gogcli-mcp 4.2.5 → 4.3.0

package/tests/tools/drive.test.ts

@@ -1,7 +1,8 @@
-import { describe, it, expect, vi, beforeEach } from 'vitest';
+import { describe, it, expect, vi, beforeEach, afterEach } from 'vitest';
 import { registerDriveTools, DRIVE_LS_COMPACT_FIELDS } from '../../src/tools/drive.js';
 import * as runner from '../../src/runner.js';
 import { createTestHarness } from '@chrischall/mcp-utils/test';
+import { pos } from '../../src/argv.js';
 
 vi.mock('../../src/runner.js');
 
@@ -111,7 +112,7 @@ describe('gog_drive_search', () => {
     const harness = await setupHandlers();
     await harness.callTool('gog_drive_search', { query: 'budget' });
     expect(runner.run).toHaveBeenCalledWith(
-      ['drive', 'search', 'budget'],
+      ['drive', 'search', pos('budget')],
       { account: undefined, stripMedia: true },
     );
   });
@@ -121,7 +122,7 @@ describe('gog_drive_search', () => {
     const harness = await setupHandlers();
     await harness.callTool('gog_drive_search', { query: 'budget', view: 'full' });
     expect(runner.run).toHaveBeenCalledWith(
-      ['drive', 'search', 'budget'],
+      ['drive', 'search', pos('budget')],
       { account: undefined, stripMedia: false },
     );
   });
@@ -142,14 +143,14 @@ describe('gog_drive_get', () => {
     vi.mocked(runner.run).mockResolvedValue('{}');
     const harness = await setupHandlers();
     await harness.callTool('gog_drive_get', { fileId: 'f1' });
-    expect(runner.run).toHaveBeenCalledWith(['drive', 'get', 'f1'], { account: undefined, stripMedia: true });
+    expect(runner.run).toHaveBeenCalledWith(['drive', 'get', pos('f1')], { account: undefined, stripMedia: true });
   });
 
   it('keeps everything for the full view', async () => {
     vi.mocked(runner.run).mockResolvedValue('{}');
     const harness = await setupHandlers();
     await harness.callTool('gog_drive_get', { fileId: 'f1', view: 'full' });
-    expect(runner.run).toHaveBeenCalledWith(['drive', 'get', 'f1'], { account: undefined, stripMedia: false });
+    expect(runner.run).toHaveBeenCalledWith(['drive', 'get', pos('f1')], { account: undefined, stripMedia: false });
   });
 
 
@@ -166,7 +167,7 @@ describe('gog_drive_mkdir', () => {
     vi.mocked(runner.run).mockResolvedValue('{"id":"new-folder"}');
     const harness = await setupHandlers();
     await harness.callTool('gog_drive_mkdir', { name: 'Reports' });
-    expect(runner.run).toHaveBeenCalledWith(['drive', 'mkdir', 'Reports'], { account: undefined });
+    expect(runner.run).toHaveBeenCalledWith(['drive', 'mkdir', pos('Reports')], { account: undefined });
   });
 
   it('returns error text on failure', async () => {
@@ -182,7 +183,7 @@ describe('gog_drive_rename', () => {
     vi.mocked(runner.run).mockResolvedValue('{}');
     const harness = await setupHandlers();
     await harness.callTool('gog_drive_rename', { fileId: 'file1', newName: 'Budget 2026' });
-    expect(runner.run).toHaveBeenCalledWith(['drive', 'rename', 'file1', 'Budget 2026'], { account: undefined });
+    expect(runner.run).toHaveBeenCalledWith(['drive', 'rename', pos('file1'), pos('Budget 2026')], { account: undefined });
   });
 
   it('returns error text on failure', async () => {
@@ -198,7 +199,7 @@ describe('gog_drive_move', () => {
     vi.mocked(runner.run).mockResolvedValue('{}');
     const harness = await setupHandlers();
     await harness.callTool('gog_drive_move', { fileId: 'file1', parentId: 'folder1' });
-    expect(runner.run).toHaveBeenCalledWith(['drive', 'move', 'file1', '--parent=folder1'], { account: undefined });
+    expect(runner.run).toHaveBeenCalledWith(['drive', 'move', pos('file1'), '--parent=folder1'], { account: undefined });
   });
 
