect(() => inlineFileArg('attach', { filename: 'dir\\file.txt', contentBase64: b64('x') }))
+      .toThrow(/must be a bare filename, not a path/);
+  });
+
+  it('rejects a traversal, a control character, and an over-long name', () => {
+    expect(() => inlineFileArg('attach', { filename: '..', contentBase64: b64('x') })).toThrow(/not a usable filename/);
+    expect(() => inlineFileArg('attach', { filename: 'a\u0000b.txt', contentBase64: b64('x') })).toThrow(/not a usable filename/);
+    expect(() => inlineFileArg('attach', { filename: `${'n'.repeat(201)}.txt`, contentBase64: b64('x') })).toThrow(/not a usable filename/);
+  });
+
+  it('rejects content that is not valid base64 instead of writing a corrupt file', () => {
+    // Buffer.from is lenient and would silently DROP the bad characters, mailing
+    // out a truncated file. The round-trip check is what turns that into an error.
+    expect(() => inlineFileArg('attach', { filename: 'a.png', contentBase64: 'not!valid!base64!' }))
+      .toThrow(/not valid base64/);
+  });
+
+  it('names the offending file and the limit when one file is too large', () => {
+    const tooBig = Buffer.alloc(MAX_INLINE_ATTACHMENT_BYTES + 1).toString('base64');
+    expect(() => inlineFileArg('attach', { filename: 'huge.bin', contentBase64: tooBig }))
+      .toThrow(/huge\.bin[\s\S]*exceeds the \d+-byte \(8 MiB\) per-file limit/);
+  });
+
+  it('accepts a file exactly at the ceiling', () => {
+    const exact = Buffer.alloc(MAX_INLINE_ATTACHMENT_BYTES).toString('base64');
+    expect(() => inlineFileArg('attach', { filename: 'exact.bin', contentBase64: exact })).not.toThrow();
+  });
+
+  it('uses a caller-supplied label in the error, for tools whose param is not attachInline', () => {
+    expect(() => inlineFileArg('localPath', { filename: 'a.png', contentBase64: '!!!' }, { where: 'content' }))
+      .toThrow(/^content: contents are not valid base64/);
+  });
+});
+
+describe('inlineAttachmentArgs', () => {
+  it('returns nothing for undefined or an empty list, so nothing is appended', () => {
+    expect(inlineAttachmentArgs('attach', undefined)).toEqual([]);
+    expect(inlineAttachmentArgs('attach', [])).toEqual([]);
+  });
+
+  it('produces one repeatable arg per attachment, in order', () => {
+    const args = inlineAttachmentArgs('attach', [
+      { filename: 'a.png', contentBase64: b64('aaa') },
+      { filename: 'b.pdf', contentBase64: b64('bbb') },
+    ]);
+    expect(args).toHaveLength(2);
+    expect(args.map((a) => (a as GogFileArg).filename)).toEqual(['a.png', 'b.pdf']);
+    expect(args.every((a) => (a as GogFileArg).flag === 'attach')).toBe(true);
+  });
+
+  it('allows two attachments with the SAME name (each gets its own temp dir)', () => {
+    const args = inlineAttachmentArgs('attach', [
+      { filename: 'chart.png', contentBase64: b64('first') },
+      { filename: 'chart.png', contentBase64: b64('second') },
+    ]);
+    expect(args).toHaveLength(2);
+    expect((args[0] as GogFileArg).contents).not.toBe((args[1] as GogFileArg).contents);
+  });
+
+  it('enforces a per-message total on top of the per-file ceiling', () => {
+    // Each file is individually legal; together they are not.
+    const chunk = Buffer.alloc(MAX_INLINE_ATTACHMENT_BYTES).toString('base64');
+    const four = Array.from({ length: 4 }, (_, i) => ({ filename: `f${i}.bin`, contentBase64: chunk }));
+    expect(() => inlineAttachmentArgs('attach', four))
+      .toThrow(/This message is too large to send/);
+  });
+
+  // The budget belongs to the REQUEST, not to the attachments. `payloadArg`
+  // turns any body over 4 KiB into a GogFileArg that rides in the same JSON
+  // body at ~1:1, so a near-max attachment set plus a multi-MiB body overruns
+  // the runner even though each input is inside its own documented limit. That
+  // is the same invisible-transport-rejection failure the ceiling exists to
+  // prevent, so the sibling args are measured rather than assumed small.
