gogcli-mcp 4.2.5 → 4.3.0

package/src/tools/chat.ts

@@ -9,6 +9,8 @@ import {
 } from './utils.js';
 import type { GogArg } from '../runner.js';
 import { attachInlineParam, inlineAttachmentArgs } from '../attachments.js';
+import { pos } from '../argv.js';
+import { confinePaths } from '../file-roots.js';
 
 // Google Chat (gog >= 0.38.0 for the mention/reaction metadata in
 // `messages list`, >= 0.39.0 for `messages search`; the rest is older).
@@ -54,7 +56,7 @@ export function registerChatTools(server: McpServer): void {
       account: accountParam,
     }),
   }, async ({ max, pageToken, page, all, account }) => {
-    const args = ['chat', 'spaces', 'list'];
+    const args: GogArg[] = ['chat', 'spaces', 'list'];
     pushPaginationFlags(args, { max, pageToken, page, all });
     return runOrDiagnose(args, { account });
   });
@@ -72,7 +74,7 @@ export function registerChatTools(server: McpServer): void {
       account: accountParam,
     }),
   }, async ({ displayName, exact, max, account }) => {
-    const args = ['chat', 'spaces', 'find', displayName];
+    const args: GogArg[] = ['chat', 'spaces', 'find', pos(displayName)];
     if (exact) args.push('--exact');
     if (max !== undefined) args.push(`--max=${max}`);
     return runOrDiagnose(args, { account });
@@ -89,7 +91,7 @@ export function registerChatTools(server: McpServer): void {
       account: accountParam,
     }),
   }, async ({ displayName, members, account }) => {
-    const args = ['chat', 'spaces', 'create', displayName];
+    const args: GogArg[] = ['chat', 'spaces', 'create', pos(displayName)];
     if (members) for (const member of members) args.push(`--member=${member}`);
     return runOrDiagnose(args, { account });
   });
@@ -105,7 +107,7 @@ export function registerChatTools(server: McpServer): void {
       account: accountParam,
     }),
   }, async ({ space, max, pageToken, page, all, account }) => {
-    const args = ['chat', 'threads', 'list', space];
+    const args: GogArg[] = ['chat', 'threads', 'list', pos(space)];
     pushPaginationFlags(args, { max, pageToken, page, all });
     return runOrDiagnose(args, { account });
   });
@@ -128,7 +130,7 @@ export function registerChatTools(server: McpServer): void {
       account: accountParam,
     }),
   }, async ({ space, thread, unread, order, max, pageToken, page, all, account }) => {
-    const args = ['chat', 'messages', 'list', space];
+    const args: GogArg[] = ['chat', 'messages', 'list', pos(space)];
     if (thread) args.push(`--thread=${thread}`);
     if (unread) args.push('--unread');
     if (order) args.push(`--order=${order}`);
@@ -163,7 +165,7 @@ export function registerChatTools(server: McpServer): void {
       account: accountParam,
     }),
   }, async ({ query, order, view, markup, max, pageToken, page, all, account }) => {
-    const args = ['chat', 'messages', 'search', query];
+    const args: GogArg[] = ['chat', 'messages', 'search', pos(query)];
     if (order) args.push(`--order=${order}`);
     if (view) args.push(`--view=${view}`);
     if (markup) args.push(`--markup=${markup}`);
@@ -184,16 +186,17 @@ export function registerChatTools(server: McpServer): void {
       thread: threadParam,
       attach: z.array(z.string()).optional().describe(
         'Attachment file paths, read WHERE GOG RUNS. On a hosted or remote deployment that is not your machine — use '
-        + 'attachInline there instead.',
+        + 'attachInline there instead. Must be inside the server\'s GOG_FILE_ROOTS directories (default ~/gogcli-mcp-files).',
       ),
       attachInline: attachInlineParam,
       account: accountParam,
     }),
   }, async ({ space, text, thread, attach, attachInline, account }) => {
+    confinePaths(attach, 'attach');
     if (text === undefined && !attach?.length && !attachInline?.length) {
       throw new Error('A Chat message needs text, an attachment, or both.');
     }
-    const args: GogArg[] = ['chat', 'messages', 'send', space];
+    const args: GogArg[] = ['chat', 'messages', 'send', pos(space)];
     if (text !== undefined) args.push(`--text=${text}`);
     if (thread) args.push(`--thread=${thread}`);
     if (attach) for (const path of attach) args.push(`--attach=${path}`);
@@ -217,7 +220,7 @@ export function registerChatTools(server: McpServer): void {
       account: accountParam,
     }),
   }, async ({ email, text, thread, account }) => {
-    const args = ['chat', 'dm', 'send', email, `--text=${text}`];
+    const args: GogArg[] = ['chat', 'dm', 'send', pos(email), `--text=${text}`];
     if (thread) args.push(`--thread=${thread}`);
     return runOrDiagnose(args, { account });
   });
@@ -232,7 +235,7 @@ export function registerChatTools(server: McpServer): void {
       account: accountParam,
     }),
   }, async ({ email, account }) => {
-    return runOrDiagnose(['chat', 'dm', 'space', email], { account });
+    return runOrDiagnose(['chat', 'dm', 'space', pos(email)], { account });
   });
 
