gogcli-mcp 4.2.5 → 4.3.0

package/tests/runner.test.ts

@@ -4,6 +4,7 @@ import { spawn as mockedSpawn } from 'node:child_process';
 import { withCallSignal } from '@chrischall/mcp-utils';
 import { run, runBinary } from '../src/runner.js';
 import type { Spawner } from '../src/runner.js';
+import { pos } from '../src/argv.js';
 
 // The real spawn is dynamically imported inside runner's default executor.
 // Mock it so the no-spawner/no-executor fallback can be exercised without
@@ -938,6 +939,141 @@ describe('run --readonly (gog 0.31)', () => {
   });
 });
 
+describe('run safety flags', () => {
+  it('injects --gmail-no-send when options.gmailNoSend is true', async () => {
+    const spawner = makeSpawner(0, '{}');
+    await run(['gmail', 'archive', 'm1'], { gmailNoSend: true, spawner });
+    expect(spawner).toHaveBeenCalledWith(
+      'gog',
+      ['--json', '--color=never', '--no-input', '--gmail-no-send', 'gmail', 'archive', 'm1'],
+      expect.any(Object),
+    );
+  });
+
+  // Defence in depth behind the tool-level guard (audit SEC-1): whatever tool
+  // built the argv, a safety-control override in flag position never reaches
+  // gog, where the LAST value of a repeated flag would win.
+  it.each([
+    ['--readonly=false'],
+    ['--disable-commands='],
+    ['--enable-commands=gmail.send'],
+    ['--gmail-no-send=false'],
+    ['--access-token=ya29.x'],
+    ['--home=/tmp/x'],
+    ['--client=other'],
+    ['-a'],
+  ])('refuses a caller-supplied %j in flag position without spawning', async (bad) => {
+    const spawner = makeSpawner(0, '{}');
+    await expect(run(['drive', 'mkdir', 'x', bad], { readonly: true, spawner })).rejects.toThrow(/not allowed/);
+    await expect(runBinary(['drive', 'mkdir', 'x', bad], { spawner })).rejects.toThrow(/not allowed/);
+    expect(spawner).not.toHaveBeenCalled();
+  });
+
+  // The backstop runs on every tool's argv, so it must match exact control
+  // names only: gog_zoom_auth_setup builds --account-id/--client-id/
+  // --client-secret, which a prefix match refused before spawning.
+  it('lets zoom auth setup credentials flags through to gog', async () => {
+    const spawner = makeSpawner(0, '{}');
+    await run(['zoom', 'auth', 'setup', '--alias=work', '--account-id=abc', '--client-id=x', '--client-secret=y'], { spawner });
+    expect(spawner).toHaveBeenCalledWith(
+      'gog',
+      ['--json', '--color=never', '--no-input', 'zoom', 'auth', 'setup', '--alias=work', '--account-id=abc', '--client-id=x', '--client-secret=y'],
+      expect.any(Object),
+    );
+  });
+
+  it('lets the same text through as a positional after --', async () => {
+    const spawner = makeSpawner(0, '{}');
+    await run(['gmail', 'search', '--', '--readonly=false'], { spawner });
+    expect(spawner).toHaveBeenCalledTimes(1);
+  });
+});
+
+// BUG-1: a positional value that starts with '-' (a Gmail negation query such
+// as "-in:spam", an ID or a name the model chose) must never be parsed as a
+// gog flag. Values marked with pos() go after a single `--`, after every flag,
+// in their original order — the pattern upstream gogcli's own MCP tools use.
+describe('run positionals', () => {
+  it('moves pos() values after -- at the end, keeping their order', async () => {
+    const spawner = makeSpawner(0, '{}');
+    await run(['sheets', 'get', pos('id1'), pos('-A1'), '--render=FORMULA'], { spawner });
+    expect(spawner).toHaveBeenCalledWith(
+      'gog',
+      ['--json', '--color=never', '--no-input', 'sheets', 'get', '--render=FORMULA', '--', 'id1', '-A1'],
+      expect.any(Object),
+    );
+  });
+
+  it('passes a flag-shaped positional through as data, not a flag', async () => {
+    const spawner = makeSpawner(0, '{}');