+  it('counts the message body against the same budget as the attachments', () => {
+    // Three files just under the 8 MiB per-file cap, summing to just under the
+    // per-message total — i.e. every input inside its own documented limit.
+    const each = Buffer.alloc(Math.floor((MAX_INLINE_ATTACHMENT_TOTAL_BYTES - 4096) / 3)).toString('base64');
+    const attachments = Array.from({ length: 3 }, (_, i) => ({ filename: `big${i}.bin`, contentBase64: each }));
+
+    // Alone: fits.
+    expect(() => inlineAttachmentArgs('attach', attachments)).not.toThrow();
+
+    // With a 2 MiB HTML body — itself well under the 8 MiB per-file cap — it
+    // does not, and the error says the body is implicated.
+    const body: GogFileArg = { kind: 'file', flag: 'body-html-file', contents: 'x'.repeat(2 * 1024 * 1024) };
+    expect(() => inlineAttachmentArgs('attach', attachments, ['gmail', 'send', body]))
+      .toThrow(/would fit on their own; the rest of the message \(its body, mostly\) spends \d+ bytes/);
+  });
+
+  it('blames the files, not the body, when the attachments alone overrun', () => {
+    const chunk = Buffer.alloc(MAX_INLINE_ATTACHMENT_BYTES).toString('base64');
+    const four = Array.from({ length: 4 }, (_, i) => ({ filename: `f${i}.bin`, contentBase64: chunk }));
+    expect(() => inlineAttachmentArgs('attach', four, ['gmail', 'send'])).toThrow(/too large to send/);
+    expect(() => inlineAttachmentArgs('attach', four, ['gmail', 'send'])).not.toThrow(/would fit on their own/);
+  });
+
+  it('measures a base64 sibling at its wire length, not its decoded length', () => {
+    // A sibling that is itself binary costs its base64 spelling, which is what
+    // actually travels — counting decoded bytes would under-report by 25%.
+    const sibling: GogFileArg = {
+      kind: 'file',
+      flag: 'attach',
+      contents: Buffer.alloc(MAX_INLINE_ATTACHMENT_BYTES).toString('base64'),
+      encoding: 'base64',
+      filename: 'already-counted.bin',
+    };
+    const each = Buffer.alloc(Math.floor((MAX_INLINE_ATTACHMENT_TOTAL_BYTES - 4096) / 3)).toString('base64');
+    const attachments = Array.from({ length: 3 }, (_, i) => ({ filename: `f${i}.bin`, contentBase64: each }));
+    expect(() => inlineAttachmentArgs('attach', attachments, ['gmail', 'send', sibling]))
+      .toThrow(/too large to send/);
+  });
+
+  it('ignores small sibling args, which the JSON reserve already covers', () => {
+    const chunk = Buffer.alloc(Math.floor(MAX_INLINE_ATTACHMENT_TOTAL_BYTES / 4)).toString('base64');
+    const two = Array.from({ length: 2 }, (_, i) => ({ filename: `f${i}.bin`, contentBase64: chunk }));
+    const flags = ['gmail', 'send', '--to=a@b.com', '--subject=Hi', '--body=short'];
+    expect(() => inlineAttachmentArgs('attach', two, flags)).not.toThrow();
+  });
+
+  // THE INVARIANT behind the per-message ceiling, asserted rather than trusted.
+  //
+  // connector-runtime sends every payload base64-encoded inside ONE JSON body,
+  // and the Fly runner caps that body at MAX_BODY_BYTES. Base64 inflates by 4/3,
+  // so a ceiling expressed in decoded bytes has to be derived from the wire cap
+  // or it documents a size that gets rejected as "request body too large" — a
+  // transport rejection from a layer the caller cannot see, which is the exact
+  // failure the tool-layer check exists to prevent. A 25 MiB total encoded to
+  // 34,952,536 chars against a 33,554,432 cap, so the limit was unreachable.