   server.registerTool('gog_chat_reactions_list', {
@@ -248,7 +251,7 @@ export function registerChatTools(server: McpServer): void {
       account: accountParam,
     }),
   }, async ({ message, space, max, pageToken, page, all, account }) => {
-    const args = ['chat', 'messages', 'reactions', 'list', message];
+    const args: GogArg[] = ['chat', 'messages', 'reactions', 'list', pos(message)];
     if (space) args.push(`--space=${space}`);
     pushPaginationFlags(args, { max, pageToken, page, all });
     return runOrDiagnose(args, { account });
@@ -266,7 +269,7 @@ export function registerChatTools(server: McpServer): void {
       account: accountParam,
     }),
   }, async ({ message, emoji, space, account }) => {
-    const args = ['chat', 'messages', 'reactions', 'create', message, emoji];
+    const args: GogArg[] = ['chat', 'messages', 'reactions', 'create', pos(message), pos(emoji)];
     if (space) args.push(`--space=${space}`);
     return runOrDiagnose(args, { account });
   });
@@ -282,7 +285,7 @@ export function registerChatTools(server: McpServer): void {
       account: accountParam,
     }),
   }, async ({ reaction, account }) => {
-    return runOrDiagnose(['chat', 'messages', 'reactions', 'delete', reaction], { account });
+    return runOrDiagnose(['chat', 'messages', 'reactions', 'delete', pos(reaction)], { account });
   });
 
   registerRunTool(server, {

package/src/tools/classroom.ts

@@ -1,6 +1,8 @@
 import { McpServer } from '@modelcontextprotocol/server';
 import { z } from 'zod';
 import { accountParam, runOrDiagnose, registerRunTool, pageTokenParam, pageAliasParam, resolvePageToken} from './utils.js';
+import { pos } from '../argv.js';
+import type { GogArg } from '../runner.js';
 
 export function registerClassroomTools(server: McpServer): void {
   server.registerTool('gog_classroom_courses_list', {
@@ -17,7 +19,7 @@ export function registerClassroomTools(server: McpServer): void {
       account: accountParam,
     }),
   }, async ({ state, teacher, student, max, pageToken, page, all, account }) => {
-    const args = ['classroom', 'courses', 'list'];
+    const args: GogArg[] = ['classroom', 'courses', 'list'];
     if (state) args.push(`--state=${state}`);
     if (teacher) args.push(`--teacher=${teacher}`);
     if (student) args.push(`--student=${student}`);
@@ -36,7 +38,7 @@ export function registerClassroomTools(server: McpServer): void {
       account: accountParam,
     }),
   }, async ({ courseId, account }) => {
-    return runOrDiagnose(['classroom', 'courses', 'get', courseId], { account });
+    return runOrDiagnose(['classroom', 'courses', 'get', pos(courseId)], { account });
   });
 
