gogcli-mcp 3.0.0 → 4.0.0

package/manifest.json

@@ -3,7 +3,7 @@
   "manifest_version": "0.3",
   "name": "gogcli-mcp",
   "display_name": "gogcli",
-  "version": "3.0.0",
+  "version": "4.0.0",
   "description": "Google Sheets (and more) for Claude via gogcli — read, write, and manage spreadsheets",
   "author": {
     "name": "Chris Hall",
@@ -266,7 +266,7 @@
     },
     {
       "name": "gog_drive_read_bytes",
-      "description": "Fetch a Drive file's raw bytes as a base64 resource (local stdio only; connector returns text-only notice)"
+      "description": "Fetch a Drive file's raw bytes as a base64 resource"
     },
     {
       "name": "gog_drive_get",

package/mint.yaml

@@ -11,25 +11,29 @@ env:
   - name: GOG_CLIENT_ID
     required: false
     help: >-
-      Google OAuth client id. NOTE: on the local-spawn path the child `gog`
-      receives a sanitized env — runner.ts drops GOG_ACCESS_TOKEN and every
-      *_TOKEN / *_SECRET / *_KEY / *_CREDENTIALS variable — so the CLI
-      authenticates from its own stored credentials under $HOME (see
-      state.dataDir), not from these variables being passed through.
+      Google OAuth client id. Read by the Node wrapper at startup
+      (bootstrap-auth.ts), which imports it into gog's keyring via a temp file
+      together with GOG_CLIENT_SECRET, GOG_REFRESH_TOKEN and GOG_ACCOUNT — set
+      all four or none. Not a secret, so unlike GOG_CLIENT_SECRET and
+      GOG_REFRESH_TOKEN it is not stripped from the spawned `gog`'s
+      environment; gog authenticates from its keyring under $HOME (see
+      state.dataDir).
   - name: GOG_CLIENT_SECRET
     secret: true
     required: false
     help: >-
-      Google OAuth client secret. Stripped from the spawned CLI's environment
-      by runner.ts's *_SECRET rule — see GOG_CLIENT_ID.
+      Google OAuth client secret. Imported into gog's keyring at startup with
+      GOG_CLIENT_ID; stripped from the spawned CLI's environment by runner.ts's
+      *_SECRET rule.
   - name: GOG_REFRESH_TOKEN
     secret: true
     required: false
     help: >-
-      Google OAuth refresh token. Stripped from the spawned CLI's environment
-      by runner.ts's *_TOKEN rule — see GOG_CLIENT_ID. A hosted deployment must
-      therefore carry gog's authorised-account state in its persisted data dir,
-      or drive a remote runner via GOG_RUNNER_URL.
+      Google OAuth refresh token (`gog auth tokens export` prints one). Imported
+      into gog's keyring at startup with GOG_CLIENT_ID; stripped from the
+      spawned CLI's environment by runner.ts's *_TOKEN rule. Changing it
+      re-imports on the next start; an in-connector re-auth
+      (gog_auth_add_url/complete) stays in effect until it changes.
   - name: GOG_ACCESS_TOKEN
     secret: true
     required: false
@@ -40,8 +44,21 @@ env:
   - name: GOG_ACCOUNT
     required: false
     help: >-
-      Which configured Google account to act as, when more than one is
-      authorised. Defaults to the single/most recent account.