+  it('keeps a full message under the Fly runner request-body cap once base64-inflated', () => {
+    const RUNNER_MAX_BODY_BYTES = 32 * 1024 * 1024; // fly-gog-runner/server.mjs
+    const encodedLength = (decoded: number): number => 4 * Math.ceil(decoded / 3);
+
+    // The payload budget must leave the JSON structure room inside the cap…
+    expect(MAX_REQUEST_PAYLOAD_WIRE_BYTES).toBeLessThan(RUNNER_MAX_BODY_BYTES);
+    expect(RUNNER_MAX_BODY_BYTES - MAX_REQUEST_PAYLOAD_WIRE_BYTES).toBeGreaterThanOrEqual(128 * 1024);
+    // …and a full attachment set must fit inside that budget once inflated.
+    expect(encodedLength(MAX_INLINE_ATTACHMENT_TOTAL_BYTES)).toBeLessThanOrEqual(MAX_REQUEST_PAYLOAD_WIRE_BYTES);
+    // The advertised number must itself be sendable — floor, not round.
+    const advertised = Number(/(\d+) MiB in total/.exec(INLINE_ATTACHMENT_LIMITS_TEXT)![1]) * 1024 * 1024;
+    expect(advertised).toBeLessThanOrEqual(MAX_INLINE_ATTACHMENT_TOTAL_BYTES);
+  });
+
+  it('reports the ceilings it actually enforces', () => {
+    expect(MAX_INLINE_ATTACHMENT_BYTES).toBe(8 * 1024 * 1024);
+    expect(MAX_REQUEST_PAYLOAD_WIRE_BYTES).toBe(32 * 1024 * 1024 - 256 * 1024);
+    expect(MAX_INLINE_ATTACHMENT_TOTAL_BYTES).toBe(24_969_216); // wire budget × 3/4
+    // The documented text is derived from the constants, so it cannot drift.
+    expect(INLINE_ATTACHMENT_LIMITS_TEXT).toBe('up to 8 MiB per file and 23 MiB in total');
+  });
+
+  it('accepts a message at the advertised total', () => {
+    // 23 MiB across three files — the number the tool description publishes.
+    const chunk = Buffer.alloc(Math.floor((23 * 1024 * 1024) / 3)).toString('base64');
+    const three = Array.from({ length: 3 }, (_, i) => ({ filename: `f${i}.bin`, contentBase64: chunk }));
+    expect(() => inlineAttachmentArgs('attach', three)).not.toThrow();
+  });
+});
+
+describe('inlineAttachmentSchema', () => {
+  it('requires both filename and contentBase64', () => {
+    expect(inlineAttachmentSchema.safeParse({ filename: 'a.png' }).success).toBe(false);
+    expect(inlineAttachmentSchema.safeParse({ contentBase64: b64('x') }).success).toBe(false);
+    expect(inlineAttachmentSchema.safeParse({ filename: 'a.png', contentBase64: b64('x') }).success).toBe(true);
+  });
+
+  it('rejects empty strings, which would produce a nameless or empty attachment', () => {
+    expect(inlineAttachmentSchema.safeParse({ filename: '', contentBase64: b64('x') }).success).toBe(false);
+    expect(inlineAttachmentSchema.safeParse({ filename: 'a.png', contentBase64: '' }).success).toBe(false);
+  });
+});

package/tests/runner-file-args-failure.test.ts

@@ -8,11 +8,13 @@ import type { Spawner } from '../src/runner.js';
 // its own file because the mock would defeat the byte-level round-trip
 // assertions in runner-file-args.test.ts.
