gogcli-mcp 4.2.5 → 4.4.0

package/tests/runner.test.ts

@@ -4,6 +4,7 @@ import { spawn as mockedSpawn } from 'node:child_process';
 import { withCallSignal } from '@chrischall/mcp-utils';
 import { run, runBinary } from '../src/runner.js';
 import type { Spawner } from '../src/runner.js';
+import { pos } from '../src/argv.js';
 
 // The real spawn is dynamically imported inside runner's default executor.
 // Mock it so the no-spawner/no-executor fallback can be exercised without
@@ -938,6 +939,141 @@ describe('run --readonly (gog 0.31)', () => {
   });
 });
 
+describe('run safety flags', () => {
+  it('injects --gmail-no-send when options.gmailNoSend is true', async () => {
+    const spawner = makeSpawner(0, '{}');
+    await run(['gmail', 'archive', 'm1'], { gmailNoSend: true, spawner });
+    expect(spawner).toHaveBeenCalledWith(
+      'gog',
+      ['--json', '--color=never', '--no-input', '--gmail-no-send', 'gmail', 'archive', 'm1'],
+      expect.any(Object),
+    );
+  });
+
+  // Defence in depth behind the tool-level guard (audit SEC-1): whatever tool
+  // built the argv, a safety-control override in flag position never reaches
+  // gog, where the LAST value of a repeated flag would win.
+  it.each([
+    ['--readonly=false'],
+    ['--disable-commands='],
+    ['--enable-commands=gmail.send'],
+    ['--gmail-no-send=false'],
+    ['--access-token=ya29.x'],
+    ['--home=/tmp/x'],
+    ['--client=other'],
+    ['-a'],
+  ])('refuses a caller-supplied %j in flag position without spawning', async (bad) => {
+    const spawner = makeSpawner(0, '{}');
+    await expect(run(['drive', 'mkdir', 'x', bad], { readonly: true, spawner })).rejects.toThrow(/not allowed/);
+    await expect(runBinary(['drive', 'mkdir', 'x', bad], { spawner })).rejects.toThrow(/not allowed/);
+    expect(spawner).not.toHaveBeenCalled();
+  });
+
+  // The backstop runs on every tool's argv, so it must match exact control
+  // names only: gog_zoom_auth_setup builds --account-id/--client-id/
+  // --client-secret, which a prefix match refused before spawning.
+  it('lets zoom auth setup credentials flags through to gog', async () => {
+    const spawner = makeSpawner(0, '{}');
+    await run(['zoom', 'auth', 'setup', '--alias=work', '--account-id=abc', '--client-id=x', '--client-secret=y'], { spawner });
+    expect(spawner).toHaveBeenCalledWith(
+      'gog',
+      ['--json', '--color=never', '--no-input', 'zoom', 'auth', 'setup', '--alias=work', '--account-id=abc', '--client-id=x', '--client-secret=y'],
+      expect.any(Object),
+    );
+  });
+
+  it('lets the same text through as a positional after --', async () => {
+    const spawner = makeSpawner(0, '{}');
+    await run(['gmail', 'search', '--', '--readonly=false'], { spawner });
+    expect(spawner).toHaveBeenCalledTimes(1);
+  });
+});
+
+// BUG-1: a positional value that starts with '-' (a Gmail negation query such
+// as "-in:spam", an ID or a name the model chose) must never be parsed as a
+// gog flag. Values marked with pos() go after a single `--`, after every flag,
+// in their original order — the pattern upstream gogcli's own MCP tools use.
+describe('run positionals', () => {
+  it('moves pos() values after -- at the end, keeping their order', async () => {
+    const spawner = makeSpawner(0, '{}');
+    await run(['sheets', 'get', pos('id1'), pos('-A1'), '--render=FORMULA'], { spawner });
+    expect(spawner).toHaveBeenCalledWith(
+      'gog',
+      ['--json', '--color=never', '--no-input', 'sheets', 'get', '--render=FORMULA', '--', 'id1', '-A1'],