   it('returns error text on failure', async () => {
@@ -214,7 +215,7 @@ describe('gog_drive_delete', () => {
     vi.mocked(runner.run).mockResolvedValue('{}');
     const harness = await setupHandlers();
     await harness.callTool('gog_drive_delete', { fileId: 'file1' });
-    expect(runner.run).toHaveBeenCalledWith(['drive', 'delete', 'file1', '--force'], { account: undefined });
+    expect(runner.run).toHaveBeenCalledWith(['drive', 'delete', pos('file1'), '--force'], { account: undefined });
   });
 
   it('appends --permanent when permanent=true', async () => {
@@ -222,7 +223,7 @@ describe('gog_drive_delete', () => {
     const harness = await setupHandlers();
     await harness.callTool('gog_drive_delete', { fileId: 'file1', permanent: true });
     expect(runner.run).toHaveBeenCalledWith(
-      ['drive', 'delete', 'file1', '--permanent', '--force'],
+      ['drive', 'delete', pos('file1'), '--permanent', '--force'],
       { account: undefined },
     );
   });
@@ -231,7 +232,7 @@ describe('gog_drive_delete', () => {
     vi.mocked(runner.run).mockResolvedValue('{}');
     const harness = await setupHandlers();
     await harness.callTool('gog_drive_delete', { fileId: 'file1', permanent: false });
-    expect(runner.run).toHaveBeenCalledWith(['drive', 'delete', 'file1', '--force'], { account: undefined });
+    expect(runner.run).toHaveBeenCalledWith(['drive', 'delete', pos('file1'), '--force'], { account: undefined });
   });
 