+    await run(['gmail', 'search', pos('--readonly=false')], { readonly: true, spawner });
+    expect(spawner).toHaveBeenCalledWith(
+      'gog',
+      ['--json', '--color=never', '--no-input', '--readonly', 'gmail', 'search', '--', '--readonly=false'],
+      expect.any(Object),
+    );
+  });
+
+  it('adds no -- when nothing is marked positional', async () => {
+    const spawner = makeSpawner(0, '{}');
+    await run(['gmail', 'labels', 'list'], { spawner });
+    expect((spawner as unknown as { mock: { calls: unknown[][] } }).mock.calls[0]![1]).not.toContain('--');
+  });
+
+  it('treats a positional file arg as a positional', async () => {
+    const spawner = makeSpawner(0, '{}');
+    await run(
+      ['drive', 'upload', { kind: 'file', flag: 'upload', contents: 'aGk=', encoding: 'base64', filename: 'a.txt', positional: true }, '--parent=p'],
+      { spawner },
+    );
+    const argv = (spawner as unknown as { mock: { calls: unknown[][] } }).mock.calls[0]![1] as string[];
+    expect(argv.slice(0, 7)).toEqual(['--json', '--color=never', '--no-input', 'drive', 'upload', '--parent=p', '--']);
+    expect(argv[7]).toMatch(/a\.txt$/);
+  });
+
+  it('keeps everything after an explicit -- positional', async () => {
+    const spawner = makeSpawner(0, '{}');
+    await runBinary(['api', 'call', '--', 'drive', pos('v3')], { spawner });
+    expect(spawner).toHaveBeenCalledWith(
+      'gog',
+      ['--json', '--color=never', '--no-input', 'api', 'call', '--', 'drive', 'v3'],
+      expect.any(Object),
+    );
+  });
+});
+
+// BUG-2: binary mode buffered a whole Drive file (plus a base64 copy) with no
+// ceiling, so one multi-GB read could exhaust the server process.
+describe('runBinary maxOutputBytes', () => {
+  function streamingSpawner(chunks: Buffer[]): { spawner: Spawner; kill: ReturnType<typeof vi.fn> } {
+    const kill = vi.fn();
+    const spawner = vi.fn(() => {
+      const proc = new EventEmitter() as ReturnType<Spawner>;
+      (proc as unknown as { stdout: EventEmitter; stderr: EventEmitter }).stdout = new EventEmitter();
+      (proc as unknown as { stdout: EventEmitter; stderr: EventEmitter }).stderr = new EventEmitter();
+      proc.kill = kill;
+      setTimeout(() => {
+        for (const c of chunks) (proc as unknown as { stdout: EventEmitter }).stdout.emit('data', c);
+        proc.emit('close', 0);
+      }, 0);
+      return proc;
+    }) as unknown as Spawner;
+    return { spawner, kill };
+  }
+
+  it('kills gog and rejects once the output passes the cap', async () => {
+    const { spawner, kill } = streamingSpawner([Buffer.alloc(6), Buffer.alloc(6), Buffer.alloc(6)]);
+    await expect(runBinary(['api', 'call'], { spawner, maxOutputBytes: 10 }))
+      .rejects.toThrow(/more than 10 bytes/);
+    expect(kill).toHaveBeenCalled();
+  });
+
+  it('returns output at or under the cap', async () => {
+    const { spawner } = streamingSpawner([Buffer.from('hello')]);
+    expect(await runBinary(['api', 'call'], { spawner, maxOutputBytes: 5 })).toBe(Buffer.from('hello').toString('base64'));
+  });
+});
+
 describe('run executor', () => {
   it('uses the lazily-imported real spawn when no spawner is injected', async () => {
     vi.mocked(mockedSpawn).mockImplementation((() => makeProc(0, '{"real":true}')) as never);

package/tests/tools/api.test.ts

@@ -1,7 +1,8 @@
-import { describe, it, expect, vi, beforeEach } from 'vitest';
+import { describe, it, expect, vi, beforeEach, afterEach } from 'vitest';
 import { registerApiTools } from '../../src/tools/api.js';
 import * as runner from '../../src/runner.js';
 import { createTestHarness } from '@chrischall/mcp-utils/test';
+import { pos } from '../../src/argv.js';
 
 vi.mock('../../src/runner.js');
 