+      expect.any(Object),
+    );
+  });
+
+  it('passes a flag-shaped positional through as data, not a flag', async () => {
+    const spawner = makeSpawner(0, '{}');
+    await run(['gmail', 'search', pos('--readonly=false')], { readonly: true, spawner });
+    expect(spawner).toHaveBeenCalledWith(
+      'gog',
+      ['--json', '--color=never', '--no-input', '--readonly', 'gmail', 'search', '--', '--readonly=false'],
+      expect.any(Object),
+    );
+  });
+
+  it('adds no -- when nothing is marked positional', async () => {
+    const spawner = makeSpawner(0, '{}');
+    await run(['gmail', 'labels', 'list'], { spawner });
+    expect((spawner as unknown as { mock: { calls: unknown[][] } }).mock.calls[0]![1]).not.toContain('--');
+  });
+
+  it('treats a positional file arg as a positional', async () => {
+    const spawner = makeSpawner(0, '{}');
+    await run(
+      ['drive', 'upload', { kind: 'file', flag: 'upload', contents: 'aGk=', encoding: 'base64', filename: 'a.txt', positional: true }, '--parent=p'],
+      { spawner },
+    );
+    const argv = (spawner as unknown as { mock: { calls: unknown[][] } }).mock.calls[0]![1] as string[];
+    expect(argv.slice(0, 7)).toEqual(['--json', '--color=never', '--no-input', 'drive', 'upload', '--parent=p', '--']);
+    expect(argv[7]).toMatch(/a\.txt$/);
+  });
+
+  it('keeps everything after an explicit -- positional', async () => {
+    const spawner = makeSpawner(0, '{}');
+    await runBinary(['api', 'call', '--', 'drive', pos('v3')], { spawner });
+    expect(spawner).toHaveBeenCalledWith(
+      'gog',
+      ['--json', '--color=never', '--no-input', 'api', 'call', '--', 'drive', 'v3'],
+      expect.any(Object),
+    );
+  });
+});
+
+// BUG-2: binary mode buffered a whole Drive file (plus a base64 copy) with no
+// ceiling, so one multi-GB read could exhaust the server process.
+describe('runBinary maxOutputBytes', () => {
+  function streamingSpawner(chunks: Buffer[]): { spawner: Spawner; kill: ReturnType<typeof vi.fn> } {
+    const kill = vi.fn();
+    const spawner = vi.fn(() => {
+      const proc = new EventEmitter() as ReturnType<Spawner>;
+      (proc as unknown as { stdout: EventEmitter; stderr: EventEmitter }).stdout = new EventEmitter();
+      (proc as unknown as { stdout: EventEmitter; stderr: EventEmitter }).stderr = new EventEmitter();
+      proc.kill = kill;
+      setTimeout(() => {
+        for (const c of chunks) (proc as unknown as { stdout: EventEmitter }).stdout.emit('data', c);
+        proc.emit('close', 0);
+      }, 0);
+      return proc;
+    }) as unknown as Spawner;
+    return { spawner, kill };
+  }
+
+  it('kills gog and rejects once the output passes the cap', async () => {
+    const { spawner, kill } = streamingSpawner([Buffer.alloc(6), Buffer.alloc(6), Buffer.alloc(6)]);
+    await expect(runBinary(['api', 'call'], { spawner, maxOutputBytes: 10 }))
+      .rejects.toThrow(/more than 10 bytes/);
+    expect(kill).toHaveBeenCalled();
+  });
+
+  it('returns output at or under the cap', async () => {
+    const { spawner } = streamingSpawner([Buffer.from('hello')]);
+    expect(await runBinary(['api', 'call'], { spawner, maxOutputBytes: 5 })).toBe(Buffer.from('hello').toString('base64'));
+  });
+});
+
 describe('run executor', () => {
   it('uses the lazily-imported real spawn when no spawner is injected', async () => {
     vi.mocked(mockedSpawn).mockImplementation((() => makeProc(0, '{"real":true}')) as never);

