gogcli-mcp 4.2.5 → 4.4.0

package/tests/tools/drive.test.ts

@@ -1,11 +1,15 @@
-import { describe, it, expect, vi, beforeEach } from 'vitest';
+import { describe, it, expect, vi, beforeEach, afterEach } from 'vitest';
 import { registerDriveTools, DRIVE_LS_COMPACT_FIELDS } from '../../src/tools/drive.js';
 import * as runner from '../../src/runner.js';
 import { createTestHarness } from '@chrischall/mcp-utils/test';
+import { pos } from '../../src/argv.js';
 
 vi.mock('../../src/runner.js');
 
-const setupHandlers = () => createTestHarness(registerDriveTools);
+// The dispatch rail asks before guest-visible / outbound calls; this client accepts.
+const setupHandlers = () => createTestHarness(registerDriveTools, {
+  elicitation: async () => ({ action: 'accept', content: { confirmed: true } }),
+});
 
 // gog_drive_ls answers in the compact rung by default, so every call carries
 // the mask. These keep the flag-mapping tests below about flag mapping while
@@ -111,7 +115,7 @@ describe('gog_drive_search', () => {
     const harness = await setupHandlers();
     await harness.callTool('gog_drive_search', { query: 'budget' });
     expect(runner.run).toHaveBeenCalledWith(
-      ['drive', 'search', 'budget'],
+      ['drive', 'search', pos('budget')],
       { account: undefined, stripMedia: true },
     );
   });
@@ -121,7 +125,7 @@ describe('gog_drive_search', () => {
     const harness = await setupHandlers();
     await harness.callTool('gog_drive_search', { query: 'budget', view: 'full' });
     expect(runner.run).toHaveBeenCalledWith(
-      ['drive', 'search', 'budget'],
+      ['drive', 'search', pos('budget')],
       { account: undefined, stripMedia: false },
     );
   });
@@ -142,14 +146,14 @@ describe('gog_drive_get', () => {
     vi.mocked(runner.run).mockResolvedValue('{}');
     const harness = await setupHandlers();
     await harness.callTool('gog_drive_get', { fileId: 'f1' });
-    expect(runner.run).toHaveBeenCalledWith(['drive', 'get', 'f1'], { account: undefined, stripMedia: true });
+    expect(runner.run).toHaveBeenCalledWith(['drive', 'get', pos('f1')], { account: undefined, stripMedia: true });
   });
 
   it('keeps everything for the full view', async () => {
     vi.mocked(runner.run).mockResolvedValue('{}');
     const harness = await setupHandlers();
     await harness.callTool('gog_drive_get', { fileId: 'f1', view: 'full' });
-    expect(runner.run).toHaveBeenCalledWith(['drive', 'get', 'f1'], { account: undefined, stripMedia: false });
+    expect(runner.run).toHaveBeenCalledWith(['drive', 'get', pos('f1')], { account: undefined, stripMedia: false });
   });
 
 
@@ -166,7 +170,7 @@ describe('gog_drive_mkdir', () => {
     vi.mocked(runner.run).mockResolvedValue('{"id":"new-folder"}');
     const harness = await setupHandlers();
     await harness.callTool('gog_drive_mkdir', { name: 'Reports' });
-    expect(runner.run).toHaveBeenCalledWith(['drive', 'mkdir', 'Reports'], { account: undefined });
+    expect(runner.run).toHaveBeenCalledWith(['drive', 'mkdir', pos('Reports')], { account: undefined });
   });
 
   it('returns error text on failure', async () => {
@@ -182,7 +186,7 @@ describe('gog_drive_rename', () => {
     vi.mocked(runner.run).mockResolvedValue('{}');
     const harness = await setupHandlers();
     await harness.callTool('gog_drive_rename', { fileId: 'file1', newName: 'Budget 2026' });
-    expect(runner.run).toHaveBeenCalledWith(['drive', 'rename', 'file1', 'Budget 2026'], { account: undefined });
+    expect(runner.run).toHaveBeenCalledWith(['drive', 'rename', pos('file1'), pos('Budget 2026')], { account: undefined });
   });
 
   it('returns error text on failure', async () => {
@@ -198,7 +202,7 @@ describe('gog_drive_move', () => {
     vi.mocked(runner.run).mockResolvedValue('{}');
     const harness = await setupHandlers();
     await harness.callTool('gog_drive_move', { fileId: 'file1', parentId: 'folder1' });
-    expect(runner.run).toHaveBeenCalledWith(['drive', 'move', 'file1', '--parent=folder1'], { account: undefined });
+    expect(runner.run).toHaveBeenCalledWith(['drive', 'move', pos('file1'), '--parent=folder1'], { account: undefined });
   });
 
