gogcli-mcp 3.0.0 → 4.0.0

package/src/tools/utils.ts

@@ -1,8 +1,8 @@
 import { z } from 'zod';
 import type { McpServer, CallToolResult } from '@modelcontextprotocol/server';
 import { errorResult, rawTextResult, minifiedResult, stripMediaUrls } from '@chrischall/mcp-utils';
-import { run, isRunnerTransportError } from '../runner.js';
-import type { GogArg, RunnerFailureKind } from '../runner.js';
+import { run } from '../runner.js';
+import type { GogArg } from '../runner.js';
 import { normalizeTimestamps } from '../timestamps.js';
 import { stripConsumedPageToken } from '../pagination.js';
 
@@ -15,23 +15,20 @@ import { stripConsumedPageToken } from '../pagination.js';
 // "\n" cannot round-trip byte-for-byte through the file path. Second, the file
 // path costs a temp dir, a write, and a delete per call.
 //
-// The value matches the per-arg byte limit the Fly runner enforced BEFORE large
-// payloads could leave argv (the old MAX_ARG_LEN, 4096). That is deliberate:
-// every body that used to round-trip inline byte-for-byte still does, so this
-// change adds no trailing-newline regression for any body that already worked —
-// only bodies that previously exceeded the cap and hard-failed ("each arg must
-// be at most 4096 chars") now take the file path and its newline trim. The
-// runner's plain-arg cap is now 64 KiB, so a 4096-byte inline value is nowhere
-// near being rejected.
+// The value is the historical per-arg cap (4096) that applied BEFORE large
+// payloads could leave argv. That is deliberate: every body that used to
+// round-trip inline byte-for-byte still does, so there is no trailing-newline
+// regression for any body that already worked — only bodies that previously
+// exceeded the cap and hard-failed now take the file path and its newline trim.
 export const PAYLOAD_INLINE_MAX = 4096;
 
 // The ONE place the inline-vs-file decision is made. Every tool that has a
 // gog `--x` / `--x-file` flag pair routes its value through here so the
 // threshold cannot drift between tools.
 //
-// Measures BYTES, not characters: the Fly runner's cap and the Linux kernel's
-// MAX_ARG_STRLEN are both byte-based, so a multibyte-heavy body (CJK, emoji)
-// would slip past a `.length` check at up to 4x its real argv cost.
+// Measures BYTES, not characters: the Linux kernel's MAX_ARG_STRLEN is
+// byte-based, so a multibyte-heavy body (CJK, emoji) would slip past a
+// `.length` check at up to 4x its real argv cost.
 export function payloadArg(
   inlineFlag: string,
   fileFlag: string,
@@ -236,31 +233,6 @@ const GRID_LIMIT_HINT =
   '\n\nThe target range is outside the sheet\'s current grid. Add the missing rows or columns ' +
   'first with gog_sheets_insert (dimension: rows or cols), then retry the write.';
 
-// The hint for each RUNNER-authored failure kind (see RunnerTransportError in
-// runner.ts). These are chosen by the error's TYPE, never by reading its text.
-//
-// transport-auth is the one that motivated all of this. The runner answers a
-// bad bearer with the single word "unauthorized"; read as prose that is
-// indistinguishable from Google rejecting a credential, and the caller was
-// being told all session to re-authorize an account that had never been asked
-// for anything. So this hint names the real cause and says outright that
-// re-authorizing cannot help. It deliberately does NOT contain the literal
-// `gog_auth_add`, which is the token the rest of the auth guidance keys on.
-const RUNNER_TRANSPORT_AUTH_HINT =
-  '\n\nThis is the CONNECTOR\'s own transport auth failing, not your Google sign-in. The gog-runner ' +
-  'backend rejected the bearer token this server sent, so the request never reached gog and no Google ' +
-  'credential was checked — the Google account is not the problem and re-authorizing it cannot fix this. ' +
-  'An operator must make the Worker secret GOG_RUNNER_KEY equal RUNNER_KEY on the Fly app ' +
-  '(wrangler secret put GOG_RUNNER_KEY / fly secrets set RUNNER_KEY), then retry.';
-
-const RUNNER_TRANSPORT_HINTS: Record<RunnerFailureKind, string> = {
-  'transport-auth': RUNNER_TRANSPORT_AUTH_HINT,
-  // The request itself was malformed, so the runner will refuse it identically
-  // every time. Nothing to advise beyond the message the runner already gave.
-  'transport-request': '',
-  'transport-retryable': TRANSIENT_HINT,
-};
-
 // Reduce `gog auth list --json` output to just the configured email addresses.
 // The raw JSON also carries OAuth scopes, the Google subject id, and creation
 // timestamps — none of which belong in an error surfaced to the model, and
@@ -291,21 +263,6 @@ export function formatAccountList(raw: string): string {
 export async function diagnose(err: unknown): Promise<CallToolResult> {
   const errText = errorText(err);
 