package/tests/send-confirm-token.test.ts

@@ -0,0 +1,200 @@
+import { describe, it, expect, beforeEach, afterEach } from 'vitest';
+import {
+  CONFIRM_TOKEN_TTL_DEFAULT_SECONDS,
+  confirmTokenTtlSeconds,
+  hashSendPayload,
+  issueConfirmToken,
+  resetConfirmTokenState,
+  sendConfirmFallbackEnabled,
+  verifyConfirmToken,
+  type ConfirmBinding,
+} from '../src/send-confirm-token.js';
+
+const ORIGINAL_ENV = { ...process.env };
+
+const BINDING: ConfirmBinding = {
+  tool: 'gog_gmail_drafts_send',
+  account: 'me@example.com',
+  target: 'r123',
+  revision: 'msg-1',
+  payloadHash: hashSendPayload({ to: 'a@example.com', body: 'hello' }),
+};
+
+const NOW = 1_800_000_000_000;
+
+beforeEach(() => {
+  process.env = { ...ORIGINAL_ENV };
+  delete process.env.GOG_SEND_CONFIRM_FALLBACK;
+  delete process.env.GOG_CONFIRM_SECRET;
+  delete process.env.GOG_CONFIRM_TTL_SECONDS;
+  resetConfirmTokenState();
+});
+
+afterEach(() => {
+  process.env = ORIGINAL_ENV;
+  resetConfirmTokenState();
+});
+
+describe('hashSendPayload', () => {
+  it('is independent of key order, so a re-read payload hashes the same', () => {
+    expect(hashSendPayload({ a: 1, b: { c: 2, d: [1, 2] } }))
+      .toBe(hashSendPayload({ b: { d: [1, 2], c: 2 }, a: 1 }));
+  });
+
+  it('changes when any value changes, including array order', () => {
+    const base = hashSendPayload({ to: ['a', 'b'], body: 'x' });
+    expect(hashSendPayload({ to: ['b', 'a'], body: 'x' })).not.toBe(base);
+    expect(hashSendPayload({ to: ['a', 'b'], body: 'x ' })).not.toBe(base);
+  });
+
+  it('treats an undefined field as absent', () => {
+    expect(hashSendPayload({ a: 1, b: undefined })).toBe(hashSendPayload({ a: 1 }));
+  });
+
+  it('distinguishes null from absent', () => {
+    expect(hashSendPayload({ a: null })).not.toBe(hashSendPayload({}));
+  });
+});
+
+describe('sendConfirmFallbackEnabled', () => {
+  it('is off unless GOG_SEND_CONFIRM_FALLBACK is exactly "token" (case-insensitive)', () => {
+    expect(sendConfirmFallbackEnabled()).toBe(false);
+    process.env.GOG_SEND_CONFIRM_FALLBACK = '1';
+    expect(sendConfirmFallbackEnabled()).toBe(false);
+    process.env.GOG_SEND_CONFIRM_FALLBACK = ' Token ';
+    expect(sendConfirmFallbackEnabled()).toBe(true);
+  });
+
+  it('treats an unresolved .mcpb placeholder as unset', () => {
+    process.env.GOG_SEND_CONFIRM_FALLBACK = '${user_config.send_confirm_fallback}';
+    expect(sendConfirmFallbackEnabled()).toBe(false);
+  });
+});
+
+describe('confirmTokenTtlSeconds', () => {
+  it('defaults to ten minutes', () => {
+    expect(CONFIRM_TOKEN_TTL_DEFAULT_SECONDS).toBe(600);
+    expect(confirmTokenTtlSeconds()).toBe(600);
+  });
+
+  it('honours a positive integer GOG_CONFIRM_TTL_SECONDS', () => {
+    process.env.GOG_CONFIRM_TTL_SECONDS = '30';
+    expect(confirmTokenTtlSeconds()).toBe(30);
+  });
+
+  it.each(['0', '-5', 'abc', '1.5', ''])('falls back to the default for %j', (value) => {
+    process.env.GOG_CONFIRM_TTL_SECONDS = value;
+    expect(confirmTokenTtlSeconds()).toBe(600);
+  });
+});
+
+describe('issueConfirmToken / verifyConfirmToken', () => {
+  it('accepts a fresh token for the exact binding it was issued for', () => {
+    const { token, expiresAt } = issueConfirmToken(BINDING, NOW);
+    expect(expiresAt).toBe(new Date(NOW + 600_000).toISOString());
+    expect(verifyConfirmToken(token, BINDING, NOW + 1_000)).toEqual({ ok: true });
+  });
+
+  it('is single-use: the second presentation is TOKEN_REUSED', () => {
+    const { token } = issueConfirmToken(BINDING, NOW);
+    expect(verifyConfirmToken(token, BINDING, NOW)).toEqual({ ok: true });
+    expect(verifyConfirmToken(token, BINDING, NOW)).toMatchObject({ ok: false, error: 'TOKEN_REUSED' });
+  });
+
+  it('expires after the TTL', () => {
+    const { token } = issueConfirmToken(BINDING, NOW);
+    expect(verifyConfirmToken(token, BINDING, NOW + 600_001)).toMatchObject({ ok: false, error: 'TOKEN_EXPIRED' });
+  });
+
+  it('uses GOG_CONFIRM_TTL_SECONDS at issue time', () => {
+    process.env.GOG_CONFIRM_TTL_SECONDS = '5';
+    const { token } = issueConfirmToken(BINDING, NOW);
+    expect(verifyConfirmToken(token, BINDING, NOW + 5_001)).toMatchObject({ ok: false, error: 'TOKEN_EXPIRED' });
+  });
+
+  it('does not consume a token that failed verification', () => {
+    const { token } = issueConfirmToken(BINDING, NOW);
+    const changed = { ...BINDING, payloadHash: hashSendPayload({ to: 'b@example.com' }) };