@@ -37,7 +38,7 @@ describe('gog_api_describe', () => {
     vi.mocked(runner.run).mockResolvedValue('{}');
     const harness = await setupHandlers();
     await harness.callTool('gog_api_describe', { api: 'drive', version: 'v3' });
-    expect(runner.run).toHaveBeenCalledWith(['api', 'describe', 'drive', 'v3'], { account: undefined });
+    expect(runner.run).toHaveBeenCalledWith(['api', 'describe', pos('drive'), pos('v3')], { account: undefined });
   });
 
   it('describes a single method when method is provided', async () => {
@@ -45,7 +46,7 @@ describe('gog_api_describe', () => {
     const harness = await setupHandlers();
     await harness.callTool('gog_api_describe', { api: 'drive', version: 'v3', method: 'files.list' });
     expect(runner.run).toHaveBeenCalledWith(
-      ['api', 'describe', 'drive', 'v3', 'files.list'],
+      ['api', 'describe', pos('drive'), pos('v3'), pos('files.list')],
       { account: undefined },
     );
   });
@@ -64,8 +65,8 @@ describe('gog_api_call', () => {
     const harness = await setupHandlers();
     await harness.callTool('gog_api_call', { api: 'drive', version: 'v3', method: 'files.list', params: '{"q":"x"}' });
     expect(runner.run).toHaveBeenCalledWith(
-      ['api', 'call', 'drive', 'v3', 'files.list', '--params={"q":"x"}'],
-      { account: undefined },
+      ['api', 'call', pos('drive'), pos('v3'), pos('files.list'), '--params={"q":"x"}'],
+      { account: undefined, gmailNoSend: true },
     );
   });
 
@@ -79,11 +80,11 @@ describe('gog_api_call', () => {
     });
     expect(runner.run).toHaveBeenCalledWith(
       [
-        'api', 'call', 'drive', 'v3', 'files.create',
+        'api', 'call', pos('drive'), pos('v3'), pos('files.create'),
         '--params={"fields":"id"}', '--body={"name":"f"}',
         '--scope=https://www.googleapis.com/auth/drive', '--allow-write', '--dry-run', '--force',
       ],
-      { account: 'a@b.com' },
+      { account: 'a@b.com', gmailNoSend: true },
     );
   });
 
@@ -94,7 +95,7 @@ describe('gog_api_call', () => {
       api: 'drive', version: 'v3', method: 'files.create', allowWrite: true,
     });
     const passedArgs = vi.mocked(runner.run).mock.calls[0][0];
-    expect(passedArgs).toEqual(['api', 'call', 'drive', 'v3', 'files.create', '--allow-write', '--force']);
+    expect(passedArgs).toEqual(['api', 'call', pos('drive'), pos('v3'), pos('files.create'), '--allow-write', '--force']);
     expect(passedArgs[passedArgs.length - 1]).toBe('--force');
   });
 