   it('returns error text on failure', async () => {
@@ -214,7 +218,7 @@ describe('gog_drive_delete', () => {
     vi.mocked(runner.run).mockResolvedValue('{}');
     const harness = await setupHandlers();
     await harness.callTool('gog_drive_delete', { fileId: 'file1' });
-    expect(runner.run).toHaveBeenCalledWith(['drive', 'delete', 'file1', '--force'], { account: undefined });
+    expect(runner.run).toHaveBeenCalledWith(['drive', 'delete', pos('file1'), '--force'], { account: undefined });
   });
 
   it('appends --permanent when permanent=true', async () => {
@@ -222,7 +226,7 @@ describe('gog_drive_delete', () => {
     const harness = await setupHandlers();
     await harness.callTool('gog_drive_delete', { fileId: 'file1', permanent: true });
     expect(runner.run).toHaveBeenCalledWith(
-      ['drive', 'delete', 'file1', '--permanent', '--force'],
+      ['drive', 'delete', pos('file1'), '--permanent', '--force'],
       { account: undefined },
     );
   });
@@ -231,7 +235,7 @@ describe('gog_drive_delete', () => {
     vi.mocked(runner.run).mockResolvedValue('{}');
     const harness = await setupHandlers();
     await harness.callTool('gog_drive_delete', { fileId: 'file1', permanent: false });
-    expect(runner.run).toHaveBeenCalledWith(['drive', 'delete', 'file1', '--force'], { account: undefined });
+    expect(runner.run).toHaveBeenCalledWith(['drive', 'delete', pos('file1'), '--force'], { account: undefined });
   });
 
   it('returns error text on failure', async () => {
@@ -248,7 +252,7 @@ describe('gog_drive_share', () => {
     const harness = await setupHandlers();
     await harness.callTool('gog_drive_share', { fileId: 'file1', to: 'user', email: 'bob@example.com' });
     expect(runner.run).toHaveBeenCalledWith(
-      ['drive', 'share', 'file1', '--to=user', '--email=bob@example.com'],
+      ['drive', 'share', pos('file1'), '--to=user', '--email=bob@example.com'],
       { account: undefined },
     );
   });
@@ -258,7 +262,7 @@ describe('gog_drive_share', () => {
     const harness = await setupHandlers();
     await harness.callTool('gog_drive_share', { fileId: 'file1', to: 'domain', domain: 'example.com', role: 'writer' });
     expect(runner.run).toHaveBeenCalledWith(
-      ['drive', 'share', 'file1', '--to=domain', '--domain=example.com', '--role=writer'],
+      ['drive', 'share', pos('file1'), '--to=domain', '--domain=example.com', '--role=writer'],
       { account: undefined },
     );
   });
@@ -268,7 +272,7 @@ describe('gog_drive_share', () => {
     const harness = await setupHandlers();
     await harness.callTool('gog_drive_share', { fileId: 'file1', to: 'anyone' });
     expect(runner.run).toHaveBeenCalledWith(
-      ['drive', 'share', 'file1', '--to=anyone', '--force'],
+      ['drive', 'share', pos('file1'), '--to=anyone', '--force'],
       { account: undefined },
     );
   });
@@ -295,6 +299,58 @@ describe('gog_drive_run', () => {
     const result = await harness.callTool('gog_drive_run', { subcommand: 'copy', args: [] });
     expect(result.content[0].text).toBe('Error: Run failed');
   });
+
+  // SEC-1 regression: `gog --readonly drive mkdir x --readonly=false` reached
+  // Google on gog 0.41.0, defeating the GOG_READONLY kill switch.
+  it('refuses --readonly=false so GOG_READONLY cannot be overridden', async () => {
+    const harness = await setupHandlers();
+    const result = await harness.callTool('gog_drive_run', { subcommand: 'mkdir', args: ['x', '--readonly=false'] });
+    expect(result.isError).toBe(true);
+    expect(result.content[0].text).toMatch(/--readonly=false is not allowed/);
+    expect(runner.run).not.toHaveBeenCalled();
+  });
+});
+
+// SEC-3/SEC-4 through the escape hatch: GOG_FILE_ROOTS must bind gog_drive_run
+// too, or `upload <gog's credentials.json>` exfiltrates what the roots protect.
+describe('gog_drive_run path confinement', () => {
+  // The suite runs with GOG_FILE_ROOTS='/'; narrow it so confinement bites.
+  let prevRoots: string | undefined;
+  beforeEach(() => { prevRoots = process.env.GOG_FILE_ROOTS; process.env.GOG_FILE_ROOTS = '/nonexistent-gog-file-root'; });
+  afterEach(() => { process.env.GOG_FILE_ROOTS = prevRoots; });
+
+  it('refuses upload, whose local path is positional, pointing at gog_drive_upload', async () => {
+    const harness = await setupHandlers();
+    const result = await harness.callTool('gog_drive_run', {
+      subcommand: 'upload',
+      args: ['/Users/x/Library/Application Support/gogcli/credentials.json'],
+    });
+    expect(result.isError).toBe(true);
+    expect(result.content[0].text).toMatch(/gog_drive_upload/);
+    expect(runner.run).not.toHaveBeenCalled();
+  });
+
+  it('refuses a download --out outside GOG_FILE_ROOTS', async () => {
+    const harness = await setupHandlers();
+    const result = await harness.callTool('gog_drive_run', { subcommand: 'download', args: ['f1', '--out=~/.zshrc'] });
+    expect(result.isError).toBe(true);
+    expect(result.content[0].text).toMatch(/--out "~\/.zshrc" is outside/);
+    expect(runner.run).not.toHaveBeenCalled();
+  });
+
+  it('refuses a --on-change hook, which runs a local command', async () => {
+    const harness = await setupHandlers();
+    const result = await harness.callTool('gog_drive_run', { subcommand: 'changes', args: ['poll', '--on-change=sh -c id'] });
+    expect(result.isError).toBe(true);
+    expect(runner.run).not.toHaveBeenCalled();
+  });
+
+  it('still forwards a --file Drive ID, which is not a local path', async () => {
+    vi.mocked(runner.run).mockResolvedValue('{}');
+    const harness = await setupHandlers();
+    await harness.callTool('gog_drive_run', { subcommand: 'audit', args: ['sharing', '--file=1AbC'] });
+    expect(runner.run).toHaveBeenCalledWith(['drive', 'audit', 'sharing', '--file=1AbC'], { account: undefined });
+  });
 });
 