+    expect(verifyConfirmToken(token, changed, NOW)).toMatchObject({ ok: false, error: 'DRAFT_CHANGED' });
+    expect(verifyConfirmToken(token, BINDING, NOW)).toEqual({ ok: true });
+  });
+
+  it('reports DRAFT_CHANGED with reason payload-changed when the payload hash differs', () => {
+    const { token } = issueConfirmToken(BINDING, NOW);
+    const changed = { ...BINDING, payloadHash: hashSendPayload({ to: 'a@example.com', body: 'HELLO' }) };
+    expect(verifyConfirmToken(token, changed, NOW)).toEqual({ ok: false, error: 'DRAFT_CHANGED', reason: 'payload-changed' });
+  });
+
+  it('reports DRAFT_CHANGED with reason message-id-rotated when the revision rotated', () => {
+    const { token } = issueConfirmToken(BINDING, NOW);
+    expect(verifyConfirmToken(token, { ...BINDING, revision: 'msg-2' }, NOW))
+      .toEqual({ ok: false, error: 'DRAFT_CHANGED', reason: 'message-id-rotated' });
+  });
+
+  it.each([
+    ['tool', { tool: 'gog_gmail_send' }],
+    ['account', { account: 'other@example.com' }],
+    ['draft/message', { target: 'r999' }],
+  ] as const)('never accepts a token issued for a different %s', (_label, override) => {
+    const { token } = issueConfirmToken(BINDING, NOW);
+    expect(verifyConfirmToken(token, { ...BINDING, ...override }, NOW)).toMatchObject({ ok: false, error: 'TOKEN_INVALID' });
+  });
+
+  it('rejects a tampered claim as TOKEN_INVALID', () => {
+    const { token } = issueConfirmToken(BINDING, NOW);
+    const [prefix, claims, sig] = token.split('.');
+    const decoded = JSON.parse(Buffer.from(claims!, 'base64url').toString('utf8'));
+    decoded.exp += 3_600_000;
+    const forged = `${prefix}.${Buffer.from(JSON.stringify(decoded)).toString('base64url')}.${sig}`;
+    expect(verifyConfirmToken(forged, BINDING, NOW)).toMatchObject({ ok: false, error: 'TOKEN_INVALID' });
+  });
+
+  it('rejects a tampered signature as TOKEN_INVALID', () => {
+    const { token } = issueConfirmToken(BINDING, NOW);
+    const flipped = token.slice(0, -2) + (token.endsWith('AA') ? 'BB' : 'AA');
+    expect(verifyConfirmToken(flipped, BINDING, NOW)).toMatchObject({ ok: false, error: 'TOKEN_INVALID' });
+  });
+
+  it.each(['', 'garbage', 'gct1.a.b', 'x.y.z', 'gct1..', 'gct1.a.b.c'])('rejects malformed token %j as TOKEN_INVALID', (token) => {
+    expect(verifyConfirmToken(token, BINDING, NOW)).toMatchObject({ ok: false, error: 'TOKEN_INVALID' });
+  });
+
+  it('rejects a correctly signed token whose claims are not JSON', async () => {
+    const { createHmac } = await import('node:crypto');
+    process.env.GOG_CONFIRM_SECRET = 'a-shared-secret';
+    resetConfirmTokenState();
+    const claims = Buffer.from('not json').toString('base64url');
+    const sig = createHmac('sha256', 'a-shared-secret').update(`gct1.${claims}`).digest('base64url');
+    expect(verifyConfirmToken(`gct1.${claims}.${sig}`, BINDING, NOW)).toMatchObject({ ok: false, error: 'TOKEN_INVALID' });
+  });
+
+  it('rejects a token signed by a previous process (per-process secret)', () => {
+    const { token } = issueConfirmToken(BINDING, NOW);
+    resetConfirmTokenState();
+    expect(verifyConfirmToken(token, BINDING, NOW)).toMatchObject({ ok: false, error: 'TOKEN_INVALID' });
+  });
+
+  it('with GOG_CONFIRM_SECRET set, a token survives a restart', () => {
+    process.env.GOG_CONFIRM_SECRET = 'a-shared-secret';
+    resetConfirmTokenState();
+    const { token } = issueConfirmToken(BINDING, NOW);
+    resetConfirmTokenState();
+    expect(verifyConfirmToken(token, BINDING, NOW)).toEqual({ ok: true });
+  });
+
+  it('binds a revision-less subject too', () => {
+    const noRevision = { ...BINDING, revision: undefined };
+    const { token } = issueConfirmToken(noRevision, NOW);
+    expect(verifyConfirmToken(token, noRevision, NOW)).toEqual({ ok: true });
+  });
+
+  it('forgets used tokens once they would have expired anyway', () => {
+    const first = issueConfirmToken(BINDING, NOW);
+    expect(verifyConfirmToken(first.token, BINDING, NOW)).toEqual({ ok: true });
+    // A later verification prunes the spent entry; the old token is then
+    // rejected as expired rather than remembered forever.
+    const second = issueConfirmToken(BINDING, NOW + 700_000);
+    expect(verifyConfirmToken(second.token, BINDING, NOW + 700_000)).toEqual({ ok: true });
+    expect(verifyConfirmToken(first.token, BINDING, NOW + 700_000)).toMatchObject({ ok: false, error: 'TOKEN_EXPIRED' });
+  });
+});