@@ -104,4 +105,69 @@ describe('gog_api_call', () => {
     const result = await harness.callTool('gog_api_call', { api: 'drive', version: 'v3', method: 'files.list' });
     expect(result.content[0].text).toBe('Error: Call failed');
   });
+
+  // SEC-2: allowWrite is a model-set boolean, so it cannot stand in for the
+  // user's confirmation of a send. Sends are refused here (and --gmail-no-send
+  // is pinned on as a backstop); so is anything that routes future mail away.
+  it.each([
+    ['gmail', 'users.messages.send'],
+    ['Gmail', 'users.drafts.send'],
+    ['gmail', 'users.settings.forwardingAddresses.create'],
+    ['gmail', 'users.settings.updateAutoForwarding'],
+    ['gmail', 'users.settings.filters.create'],
+    ['gmail', 'users.settings.delegates.create'],
+  ])('refuses %s %s', async (api, method) => {
+    const harness = await setupHandlers();
+    const result = await harness.callTool('gog_api_call', { api, version: 'v1', method, allowWrite: true });
+    expect(result.isError).toBe(true);
+    expect(result.content[0].text).toMatch(/not available through gog_api_call/);
+    expect(runner.run).not.toHaveBeenCalled();
+  });
+
+  it('still allows other gmail methods', async () => {
+    vi.mocked(runner.run).mockResolvedValue('{}');
+    const harness = await setupHandlers();
+    const result = await harness.callTool('gog_api_call', { api: 'gmail', version: 'v1', method: 'users.labels.list' });
+    expect(result.isError).toBeFalsy();
+  });
+
+  // SEC-1: the positional api/version/method are model-supplied too.
+  it.each([
+    [{ api: '--readonly=false', version: 'v3', method: 'files.list' }],
+    [{ api: 'drive', version: '--', method: 'files.list' }],
+    [{ api: 'drive', version: 'v3', method: '--disable-commands=' }],
+  ])('refuses a safety-flag override in %j', async (input) => {
+    const harness = await setupHandlers();
+    const result = await harness.callTool('gog_api_call', input);
+    expect(result.isError).toBe(true);
+    expect(result.content[0].text).toMatch(/not allowed/);
+    expect(runner.run).not.toHaveBeenCalled();
+  });
+});
+
+// SEC-3/SEC-4: gog reads `--body=@path` from the host, so an unconfined body
+// is a read primitive (gog's credentials.json is itself valid JSON).
+describe('gog_api_call @file confinement', () => {
+  let prevRoots: string | undefined;
+  beforeEach(() => { prevRoots = process.env.GOG_FILE_ROOTS; process.env.GOG_FILE_ROOTS = '/nonexistent-gog-file-root'; });
+  afterEach(() => { process.env.GOG_FILE_ROOTS = prevRoots; });
+
+  it.each([
+    [{ body: '@/Users/x/Library/Application Support/gogcli/credentials.json' }, /body/],
+    [{ params: '@/etc/passwd' }, /params/],
+  ])('refuses %j outside GOG_FILE_ROOTS', async (extra, param) => {
+    const harness = await createTestHarness(registerApiTools);
+    const result = await harness.callTool('gog_api_call', { api: 'drive', version: 'v3', method: 'files.create', allowWrite: true, ...extra });
+    expect(result.isError).toBe(true);
+    expect(result.content[0].text).toMatch(/outside the directories/);
+    expect(result.content[0].text).toMatch(param);
+    expect(runner.run).not.toHaveBeenCalled();
+  });
+
+  it('passes an inline JSON body through', async () => {
+    vi.mocked(runner.run).mockResolvedValue('{}');
+    const harness = await createTestHarness(registerApiTools);
+    await harness.callTool('gog_api_call', { api: 'drive', version: 'v3', method: 'files.list', body: '{"a":1}' });
+    expect(runner.run).toHaveBeenCalled();
+  });
 });

package/tests/tools/appscript.test.ts

@@ -2,6 +2,7 @@ import { describe, it, expect, vi, beforeEach } from 'vitest';
 import { registerAppScriptTools } from '../../src/tools/appscript.js';
 import * as runner from '../../src/runner.js';
 import { createTestHarness } from '@chrischall/mcp-utils/test';
+import { pos } from '../../src/argv.js';
 
 vi.mock('../../src/runner.js');
 