-  // STRUCTURE BEFORE PROSE. A RunnerTransportError is this connector's own
-  // transport failing — its bearer, its request validation, its drain. Nothing
-  // was shown to Google, so none of the patterns below may be consulted for it:
-  // they exist to read gog's/Google's words, and the runner's words are not
-  // those. Read as prose, the runner's `unauthorized` matched
-  // DEFINITE_AUTH_PATTERN and produced AUTH_HINT — a human being told to
-  // re-authorize a healthy account over what was really a key mismatch.
-  //
-  // This short-circuits the ladder rather than joining it, so it is not a new
-  // rung in the precedence order documented below; that order still governs
-  // every error that genuinely came from gog.
-  const transportHint = isRunnerTransportError(err)
-    ? RUNNER_TRANSPORT_HINTS[err.kind]
-    : undefined;
-
   const isInvalidGrant = INVALID_GRANT_PATTERN.test(errText);
 
   // Precedence, and the reason for it. Reporting needs-auth is EXPENSIVE to be
@@ -321,10 +278,7 @@ export async function diagnose(err: unknown): Promise<CallToolResult> {
   const isTransientError = !DEFINITE_AUTH_PATTERN.test(errText) && TRANSIENT_ERROR_PATTERN.test(errText);
   const isAuthError = !isTransientError && AUTH_ERROR_PATTERN.test(errText);
   const isGridLimitError = GRID_LIMIT_ERROR_PATTERN.test(errText);
-  // `??`, not `||`: 'transport-request' maps to the empty string on purpose —
-  // "this failure is ours and there is nothing to advise" — and `||` would fall
-  // through to the prose ladder for exactly the errors that must never reach it.
-  const hint = transportHint ?? (isInvalidGrant
+  const hint = isInvalidGrant
     ? INVALID_GRANT_HINT
     : isAuthError
       ? AUTH_HINT
@@ -332,7 +286,7 @@ export async function diagnose(err: unknown): Promise<CallToolResult> {
         ? TRANSIENT_HINT
         : isGridLimitError
           ? GRID_LIMIT_HINT
-          : '');
+          : '';
   try {
     const accounts = formatAccountList(await run(['auth', 'list']));
     return errorResult(`${errText}\n\nConfigured accounts:\n${accounts || '(none)'}${hint}`);

package/tests/attachments.test.ts

@@ -125,9 +125,8 @@ describe('inlineAttachmentArgs', () => {
   // The budget belongs to the REQUEST, not to the attachments. `payloadArg`
   // turns any body over 4 KiB into a GogFileArg that rides in the same JSON
   // body at ~1:1, so a near-max attachment set plus a multi-MiB body overruns
-  // the runner even though each input is inside its own documented limit. That
-  // is the same invisible-transport-rejection failure the ceiling exists to
-  // prevent, so the sibling args are measured rather than assumed small.
+  // the budget even though each input is inside its own documented limit, so
+  // the sibling args are measured rather than assumed small.
   it('counts the message body against the same budget as the attachments', () => {
     // Three files just under the 8 MiB per-file cap, summing to just under the
     // per-message total — i.e. every input inside its own documented limit.
@@ -176,20 +175,18 @@ describe('inlineAttachmentArgs', () => {
 