package/tests/tools/api.test.ts

@@ -1,7 +1,8 @@
-import { describe, it, expect, vi, beforeEach } from 'vitest';
+import { describe, it, expect, vi, beforeEach, afterEach } from 'vitest';
 import { registerApiTools } from '../../src/tools/api.js';
 import * as runner from '../../src/runner.js';
 import { createTestHarness } from '@chrischall/mcp-utils/test';
+import { pos } from '../../src/argv.js';
 
 vi.mock('../../src/runner.js');
 
@@ -37,7 +38,7 @@ describe('gog_api_describe', () => {
     vi.mocked(runner.run).mockResolvedValue('{}');
     const harness = await setupHandlers();
     await harness.callTool('gog_api_describe', { api: 'drive', version: 'v3' });
-    expect(runner.run).toHaveBeenCalledWith(['api', 'describe', 'drive', 'v3'], { account: undefined });
+    expect(runner.run).toHaveBeenCalledWith(['api', 'describe', pos('drive'), pos('v3')], { account: undefined });
   });
 
   it('describes a single method when method is provided', async () => {
@@ -45,7 +46,7 @@ describe('gog_api_describe', () => {
     const harness = await setupHandlers();
     await harness.callTool('gog_api_describe', { api: 'drive', version: 'v3', method: 'files.list' });
     expect(runner.run).toHaveBeenCalledWith(
-      ['api', 'describe', 'drive', 'v3', 'files.list'],
+      ['api', 'describe', pos('drive'), pos('v3'), pos('files.list')],
       { account: undefined },
     );
   });
@@ -64,8 +65,8 @@ describe('gog_api_call', () => {
     const harness = await setupHandlers();
     await harness.callTool('gog_api_call', { api: 'drive', version: 'v3', method: 'files.list', params: '{"q":"x"}' });
     expect(runner.run).toHaveBeenCalledWith(
-      ['api', 'call', 'drive', 'v3', 'files.list', '--params={"q":"x"}'],
-      { account: undefined },
+      ['api', 'call', pos('drive'), pos('v3'), pos('files.list'), '--params={"q":"x"}'],
+      { account: undefined, gmailNoSend: true },
     );
   });
 
@@ -79,11 +80,11 @@ describe('gog_api_call', () => {
     });
     expect(runner.run).toHaveBeenCalledWith(
       [
-        'api', 'call', 'drive', 'v3', 'files.create',
+        'api', 'call', pos('drive'), pos('v3'), pos('files.create'),
         '--params={"fields":"id"}', '--body={"name":"f"}',
         '--scope=https://www.googleapis.com/auth/drive', '--allow-write', '--dry-run', '--force',
       ],
-      { account: 'a@b.com' },
+      { account: 'a@b.com', gmailNoSend: true },
     );
   });
 
@@ -94,7 +95,7 @@ describe('gog_api_call', () => {
       api: 'drive', version: 'v3', method: 'files.create', allowWrite: true,
     });
     const passedArgs = vi.mocked(runner.run).mock.calls[0][0];
-    expect(passedArgs).toEqual(['api', 'call', 'drive', 'v3', 'files.create', '--allow-write', '--force']);
+    expect(passedArgs).toEqual(['api', 'call', pos('drive'), pos('v3'), pos('files.create'), '--allow-write', '--force']);
     expect(passedArgs[passedArgs.length - 1]).toBe('--force');
   });
 
@@ -104,4 +105,69 @@ describe('gog_api_call', () => {
     const result = await harness.callTool('gog_api_call', { api: 'drive', version: 'v3', method: 'files.list' });
     expect(result.content[0].text).toBe('Error: Call failed');
   });
+
+  // SEC-2: allowWrite is a model-set boolean, so it cannot stand in for the