   server.registerTool('gog_classroom_students_list', {
@@ -51,7 +53,7 @@ export function registerClassroomTools(server: McpServer): void {
       account: accountParam,
     }),
   }, async ({ courseId, max, pageToken, page, all, account }) => {
-    const args = ['classroom', 'students', 'list', courseId];
+    const args: GogArg[] = ['classroom', 'students', 'list', pos(courseId)];
     if (max !== undefined) args.push(`--max=${max}`);
     const token = resolvePageToken({ pageToken, page });
     if (token) args.push(`--page=${token}`);
@@ -68,7 +70,7 @@ export function registerClassroomTools(server: McpServer): void {
       account: accountParam,
     }),
   }, async ({ courseId, userId, account }) => {
-    return runOrDiagnose(['classroom', 'students', 'get', courseId, userId], { account });
+    return runOrDiagnose(['classroom', 'students', 'get', pos(courseId), pos(userId)], { account });
   });
 
   server.registerTool('gog_classroom_teachers_list', {
@@ -83,7 +85,7 @@ export function registerClassroomTools(server: McpServer): void {
       account: accountParam,
     }),
   }, async ({ courseId, max, pageToken, page, all, account }) => {
-    const args = ['classroom', 'teachers', 'list', courseId];
+    const args: GogArg[] = ['classroom', 'teachers', 'list', pos(courseId)];
     if (max !== undefined) args.push(`--max=${max}`);
     const token = resolvePageToken({ pageToken, page });
     if (token) args.push(`--page=${token}`);
@@ -100,7 +102,7 @@ export function registerClassroomTools(server: McpServer): void {
       account: accountParam,
     }),
   }, async ({ courseId, userId, account }) => {
-    return runOrDiagnose(['classroom', 'teachers', 'get', courseId, userId], { account });
+    return runOrDiagnose(['classroom', 'teachers', 'get', pos(courseId), pos(userId)], { account });
   });
 
   server.registerTool('gog_classroom_roster', {
@@ -117,7 +119,7 @@ export function registerClassroomTools(server: McpServer): void {
       account: accountParam,
     }),
   }, async ({ courseId, students, teachers, max, pageToken, page, all, account }) => {
-    const args = ['classroom', 'roster', courseId];
+    const args: GogArg[] = ['classroom', 'roster', pos(courseId)];
     if (students) args.push('--students');
     if (teachers) args.push('--teachers');
     if (max !== undefined) args.push(`--max=${max}`);
@@ -143,7 +145,7 @@ export function registerClassroomTools(server: McpServer): void {
       account: accountParam,
     }),
   }, async ({ courseId, state, topic, orderBy, max, pageToken, page, all, scanPages, account }) => {
-    const args = ['classroom', 'coursework', 'list', courseId];
+    const args: GogArg[] = ['classroom', 'coursework', 'list', pos(courseId)];
     if (state) args.push(`--state=${state}`);
     if (topic) args.push(`--topic=${topic}`);
     if (orderBy) args.push(`--order-by=${orderBy}`);
@@ -164,7 +166,7 @@ export function registerClassroomTools(server: McpServer): void {
       account: accountParam,
     }),
   }, async ({ courseId, courseworkId, account }) => {
-    return runOrDiagnose(['classroom', 'coursework', 'get', courseId, courseworkId], { account });
+    return runOrDiagnose(['classroom', 'coursework', 'get', pos(courseId), pos(courseworkId)], { account });
   });
 
   server.registerTool('gog_classroom_submissions_list', {
@@ -183,7 +185,7 @@ export function registerClassroomTools(server: McpServer): void {
       account: accountParam,
     }),
   }, async ({ courseId, courseworkId, state, late, user, max, pageToken, page, all, account }) => {
-    const args = ['classroom', 'submissions', 'list', courseId, courseworkId];
+    const args: GogArg[] = ['classroom', 'submissions', 'list', pos(courseId), pos(courseworkId)];
     if (state) args.push(`--state=${state}`);
     if (late) args.push(`--late=${late}`);
     if (user) args.push(`--user=${user}`);
@@ -204,7 +206,7 @@ export function registerClassroomTools(server: McpServer): void {
       account: accountParam,
     }),
   }, async ({ courseId, courseworkId, submissionId, account }) => {
-    return runOrDiagnose(['classroom', 'submissions', 'get', courseId, courseworkId, submissionId], { account });
+    return runOrDiagnose(['classroom', 'submissions', 'get', pos(courseId), pos(courseworkId), pos(submissionId)], { account });
   });
 