+      The Google account to act as. Required for the startup auth bootstrap
+      (the refresh token is imported under this email); otherwise defaults to
+      gog's single/most recent account.
+  - name: GOG_KEYRING_BACKEND
+    required: false
+    help: >-
+      gog's credential store. Set to "file" on a headless host — there is no OS
+      keychain — so the keyring lives on the persistent data dir.
+  - name: GOG_KEYRING_PASSWORD
+    secret: true
+    required: false
+    help: >-
+      Encrypts gog's file keyring on the data dir. Required with
+      GOG_KEYRING_BACKEND=file. Deliberately not stripped from the spawned
+      CLI's environment — it is the one credential gog itself reads.
   - name: GOG_READONLY
     required: false
     help: >-
@@ -52,17 +69,6 @@ env:
     help: >-
       Path to the `gog` binary. Leave unset when the dependency below supplies
       it; set it only to point at a binary you manage yourself.
-  - name: GOG_RUNNER_URL
-    required: false
-    help: >-
-      URL of a remote gog runner to execute against instead of spawning the
-      local binary. If you set this, add its host to egress.allow.
-  - name: GOG_RUNNER_KEY
-    secret: true
-    required: false
-    help: >-
-      Shared key authenticating calls to GOG_RUNNER_URL. Required whenever that
-      is set.
   - name: GOG_TIMEZONE
     required: false
     help: >-
@@ -81,9 +87,8 @@ dependencies:
   # Every tool shells out to the `gog` CLI; without it the server starts and
   # then fails on the first call. This tag must track
   # packages/gogcli-mcp/src/runner.ts's MIN_GOG_VERSION (the floor the tools
-  # assume) and the fly-gog-runner/Dockerfile GOG_VERSION build arg. See
-  # CLAUDE.md "Required gog version" — bumping the floor means bumping these
-  # nine pins too.
+  # assume). See CLAUDE.md "Required gog version" — bumping the floor means
+  # bumping these nine pins, and the pin stored on each mcp-host registration.
   - kind: github-release
     repo: openclaw/gogcli
     tag: v0.40.0
@@ -92,15 +97,14 @@ dependencies:
 state:
   dataDir: true
   reason: >-
-    `gog` keeps its authorised-account state and token cache under $HOME.
-    Without a persistent data dir every cold start has no account configured and
-    every tool call fails until the credentials are re-supplied.
+    `gog` keeps its authorised-account state and file keyring under $HOME, and
+    the wrapper keeps its auth-bootstrap marker (~/.gogcli-mcp) there, so a
+    restart neither re-imports an unchanged secret nor discards an
+    in-connector re-auth. Without a persistent data dir every cold start has
+    only what the env secrets can re-seed.
 egress:
   allow:
     # Google OAuth token exchange and the Google REST APIs the CLI calls.
     - oauth2.googleapis.com
     - www.googleapis.com
     - googleapis.com
-    #
-    # NOTE: if you set GOG_RUNNER_URL to run against a remote gog runner, add
-    # that host here too — it is supplied at runtime and cannot be declared.