+  // user's confirmation of a send. Sends are refused here (and --gmail-no-send
+  // is pinned on as a backstop); so is anything that routes future mail away.
+  it.each([
+    ['gmail', 'users.messages.send'],
+    ['Gmail', 'users.drafts.send'],
+    ['gmail', 'users.settings.forwardingAddresses.create'],
+    ['gmail', 'users.settings.updateAutoForwarding'],
+    ['gmail', 'users.settings.filters.create'],
+    ['gmail', 'users.settings.delegates.create'],
+  ])('refuses %s %s', async (api, method) => {
+    const harness = await setupHandlers();
+    const result = await harness.callTool('gog_api_call', { api, version: 'v1', method, allowWrite: true });
+    expect(result.isError).toBe(true);
+    expect(result.content[0].text).toMatch(/not available through gog_api_call/);
+    expect(runner.run).not.toHaveBeenCalled();
+  });
+
+  it('still allows other gmail methods', async () => {
+    vi.mocked(runner.run).mockResolvedValue('{}');
+    const harness = await setupHandlers();
+    const result = await harness.callTool('gog_api_call', { api: 'gmail', version: 'v1', method: 'users.labels.list' });
+    expect(result.isError).toBeFalsy();
+  });
+
+  // SEC-1: the positional api/version/method are model-supplied too.
+  it.each([
+    [{ api: '--readonly=false', version: 'v3', method: 'files.list' }],
+    [{ api: 'drive', version: '--', method: 'files.list' }],
+    [{ api: 'drive', version: 'v3', method: '--disable-commands=' }],
+  ])('refuses a safety-flag override in %j', async (input) => {
+    const harness = await setupHandlers();
+    const result = await harness.callTool('gog_api_call', input);
+    expect(result.isError).toBe(true);
+    expect(result.content[0].text).toMatch(/not allowed/);
+    expect(runner.run).not.toHaveBeenCalled();
+  });
+});
+
+// SEC-3/SEC-4: gog reads `--body=@path` from the host, so an unconfined body
+// is a read primitive (gog's credentials.json is itself valid JSON).
+describe('gog_api_call @file confinement', () => {
+  let prevRoots: string | undefined;
+  beforeEach(() => { prevRoots = process.env.GOG_FILE_ROOTS; process.env.GOG_FILE_ROOTS = '/nonexistent-gog-file-root'; });
+  afterEach(() => { process.env.GOG_FILE_ROOTS = prevRoots; });
+
+  it.each([
+    [{ body: '@/Users/x/Library/Application Support/gogcli/credentials.json' }, /body/],
+    [{ params: '@/etc/passwd' }, /params/],
+  ])('refuses %j outside GOG_FILE_ROOTS', async (extra, param) => {
+    const harness = await createTestHarness(registerApiTools);
+    const result = await harness.callTool('gog_api_call', { api: 'drive', version: 'v3', method: 'files.create', allowWrite: true, ...extra });
+    expect(result.isError).toBe(true);
+    expect(result.content[0].text).toMatch(/outside the directories/);
+    expect(result.content[0].text).toMatch(param);
+    expect(runner.run).not.toHaveBeenCalled();
+  });
+
+  it('passes an inline JSON body through', async () => {
+    vi.mocked(runner.run).mockResolvedValue('{}');
+    const harness = await createTestHarness(registerApiTools);
+    await harness.callTool('gog_api_call', { api: 'drive', version: 'v3', method: 'files.list', body: '{"a":1}' });
+    expect(runner.run).toHaveBeenCalled();
+  });
 });