   // THE INVARIANT behind the per-message ceiling, asserted rather than trusted.
   //
-  // connector-runtime sends every payload base64-encoded inside ONE JSON body,
-  // and the Fly runner caps that body at MAX_BODY_BYTES. Base64 inflates by 4/3,
-  // so a ceiling expressed in decoded bytes has to be derived from the wire cap
-  // or it documents a size that gets rejected as "request body too large" — a
-  // transport rejection from a layer the caller cannot see, which is the exact
-  // failure the tool-layer check exists to prevent. A 25 MiB total encoded to
-  // 34,952,536 chars against a 33,554,432 cap, so the limit was unreachable.
-  it('keeps a full message under the Fly runner request-body cap once base64-inflated', () => {
-    const RUNNER_MAX_BODY_BYTES = 32 * 1024 * 1024; // fly-gog-runner/server.mjs
+  // Every payload rides base64-encoded inside ONE JSON body, capped at a 32 MiB
+  // request budget. Base64 inflates by 4/3, so a ceiling expressed in decoded
+  // bytes has to be derived from the wire cap or it documents a size that cannot
+  // actually be sent. A 25 MiB total encoded to 34,952,536 chars against a
+  // 33,554,432 cap, so the limit was unreachable.
+  it('keeps a full message under the 32 MiB request budget once base64-inflated', () => {
+    const REQUEST_MAX_BODY_BYTES = 32 * 1024 * 1024;
     const encodedLength = (decoded: number): number => 4 * Math.ceil(decoded / 3);
 
     // The payload budget must leave the JSON structure room inside the cap…
-    expect(MAX_REQUEST_PAYLOAD_WIRE_BYTES).toBeLessThan(RUNNER_MAX_BODY_BYTES);
-    expect(RUNNER_MAX_BODY_BYTES - MAX_REQUEST_PAYLOAD_WIRE_BYTES).toBeGreaterThanOrEqual(128 * 1024);
+    expect(MAX_REQUEST_PAYLOAD_WIRE_BYTES).toBeLessThan(REQUEST_MAX_BODY_BYTES);
+    expect(REQUEST_MAX_BODY_BYTES - MAX_REQUEST_PAYLOAD_WIRE_BYTES).toBeGreaterThanOrEqual(128 * 1024);
     // …and a full attachment set must fit inside that budget once inflated.
     expect(encodedLength(MAX_INLINE_ATTACHMENT_TOTAL_BYTES)).toBeLessThanOrEqual(MAX_REQUEST_PAYLOAD_WIRE_BYTES);
     // The advertised number must itself be sendable — floor, not round.

package/tests/blob-upload.test.ts

@@ -1,204 +1,279 @@
-import { describe, it, expect, vi, afterEach } from 'vitest';
-import { uploadToBlobStore, RUNNER_UPLOAD_TIMEOUT_MS } from '../src/blob-upload.js';
+import { describe, it, expect, beforeEach, afterEach } from 'vitest';
+import { createServer, type IncomingMessage, type Server, type ServerResponse } from 'node:http';
+import type { AddressInfo } from 'node:net';
+import { mkdtemp, mkdir, writeFile, symlink, truncate, rm } from 'node:fs/promises';
+import { tmpdir } from 'node:os';
+import { join } from 'node:path';
+import {
+  uploadToBlobStore,
+  ATTACHMENT_DOWNLOAD_ROOT,
+  BLOB_UPLOAD_TIMEOUT_MS,
+  MAX_BLOB_UPLOAD_BYTES,
+} from '../src/blob-upload.js';
 
-// A minted PUT URL, with the two shapes the scrubber has to recognise: the
-// whole string, and the bare signature it carries.
 const SIG = 'AbCdEf-_1234';
-const PUT_URL = `https://host.example/b/reg_1/gmail/m1/Guest%20Copy.pdf?exp=1757000000000&sig=${SIG}`;
+const CONTENT = Buffer.from('%PDF-1.7 twelve bytes and a few more');
 
-const ENV = { GOG_RUNNER_URL: 'https://runner.example', GOG_RUNNER_KEY: 'runner-key' };
+interface Received {
+  method?: string;
+  headers: IncomingMessage['headers'];
+  body: Buffer;
+}
 
-const REQUEST = { path: '/tmp/gog-attachments/m1/Guest_Copy.pdf', url: PUT_URL, contentType: 'application/pdf' };
+let server: Server;
+let base: string;
+let received: Received[];
+let handler: (req: IncomingMessage, res: ServerResponse, body: Buffer) => void;
+let root: string;
+let outside: string;
 