@@ -14,7 +15,7 @@ describe('gog_appscript_get', () => {
     vi.mocked(runner.run).mockResolvedValue('{}');
     const harness = await setupHandlers();
     await harness.callTool('gog_appscript_get', { scriptId: 'S1' });
-    expect(runner.run).toHaveBeenCalledWith(['appscript', 'get', 'S1'], { account: undefined });
+    expect(runner.run).toHaveBeenCalledWith(['appscript', 'get', pos('S1')], { account: undefined });
   });
 
   it('returns error text on failure', async () => {
@@ -30,7 +31,7 @@ describe('gog_appscript_content', () => {
     vi.mocked(runner.run).mockResolvedValue('{}');
     const harness = await setupHandlers();
     await harness.callTool('gog_appscript_content', { scriptId: 'S1', account: 'me@x.com' });
-    expect(runner.run).toHaveBeenCalledWith(['appscript', 'content', 'S1'], { account: 'me@x.com' });
+    expect(runner.run).toHaveBeenCalledWith(['appscript', 'content', pos('S1')], { account: 'me@x.com' });
   });
 });
 
@@ -39,7 +40,7 @@ describe('gog_appscript_pull', () => {
     vi.mocked(runner.run).mockResolvedValue('{}');
     const harness = await setupHandlers();
     await harness.callTool('gog_appscript_pull', { scriptId: 'S1', dir: '/tmp/proj' });
-    expect(runner.run).toHaveBeenCalledWith(['appscript', 'pull', 'S1', '/tmp/proj'], { account: undefined });
+    expect(runner.run).toHaveBeenCalledWith(['appscript', 'pull', pos('S1'), pos('/tmp/proj')], { account: undefined });
   });
 
   it('passes --overwrite', async () => {
@@ -47,7 +48,7 @@ describe('gog_appscript_pull', () => {
     const harness = await setupHandlers();
     await harness.callTool('gog_appscript_pull', { scriptId: 'S1', dir: '/tmp/proj', overwrite: true });
     expect(runner.run).toHaveBeenCalledWith(
-      ['appscript', 'pull', 'S1', '/tmp/proj', '--overwrite'],
+      ['appscript', 'pull', pos('S1'), pos('/tmp/proj'), '--overwrite'],
       { account: undefined },
     );
   });
@@ -95,7 +96,7 @@ describe('gog_appscript_deployments', () => {
     const harness = await setupHandlers();
     await harness.callTool('gog_appscript_deployments', { scriptId: 'S1', max: 10, pageToken: 'tok' });
     expect(runner.run).toHaveBeenCalledWith(
-      ['appscript', 'deployments', 'S1', '--max=10', '--page=tok'],
+      ['appscript', 'deployments', pos('S1'), '--max=10', '--page=tok'],
       { account: undefined },
     );
   });
@@ -106,7 +107,7 @@ describe('gog_appscript_versions', () => {
     vi.mocked(runner.run).mockResolvedValue('{}');
     const harness = await setupHandlers();
     await harness.callTool('gog_appscript_versions', { scriptId: 'S1', all: true });
-    expect(runner.run).toHaveBeenCalledWith(['appscript', 'versions', 'S1', '--all'], { account: undefined });
+    expect(runner.run).toHaveBeenCalledWith(['appscript', 'versions', pos('S1'), '--all'], { account: undefined });
   });
 });
 
@@ -115,7 +116,7 @@ describe('gog_appscript_run_function', () => {
     vi.mocked(runner.run).mockResolvedValue('{}');
     const harness = await setupHandlers();
     await harness.callTool('gog_appscript_run_function', { scriptId: 'S1', functionName: 'doWork' });
-    expect(runner.run).toHaveBeenCalledWith(['appscript', 'run', 'S1', 'doWork'], { account: undefined });
+    expect(runner.run).toHaveBeenCalledWith(['appscript', 'run', pos('S1'), pos('doWork')], { account: undefined });
   });
 