   it('returns error text on failure', async () => {
@@ -248,7 +249,7 @@ describe('gog_drive_share', () => {
     const harness = await setupHandlers();
     await harness.callTool('gog_drive_share', { fileId: 'file1', to: 'user', email: 'bob@example.com' });
     expect(runner.run).toHaveBeenCalledWith(
-      ['drive', 'share', 'file1', '--to=user', '--email=bob@example.com'],
+      ['drive', 'share', pos('file1'), '--to=user', '--email=bob@example.com'],
       { account: undefined },
     );
   });
@@ -258,7 +259,7 @@ describe('gog_drive_share', () => {
     const harness = await setupHandlers();
     await harness.callTool('gog_drive_share', { fileId: 'file1', to: 'domain', domain: 'example.com', role: 'writer' });
     expect(runner.run).toHaveBeenCalledWith(
-      ['drive', 'share', 'file1', '--to=domain', '--domain=example.com', '--role=writer'],
+      ['drive', 'share', pos('file1'), '--to=domain', '--domain=example.com', '--role=writer'],
       { account: undefined },
     );
   });
@@ -268,7 +269,7 @@ describe('gog_drive_share', () => {
     const harness = await setupHandlers();
     await harness.callTool('gog_drive_share', { fileId: 'file1', to: 'anyone' });
     expect(runner.run).toHaveBeenCalledWith(
-      ['drive', 'share', 'file1', '--to=anyone', '--force'],
+      ['drive', 'share', pos('file1'), '--to=anyone', '--force'],
       { account: undefined },
     );
   });
@@ -295,6 +296,58 @@ describe('gog_drive_run', () => {
     const result = await harness.callTool('gog_drive_run', { subcommand: 'copy', args: [] });
     expect(result.content[0].text).toBe('Error: Run failed');
   });
+
+  // SEC-1 regression: `gog --readonly drive mkdir x --readonly=false` reached
+  // Google on gog 0.41.0, defeating the GOG_READONLY kill switch.
+  it('refuses --readonly=false so GOG_READONLY cannot be overridden', async () => {
+    const harness = await setupHandlers();
+    const result = await harness.callTool('gog_drive_run', { subcommand: 'mkdir', args: ['x', '--readonly=false'] });
+    expect(result.isError).toBe(true);
+    expect(result.content[0].text).toMatch(/--readonly=false is not allowed/);
+    expect(runner.run).not.toHaveBeenCalled();
+  });
+});
+
+// SEC-3/SEC-4 through the escape hatch: GOG_FILE_ROOTS must bind gog_drive_run
+// too, or `upload <gog's credentials.json>` exfiltrates what the roots protect.
+describe('gog_drive_run path confinement', () => {
+  // The suite runs with GOG_FILE_ROOTS='/'; narrow it so confinement bites.
+  let prevRoots: string | undefined;
+  beforeEach(() => { prevRoots = process.env.GOG_FILE_ROOTS; process.env.GOG_FILE_ROOTS = '/nonexistent-gog-file-root'; });
+  afterEach(() => { process.env.GOG_FILE_ROOTS = prevRoots; });
+
+  it('refuses upload, whose local path is positional, pointing at gog_drive_upload', async () => {
+    const harness = await setupHandlers();
+    const result = await harness.callTool('gog_drive_run', {
+      subcommand: 'upload',
+      args: ['/Users/x/Library/Application Support/gogcli/credentials.json'],
+    });
+    expect(result.isError).toBe(true);
+    expect(result.content[0].text).toMatch(/gog_drive_upload/);
+    expect(runner.run).not.toHaveBeenCalled();
+  });
+
+  it('refuses a download --out outside GOG_FILE_ROOTS', async () => {
+    const harness = await setupHandlers();
+    const result = await harness.callTool('gog_drive_run', { subcommand: 'download', args: ['f1', '--out=~/.zshrc'] });
+    expect(result.isError).toBe(true);
+    expect(result.content[0].text).toMatch(/--out "~\/.zshrc" is outside/);
+    expect(runner.run).not.toHaveBeenCalled();
+  });
+
+  it('refuses a --on-change hook, which runs a local command', async () => {
+    const harness = await setupHandlers();
+    const result = await harness.callTool('gog_drive_run', { subcommand: 'changes', args: ['poll', '--on-change=sh -c id'] });
+    expect(result.isError).toBe(true);
+    expect(runner.run).not.toHaveBeenCalled();
+  });
+
+  it('still forwards a --file Drive ID, which is not a local path', async () => {
+    vi.mocked(runner.run).mockResolvedValue('{}');
+    const harness = await setupHandlers();
+    await harness.callTool('gog_drive_run', { subcommand: 'audit', args: ['sharing', '--file=1AbC'] });
+    expect(runner.run).toHaveBeenCalledWith(['drive', 'audit', 'sharing', '--file=1AbC'], { account: undefined });
+  });
 });
 
 describe('gog_drive_extract_text', () => {
@@ -324,7 +377,7 @@ describe('gog_drive_extract_text', () => {
       ['api', 'call', 'drive', 'v3', 'files.export', '--params={"fileId":"tmpDoc1","mimeType":"text/plain"}'],
       { account: undefined },
     );
-    expect(runner.run).toHaveBeenCalledWith(['drive', 'delete', 'tmpDoc1', '--permanent', '--force'], { account: undefined });
+    expect(runner.run).toHaveBeenCalledWith(['drive', 'delete', pos('tmpDoc1'), '--permanent', '--force'], { account: undefined });
   });
 
   it('passes an ocrLanguage hint on the copy', async () => {
@@ -340,7 +393,7 @@ describe('gog_drive_extract_text', () => {
         '--params={"fileId":"pdf1","ocrLanguage":"fr"}', '--body={"name":"gogcli-ocr-pdf1","mimeType":"application/vnd.google-apps.document"}'],
       { account: undefined, timeout: 300_000 },
     );
-    expect(runner.run).toHaveBeenCalledWith(['drive', 'delete', 'tmpDoc2', '--permanent', '--force'], { account: undefined });
+    expect(runner.run).toHaveBeenCalledWith(['drive', 'delete', pos('tmpDoc2'), '--permanent', '--force'], { account: undefined });
   });
 