-function answers(status: number, body: unknown, ok = status >= 200 && status < 300) {
-  return vi.fn(async () => ({
-    ok,
-    status,
-    text: async () => (typeof body === 'string' ? body : JSON.stringify(body)),
-  }));
+function signedUrl(path = '/b/reg_1/gmail/m1/a1/Guest%20Copy.pdf'): string {
+  return `${base}${path}?exp=1757000000000&sig=${SIG}`;
 }
 
-afterEach(() => {
-  vi.unstubAllGlobals();
-  vi.unstubAllEnvs();
+beforeEach(async () => {
+  received = [];
+  handler = (_req, res) => { res.writeHead(200); res.end(); };
+  server = createServer((req, res) => {
+    const chunks: Buffer[] = [];
+    req.on('data', (c: Buffer) => chunks.push(c));
+    req.on('end', () => {
+      const body = Buffer.concat(chunks);
+      received.push({ method: req.method, headers: req.headers, body });
+      handler(req, res, body);
+    });
+  });
+  await new Promise<void>((resolve) => server.listen(0, '127.0.0.1', resolve));
+  base = `http://127.0.0.1:${(server.address() as AddressInfo).port}`;
+
+  const scratch = await mkdtemp(join(tmpdir(), 'blob-upload-'));
+  root = join(scratch, 'gog-attachments');
+  outside = join(scratch, 'outside');
+  await mkdir(join(root, 'm1', 'a1'), { recursive: true });
+  await mkdir(outside);
+  await writeFile(join(root, 'm1', 'a1', 'Guest_Copy.pdf'), CONTENT);
+  await writeFile(join(outside, 'refresh-token'), 'secret');
+});
+
+afterEach(async () => {
+  server.closeAllConnections();
+  await new Promise<void>((resolve) => server.close(() => resolve()));
+  await rm(join(root, '..'), { recursive: true, force: true });
+});
+
+const file = () => join(root, 'm1', 'a1', 'Guest_Copy.pdf');
+const request = (overrides: Partial<{ path: string; url: string; contentType: string }> = {}) => ({
+  path: file(),
+  url: signedUrl(),
+  contentType: 'application/pdf',
+  ...overrides,
 });
+const failure = (promise: Promise<unknown>) => promise.then(
+  () => { throw new Error('expected the upload to fail'); },
+  (err: Error) => err,
+);
 
 describe('uploadToBlobStore', () => {
-  it('POSTs the path, the URL and the content type to the runner, bearing its key', async () => {
-    const fetchMock = answers(200, { ok: true, status: 200, bytes: 99723 });
-    vi.stubGlobal('fetch', fetchMock);
-
-    const outcome = await uploadToBlobStore(REQUEST, { env: { ...ENV, GOG_RUNNER_URL: 'https://runner.example//' } });
-
-    expect(outcome).toEqual({ bytes: 99723, status: 200 });
-    const [url, init] = fetchMock.mock.calls[0] as [string, RequestInit];
-    // Trailing slashes trimmed — `<endpoint>//upload` is a different route.
-    expect(url).toBe('https://runner.example/upload');
-    expect(init.method).toBe('POST');
-    expect(init.headers).toMatchObject({
-      Authorization: 'Bearer runner-key',
-      'Content-Type': 'application/json',
-    });
-    expect(JSON.parse(init.body as string)).toEqual({
-      path: REQUEST.path,
-      url: PUT_URL,
-      contentType: 'application/pdf',
-    });
-    // A deadline of our own: the runner's 120 s is an INACTIVITY timer and
-    // cannot bound a transfer that keeps dribbling, so nothing else protects
-    // the MCP caller from a request that never ends.
-    expect(init.signal).toBeInstanceOf(AbortSignal);
+  it('PUTs the file to the signed URL and reports the size streamed and the status', async () => {
+    handler = (_req, res) => { res.writeHead(201); res.end(); };
+
+    const outcome = await uploadToBlobStore(request(), { root });
+
+    expect(outcome).toEqual({ bytes: CONTENT.length, status: 201 });
+    expect(received).toHaveLength(1);
+    expect(received[0].method).toBe('PUT');
+    expect(received[0].body.equals(CONTENT)).toBe(true);
+    // Content-Length from the file's own size — a chunked PUT is a 411 at the
+    // gateway, so this must never be left to the transport.
+    expect(received[0].headers['content-length']).toBe(String(CONTENT.length));
+    expect(received[0].headers['transfer-encoding']).toBeUndefined();
   });
 