 describe('gog_drive_extract_text', () => {
@@ -324,7 +380,7 @@ describe('gog_drive_extract_text', () => {
       ['api', 'call', 'drive', 'v3', 'files.export', '--params={"fileId":"tmpDoc1","mimeType":"text/plain"}'],
       { account: undefined },
     );
-    expect(runner.run).toHaveBeenCalledWith(['drive', 'delete', 'tmpDoc1', '--permanent', '--force'], { account: undefined });
+    expect(runner.run).toHaveBeenCalledWith(['drive', 'delete', pos('tmpDoc1'), '--permanent', '--force'], { account: undefined });
   });
 
   it('passes an ocrLanguage hint on the copy', async () => {
@@ -340,7 +396,7 @@ describe('gog_drive_extract_text', () => {
         '--params={"fileId":"pdf1","ocrLanguage":"fr"}', '--body={"name":"gogcli-ocr-pdf1","mimeType":"application/vnd.google-apps.document"}'],
       { account: undefined, timeout: 300_000 },
     );
-    expect(runner.run).toHaveBeenCalledWith(['drive', 'delete', 'tmpDoc2', '--permanent', '--force'], { account: undefined });
+    expect(runner.run).toHaveBeenCalledWith(['drive', 'delete', pos('tmpDoc2'), '--permanent', '--force'], { account: undefined });
   });
 
   it('exports a native Google Doc directly with no convert or temp cleanup', async () => {
@@ -383,7 +439,7 @@ describe('gog_drive_extract_text', () => {
     const result = await harness.callTool('gog_drive_extract_text', { fileId: 'pdf1' });
     expect(result.isError).toBe(true);
     expect(result.content[0].text).toContain('export exploded');
-    expect(runner.run).toHaveBeenCalledWith(['drive', 'delete', 'tmpDoc3', '--permanent', '--force'], { account: undefined });
+    expect(runner.run).toHaveBeenCalledWith(['drive', 'delete', pos('tmpDoc3'), '--permanent', '--force'], { account: undefined });
   });
 
   it('errors clearly when OCR conversion returns no id (and creates nothing to clean up)', async () => {
@@ -417,7 +473,7 @@ describe('gog_drive_extract_text', () => {
       .mockResolvedValueOnce('body');
     const harness = await setupHandlers();
     await harness.callTool('gog_drive_extract_text', { fileId: 'doc1', account: 'me@x.com' });
-    expect(runner.run).toHaveBeenCalledWith(['drive', 'get', 'doc1'], { account: 'me@x.com' });
+    expect(runner.run).toHaveBeenCalledWith(['drive', 'get', pos('doc1')], { account: 'me@x.com' });
   });
 });
 