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "gogcli-mcp",
-  "version": "3.0.0",
+  "version": "4.0.0",
   "mcpName": "io.github.chrischall/gogcli-mcp",
   "description": "MCP server wrapping gogcli for Google service access",
   "author": "Claude Code (AI) <https://www.anthropic.com/claude>",
@@ -47,9 +47,9 @@
   },
   "devDependencies": {
     "@types/node": "^26.5.1",
-    "@vitest/coverage-v8": "^4.1.8",
+    "@vitest/coverage-v8": "^5.0.1",
     "esbuild": "^0.28.2",
     "typescript": "^7.0.2",
-    "vitest": "^4.1.11"
+    "vitest": "^5.0.1"
   }
 }

package/server.json

@@ -7,12 +7,12 @@
     "source": "github",
     "subfolder": "packages/gogcli-mcp"
   },
-  "version": "3.0.0",
+  "version": "4.0.0",
   "packages": [
     {
       "registryType": "npm",
       "identifier": "gogcli-mcp",
-      "version": "3.0.0",
+      "version": "4.0.0",
       "transport": {
         "type": "stdio"
       },

package/src/attachments.ts

@@ -9,14 +9,13 @@ import type { GogArg, GogFileArg } from './runner.js';
  * Every attachment input gog offers is a PATH — `gmail send --attach`,
  * `gmail drafts create --attach`, `drive upload <localPath>` — and those paths
  * resolve wherever gog runs. On the local stdio transport that is the caller's
- * own machine and everything works. On the hosted connector, and on any host
- * that reaches a backend through GOG_RUNNER_URL, gog runs somewhere else
- * entirely: no path the caller can name exists there, so outbound attachments
- * were simply impossible — including via Drive, whose upload takes a path too.
+ * own machine and everything works. On a hosted deployment (mcp-host), gog
+ * runs somewhere else entirely: no path the caller can name exists there, so
+ * outbound attachments would be impossible — including via Drive, whose upload
+ * takes a path too.
  *
  * The seam that fixes it already existed. `GogFileArg` writes a payload to a
- * private temp file NEXT TO GOG — on the runner for the remote path, in a
- * mkdtemp dir for the local one — and passes the resulting path. It was built
+ * private temp file NEXT TO GOG (a mkdtemp dir) and passes the resulting path. It was built
  * for oversized text (a long HTML mail body) that could not fit in argv; all
  * binary attachments need on top of that is a base64 spelling and control of
  * the basename, both of which are now `GogFileArg` fields.
@@ -27,39 +26,34 @@ import type { GogArg, GogFileArg } from './runner.js';
 
 // Ceiling for ONE attachment's decoded bytes.
 //
-// Pinned to the Fly runner's own MAX_FILE_ARG_BYTES (fly-gog-runner/server.mjs)
-// so the two agree. That matters: without a check here the local stdio path
-// would accept any size while the remote path refused at 8 MiB, and the caller
-// would meet the limit as a transport rejection from a layer they cannot see.
-// Checked in the TOOL so the error names the file and the limit instead.
+// A published, stable limit: callers plan around it, so it stays fixed. Checked
+// in the TOOL so the error names the file and the limit, rather than the caller
+// meeting an oversized request as an opaque failure from a layer they cannot
+// see.
 export const MAX_INLINE_ATTACHMENT_BYTES = 8 * 1024 * 1024;
 
-// The Fly runner caps an ENTIRE /run request body at 32 MiB
-// (fly-gog-runner/server.mjs MAX_BODY_BYTES). Restated rather than imported:
-// that package is not a dependency of this one, and the Worker bundle must not
-// pull it in. Keep the two in sync.
-const RUNNER_MAX_BODY_BYTES = 32 * 1024 * 1024;
+// The budget for an ENTIRE request's payload, as spelled on the wire (32 MiB).
+// An MCP tool call carries every attachment as base64 inside one JSON-RPC
+// message, so the whole request — not each file — is what has to stay bounded.
+const REQUEST_MAX_BODY_BYTES = 32 * 1024 * 1024;
 
 // Room inside that body for the JSON structure alone — key names, quoting,
-// commas, the accessToken, and the short flag strings (`--to=…`, `--subject=…`).
+// commas, and the short flag strings (`--to=…`, `--subject=…`).
 // It does NOT have to cover the mail body: a large body is a GogFileArg, and
 // GogFileArgs are measured explicitly below rather than absorbed here.
-const RUNNER_BODY_JSON_RESERVE_BYTES = 256 * 1024;
+const REQUEST_BODY_JSON_RESERVE_BYTES = 256 * 1024;
 
 /**
- * How many bytes of PAYLOAD one `/run` request can carry, counted as they are
- * spelled on the wire.
+ * How many bytes of PAYLOAD one request can carry, counted as they are spelled
+ * on the wire.
  *
  * The binding constraint on a message is its wire size, not the decoded size of
- * its files, and it is tighter than Gmail's own 25 MB limit: connector-runtime
- * sends every payload inside one `JSON.stringify({ args, accessToken })` body,
- * where binary rides as base64 (4/3 inflation) and text rides verbatim. A limit
- * expressed in decoded bytes must absorb that inflation or it documents a size
- * the runner rejects with "request body too large" — a rejection from a layer
- * the caller cannot see, which is exactly what pinning the per-file ceiling to
- * MAX_FILE_ARG_BYTES exists to prevent.
+ * its files, and it is tighter than Gmail's own 25 MB limit: every payload rides
+ * inside one JSON body, where binary rides as base64 (4/3 inflation) and text
+ * rides verbatim. A limit expressed in decoded bytes must absorb that inflation
+ * or it documents a size that cannot actually be sent.
  */
-export const MAX_REQUEST_PAYLOAD_WIRE_BYTES = RUNNER_MAX_BODY_BYTES - RUNNER_BODY_JSON_RESERVE_BYTES;
+export const MAX_REQUEST_PAYLOAD_WIRE_BYTES = REQUEST_MAX_BODY_BYTES - REQUEST_BODY_JSON_RESERVE_BYTES;
 