   server.registerTool('gog_classroom_submissions_grade', {
@@ -219,7 +221,7 @@ export function registerClassroomTools(server: McpServer): void {
       account: accountParam,
     }),
   }, async ({ courseId, courseworkId, submissionId, draft, assigned, account }) => {
-    const args = ['classroom', 'submissions', 'grade', courseId, courseworkId, submissionId];
+    const args: GogArg[] = ['classroom', 'submissions', 'grade', pos(courseId), pos(courseworkId), pos(submissionId)];
     if (draft) args.push(`--draft=${draft}`);
     if (assigned) args.push(`--assigned=${assigned}`);
     return runOrDiagnose(args, { account });
@@ -235,7 +237,7 @@ export function registerClassroomTools(server: McpServer): void {
       account: accountParam,
     }),
   }, async ({ courseId, courseworkId, submissionId, account }) => {
-    return runOrDiagnose(['classroom', 'submissions', 'return', courseId, courseworkId, submissionId], { account });
+    return runOrDiagnose(['classroom', 'submissions', 'return', pos(courseId), pos(courseworkId), pos(submissionId)], { account });
   });
 
   server.registerTool('gog_classroom_submissions_turn_in', {
@@ -248,7 +250,7 @@ export function registerClassroomTools(server: McpServer): void {
       account: accountParam,
     }),
   }, async ({ courseId, courseworkId, submissionId, account }) => {
-    return runOrDiagnose(['classroom', 'submissions', 'turn-in', courseId, courseworkId, submissionId], { account });
+    return runOrDiagnose(['classroom', 'submissions', 'turn-in', pos(courseId), pos(courseworkId), pos(submissionId)], { account });
   });
 
   server.registerTool('gog_classroom_submissions_reclaim', {
@@ -261,7 +263,7 @@ export function registerClassroomTools(server: McpServer): void {
       account: accountParam,
     }),
   }, async ({ courseId, courseworkId, submissionId, account }) => {
-    return runOrDiagnose(['classroom', 'submissions', 'reclaim', courseId, courseworkId, submissionId], { account });
+    return runOrDiagnose(['classroom', 'submissions', 'reclaim', pos(courseId), pos(courseworkId), pos(submissionId)], { account });
   });
 
   server.registerTool('gog_classroom_announcements_list', {
@@ -278,7 +280,7 @@ export function registerClassroomTools(server: McpServer): void {
       account: accountParam,
     }),
   }, async ({ courseId, state, orderBy, max, pageToken, page, all, account }) => {
-    const args = ['classroom', 'announcements', 'list', courseId];
+    const args: GogArg[] = ['classroom', 'announcements', 'list', pos(courseId)];
     if (state) args.push(`--state=${state}`);
     if (orderBy) args.push(`--order-by=${orderBy}`);
     if (max !== undefined) args.push(`--max=${max}`);
@@ -297,7 +299,7 @@ export function registerClassroomTools(server: McpServer): void {
       account: accountParam,
     }),
   }, async ({ courseId, announcementId, account }) => {
-    return runOrDiagnose(['classroom', 'announcements', 'get', courseId, announcementId], { account });
+    return runOrDiagnose(['classroom', 'announcements', 'get', pos(courseId), pos(announcementId)], { account });
   });
 
   server.registerTool('gog_classroom_announcements_create', {
@@ -311,7 +313,7 @@ export function registerClassroomTools(server: McpServer): void {
       account: accountParam,
     }),
   }, async ({ courseId, text, state, scheduled, account }) => {
-    const args = ['classroom', 'announcements', 'create', courseId, `--text=${text}`];
+    const args: GogArg[] = ['classroom', 'announcements', 'create', pos(courseId), `--text=${text}`];
     if (state) args.push(`--state=${state}`);
     if (scheduled) args.push(`--scheduled=${scheduled}`);
     return runOrDiagnose(args, { account });
@@ -329,7 +331,7 @@ export function registerClassroomTools(server: McpServer): void {
       account: accountParam,
     }),
   }, async ({ courseId, max, pageToken, page, all, account }) => {
-    const args = ['classroom', 'topics', 'list', courseId];
+    const args: GogArg[] = ['classroom', 'topics', 'list', pos(courseId)];
     if (max !== undefined) args.push(`--max=${max}`);
     const token = resolvePageToken({ pageToken, page });
     if (token) args.push(`--page=${token}`);
@@ -346,7 +348,7 @@ export function registerClassroomTools(server: McpServer): void {
       account: accountParam,
     }),
   }, async ({ courseId, topicId, account }) => {
-    return runOrDiagnose(['classroom', 'topics', 'get', courseId, topicId], { account });
+    return runOrDiagnose(['classroom', 'topics', 'get', pos(courseId), pos(topicId)], { account });
   });
 