@@ -435,10 +491,44 @@ describe('gog_drive_read_bytes', () => {
     expect(result.content[0].text).toContain('a.pdf');
     expect(runner.runBinary).toHaveBeenCalledWith(
       ['api', 'call', 'drive', 'v3', 'files.get', '--params={"fileId":"f1","alt":"media"}'],
-      { account: undefined },
+      { account: undefined, maxOutputBytes: 8 * 1024 * 1024 },
     );
   });
 
+  // BUG-2: the size is known from `drive get` before a byte is fetched.
+  it('refuses a file over the inline ceiling without fetching its bytes', async () => {
+    vi.mocked(runner.run).mockResolvedValueOnce(JSON.stringify({ file: { name: 'backup.zip', mimeType: 'application/zip', size: '4294967296' } }));
+    const harness = await setupHandlers();
+    const result = await harness.callTool('gog_drive_read_bytes', { fileId: 'f1' });
+    expect(result.isError).toBe(true);
+    expect(result.content[0].text).toMatch(/4294967296 bytes.*8 MiB/);
+    expect(result.content[0].text).toContain('gog_drive_extract_text');
+    expect(runner.runBinary).not.toHaveBeenCalled();
+  });
+
+  it('names the file by id when an oversized file has no name', async () => {
+    vi.mocked(runner.run).mockResolvedValueOnce(JSON.stringify({ size: 9 * 1024 * 1024 }));
+    const harness = await setupHandlers();
+    const result = await harness.callTool('gog_drive_read_bytes', { fileId: 'f9' });
+    expect(result.content[0].text).toMatch(/^f9 is 9437184 bytes/);
+  });
+
+  it('treats an unparseable size as unknown and relies on the fetch cap', async () => {
+    vi.mocked(runner.run).mockResolvedValueOnce(JSON.stringify({ file: { name: 'a.bin', size: 'n/a' } }));
+    vi.mocked(runner.runBinary).mockResolvedValueOnce(Buffer.from('x').toString('base64'));
+    const harness = await setupHandlers();
+    const result = await harness.callTool('gog_drive_read_bytes', { fileId: 'f1' });
+    expect(result.isError).toBeFalsy();
+  });
+
+  it('caps the fetch itself when Drive reports no size', async () => {
+    vi.mocked(runner.run).mockResolvedValueOnce(JSON.stringify({ file: { name: 'a.bin', mimeType: 'application/octet-stream' } }));
+    vi.mocked(runner.runBinary).mockResolvedValueOnce(Buffer.from('x').toString('base64'));
+    const harness = await setupHandlers();
+    await harness.callTool('gog_drive_read_bytes', { fileId: 'f1' });
+    expect(runner.runBinary).toHaveBeenCalledWith(expect.any(Array), { account: undefined, maxOutputBytes: 8 * 1024 * 1024 });
+  });
+
   it('names the text fallback when the resource type is one hosts refuse to render', async () => {
     // The bytes arrive fine; some hosts just drop a non-image embedded resource
     // ("Resources of type 'application/pdf' are not currently supported"), and