   it('exports a native Google Doc directly with no convert or temp cleanup', async () => {
@@ -383,7 +436,7 @@ describe('gog_drive_extract_text', () => {
     const result = await harness.callTool('gog_drive_extract_text', { fileId: 'pdf1' });
     expect(result.isError).toBe(true);
     expect(result.content[0].text).toContain('export exploded');
-    expect(runner.run).toHaveBeenCalledWith(['drive', 'delete', 'tmpDoc3', '--permanent', '--force'], { account: undefined });
+    expect(runner.run).toHaveBeenCalledWith(['drive', 'delete', pos('tmpDoc3'), '--permanent', '--force'], { account: undefined });
   });
 
   it('errors clearly when OCR conversion returns no id (and creates nothing to clean up)', async () => {
@@ -417,7 +470,7 @@ describe('gog_drive_extract_text', () => {
       .mockResolvedValueOnce('body');
     const harness = await setupHandlers();
     await harness.callTool('gog_drive_extract_text', { fileId: 'doc1', account: 'me@x.com' });
-    expect(runner.run).toHaveBeenCalledWith(['drive', 'get', 'doc1'], { account: 'me@x.com' });
+    expect(runner.run).toHaveBeenCalledWith(['drive', 'get', pos('doc1')], { account: 'me@x.com' });
   });
 });
 
@@ -435,10 +488,44 @@ describe('gog_drive_read_bytes', () => {
     expect(result.content[0].text).toContain('a.pdf');
     expect(runner.runBinary).toHaveBeenCalledWith(
       ['api', 'call', 'drive', 'v3', 'files.get', '--params={"fileId":"f1","alt":"media"}'],
-      { account: undefined },
+      { account: undefined, maxOutputBytes: 8 * 1024 * 1024 },
     );
   });
 
+  // BUG-2: the size is known from `drive get` before a byte is fetched.
+  it('refuses a file over the inline ceiling without fetching its bytes', async () => {
+    vi.mocked(runner.run).mockResolvedValueOnce(JSON.stringify({ file: { name: 'backup.zip', mimeType: 'application/zip', size: '4294967296' } }));
+    const harness = await setupHandlers();
+    const result = await harness.callTool('gog_drive_read_bytes', { fileId: 'f1' });
+    expect(result.isError).toBe(true);
+    expect(result.content[0].text).toMatch(/4294967296 bytes.*8 MiB/);
+    expect(result.content[0].text).toContain('gog_drive_extract_text');
+    expect(runner.runBinary).not.toHaveBeenCalled();
+  });
+
+  it('names the file by id when an oversized file has no name', async () => {
+    vi.mocked(runner.run).mockResolvedValueOnce(JSON.stringify({ size: 9 * 1024 * 1024 }));
+    const harness = await setupHandlers();
+    const result = await harness.callTool('gog_drive_read_bytes', { fileId: 'f9' });
+    expect(result.content[0].text).toMatch(/^f9 is 9437184 bytes/);
+  });
+
+  it('treats an unparseable size as unknown and relies on the fetch cap', async () => {
+    vi.mocked(runner.run).mockResolvedValueOnce(JSON.stringify({ file: { name: 'a.bin', size: 'n/a' } }));
+    vi.mocked(runner.runBinary).mockResolvedValueOnce(Buffer.from('x').toString('base64'));
+    const harness = await setupHandlers();
+    const result = await harness.callTool('gog_drive_read_bytes', { fileId: 'f1' });
+    expect(result.isError).toBeFalsy();
+  });
+
+  it('caps the fetch itself when Drive reports no size', async () => {
+    vi.mocked(runner.run).mockResolvedValueOnce(JSON.stringify({ file: { name: 'a.bin', mimeType: 'application/octet-stream' } }));
+    vi.mocked(runner.runBinary).mockResolvedValueOnce(Buffer.from('x').toString('base64'));
+    const harness = await setupHandlers();
+    await harness.callTool('gog_drive_read_bytes', { fileId: 'f1' });
+    expect(runner.runBinary).toHaveBeenCalledWith(expect.any(Array), { account: undefined, maxOutputBytes: 8 * 1024 * 1024 });
+  });
+
   it('names the text fallback when the resource type is one hosts refuse to render', async () => {
     // The bytes arrive fine; some hosts just drop a non-image embedded resource
     // ("Resources of type 'application/pdf' are not currently supported"), and