   it('passes params and --dev-mode', async () => {
@@ -125,7 +126,7 @@ describe('gog_appscript_run_function', () => {
       scriptId: 'S1', functionName: 'doWork', params: '["a",1]', devMode: true,
     });
     expect(runner.run).toHaveBeenCalledWith(
-      ['appscript', 'run', 'S1', 'doWork', '--params=["a",1]', '--dev-mode'],
+      ['appscript', 'run', pos('S1'), pos('doWork'), '--params=["a",1]', '--dev-mode'],
       { account: undefined },
     );
   });
@@ -157,3 +158,28 @@ describe('gog_appscript_run', () => {
     expect(runner.run).toHaveBeenCalledWith(['appscript', 'get', 'S1'], { account: undefined });
   });
 });
+
+// SEC-3/SEC-4: every model-supplied server path must resolve inside an
+// operator-configured root (GOG_FILE_ROOTS). The suite runs with '/' so the
+// arg-shape tests can use any path; these narrow it.
+async function withFileRoots<T>(roots: string, fn: () => Promise<T>): Promise<T> {
+  const prev = process.env.GOG_FILE_ROOTS;
+  process.env.GOG_FILE_ROOTS = roots;
+  try {
+    return await fn();
+  } finally {
+    process.env.GOG_FILE_ROOTS = prev;
+  }
+}
+
+describe('gog_appscript_pull — server paths', () => {
+  it('refuses a dir outside GOG_FILE_ROOTS', async () => {
+    const harness = await setupHandlers();
+    const result = await withFileRoots('/srv/gog-files', () => harness.callTool('gog_appscript_pull', {
+      scriptId: 'S1', dir: '/Users/me/Library/LaunchAgents',
+    }));
+    expect(result.isError).toBe(true);
+    expect(result.content[0].text).toContain('dir "/Users/me/Library/LaunchAgents" is outside');
+    expect(runner.run).not.toHaveBeenCalled();
+  });
+});

package/tests/tools/auth.test.ts

@@ -2,6 +2,7 @@ import { describe, it, expect, vi, beforeEach } from 'vitest';
 import { registerAuthTools, authToolsFor } from '../../src/tools/auth.js';
 import * as runner from '../../src/runner.js';
 import { createTestHarness } from '@chrischall/mcp-utils/test';
+import { pos } from '../../src/argv.js';
 
 vi.mock('../../src/runner.js');
 