 // Ceiling for all inline attachments on one message, in DECODED bytes — the
 // units a caller thinks in, derived from the wire budget above.
@@ -70,15 +64,15 @@ export const MAX_REQUEST_PAYLOAD_WIRE_BYTES = RUNNER_MAX_BODY_BYTES - RUNNER_BOD
 // at roughly 1:1. `inlineAttachmentArgs` therefore measures the actual sibling
 // args rather than trusting this number, so a 23 MiB attachment set plus a
 // multi-MiB HTML body is refused here, with an error naming the body, instead of
-// arriving as a bare transport rejection.
+// arriving as an opaque failure.
 //
 // Neither bound is hypothetical at the edges: three attachments at the
 // documented 8 MiB per-file maximum is 24 MiB, which alone encodes to exactly
-// MAX_BODY_BYTES, leaving nothing for anything else.
+// the 32 MiB request budget, leaving nothing for anything else.
 export const MAX_INLINE_ATTACHMENT_TOTAL_BYTES = Math.floor((MAX_REQUEST_PAYLOAD_WIRE_BYTES * 3) / 4);
 
 /**
- * Bytes one already-assembled arg occupies in the `/run` JSON body.
+ * Bytes one already-assembled arg occupies in the request's JSON body.
  *
  * A plain string costs its UTF-8 length; a file arg costs the length of its
  * `contents` as spelled on the wire — the base64 text for binary, the UTF-8
@@ -127,8 +121,8 @@ export type InlineAttachmentInput = z.infer<typeof inlineAttachmentSchema>;
 /** Reusable tool parameter — the same field on send, drafts create and update. */
 export const attachInlineParam = z.array(inlineAttachmentSchema).optional().describe(
   'Attachments supplied as BYTES rather than as server-side paths — use this whenever you hold a file '
-  + 'and the gog server does not, which is always the case on the hosted connector and on any remote '
-  + `deployment. Each entry is {filename, contentBase64} (${INLINE_ATTACHMENT_LIMITS_TEXT}). `
+  + 'and the gog server does not, which is always the case on a hosted deployment (e.g. mcp-host). '
+  + `Each entry is {filename, contentBase64} (${INLINE_ATTACHMENT_LIMITS_TEXT}). `
   + 'Can be combined with `attach`: the two name disjoint files (paths read on the server vs. bytes sent '
   + 'with the call), and both end up as ordinary attachments on the message.',
 );
@@ -171,7 +165,7 @@ function decodedLength(contentBase64: string): number | null {
 
 /**
  * Validate ONE caller-supplied file and turn it into a `GogFileArg`, which the
- * executor materializes to a temp file beside gog.
+ * runner materializes to a temp file beside gog.
  *
  * Throws with an actionable message on anything invalid. The MCP layer turns a
  * thrown handler error into an `isError` result, so every rejection here reaches