-  it('refuses, without dialling, when no gog runner is configured', async () => {
-    const fetchMock = answers(200, { ok: true });
-    vi.stubGlobal('fetch', fetchMock);
+  // The PUT signature commits to the content type, so any normalisation —
+  // re-casing, a charset appended, a default substituted — is a refusal that
+  // reads like a missing object.
+  it('sends the content type byte for byte as given', async () => {
+    await uploadToBlobStore(request({ contentType: 'Application/PDF; Name="x"' }), { root });
 
-    await expect(uploadToBlobStore(REQUEST, { env: { GOG_RUNNER_URL: ENV.GOG_RUNNER_URL } }))
-      .rejects.toThrow(/GOG_RUNNER_URL.*GOG_RUNNER_KEY/s);
-    await expect(uploadToBlobStore(REQUEST, { env: { GOG_RUNNER_KEY: ENV.GOG_RUNNER_KEY } }))
-      .rejects.toThrow(/GOG_RUNNER_URL.*GOG_RUNNER_KEY/s);
-    expect(fetchMock).not.toHaveBeenCalled();
+    expect(received[0].headers['content-type']).toBe('Application/PDF; Name="x"');
   });
 
-  it('reports the blob store\'s own verdict when the runner relays a refusal', async () => {
-    vi.stubGlobal('fetch', answers(422, {
-      error: 'the blob store refused the upload with 403: forbidden',
-      status: 403,
-      retryable: false,
-    }));
-
-    await expect(uploadToBlobStore(REQUEST, { env: ENV }))
-      .rejects.toThrow(/the blob store refused the upload with 403: forbidden/);
+  it('accepts a path relative to the root', async () => {
+    await expect(uploadToBlobStore(request({ path: 'm1/a1/Guest_Copy.pdf' }), { root }))
+      .resolves.toEqual({ bytes: CONTENT.length, status: 200 });
   });
 
-  it('names the runner\'s status when it answers with no error text', async () => {
-    vi.stubGlobal('fetch', answers(502, { retryable: true }));
+  describe('confinement to the download root', () => {
+    it('refuses a path that walks out of the root, without dialling', async () => {
+      const err = await failure(uploadToBlobStore(
+        request({ path: join(root, '..', 'outside', 'refresh-token') }), { root },
+      ));
+
+      expect(err.message).toMatch(/must be inside/);
+      expect(received).toHaveLength(0);
+    });
+
+    it('refuses a sibling that merely shares the root as a prefix', async () => {
+      await mkdir(`${root}-evil`);
+      await writeFile(`${root}-evil/x`, 'nope');
+
+      const err = await failure(uploadToBlobStore(request({ path: `${root}-evil/x` }), { root }));
+
+      expect(err.message).toMatch(/must be inside/);
+      expect(received).toHaveLength(0);
+    });
+
+    it('refuses a symlink inside the root that points outside it', async () => {
+      await symlink(join(outside, 'refresh-token'), join(root, 'm1', 'escape'));
+
+      const err = await failure(uploadToBlobStore(request({ path: join(root, 'm1', 'escape') }), { root }));
+
+      expect(err.message).toMatch(/must be inside/);
+      expect(received).toHaveLength(0);
+    });
+
+    it('refuses a directory', async () => {
+      const err = await failure(uploadToBlobStore(request({ path: join(root, 'm1') }), { root }));
+
+      expect(err.message).toMatch(/regular file/);
+      expect(received).toHaveLength(0);
+    });
+
+    it('says the file is missing, rather than failing somewhere later', async () => {
+      const err = await failure(uploadToBlobStore(request({ path: join(root, 'm1', 'gone.pdf') }), { root }));
+
+      expect(err.message).toMatch(/could not be found/);
+      expect(received).toHaveLength(0);
+    });
+
+    it('confines to the real attachment root when no root is given', async () => {
+      expect(ATTACHMENT_DOWNLOAD_ROOT).toBe('/tmp/gog-attachments');
 