@@ -108,7 +109,7 @@ describe('gog_auth_add', () => {
     const harness = await setupHandlers();
     const result = await harness.callTool('gog_auth_add', { email: 'user@gmail.com' });
     expect(runner.run).toHaveBeenCalledWith(
-      ['auth', 'add', 'user@gmail.com', '--services', 'all'],
+      ['auth', 'add', pos('user@gmail.com'), '--services', 'all'],
       { interactive: true, timeout: 300_000 },
     );
     expect(result.content[0].text).toBe('Authorization successful for user@gmail.com');
@@ -119,7 +120,7 @@ describe('gog_auth_add', () => {
     const harness = await setupHandlers();
     await harness.callTool('gog_auth_add', { email: 'user@gmail.com', services: 'sheets,gmail' });
     expect(runner.run).toHaveBeenCalledWith(
-      ['auth', 'add', 'user@gmail.com', '--services', 'sheets,gmail'],
+      ['auth', 'add', pos('user@gmail.com'), '--services', 'sheets,gmail'],
       { interactive: true, timeout: 300_000 },
     );
   });
@@ -137,7 +138,7 @@ describe('gog_auth_add', () => {
       extraScopes: 'https://www.googleapis.com/auth/bigquery.readonly',
     });
     expect(runner.run).toHaveBeenCalledWith(
-      ['auth', 'add', 'user@gmail.com', '--services', 'sheets',
+      ['auth', 'add', pos('user@gmail.com'), '--services', 'sheets',
         '--extra-scopes=https://www.googleapis.com/auth/bigquery.readonly', '--force-consent'],
       { interactive: true, timeout: 300_000 },
     );
@@ -148,7 +149,7 @@ describe('gog_auth_add', () => {
     const harness = await setupHandlers();
     await harness.callTool('gog_auth_add', { email: 'user@gmail.com' });
     expect(runner.run).toHaveBeenCalledWith(
-      ['auth', 'add', 'user@gmail.com', '--services', 'all'],
+      ['auth', 'add', pos('user@gmail.com'), '--services', 'all'],
       { interactive: true, timeout: 300_000 },
     );
   });
@@ -229,7 +230,7 @@ describe('gog_auth_add_url', () => {
     const harness = await setupHandlers();
     const result = await harness.callTool('gog_auth_add_url', { email: 'user@gmail.com' });
     expect(runner.run).toHaveBeenCalledWith(
-      ['auth', 'add', 'user@gmail.com', '--remote', '--step', '1', '--services', 'all', '--force-consent'],
+      ['auth', 'add', pos('user@gmail.com'), '--remote', '--step', '1', '--services', 'all', '--force-consent'],
       { redactMode: 'tokens' },
     );
     expect(result.content[0].text).toContain('accounts.google.com');
@@ -240,7 +241,7 @@ describe('gog_auth_add_url', () => {
     const harness = await setupHandlers();
     await harness.callTool('gog_auth_add_url', { email: 'user@gmail.com', services: 'gmail,drive' });
     expect(runner.run).toHaveBeenCalledWith(
-      ['auth', 'add', 'user@gmail.com', '--remote', '--step', '1', '--services', 'gmail,drive', '--force-consent'],
+      ['auth', 'add', pos('user@gmail.com'), '--remote', '--step', '1', '--services', 'gmail,drive', '--force-consent'],
       { redactMode: 'tokens' },
     );
   });
@@ -254,7 +255,7 @@ describe('gog_auth_add_url', () => {
       extraScopes: 'https://www.googleapis.com/auth/bigquery.readonly',
     });
     expect(runner.run).toHaveBeenCalledWith(
-      ['auth', 'add', 'user@gmail.com', '--remote', '--step', '1', '--services', 'sheets', '--force-consent',
+      ['auth', 'add', pos('user@gmail.com'), '--remote', '--step', '1', '--services', 'sheets', '--force-consent',
         '--extra-scopes=https://www.googleapis.com/auth/bigquery.readonly'],
       { redactMode: 'tokens' },
     );
@@ -277,7 +278,7 @@ describe('gog_auth_add_complete', () => {
       redirectUrl: 'http://127.0.0.1:59436/oauth2/callback?code=abc&state=xyz',
     });
     expect(runner.run).toHaveBeenCalledWith(
-      ['auth', 'add', 'user@gmail.com', '--remote', '--step', '2', '--auth-url',
+      ['auth', 'add', pos('user@gmail.com'), '--remote', '--step', '2', '--auth-url',
         'http://127.0.0.1:59436/oauth2/callback?code=abc&state=xyz', '--services', 'all', '--force-consent'],
     );
     expect(result.content[0].text).toContain('stored');
@@ -292,7 +293,7 @@ describe('gog_auth_add_complete', () => {
       services: 'gmail,drive',
     });
     expect(runner.run).toHaveBeenCalledWith(
-      ['auth', 'add', 'user@gmail.com', '--remote', '--step', '2', '--auth-url',
+      ['auth', 'add', pos('user@gmail.com'), '--remote', '--step', '2', '--auth-url',
         'http://127.0.0.1/cb?code=c&state=s', '--services', 'gmail,drive', '--force-consent'],
     );
   });
@@ -307,7 +308,7 @@ describe('gog_auth_add_complete', () => {
       extraScopes: 'https://www.googleapis.com/auth/bigquery.readonly',
     });
     expect(runner.run).toHaveBeenCalledWith(
-      ['auth', 'add', 'user@gmail.com', '--remote', '--step', '2', '--auth-url',
+      ['auth', 'add', pos('user@gmail.com'), '--remote', '--step', '2', '--auth-url',
         'http://127.0.0.1/cb?code=c&state=s', '--services', 'sheets', '--force-consent',
         '--extra-scopes=https://www.googleapis.com/auth/bigquery.readonly'],
     );
@@ -332,7 +333,7 @@ describe('authToolsFor (least-privilege default services)', () => {
     const harness = await gmailHarness();
     await harness.callTool('gog_auth_add_url', { email: 'u@x.com' });
     expect(runner.run).toHaveBeenCalledWith(
-      ['auth', 'add', 'u@x.com', '--remote', '--step', '1', '--services', 'gmail', '--force-consent'],
+      ['auth', 'add', pos('u@x.com'), '--remote', '--step', '1', '--services', 'gmail', '--force-consent'],
       { redactMode: 'tokens' },
     );
   });
@@ -342,7 +343,7 @@ describe('authToolsFor (least-privilege default services)', () => {
     const harness = await gmailHarness();
     await harness.callTool('gog_auth_add', { email: 'u@x.com' });
     expect(runner.run).toHaveBeenCalledWith(
-      ['auth', 'add', 'u@x.com', '--services', 'gmail'],
+      ['auth', 'add', pos('u@x.com'), '--services', 'gmail'],
       { interactive: true, timeout: 300_000 },
     );
   });
@@ -355,7 +356,7 @@ describe('authToolsFor (least-privilege default services)', () => {
       redirectUrl: 'http://127.0.0.1/cb?code=c&state=s',
     });
     expect(runner.run).toHaveBeenCalledWith(
-      ['auth', 'add', 'u@x.com', '--remote', '--step', '2', '--auth-url',
+      ['auth', 'add', pos('u@x.com'), '--remote', '--step', '2', '--auth-url',
         'http://127.0.0.1/cb?code=c&state=s', '--services', 'gmail', '--force-consent'],
     );
   });
@@ -365,7 +366,7 @@ describe('authToolsFor (least-privilege default services)', () => {
     const harness = await gmailHarness();
     await harness.callTool('gog_auth_add_url', { email: 'u@x.com', services: 'gmail,drive' });
     expect(runner.run).toHaveBeenCalledWith(
-      ['auth', 'add', 'u@x.com', '--remote', '--step', '1', '--services', 'gmail,drive', '--force-consent'],
+      ['auth', 'add', pos('u@x.com'), '--remote', '--step', '1', '--services', 'gmail,drive', '--force-consent'],
       { redactMode: 'tokens' },
     );
   });
@@ -381,10 +382,36 @@ describe('gog_auth_run', () => {
   });
 