package/tests/tools/appscript.test.ts

@@ -2,6 +2,7 @@ import { describe, it, expect, vi, beforeEach } from 'vitest';
 import { registerAppScriptTools } from '../../src/tools/appscript.js';
 import * as runner from '../../src/runner.js';
 import { createTestHarness } from '@chrischall/mcp-utils/test';
+import { pos } from '../../src/argv.js';
 
 vi.mock('../../src/runner.js');
 
@@ -14,7 +15,7 @@ describe('gog_appscript_get', () => {
     vi.mocked(runner.run).mockResolvedValue('{}');
     const harness = await setupHandlers();
     await harness.callTool('gog_appscript_get', { scriptId: 'S1' });
-    expect(runner.run).toHaveBeenCalledWith(['appscript', 'get', 'S1'], { account: undefined });
+    expect(runner.run).toHaveBeenCalledWith(['appscript', 'get', pos('S1')], { account: undefined });
   });
 
   it('returns error text on failure', async () => {
@@ -30,7 +31,7 @@ describe('gog_appscript_content', () => {
     vi.mocked(runner.run).mockResolvedValue('{}');
     const harness = await setupHandlers();
     await harness.callTool('gog_appscript_content', { scriptId: 'S1', account: 'me@x.com' });
-    expect(runner.run).toHaveBeenCalledWith(['appscript', 'content', 'S1'], { account: 'me@x.com' });
+    expect(runner.run).toHaveBeenCalledWith(['appscript', 'content', pos('S1')], { account: 'me@x.com' });
   });
 });
 
@@ -39,7 +40,7 @@ describe('gog_appscript_pull', () => {
     vi.mocked(runner.run).mockResolvedValue('{}');
     const harness = await setupHandlers();
     await harness.callTool('gog_appscript_pull', { scriptId: 'S1', dir: '/tmp/proj' });
-    expect(runner.run).toHaveBeenCalledWith(['appscript', 'pull', 'S1', '/tmp/proj'], { account: undefined });
+    expect(runner.run).toHaveBeenCalledWith(['appscript', 'pull', pos('S1'), pos('/tmp/proj')], { account: undefined });
   });
 