   server.registerTool('gog_classroom_invitations_list', {
@@ -362,7 +364,7 @@ export function registerClassroomTools(server: McpServer): void {
       account: accountParam,
     }),
   }, async ({ course, user, max, pageToken, page, all, account }) => {
-    const args = ['classroom', 'invitations', 'list'];
+    const args: GogArg[] = ['classroom', 'invitations', 'list'];
     if (course) args.push(`--course=${course}`);
     if (user) args.push(`--user=${user}`);
     if (max !== undefined) args.push(`--max=${max}`);
@@ -380,7 +382,7 @@ export function registerClassroomTools(server: McpServer): void {
       account: accountParam,
     }),
   }, async ({ invitationId, account }) => {
-    return runOrDiagnose(['classroom', 'invitations', 'get', invitationId], { account });
+    return runOrDiagnose(['classroom', 'invitations', 'get', pos(invitationId)], { account });
   });
 
   server.registerTool('gog_classroom_invitations_accept', {
@@ -391,7 +393,7 @@ export function registerClassroomTools(server: McpServer): void {
       account: accountParam,
     }),
   }, async ({ invitationId, account }) => {
-    return runOrDiagnose(['classroom', 'invitations', 'accept', invitationId], { account });
+    return runOrDiagnose(['classroom', 'invitations', 'accept', pos(invitationId)], { account });
   });
 
   server.registerTool('gog_classroom_profile_get', {
@@ -402,8 +404,8 @@ export function registerClassroomTools(server: McpServer): void {
       account: accountParam,
     }),
   }, async ({ userId, account }) => {
-    const args = ['classroom', 'profile', 'get'];
-    if (userId) args.push(userId);
+    const args: GogArg[] = ['classroom', 'profile', 'get'];
+    if (userId) args.push(pos(userId));
     return runOrDiagnose(args, { account });
   });
 

package/src/tools/contacts.ts

@@ -1,6 +1,8 @@
 import { McpServer } from '@modelcontextprotocol/server';
 import { z } from 'zod';
 import { accountParam, runOrDiagnose, registerRunTool } from './utils.js';
+import { pos } from '../argv.js';
+import type { GogArg } from '../runner.js';
 
 export function registerContactsTools(server: McpServer): void {
   server.registerTool('gog_contacts_search', {
@@ -11,7 +13,7 @@ export function registerContactsTools(server: McpServer): void {
       account: accountParam,
     }),
   }, async ({ query, account }) => {
-    return runOrDiagnose(['contacts', 'search', query], { account });
+    return runOrDiagnose(['contacts', 'search', pos(query)], { account });
   });
 
   server.registerTool('gog_contacts_list', {
@@ -32,7 +34,7 @@ export function registerContactsTools(server: McpServer): void {
       account: accountParam,
     }),
   }, async ({ resourceName, account }) => {
-    return runOrDiagnose(['contacts', 'get', resourceName], { account });
+    return runOrDiagnose(['contacts', 'get', pos(resourceName)], { account });
   });
 
   server.registerTool('gog_contacts_create', {
@@ -48,7 +50,7 @@ export function registerContactsTools(server: McpServer): void {
       account: accountParam,
     }),
   }, async ({ givenName, familyName, email, phone, org, title, account }) => {
-    const args = ['contacts', 'create', `--given=${givenName}`];
+    const args: GogArg[] = ['contacts', 'create', `--given=${givenName}`];
     if (familyName) args.push(`--family=${familyName}`);
     if (email) args.push(`--email=${email}`);
     if (phone) args.push(`--phone=${phone}`);