package/src/blob-upload.ts

@@ -1,66 +1,46 @@
-import { readEnvVar } from '@chrischall/mcp-utils';
-
 /**
- * Ask the gog runner to stream a file off ITS disk to a signed blob-store URL.
- *
- * ## Why the runner and not this process
- *
- * Under the hosted connector this child is a FORWARDER: `run()` POSTs an
- * arg-array to fly-gog-runner, the Google refresh token lives in that app's
- * keyring, and `gog gmail attachment --out` writes the file to THAT box's disk.
- * The child never sees a byte, so the runner is the only party that can send
- * one anywhere. That is the same seam `deliverViaDrive` already uses — `gog
- * drive upload <path>` pushes bytes from the runner's disk to a remote
- * destination with the child out of the way — with a different destination.
+ * Stream a downloaded attachment off this machine's disk to a signed
+ * blob-store URL.
  *
- * Routing them through the child instead would cap out near 24 MB against
- * `/run`'s 32 MB body envelope and cost a ~31 MB base64 string plus a decoded
- * copy, for bytes nobody here reads.
+ * gog runs in this process tree (mcp-host installs it onto the child's PATH),
+ * so `gog gmail attachment --out` has just written the file HERE, and this
+ * process is the party that sends it. The rules are the ones the retired Fly
+ * runner's `POST /upload` enforced, now applied locally:
  *
- * ## What the runner does with it
+ * - The path is confined to the attachment download root, checked lexically
+ *   and again on the real path (a symlink inside the root is a second way out).
+ *   Unconfined, this is a file-read primitive aimed at a signed URL of the
+ *   caller's choosing — and `$HOME` holds gog's keyring.
+ * - A file over the blob store's 100 MiB ceiling is refused BEFORE dialling:
+ *   the gateway's 413 would arrive only after the whole transfer had run.
+ * - The PUT carries `Content-Length` from the file's own size (a chunked PUT is
+ *   a 411) and `Content-Type` byte for byte as given — the signature commits to
+ *   it, and a normalised header reads as a missing object.
+ * - One total deadline bounds the exchange, so a wedged transfer cannot leave
+ *   the MCP request unanswered.
  *
- * `POST /upload` (fly-gog-runner/server.mjs) confines `path` to the attachment
- * directory, refuses anything past the blob store's own 100 MiB ceiling before
- * dialling, and PUTs the file with `Content-Length` from its own size and the
- * `Content-Type` header byte for byte as given — the PUT signature commits to
- * it. Its statuses carry the classification: `422` is deterministic (re-mint,
- * do not retry), `502` is the far side or the transfer, `400`/`404` are this
- * request. All of them are failures here; none of them is retried from this
- * side, because a fresh URL is the only repair for the common one.
+ * Every message thrown has the signed URL and its bare `sig=` value scrubbed.
  */
 
 /**
- * The deadline this side puts on the exchange.
- *
- * The runner has one of its own (`UPLOAD_TIMEOUT_MS`, 120 s) but it is an
- * INACTIVITY timer spent through `req.setTimeout` — it bounds a socket that has
- * gone quiet, never a transfer that keeps dribbling — so nothing else stands
- * between a wedged upload and an MCP request that never answers.
- *
- * Longer than `/run`'s 30 s because this is not a `gog` invocation: it is up to
- * 100 MiB leaving a Fly machine, and firing before the runner can report a real
- * failure would turn "the blob store refused the signature" into an opaque
- * timeout — the same reason `makeFlyExecutor` sits its deadline above the
- * backend's.
- *
- * It is `120 s + 5 s`, and it was 90 s: the doc block above cited that rule
- * while the number inverted it, so a socket that went quiet was aborted HERE
- * 30 s before the runner's own timer could say "the upload timed out after
- * 120000ms". Exactly the opaque client abort the rule exists to prevent, and
- * the one shape where the runner has something useful to say. The grace is
- * `DEADLINE_GRACE_MS`'s 5 s for `DEADLINE_GRACE_MS`'s reason: enough for the
- * answer to travel, and not a second more, because every extra second is a
- * second of opaque timeout replacing a real error.
- *
- * Restated rather than imported — `fly-gog-runner/server.mjs` must not be
- * pulled into the Worker bundle, the same trade `attachments.ts` makes for the
- * runner's size ceilings — so the two move by hand, and a test asserts the
- * ordering rather than leaving it to this comment.
+ * Where gmail's attachment download writes (`defaultOutPath` in
+ * packages/gogcli-mcp-gmail/src/tools/gmail-extra.ts) and the only tree this
+ * module will read back from.
  */
-export const RUNNER_UPLOAD_TIMEOUT_MS = 125_000;
+export const ATTACHMENT_DOWNLOAD_ROOT = '/tmp/gog-attachments';
+
+/** mcp-host's blob store caps one object at 100 MiB and answers 413 past it. */
+export const MAX_BLOB_UPLOAD_BYTES = 100 * 1024 * 1024;
+
+/** Total deadline on one PUT, from dial to the blob store's last byte. */
+export const BLOB_UPLOAD_TIMEOUT_MS = 120_000;
+
+// Enough of the blob store's error body to quote its `{"error":"…"}`, bounded
+// so a stray HTML page cannot become the message.
+const ERROR_BODY_SNIPPET = 512;
 