   it('passes --overwrite', async () => {
@@ -47,7 +48,7 @@ describe('gog_appscript_pull', () => {
     const harness = await setupHandlers();
     await harness.callTool('gog_appscript_pull', { scriptId: 'S1', dir: '/tmp/proj', overwrite: true });
     expect(runner.run).toHaveBeenCalledWith(
-      ['appscript', 'pull', 'S1', '/tmp/proj', '--overwrite'],
+      ['appscript', 'pull', pos('S1'), pos('/tmp/proj'), '--overwrite'],
       { account: undefined },
     );
   });
@@ -95,7 +96,7 @@ describe('gog_appscript_deployments', () => {
     const harness = await setupHandlers();
     await harness.callTool('gog_appscript_deployments', { scriptId: 'S1', max: 10, pageToken: 'tok' });
     expect(runner.run).toHaveBeenCalledWith(
-      ['appscript', 'deployments', 'S1', '--max=10', '--page=tok'],
+      ['appscript', 'deployments', pos('S1'), '--max=10', '--page=tok'],
       { account: undefined },
     );
   });
@@ -106,7 +107,7 @@ describe('gog_appscript_versions', () => {
     vi.mocked(runner.run).mockResolvedValue('{}');
     const harness = await setupHandlers();
     await harness.callTool('gog_appscript_versions', { scriptId: 'S1', all: true });
-    expect(runner.run).toHaveBeenCalledWith(['appscript', 'versions', 'S1', '--all'], { account: undefined });
+    expect(runner.run).toHaveBeenCalledWith(['appscript', 'versions', pos('S1'), '--all'], { account: undefined });
   });
 });
 
@@ -115,7 +116,7 @@ describe('gog_appscript_run_function', () => {
     vi.mocked(runner.run).mockResolvedValue('{}');
     const harness = await setupHandlers();
     await harness.callTool('gog_appscript_run_function', { scriptId: 'S1', functionName: 'doWork' });
-    expect(runner.run).toHaveBeenCalledWith(['appscript', 'run', 'S1', 'doWork'], { account: undefined });
+    expect(runner.run).toHaveBeenCalledWith(['appscript', 'run', pos('S1'), pos('doWork')], { account: undefined });
   });
 
   it('passes params and --dev-mode', async () => {
@@ -125,7 +126,7 @@ describe('gog_appscript_run_function', () => {
       scriptId: 'S1', functionName: 'doWork', params: '["a",1]', devMode: true,
     });
     expect(runner.run).toHaveBeenCalledWith(
-      ['appscript', 'run', 'S1', 'doWork', '--params=["a",1]', '--dev-mode'],
+      ['appscript', 'run', pos('S1'), pos('doWork'), '--params=["a",1]', '--dev-mode'],
       { account: undefined },
     );
   });
@@ -157,3 +158,28 @@ describe('gog_appscript_run', () => {
     expect(runner.run).toHaveBeenCalledWith(['appscript', 'get', 'S1'], { account: undefined });
   });
 });
+
+// SEC-3/SEC-4: every model-supplied server path must resolve inside an
+// operator-configured root (GOG_FILE_ROOTS). The suite runs with '/' so the
+// arg-shape tests can use any path; these narrow it.
+async function withFileRoots<T>(roots: string, fn: () => Promise<T>): Promise<T> {
+  const prev = process.env.GOG_FILE_ROOTS;
+  process.env.GOG_FILE_ROOTS = roots;
+  try {
+    return await fn();
+  } finally {
+    process.env.GOG_FILE_ROOTS = prev;
+  }
+}
+
+describe('gog_appscript_pull — server paths', () => {
+  it('refuses a dir outside GOG_FILE_ROOTS', async () => {
+    const harness = await setupHandlers();
+    const result = await withFileRoots('/srv/gog-files', () => harness.callTool('gog_appscript_pull', {
+      scriptId: 'S1', dir: '/Users/me/Library/LaunchAgents',
+    }));
+    expect(result.isError).toBe(true);
+    expect(result.content[0].text).toContain('dir "/Users/me/Library/LaunchAgents" is outside');
+    expect(runner.run).not.toHaveBeenCalled();
+  });
+});