 const mkdtemp = vi.fn(async () => '/tmp/gogcli-mcp-fake');
+const mkdir = vi.fn(async () => undefined);
 const writeFile = vi.fn(async () => {});
 const rm = vi.fn(async () => {});
 
 vi.mock('node:fs/promises', () => ({
   mkdtemp: (...args: unknown[]) => mkdtemp(...(args as [])),
+  mkdir: (...args: unknown[]) => mkdir(...(args as [])),
   writeFile: (...args: unknown[]) => writeFile(...(args as [])),
   rm: (...args: unknown[]) => rm(...(args as [])),
 }));
@@ -36,9 +38,11 @@ const fileArg = { kind: 'file', flag: 'body-file', contents: 'payload' } as cons
 describe('temp-file materialization failures', () => {
   beforeEach(() => {
     mkdtemp.mockClear();
+    mkdir.mockClear();
     writeFile.mockClear();
     rm.mockClear();
     rm.mockImplementation(async () => {});
+    mkdir.mockImplementation(async () => undefined);
     writeFile.mockImplementation(async () => {});
   });
 
@@ -83,12 +87,53 @@ describe('temp-file materialization failures', () => {
     await expect(run(['gmail', 'send', fileArg], { spawner })).rejects.toThrow('gog: invalid draft');
   });
 
-  it('writes the payload with mode 0600 and utf8 encoding', async () => {
+  it('writes the payload as owner-only utf8 bytes', async () => {
     await run(['gmail', 'send', fileArg], { spawner: okSpawner() });
     expect(writeFile).toHaveBeenCalledWith(
       expect.stringContaining('body-file.txt'),
-      'payload',
-      { encoding: 'utf8', mode: 0o600 },
+      Buffer.from('payload', 'utf8'),
+      { mode: 0o600 },
     );
+    // Each payload lands in its own numbered subdirectory of the temp dir, so a
+    // caller-chosen basename can never clobber another payload's.
+    expect(mkdir).toHaveBeenCalledWith('/tmp/gogcli-mcp-fake/0', { recursive: true, mode: 0o700 });
+  });
+
+  it('decodes a base64 payload to real bytes and honours a caller filename', async () => {
+    const png = Buffer.from([0x89, 0x50, 0x4e, 0x47, 0x0d, 0x0a, 0x1a, 0x0a]);
+    await run([
+      'gmail', 'send',
+      { kind: 'file', flag: 'attach', contents: png.toString('base64'), encoding: 'base64', filename: 'Screenshot 2026-06-13 152500.png' },
+    ], { spawner: okSpawner() });
+    expect(writeFile).toHaveBeenCalledWith(
+      '/tmp/gogcli-mcp-fake/0/Screenshot 2026-06-13 152500.png',
+      png,
+      { mode: 0o600 },
+    );
+  });
+
+  it('gives each file arg its own subdirectory so identical basenames survive', async () => {
+    const spawner = okSpawner();
+    await run([
+      'gmail', 'send',
+      { kind: 'file', flag: 'attach', contents: 'YQ==', encoding: 'base64', filename: 'chart.png' },
+      { kind: 'file', flag: 'attach', contents: 'Yg==', encoding: 'base64', filename: 'chart.png' },
+    ], { spawner });
+    const written = writeFile.mock.calls.map((c) => c[0]);
+    expect(written).toEqual(['/tmp/gogcli-mcp-fake/0/chart.png', '/tmp/gogcli-mcp-fake/1/chart.png']);
+    // Both survive as distinct --attach values rather than one clobbering the other.
+    const argv = (spawner as unknown as { mock: { calls: [string, string[]][] } }).mock.calls[0][1];
+    expect(argv.filter((a) => a.startsWith('--attach='))).toHaveLength(2);
+  });
+
+  it('emits a positional file arg as a bare path, not --flag=path', async () => {
+    const spawner = okSpawner();
+    await run([
+      'drive', 'upload',
+      { kind: 'file', flag: 'localPath', contents: 'YQ==', encoding: 'base64', filename: 'notes.md', positional: true },
+    ], { spawner });
+    const argv = (spawner as unknown as { mock: { calls: [string, string[]][] } }).mock.calls[0][1];
+    expect(argv).toContain('/tmp/gogcli-mcp-fake/0/notes.md');
+    expect(argv.some((a) => a.startsWith('--localPath='))).toBe(false);
   });
 });

package/tests/runner.test.ts

@@ -592,6 +592,132 @@ describe('run', () => {
     expect(tokensOnly).not.toContain('[REDACTED]');
   });
 
+  // ==========================================================================
+  // BASE64 PAYLOAD SURVIVAL — the "Invalid Base64 string" defect.
+  //
+  // `1//` is spelled entirely in the base64 alphabet, so the refresh-token
+  // pattern used to match inside attachment bytes and eat forward to the next
+  // `+` or `/`. A 72 KiB PNG is ~97k base64 chars, giving ~0.37 expected `1//`
+  // runs — so roughly a THIRD of all attachments came back corrupt, and the
+  // client rejected them with an MCP -32602 "Invalid Base64 string".