 export interface BlobUploadRequest {
-  /** The file to send, resolved on the RUNNER's disk. */
+  /** The file to send, on this machine, inside the attachment download root. */
   path: string;
   /** The signed PUT URL. A credential — never log it, never echo it. */
   url: string;
@@ -69,30 +49,24 @@ export interface BlobUploadRequest {
 }
 
 export interface BlobUploadOutcome {
-  /** Bytes the runner actually streamed — the file's own size, not a claim. */
-  bytes?: number;
-  /** The blob store's status, as the runner observed it. */
-  status?: number;
+  /** Bytes streamed — the file's own size, not a claim. */
+  bytes: number;
+  /** The blob store's (2xx) status. */
+  status: number;
 }
 
 export interface BlobUploadOptions {
-  /** Where the runner's endpoint and key are read from. Injected by tests. */
-  env?: NodeJS.ProcessEnv;
+  /** The confinement root. Injected by tests. */
+  root?: string;
+  /** The total deadline. Injected by tests. */
+  timeoutMs?: number;
 }
 
 /**
  * Remove a signed URL, and the bare signature inside it, from a message.
  *
- * Everything this module throws is expected to be logged, and a failure's text
- * is routinely a third party's: the runner scrubs its own words, but the blob
- * store's error is quoted through it and an HTTP client's rejection may name
- * the URL it was dialling. Both shapes are removed, because either left
- * standing is the whole credential — the signature is what `sig=` carries, and
- * the rest of the URL is public.
- *
- * The empty needle is guarded rather than assumed away: `split('')` cuts a
- * message into single characters and interleaves the replacement between every
- * one of them.
+ * The empty needle is guarded: `split('')` cuts a message into single
+ * characters and interleaves the replacement between every one of them.
  */
 function withoutUrlSecrets(message: string, url: string): string {
   let out = url ? message.split(url).join('<signed url>') : message;
@@ -101,79 +75,136 @@ function withoutUrlSecrets(message: string, url: string): string {
   return out;
 }
 