package/src/tools/docs.ts

@@ -1,6 +1,8 @@
 import { McpServer } from '@modelcontextprotocol/server';
 import { z } from 'zod';
 import { accountParam, runOrDiagnose, registerRunTool } from './utils.js';
+import { pos } from '../argv.js';
+import type { GogArg } from '../runner.js';
 
 export function registerDocsTools(server: McpServer): void {
   server.registerTool('gog_docs_info', {
@@ -11,7 +13,7 @@ export function registerDocsTools(server: McpServer): void {
       account: accountParam,
     }),
   }, async ({ docId, account }) => {
-    return runOrDiagnose(['docs', 'info', docId], { account });
+    return runOrDiagnose(['docs', 'info', pos(docId)], { account });
   });
 
   server.registerTool('gog_docs_cat', {
@@ -23,7 +25,7 @@ export function registerDocsTools(server: McpServer): void {
       account: accountParam,
     }),
   }, async ({ docId, chips, account }) => {
-    const args = ['docs', 'cat', docId];
+    const args: GogArg[] = ['docs', 'cat', pos(docId)];
     if (chips) args.push('--chips');
     return runOrDiagnose(args, { account });
   });
@@ -36,7 +38,7 @@ export function registerDocsTools(server: McpServer): void {
       account: accountParam,
     }),
   }, async ({ title, account }) => {
-    return runOrDiagnose(['docs', 'create', title], { account });
+    return runOrDiagnose(['docs', 'create', pos(title)], { account });
   });
 
   server.registerTool('gog_docs_write', {
@@ -62,7 +64,7 @@ export function registerDocsTools(server: McpServer): void {
       account: accountParam,
     }),
   }, async ({ docId, text, append, checkOrphans, bullets, bulletPreset, ordered, noBullets, indentStart, indentEnd, indentFirstLine, spaceAbove, spaceBelow, keepLinesTogether, keepWithNext, batch, account }) => {
-    const args = ['docs', 'write', docId, `--text=${text}`];
+    const args: GogArg[] = ['docs', 'write', pos(docId), `--text=${text}`];
     if (append) args.push('--append');
     if (checkOrphans) args.push('--check-orphans');
     if (bullets) args.push('--bullets');
@@ -90,7 +92,7 @@ export function registerDocsTools(server: McpServer): void {
       account: accountParam,
     }),
   }, async ({ docId, find, replace, account }) => {
-    return runOrDiagnose(['docs', 'find-replace', docId, find, replace], { account });
+    return runOrDiagnose(['docs', 'find-replace', pos(docId), pos(find), pos(replace)], { account });
   });
 
   server.registerTool('gog_docs_structure', {
@@ -101,7 +103,7 @@ export function registerDocsTools(server: McpServer): void {
       account: accountParam,
     }),
   }, async ({ docId, account }) => {
-    return runOrDiagnose(['docs', 'structure', docId], { account });
+    return runOrDiagnose(['docs', 'structure', pos(docId)], { account });
   });
 
   registerRunTool(server, { service: 'docs', examples: '"copy", "clear", "insert", "sed", "export"' });

package/src/tools/drive.ts

@@ -1,10 +1,13 @@
 import { McpServer } from '@modelcontextprotocol/server';
 import type { CallToolResult } from '@modelcontextprotocol/server';
 import { z } from 'zod';
-import { rawTextResult, viewParam, resolveView } from '@chrischall/mcp-utils';
+import { errorResult, rawTextResult, viewParam, resolveView } from '@chrischall/mcp-utils';
+import { MAX_INLINE_ATTACHMENT_BYTES } from '../attachments.js';
 
 import { run, runBinary } from '../runner.js';
 import { accountParam, diagnose, runOrDiagnose, registerRunTool, pageTokenParam, pageAliasParam, resolvePageToken} from './utils.js';
+import { pos } from '../argv.js';
+import type { GogArg } from '../runner.js';
 
 // A native Google Doc exports to text directly; anything else (PDF, image,
 // docx, …) is first copied WITH conversion to this type, which makes Drive run
@@ -13,12 +16,21 @@ const GOOGLE_DOC_MIME = 'application/vnd.google-apps.document';
 