+  //
+  // It looked filename-dependent because it is content-dependent and therefore
+  // uncorrelated with anything visible. These tests pin the real variable.
+  // ==========================================================================
+  const isValidBase64 = (s: string): boolean => Buffer.from(s, 'base64').toString('base64') === s;
+
+  it('leaves a base64 payload containing the refresh-token spelling intact', async () => {
+    // `1//` sitting mid-blob, preceded by base64 characters — the exact shape
+    // that used to be deleted.
+    const payload = `AAAA1//abcdefghijklmnop${'QRSTuvwx'.repeat(4)}`;
+    expect(payload).toContain('1//');
+    const spawner = makeSpawner(0, JSON.stringify({ contentBase64: payload }), '');
+    const out = await run(['gmail', 'attachment', 'm1', '0'], { spawner });
+    expect(JSON.parse(out).contentBase64).toBe(payload);
+    expect(out).not.toContain('[REDACTED]');
+  });
+
+  it('keeps every generated attachment payload valid base64 (the ~30% failure)', async () => {
+    // 200 payloads at the reported sizes. Before the fix ~30% of these came back
+    // undecodable; the assertion is that ALL of them survive, not most.
+    for (let i = 0; i < 200; i += 1) {
+      const bytes = Buffer.alloc(4096);
+      // Deterministic filler that still produces `1//` runs at the natural rate:
+      // a counter-driven byte pattern, seeded differently per iteration.
+      for (let b = 0; b < bytes.length; b += 1) bytes[b] = (b * 31 + i * 7) % 256;
+      const payload = bytes.toString('base64');
+      const spawner = makeSpawner(0, JSON.stringify({ contentBase64: payload }), '');
+      const out = await run(['gmail', 'attachment', 'm1', '0'], { spawner });
+      const got = JSON.parse(out).contentBase64 as string;
+      expect(isValidBase64(got)).toBe(true);
+      expect(got).toBe(payload);
+    }
+  });
+
+  // The left-boundary anchor must not narrow detection. Every character NOT in
+  // the standard base64 alphabet is a delimiter a real token turns up after, and
+  // `=` is the one that matters most: the form-encoded spelling is not covered by
+  // the shared redactor's query-param rule, which requires a preceding `?`/`&`.
+  it.each([
+    ['refresh_token=1//0eFORM-ENCODED-LEAK', '1//0eFORM-ENCODED-LEAK'],
+    ['access_token=ya29.a0FORM-ENCODED-LEAK', 'ya29.a0FORM-ENCODED-LEAK'],
+    ['grant:1//0eCOLON-LEAK', '1//0eCOLON-LEAK'],
+    ['[1//0eBRACKET-LEAK]', '1//0eBRACKET-LEAK'],
+    ['token is ya29.a0SPACE-LEAK', 'ya29.a0SPACE-LEAK'],
+  ])('redacts a token delimited by %j', async (stdout, secret) => {
+    const spawner = makeSpawner(0, stdout, '');
+    const out = await run(['auth', 'list'], { spawner });
+    expect(out).not.toContain(secret);
+    expect(out).toContain('[REDACTED]');
+  });
+
+  it("redactMode 'tokens' also catches the form-encoded spelling", async () => {
+    // This path runs ONLY redactGoogleTokens, so the anchor is the whole defence.
+    const spawner = makeSpawner(0, 'refresh_token=1//0eTOKENS-MODE-LEAK', '');
+    const out = await run(['auth', 'add'], { spawner, redactMode: 'tokens' });
+    expect(out).not.toContain('1//0eTOKENS-MODE-LEAK');
+    expect(out).toContain('[REDACTED]');
+  });
+
+  it('still redacts a real refresh token, which is never welded to base64', async () => {
+    // The anchor must not have bought base64 survival at the cost of detection:
+    // a genuine token is always delimited (quote, space, `=`, `:`), so it still
+    // matches.