-    await expect(uploadToBlobStore(REQUEST, { env: ENV })).rejects.toThrow(/502/);
+      const err = await failure(uploadToBlobStore(request({ path: '/etc/passwd' })));
+
+      expect(err.message).toContain('must be inside /tmp/gog-attachments');
+      expect(received).toHaveLength(0);
+    });
   });
 
-  it('survives an answer that is not JSON at all (a proxy\'s HTML error page)', async () => {
-    vi.stubGlobal('fetch', answers(504, '<html>gateway timeout</html>'));
+  // mcp-host's blob store answers 413 past 100 MiB, but only after the whole
+  // transfer has run — and a caller reads a late size error as a signing one.
+  it('refuses a file over the blob store\'s ceiling before dialling', async () => {
+    expect(MAX_BLOB_UPLOAD_BYTES).toBe(100 * 1024 * 1024);
+    const big = join(root, 'm1', 'a1', 'huge.bin');
+    await writeFile(big, '');
+    await truncate(big, MAX_BLOB_UPLOAD_BYTES + 1); // sparse: no 100 MiB write
 
-    // The body is quoted, not parsed — and the throw is about the upload, never
-    // a SyntaxError from somewhere inside this module.
-    await expect(uploadToBlobStore(REQUEST, { env: ENV })).rejects.toThrow(/504/);
+    const err = await failure(uploadToBlobStore(request({ path: big }), { root }));
+
+    expect(err.message).toContain(`${MAX_BLOB_UPLOAD_BYTES + 1} bytes`);
+    expect(err.message).toContain(String(MAX_BLOB_UPLOAD_BYTES));
+    expect(received).toHaveLength(0);
   });
 
-  // A signed URL is a credential with up to 24 h of anybody-who-holds-it access
-  // to the object. The runner scrubs its own words, but the far side's text is
-  // a third party's and may quote the request URL straight back — and an error
-  // thrown here is the one value on this path that is expected to be logged.
-  it('never lets the signed URL, or its bare signature, into the error it throws', async () => {
-    vi.stubGlobal('fetch', answers(422, { error: `refused: PUT ${PUT_URL} (sig ${SIG})`, status: 403 }));
-
-    const err = await uploadToBlobStore(REQUEST, { env: ENV }).catch((e: Error) => e);
-    expect(err).toBeInstanceOf(Error);
-    expect((err as Error).message).not.toContain(PUT_URL);
-    expect((err as Error).message).not.toContain(SIG);
-    expect((err as Error).message).toContain('<signed url>');
+  it('refuses a URL that is not absolute http(s), without dialling', async () => {
+    for (const url of ['not a url at all', 'ftp://blob.example/x', '']) {
+      const err = await failure(uploadToBlobStore(request({ url }), { root }));
+      expect(err.message).toMatch(/absolute http\(s\) URL/);
+    }
+    expect(received).toHaveLength(0);
   });
 
-  it('scrubs a transport failure too — a rejected fetch may quote the URL', async () => {
-    vi.stubGlobal('fetch', vi.fn(async () => {
-      throw new Error(`connect ECONNREFUSED while sending ${PUT_URL}`);
-    }));
+  it('throws with the blob store\'s status and a bounded quote of its answer', async () => {
+    handler = (_req, res) => {
+      res.writeHead(403, { 'content-type': 'application/json' });
+      res.end(JSON.stringify({ error: 'signature does not verify' }));
+    };
+
+    const err = await failure(uploadToBlobStore(request(), { root }));
 
-    const err = await uploadToBlobStore(REQUEST, { env: ENV }).catch((e: Error) => e);
-    expect((err as Error).message).not.toContain(PUT_URL);
-    expect((err as Error).message).not.toContain(SIG);
-    expect((err as Error).message).toContain('ECONNREFUSED');
+    expect(err.message).toMatch(/403/);
+    expect(err.message).toContain('signature does not verify');
   });
 