 // Parse `gog drive get` JSON into { name, mimeType }. gog nests the payload
 // under `file`; fall back to the top level if that ever changes.
-function fileMeta(raw: string): { name?: string; mimeType?: string } {
-  const parsed = JSON.parse(raw) as { file?: { name?: string; mimeType?: string }; name?: string; mimeType?: string };
+type DriveMeta = { name?: string; mimeType?: string; size?: string | number };
+
+function fileMeta(raw: string): { name?: string; mimeType?: string; size?: number } {
+  const parsed = JSON.parse(raw) as { file?: DriveMeta } & DriveMeta;
   const f = parsed.file ?? parsed;
-  return { name: f.name, mimeType: f.mimeType };
+  // Drive reports int64 fields as strings; native Google formats carry none.
+  const size = f.size === undefined ? undefined : Number(f.size);
+  return { name: f.name, mimeType: f.mimeType, size: Number.isFinite(size) ? size : undefined };
 }
 
+// The most gog_drive_read_bytes returns inline — the same 8 MiB per-file cap
+// the attachment path enforces. The bytes travel base64-encoded (4/3 larger)
+// inside one JSON-RPC message, and past this no MCP client accepts the result.
+export const MAX_DRIVE_READ_BYTES = MAX_INLINE_ATTACHMENT_BYTES;
+
 
 // The `compact` rung for gog_drive_ls, as a Google Drive field mask.
 //
@@ -52,7 +64,7 @@ export function registerDriveTools(server: McpServer): void {
       account: accountParam,
     }),
   }, async ({ folderId, max, pageToken, page, query, allDrives, view, account }) => {
-    const args = ['drive', 'ls'];
+    const args: GogArg[] = ['drive', 'ls'];
     if (folderId) args.push(`--parent=${folderId}`);
     if (max !== undefined) args.push(`--max=${max}`);
     const token = resolvePageToken({ pageToken, page });
@@ -78,7 +90,7 @@ export function registerDriveTools(server: McpServer): void {
       account: accountParam,
     }),
   }, async ({ query, view, account }) => {
-    return runOrDiagnose(['drive', 'search', query], {
+    return runOrDiagnose(['drive', 'search', pos(query)], {
       account,
       stripMedia: resolveView(view, ['compact', 'full']) === 'compact',
     });
@@ -99,7 +111,7 @@ export function registerDriveTools(server: McpServer): void {
       account: accountParam,
     }),
   }, async ({ fileId, view, account }) => {
-    return runOrDiagnose(['drive', 'get', fileId], {
+    return runOrDiagnose(['drive', 'get', pos(fileId)], {
       account,
       stripMedia: resolveView(view, ['compact', 'full']) === 'compact',
     });
@@ -113,7 +125,7 @@ export function registerDriveTools(server: McpServer): void {
       account: accountParam,
     }),
   }, async ({ name, account }) => {
-    return runOrDiagnose(['drive', 'mkdir', name], { account });
+    return runOrDiagnose(['drive', 'mkdir', pos(name)], { account });
   });
 
   server.registerTool('gog_drive_rename', {
@@ -125,7 +137,7 @@ export function registerDriveTools(server: McpServer): void {
       account: accountParam,
     }),
   }, async ({ fileId, newName, account }) => {
-    return runOrDiagnose(['drive', 'rename', fileId, newName], { account });
+    return runOrDiagnose(['drive', 'rename', pos(fileId), pos(newName)], { account });
   });
 
   server.registerTool('gog_drive_move', {
@@ -137,7 +149,7 @@ export function registerDriveTools(server: McpServer): void {
       account: accountParam,
     }),
   }, async ({ fileId, parentId, account }) => {
-    return runOrDiagnose(['drive', 'move', fileId, `--parent=${parentId}`], { account });
+    return runOrDiagnose(['drive', 'move', pos(fileId), `--parent=${parentId}`], { account });
   });
 