+    const spawner = makeSpawner(0, '{"refresh_token":"1//0eREAL-REFRESH-TOKEN"}', '');
+    const out = await run(['auth', 'list'], { spawner });
+    expect(out).not.toContain('1//0eREAL-REFRESH-TOKEN');
+    expect(out).toContain('[REDACTED]');
+  });
+
+  it('opaqueFields exempts a named blob from redaction it would otherwise fail', async () => {
+    // A payload that spells a Google API key by chance — still possible after
+    // the boundary anchor, because AIza… needs no delimiter. The field
+    // exemption is what covers this class rather than one pattern.
+    // `/` supplies the word boundary AIza… needs, and every character here is
+    // in the base64 alphabet — so this is a payload a real file can produce.
+    const payload = `AAAA/AIza${'B'.repeat(35)}/CCC`;
+    expect(Buffer.from(payload, 'base64').toString('base64')).toBe(payload); // genuinely valid base64
+    const spawner = makeSpawner(0, JSON.stringify({ contentBase64: payload }), '');
+    const bare = await run(['gmail', 'attachment', 'm1', '0'], { spawner });
+    expect(bare).toContain('[REDACTED]'); // unprotected, the shared redactor hits it
+
+    const spawner2 = makeSpawner(0, JSON.stringify({ contentBase64: payload }), '');
+    const guarded = await run(['gmail', 'attachment', 'm1', '0'], {
+      spawner: spawner2,
+      opaqueFields: ['contentBase64'],
+    });
+    expect(JSON.parse(guarded).contentBase64).toBe(payload);
+  });
+
+  it('opaqueFields still redacts prose OUTSIDE the exempt field', async () => {
+    // The exemption is per-field, not per-response: a token in a sibling field
+    // must still be stripped.
+    const stdout = JSON.stringify({
+      contentBase64: 'QUJDREVGR0hJSktMTU5PUFFSU1Q=',
+      note: 'refreshed with 1//0eLEAK-IN-PROSE',
+    });
+    const spawner = makeSpawner(0, stdout, '');
+    const out = await run(['gmail', 'attachment', 'm1', '0'], { spawner, opaqueFields: ['contentBase64'] });
+    expect(out).not.toContain('1//0eLEAK-IN-PROSE');
+    expect(JSON.parse(out).contentBase64).toBe('QUJDREVGR0hJSktMTU5PUFFSU1Q=');
+  });
+
+  it('opaqueFields does not exempt a field carrying prose rather than a blob', async () => {
+    // Only an all-base64 value qualifies, so naming a field cannot be used to
+    // smuggle a credential through in a sentence.
+    const stdout = JSON.stringify({ contentBase64: 'token is 1//0eSMUGGLED-TOKEN here' });
+    const spawner = makeSpawner(0, stdout, '');
+    const out = await run(['gmail', 'attachment', 'm1', '0'], { spawner, opaqueFields: ['contentBase64'] });
+    expect(out).not.toContain('1//0eSMUGGLED-TOKEN');
+  });
+
+  it('opaqueFields never exempts anything on the ERROR path', async () => {
+    const spawner = makeSpawner(1, '', 'failed for 1//0eERROR-PATH-LEAK');
+    await expect(
+      run(['gmail', 'attachment', 'm1', '0'], { spawner, opaqueFields: ['contentBase64'] }),
+    ).rejects.toThrow(/\[REDACTED\]/);
+  });
+
   it("redactMode 'tokens' still strips real Google tokens", async () => {
     const leak = 'url with token ya29.a0Ad52N3-STEP-LEAK and refresh 1//0eSTEP-REFRESH-LEAK';
     const spawner = makeSpawner(0, leak, '');

package/tests/tools/gmail.test.ts

@@ -279,6 +279,95 @@ describe('gog_gmail_send', () => {
     );
   });
 
+  // ==========================================================================
+  // INLINE ATTACHMENT BYTES — for callers with no filesystem in common with gog
+  // (the hosted connector, any GOG_RUNNER_URL backend). The bytes ride with the
+  // call and the executor materializes them beside gog.