-  it('reports a transport failure that threw something other than an Error', async () => {
-    vi.stubGlobal('fetch', vi.fn(async () => { throw 'socket hang up'; }));
+  it('quotes no more than a snippet of a long error body', async () => {
+    handler = (_req, res) => {
+      res.writeHead(500);
+      res.write('x'.repeat(400));
+      setTimeout(() => {
+        res.write('y'.repeat(400));
+        setTimeout(() => res.end('z'.repeat(400)), 20);
+      }, 20);
+    };
+
+    const err = await failure(uploadToBlobStore(request(), { root }));
+
+    expect(err.message).toMatch(/500/);
+    expect(err.message).not.toContain('z');
+    expect(err.message.length).toBeLessThan(1000);
+  });
+
+  it('gives up at its total deadline rather than hanging the MCP request', async () => {
+    handler = () => { /* never answers */ };
+
+    const err = await failure(uploadToBlobStore(request(), { root, timeoutMs: 50 }));
 
-    await expect(uploadToBlobStore(REQUEST, { env: ENV })).rejects.toThrow(/socket hang up/);
+    expect(err.message).toMatch(/did not finish within 50ms/);
   });
 
-  // The response ARRIVES and then its body fails to read — a severed or
-  // truncated answer. That is a third shape of transport failure, and the
-  // module's contract is about every one of them: nothing it throws carries the
-  // URL. undici's own body errors ('terminated', 'Premature close') happen to
-  // name nothing, so this is the guarantee being a property of the function
-  // rather than a fact about today's runtime.
-  it('scrubs a body that fails to read, as it scrubs a failed dial', async () => {
-    vi.stubGlobal('fetch', vi.fn(async () => ({
-      ok: true,
-      status: 200,
-      text: async () => { throw new Error(`terminated while reading ${PUT_URL}`); },
-    })));
-
-    const err = await uploadToBlobStore(REQUEST, { env: ENV }).catch((e: Error) => e);
-    expect(err).toBeInstanceOf(Error);
-    expect((err as Error).message).not.toContain(PUT_URL);
-    expect((err as Error).message).not.toContain(SIG);
-    expect((err as Error).message).toContain('terminated');
+  it('keeps a deadline of its own by default', () => {
+    expect(BLOB_UPLOAD_TIMEOUT_MS).toBeGreaterThan(30_000);
   });
 
-  it('reports a body read that rejected with something other than an Error', async () => {
-    vi.stubGlobal('fetch', vi.fn(async () => ({
-      ok: true,
-      status: 200,
-      text: async () => { throw 'premature close'; },
-    })));
+  // A signed URL is a credential with up to 24 h of anybody-who-holds-it access
+  // to the object, and everything thrown here is expected to be logged.
+  describe('never lets the signed URL or its bare signature into a message', () => {
+    it('scrubs the blob store quoting the request back', async () => {
+      handler = (req, res) => { res.writeHead(403); res.end(`refused PUT ${base}${req.url} (sig ${SIG})`); };
 
-    await expect(uploadToBlobStore(REQUEST, { env: ENV })).rejects.toThrow(/premature close/);
-  });
+      const err = await failure(uploadToBlobStore(request(), { root }));
 
-  // The whole-string replacement is what does the work for a URL with no `sig`
-  // at all — and a URL that is not parseable must still be redacted rather than
-  // throwing on the way to a redaction.
-  it('scrubs a URL that carries no signature and does not parse', async () => {
-    const odd = 'not a url at all';
-    vi.stubGlobal('fetch', answers(422, { error: `refused: ${odd}`, status: 400 }));
+      expect(err.message).not.toContain(signedUrl());
+      expect(err.message).not.toContain(SIG);
+      expect(err.message).toContain('<signed url>');
+    });
 
-    const err = await uploadToBlobStore({ ...REQUEST, url: odd }, { env: ENV }).catch((e: Error) => e);
-    expect((err as Error).message).not.toContain(odd);
-    expect((err as Error).message).toContain('<signed url>');
-  });
+    it('scrubs a transport failure', async () => {
+      server.closeAllConnections();
+      await new Promise<void>((resolve) => server.close(() => resolve()));
+      server = createServer();
+      server.listen(0);
 