   it('works with empty args array', async () => {
-    vi.mocked(runner.run).mockResolvedValue('token info');
+    vi.mocked(runner.run).mockResolvedValue('accounts');
     const harness = await setupHandlers();
-    await harness.callTool('gog_auth_run', { subcommand: 'tokens', args: [] });
-    expect(runner.run).toHaveBeenCalledWith(['auth', 'tokens'], {});
+    await harness.callTool('gog_auth_run', { subcommand: 'list', args: [] });
+    expect(runner.run).toHaveBeenCalledWith(['auth', 'list'], {});
+  });
+
+  it.each(['list', 'status', 'services', 'remove', 'alias'])('allows %s', async (subcommand) => {
+    vi.mocked(runner.run).mockResolvedValue('ok');
+    const harness = await setupHandlers();
+    const result = await harness.callTool('gog_auth_run', { subcommand, args: [] });
+    expect(result.isError).toBeFalsy();
+    expect(runner.run).toHaveBeenCalledWith(['auth', subcommand], {});
+  });
+
+  // SEC-3: `auth tokens export --out <path>` writes a long-lived refresh token
+  // to disk, where an attach path can read it back out. Credentials and the
+  // keyring are the same class. Only the account-management subset is exposed.
+  it.each([
+    ['tokens', ['export', 'me@example.com', '--out=/tmp/t.json']],
+    ['tokens', ['import', '/tmp/t.json']],
+    ['credentials', ['list']],
+    ['keyring', []],
+    ['add', ['me@example.com']],
+    ['service-account', ['set']],
+  ])('refuses auth %s %j', async (subcommand, args) => {
+    const harness = await setupHandlers();
+    const result = await harness.callTool('gog_auth_run', { subcommand, args });
+    expect(result.isError).toBe(true);
+    expect(result.content[0].text).toMatch(/not available through gog_auth_run/);
+    expect(runner.run).not.toHaveBeenCalled();
   });
 
   it('returns error text on failure', async () => {