+  // ==========================================================================
+  it('turns attachInline bytes into repeatable --attach file args', async () => {
+    vi.mocked(runner.run).mockResolvedValue('{}');
+    const harness = await setupHandlers();
+    const png = Buffer.from([0x89, 0x50, 0x4e, 0x47]).toString('base64');
+    await harness.callTool('gog_gmail_send', {
+      to: 'bob@example.com',
+      subject: 'Layouts',
+      body: 'See attached',
+      attachInline: [{ filename: 'pendant-layouts.png', contentBase64: png }],
+    });
+    expect(runner.run).toHaveBeenCalledWith(
+      [
+        'gmail', 'send',
+        '--to=bob@example.com', '--subject=Layouts', '--body=See attached',
+        { kind: 'file', flag: 'attach', contents: png, encoding: 'base64', filename: 'pendant-layouts.png' },
+      ],
+      { account: undefined },
+    );
+  });
+
+  it('combines server-side paths and inline bytes on one message', async () => {
+    vi.mocked(runner.run).mockResolvedValue('{}');
+    const harness = await setupHandlers();
+    const bytes = Buffer.from('hello').toString('base64');
+    await harness.callTool('gog_gmail_send', {
+      to: 'bob@example.com',
+      subject: 'Both',
+      body: 'x',
+      attach: ['/tmp/on-server.pdf'],
+      attachInline: [{ filename: 'from-client.txt', contentBase64: bytes }],
+    });
+    const args = vi.mocked(runner.run).mock.calls[0][0];
+    expect(args).toContain('--attach=/tmp/on-server.pdf');
+    expect(args).toContainEqual(
+      { kind: 'file', flag: 'attach', contents: bytes, encoding: 'base64', filename: 'from-client.txt' },
+    );
+  });
+
+  it('keeps a filename with spaces and non-ASCII intact end to end', async () => {
+    vi.mocked(runner.run).mockResolvedValue('{}');
+    const harness = await setupHandlers();
+    const filename = 'Reçu — étude 2026.png';
+    await harness.callTool('gog_gmail_send', {
+      to: 'bob@example.com', subject: 's', body: 'b',
+      attachInline: [{ filename, contentBase64: Buffer.from('x').toString('base64') }],
+    });
+    const args = vi.mocked(runner.run).mock.calls[0][0];
+    expect(args.at(-1)).toMatchObject({ filename });
+  });
+
+  it('surfaces an invalid-base64 attachment as a readable error, not a corrupt send', async () => {
+    vi.mocked(runner.run).mockResolvedValue('{}');
+    const harness = await setupHandlers();
+    const res = await harness.callTool('gog_gmail_send', {
+      to: 'bob@example.com', subject: 's', body: 'b',
+      attachInline: [{ filename: 'a.png', contentBase64: 'not!valid!base64!' }],
+    });
+    expect(res.isError).toBe(true);
+    expect(res.content[0].text).toMatch(/not valid base64/);
+    expect(runner.run).not.toHaveBeenCalled(); // nothing was sent
+  });
+
+  it('rejects an oversize attachment before the call rather than deep in the stack', async () => {
+    vi.mocked(runner.run).mockResolvedValue('{}');
+    const harness = await setupHandlers();
+    const res = await harness.callTool('gog_gmail_send', {
+      to: 'bob@example.com', subject: 's', body: 'b',
+      attachInline: [{ filename: 'huge.bin', contentBase64: Buffer.alloc(8 * 1024 * 1024 + 1).toString('base64') }],
+    });
+    expect(res.isError).toBe(true);
+    expect(res.content[0].text).toMatch(/per-file limit/);
+    expect(runner.run).not.toHaveBeenCalled();
+  });
+
+  it('leaves the arg list untouched when attachInline is absent', async () => {
+    vi.mocked(runner.run).mockResolvedValue('{}');
+    const harness = await setupHandlers();
+    await harness.callTool('gog_gmail_send', { to: 'b@e.com', subject: 'Hi', body: 'Hello' });
+    expect(runner.run).toHaveBeenCalledWith(
+      ['gmail', 'send', '--to=b@e.com', '--subject=Hi', '--body=Hello'],
+      { account: undefined },
+    );
+  });
+
   // A body over the shared threshold cannot ride in argv (the hosted runner
   // caps a single arg; Linux caps MAX_ARG_STRLEN at 128 KiB), so payloadArg
   // swaps it for a file arg the executor materializes as a temp file.