-  // `split('')` cuts a message into single characters and interleaves the
-  // replacement between every one of them, so an empty needle does not redact a
-  // message, it destroys it. Today's one call site always mints a URL first —
-  // this is a property of the function, which is why it is asserted on it.
-  it('an empty URL leaves the message intact rather than shredding it', async () => {
-    vi.stubGlobal('fetch', answers(422, { error: 'the blob store refused the upload', status: 403 }));
+      const err = await failure(uploadToBlobStore(request(), { root }));
 
-    const err = await uploadToBlobStore({ ...REQUEST, url: '' }, { env: ENV }).catch((e: Error) => e);
-    expect((err as Error).message).toContain('the blob store refused the upload');
-    expect((err as Error).message).not.toContain('<signed url>');
-  });
+      expect(err.message).toMatch(/ECONNREFUSED/);
+      expect(err.message).not.toContain(SIG);
+    });
 
-  it('reads the ambient environment, and its own deadline, when given neither', async () => {
-    const fetchMock = answers(200, { ok: true, status: 200, bytes: 12 });
-    vi.stubGlobal('fetch', fetchMock);
-    vi.stubEnv('GOG_RUNNER_URL', ENV.GOG_RUNNER_URL);
-    vi.stubEnv('GOG_RUNNER_KEY', ENV.GOG_RUNNER_KEY);
+    it('scrubs a response severed mid-body', async () => {
+      handler = (_req, res) => {
+        res.writeHead(403, { 'content-length': '1000' });
+        res.write('partial', () => res.socket?.destroy());
+      };
 
-    await expect(uploadToBlobStore(REQUEST)).resolves.toEqual({ bytes: 12, status: 200 });
-    expect((fetchMock.mock.calls[0] as [string, RequestInit])[0]).toBe('https://runner.example/upload');
-  });
+      const err = await failure(uploadToBlobStore(request(), { root }));
 
-  it('exposes its deadline as a constant rather than a literal at the call site', () => {
-    expect(RUNNER_UPLOAD_TIMEOUT_MS).toBeGreaterThan(30_000);
-  });
+      expect(err.message).toMatch(/upload to the blob store did not complete/);
+      expect(err.message).not.toContain(SIG);
+    });
 
-  // The rule this repo already applies at the other hop (`DEADLINE_GRACE_MS` in
-  // connector-runtime.ts: 30 s backend budget + 5 s): the CALLER's deadline sits
-  // ABOVE the backend's own, so the backend loses the race only when it
-  // genuinely cannot answer. The doc block here cited that rule while the
-  // numbers inverted it — 90 s against the runner's 120 s — so a socket that
-  // went quiet was aborted on this side 30 s before the runner's own timer could
-  // name it, turning "the upload timed out after 120000ms" into exactly the
-  // opaque client abort the rule exists to prevent.
-  //
-  // Restated rather than imported: `fly-gog-runner/server.mjs` must not be
-  // pulled into the Worker bundle (the same reason the attachment ceilings are
-  // restated in attachments.ts), so the two move by hand and this is the guard.
-  it('sits above the runner\'s own upload timeout, so the runner answers first', () => {
-    const UPLOAD_TIMEOUT_MS_ON_THE_BOX = 120_000; // server.mjs UPLOAD_TIMEOUT_MS
-    expect(RUNNER_UPLOAD_TIMEOUT_MS).toBeGreaterThan(UPLOAD_TIMEOUT_MS_ON_THE_BOX);
+    it('scrubs a TLS failure on an https URL', async () => {
+      const url = signedUrl().replace('http:', 'https:');
+
+      const err = await failure(uploadToBlobStore(request({ url }), { root }));
+
+      expect(err.message).toMatch(/upload to the blob store did not complete/);
+      expect(err.message).not.toContain(url);
+      expect(err.message).not.toContain(SIG);
+    });
+
+    // `split('')` would cut the message into characters and interleave the
+    // replacement between every one of them.
+    it('leaves a message intact when the URL is empty', async () => {
+      const err = await failure(uploadToBlobStore(request({ url: '' }), { root }));
+
+      expect(err.message).not.toContain('<signed url>');
+      expect(err.message).toMatch(/absolute http\(s\) URL/);
+    });
   });
 });