+class UploadError extends Error {}
+
+async function resolveConfined(root: string, requested: string): Promise<{ file: string; bytes: number }> {
+  const path = await import('node:path');
+  const { realpath, stat } = await import('node:fs/promises');
+  // Separator-terminated, so `/tmp/gog-attachments-evil` is not "inside".
+  const isInside = (base: string, candidate: string) =>
+    candidate === base || candidate.startsWith(base + path.sep);
+
+  const lexicalRoot = path.resolve(root);
+  const candidate = path.resolve(lexicalRoot, requested);
+  if (!isInside(lexicalRoot, candidate)) {
+    throw new UploadError(`the attachment path must be inside ${lexicalRoot}`);
+  }
+  let realFile: string;
+  let realRoot: string;
+  try {
+    realFile = await realpath(candidate);
+    // /tmp is itself a symlink on macOS, so the root is compared real-to-real.
+    realRoot = await realpath(lexicalRoot);
+  } catch (err) {
+    throw new UploadError(`the downloaded attachment could not be found: ${(err as Error).message}`);
+  }
+  if (!isInside(realRoot, realFile)) {
+    throw new UploadError(`the attachment path must be inside ${realRoot}`);
+  }
+  const info = await stat(realFile);
+  if (!info.isFile()) throw new UploadError('the attachment path must name a regular file');
+  if (info.size > MAX_BLOB_UPLOAD_BYTES) {
+    throw new UploadError(
+      `the attachment is ${info.size} bytes; the blob store's maximum is ${MAX_BLOB_UPLOAD_BYTES} bytes`,
+    );
+  }
+  return { file: realFile, bytes: info.size };
+}
+
+function parseTarget(url: string): URL {
+  let target: URL | undefined;
+  try {
+    target = new URL(url);
+  } catch {
+    // refused below
+  }
+  if (!target || (target.protocol !== 'https:' && target.protocol !== 'http:')) {
+    throw new UploadError('the upload target must be an absolute http(s) URL');
+  }
+  return target;
+}
+
+// `http.request` rather than `fetch`: undici drops a caller-set Content-Length
+// from a streamed body and sends it chunked, which the gateway refuses. The
+// body is a pipe, so a 100 MiB file is never held in memory.
+async function putFile(
+  target: URL,
+  file: string,
+  bytes: number,
+  contentType: string,
+  timeoutMs: number,
+): Promise<{ status: number; body: string }> {
+  const { createReadStream } = await import('node:fs');
+  const { pipeline } = await import('node:stream');
+  const transport = target.protocol === 'https:' ? await import('node:https') : await import('node:http');
+
+  return new Promise((resolve, reject) => {
+    let settled = false;
+    const source = createReadStream(file);
+    const req = transport.request(target, {
+      method: 'PUT',
+      headers: { 'content-type': contentType, 'content-length': String(bytes) },
+    });
+    // Release both ends either way: the blob store may answer (and refuse)
+    // before the body is sent, and an unfinished request holds its socket.
+    const finish = (settle: () => void) => {
+      if (settled) return;
+      settled = true;
+      clearTimeout(timer);
+      source.destroy();
+      req.destroy();
+      settle();
+    };
+    const fail = (err: unknown) => finish(() => reject(err));
+    const timer = setTimeout(
+      () => fail(new UploadError(`the upload to the blob store did not finish within ${timeoutMs}ms`)),
+      timeoutMs,
+    );
+
+    req.on('error', fail);
+    req.on('response', (res) => {
+      const chunks: Buffer[] = [];
+      let held = 0;
+      res.on('data', (chunk: Buffer) => {
+        if (held >= ERROR_BODY_SNIPPET) return;
+        chunks.push(chunk);
+        held += chunk.length;
+      });
+      res.on('error', fail);
+      res.on('end', () => finish(() => resolve({
+        status: res.statusCode as number,
+        body: Buffer.concat(chunks).toString().slice(0, ERROR_BODY_SNIPPET),
+      })));
+    });
+    pipeline(source, req, (err) => { if (err) fail(err); });
+  });
+}
+
 /**
- * Stream the file at `request.path` (on the runner) to `request.url`.
+ * PUT the file at `request.path` to `request.url`.
  *
- * Resolves with what the runner reported; THROWS on every failure, with a
- * message safe to log. Both variables are required — the same both-or-neither
- * rule `useRemoteGogRunner` applies, for the same reason: a URL with no key
- * sends unauthenticated requests the runner rejects, and a key with no URL is a
- * credential configured for nothing.
+ * Resolves with the bytes streamed and the blob store's status; THROWS on every
+ * failure, with a message safe to log. Nothing is retried: a fresh URL is the