   server.registerTool('gog_drive_delete', {
@@ -149,7 +161,7 @@ export function registerDriveTools(server: McpServer): void {
       account: accountParam,
     }),
   }, async ({ fileId, permanent, account }) => {
-    const args = ['drive', 'delete', fileId];
+    const args: GogArg[] = ['drive', 'delete', pos(fileId)];
     if (permanent) args.push('--permanent');
     // gog gates drive delete behind a confirmation; the runner injects
     // --no-input, so without --force it refuses at runtime.
@@ -169,7 +181,7 @@ export function registerDriveTools(server: McpServer): void {
       account: accountParam,
     }),
   }, async ({ fileId, to, email, domain, role, account }) => {
-    const args = ['drive', 'share', fileId, `--to=${to}`];
+    const args: GogArg[] = ['drive', 'share', pos(fileId), `--to=${to}`];
     if (email) args.push(`--email=${email}`);
     if (domain) args.push(`--domain=${domain}`);
     if (role) args.push(`--role=${role}`);
@@ -201,7 +213,7 @@ export function registerDriveTools(server: McpServer): void {
   }, async ({ fileId, ocrLanguage, offset = 0, maxChars, account }) => {
     let tempDocId: string | undefined;
     try {
-      const { name, mimeType } = fileMeta(await run(['drive', 'get', fileId], { account }));
+      const { name, mimeType } = fileMeta(await run(['drive', 'get', pos(fileId)], { account }));
 
       // Native Docs export straight to text; everything else is OCR-converted first.
       let sourceId = fileId;
@@ -242,7 +254,7 @@ export function registerDriveTools(server: McpServer): void {
     } finally {
       // Always remove the temp Doc — on success, and on a mid-extraction failure.
       if (tempDocId) {
-        await run(['drive', 'delete', tempDocId, '--permanent', '--force'], { account }).catch(() => {});
+        await run(['drive', 'delete', pos(tempDocId), '--permanent', '--force'], { account }).catch(() => {});
       }
     }
   });
@@ -251,7 +263,7 @@ export function registerDriveTools(server: McpServer): void {
     description:
       'Fetch a Drive file\'s raw bytes and return them base64-encoded as an embedded resource — the ' +
       'generic fallback for callers that want the file itself (to parse locally) rather than extracted ' +
-      'text. For readable text from a PDF, prefer gog_drive_extract_text.',
+      'text. Files over 8 MiB are refused (checked before downloading). For readable text from a PDF, prefer gog_drive_extract_text.',
     annotations: { readOnlyHint: true },
     inputSchema: z.object({
       fileId: z.string().describe('Drive file ID'),
@@ -259,9 +271,21 @@ export function registerDriveTools(server: McpServer): void {
     }),
   }, async ({ fileId, account }): Promise<CallToolResult> => {
     try {
-      const { name, mimeType } = fileMeta(await run(['drive', 'get', fileId], { account }));
+      const { name, mimeType, size } = fileMeta(await run(['drive', 'get', pos(fileId)], { account }));
+      // Refuse an oversized file BEFORE fetching it (audit BUG-2): buffering a
+      // multi-GB file plus its base64 copy can take down the whole server.
+      if (size !== undefined && size > MAX_DRIVE_READ_BYTES) {
+        return errorResult(
+          `${name ?? fileId} is ${size} bytes, over the 8 MiB this tool returns inline. `
+          + 'Use gog_drive_extract_text for its text, or share its webViewLink (gog_drive_get) instead.',
+        );
+      }
       const params = JSON.stringify({ fileId, alt: 'media' });
-      const blob = await runBinary(['api', 'call', 'drive', 'v3', 'files.get', `--params=${params}`], { account });
+      // The cap also bounds the fetch itself, for files Drive reports no size for.
+      const blob = await runBinary(
+        ['api', 'call', 'drive', 'v3', 'files.get', `--params=${params}`],
+        { account, maxOutputBytes: MAX_DRIVE_READ_BYTES },
+      );
       const type = mimeType ?? 'application/octet-stream';
       // Several hosts (claude.ai among them) render embedded IMAGE resources
       // and reject every other type outright — "Resources of type
@@ -290,5 +314,5 @@ export function registerDriveTools(server: McpServer): void {
     }
   });
 
-  registerRunTool(server, { service: 'drive', examples: '"copy", "upload", "download", "permissions"' });
+  registerRunTool(server, { service: 'drive', examples: '"copy", "download", "permissions"' });
 }