+ * only repair for the common failure (a stale or mismatched signature).
  */
 export async function uploadToBlobStore(
   request: BlobUploadRequest,
   options: BlobUploadOptions = {},
 ): Promise<BlobUploadOutcome> {
-  const env = options.env ?? process.env;
-  // The shared reader, as everywhere else: blanks, unexpanded `${...}`
-  // placeholders and the literal "undefined"/"null" are all unset.
-  const endpoint = readEnvVar('GOG_RUNNER_URL', { env });
-  const key = readEnvVar('GOG_RUNNER_KEY', { env });
-  if (!endpoint || !key) {
-    throw new Error(
-      'no gog runner is configured (GOG_RUNNER_URL + GOG_RUNNER_KEY, both or neither), and the ' +
-      'attachment bytes are on the runner\'s disk rather than here — so nothing on this side can send them',
-    );
-  }
-
-  let response: { ok: boolean; status: number; text(): Promise<string> };
-  try {
-    response = await fetch(`${endpoint.replace(/\/+$/, '')}/upload`, {
-      method: 'POST',
-      headers: { Authorization: `Bearer ${key}`, 'Content-Type': 'application/json' },
-      body: JSON.stringify({ path: request.path, url: request.url, contentType: request.contentType }),
-      signal: AbortSignal.timeout(RUNNER_UPLOAD_TIMEOUT_MS),
-    });
-  } catch (err) {
-    throw new Error(withoutUrlSecrets(
-      `the upload to the blob store did not complete: ${err instanceof Error ? err.message : String(err)}`,
-      request.url,
-    ));
-  }
-
-  // Inside a try of its own: the response ARRIVING is not the body arriving,
-  // and a severed or truncated one rejects here. That rejection is a transport
-  // failure like the dial above and is scrubbed like one — this module's
-  // contract is that nothing it throws carries the URL, and a guarantee with a
-  // hole in it is not one.
-  let raw: string;
   try {
-    raw = await response.text();
+    const target = parseTarget(request.url);
+    const { file, bytes } = await resolveConfined(options.root ?? ATTACHMENT_DOWNLOAD_ROOT, request.path);
+    const answer = await putFile(
+      target, file, bytes, request.contentType, options.timeoutMs ?? BLOB_UPLOAD_TIMEOUT_MS,
+    );
+    if (answer.status < 200 || answer.status >= 300) {
+      throw new UploadError(`the blob store refused the upload with ${answer.status}: ${answer.body}`.trim());
+    }
+    return { bytes, status: answer.status };
   } catch (err) {
-    throw new Error(withoutUrlSecrets(
-      `the upload to the blob store did not complete: the runner's answer could not be read: ` +
-      `${err instanceof Error ? err.message : String(err)}`,
-      request.url,
-    ));
-  }
-  let body: { error?: string; bytes?: number; status?: number } = {};
-  try {
-    body = JSON.parse(raw) as typeof body;
-  } catch {
-    // A proxy's HTML error page, or a truncated answer. Quoted, never parsed
-    // into a decision — the status is the part that classifies.
-    body = { error: raw };
-  }
-  if (!response.ok) {
-    // The runner's own status says which layer failed (422 refused / 502 far
-    // side / 400 this request); `body.status` is the blob store's verdict when
-    // there was one. Both are reported, because "403 inside a 422" is what
-    // tells a stale signature from a broken runner.
-    throw new Error(withoutUrlSecrets(
-      `the runner could not store the attachment (HTTP ${response.status}` +
-      `${body.status ? `, blob store ${body.status}` : ''}): ${body.error ?? 'no reason given'}`,
-      request.url,
-    ));
+    const message = err instanceof UploadError
+      ? err.message
+      : `the upload to the blob store did not complete: ${(err as Error).message}`;
+    throw new Error(withoutUrlSecrets(message, request.url));
   }
-  return { bytes: body.bytes, status: body.status };
 }

package/src/blob-urls.ts

@@ -56,11 +56,9 @@ import { readEnvVar } from '@chrischall/mcp-utils';
  * that is easy to get wrong is exactly the part below — which bytes are signed,
  * and which of them are percent-encoded on the way into the URL.
  *
- * `node:crypto` rather than WebCrypto (which `google-token.ts` uses, for the
- * Worker build): HMAC through `crypto.subtle` is async, and a URL minter that
- * returns a promise infects every call site for no gain here. The Worker build
- * sets `nodejs_compat` (wrangler.jsonc), so `createHmac` resolves there too if
- * this module is ever pulled into that graph.
+ * `node:crypto` rather than WebCrypto: HMAC through `crypto.subtle` is async,
+ * and a URL minter that returns a promise infects every call site for no gain
+ * here.
  */
 
 /**