package/tests/tools/gmail-confirm-token.test.ts

@@ -0,0 +1,274 @@
+import { describe, it, expect, vi, beforeEach, afterEach } from 'vitest';
+import { mkdtempSync, writeFileSync } from 'node:fs';
+import { tmpdir } from 'node:os';
+import { join } from 'node:path';
+import { createTestHarness } from '@chrischall/mcp-utils/test';
+import { metadataThreadId, registerGmailTools } from '../../src/tools/gmail.js';
+import * as runner from '../../src/runner.js';
+import { pos } from '../../src/argv.js';
+import { resetConfirmTokenState } from '../../src/send-confirm-token.js';
+
+vi.mock('../../src/runner.js');
+
+// ============================================================================
+// The two-phase confirmToken fallback on the base package's send tools,
+// driven through the real MCP RPC path. A harness registered WITHOUT an
+// elicitation handler is a client that declares no elicitation — claude.ai's
+// measured shape.
+// ============================================================================
+
+const ORIGINAL_ENV = { ...process.env };
+let fileRoot: string;
+
+beforeEach(() => {
+  vi.clearAllMocks();
+  process.env = { ...ORIGINAL_ENV };
+  delete process.env.GOG_SEND_CONFIRM_FALLBACK;
+  delete process.env.GOG_CONFIRM_TTL_SECONDS;
+  delete process.env.GOG_CONFIRM_SECRET;
+  process.env.GOG_ACCOUNT = 'me@example.com';
+  fileRoot = mkdtempSync(join(tmpdir(), 'gct-roots-'));
+  process.env.GOG_FILE_ROOTS = fileRoot;
+  resetConfirmTokenState();
+  vi.spyOn(process.stderr, 'write').mockImplementation(() => true);
+});
+
+afterEach(() => {
+  process.env = ORIGINAL_ENV;
+  vi.restoreAllMocks();
+  vi.useRealTimers();
+});
+
+const noElicitation = () => createTestHarness(registerGmailTools);
+const withElicitation = () => createTestHarness(registerGmailTools, {
+  elicitation: async () => ({ action: 'accept', content: { confirmed: true } }),
+});
+const json = (r: { content: Array<{ text?: string }> }) => JSON.parse(r.content[0]!.text as string);
+const SENT = '{"id":"sent1"}';
+
+const SEND_ARGS = {
+  to: 'alice@example.com',
+  cc: 'carol@example.com',
+  bcc: 'secret-bcc@example.com',
+  subject: 'Quarterly numbers',
+  body: 'Hi Alice,\n\nNumbers attached.\n\n— me',
+};
+
+const sendCalls = () => vi.mocked(runner.run).mock.calls.filter(([args]) => args[0] === 'gmail' && args[1] === 'send');
+
+describe('gog_gmail_send — token fallback', () => {
+  it('elicitation supported: unchanged — prompts and sends, confirmToken or not', async () => {
+    process.env.GOG_SEND_CONFIRM_FALLBACK = 'token';
+    vi.mocked(runner.run).mockResolvedValue(SENT);
+    const harness = await withElicitation();
+    const result = await harness.callTool('gog_gmail_send', { ...SEND_ARGS, confirmToken: 'gct1.not.real' });
+    expect(result.content[0]!.text).toBe(SENT);
+    expect(sendCalls()).toHaveLength(1);
+  });
+
+  it('unsupported + env unset: refuses, with the new hint', async () => {
+    const harness = await noElicitation();
+    const body = json(await harness.callTool('gog_gmail_send', SEND_ARGS));
+    expect(body).toMatchObject({ confirmed: false, dispatched: false, reason: 'confirmation-unsupported' });
+    expect(body.note).toContain('set GOG_SEND_CONFIRM_FALLBACK=token to enable two-step confirmation');
+    expect(runner.run).not.toHaveBeenCalled();
+  });
+
+  describe('unsupported + GOG_SEND_CONFIRM_FALLBACK=token', () => {
+    beforeEach(() => { process.env.GOG_SEND_CONFIRM_FALLBACK = 'token'; });
+
+    it('phase 1 previews everything (Bcc included, full body) and sends nothing', async () => {
+      const long = `${'x'.repeat(5000)}END`;
+      const harness = await noElicitation();
+      const body = json(await harness.callTool('gog_gmail_send', {
+        ...SEND_ARGS,
+        body: long,
+        threadId: 't1',
+        replyToMessageId: 'm0',
+        attachInline: [{ filename: 'q3.csv', contentBase64: Buffer.from('a,b\n1,2\n').toString('base64') }],
+      }));
+      expect(body.status).toBe('confirmation-required');
+      expect(body.dispatched).toBe(false);
+      expect(body.preview).toEqual({
+        from: 'me@example.com',
+        to: 'alice@example.com',
+        cc: 'carol@example.com',
+        bcc: 'secret-bcc@example.com',
+        subject: 'Quarterly numbers',
+        body: long,
+        attachments: [{ name: 'q3.csv', size: 8 }],
+        threadId: 't1',
+        inReplyTo: 'm0',
+        quotesOriginal: false,
+      });
+      expect(body.confirmToken).toMatch(/^gct1\./);
+      expect(body.instruction).toMatch(/verbatim/);
+      expect(runner.run).not.toHaveBeenCalled();
+    });
+
+    it('phase 2 with a valid token sends, exactly once', async () => {
+      vi.mocked(runner.run).mockResolvedValue(SENT);
+      const harness = await noElicitation();
+      const { confirmToken } = json(await harness.callTool('gog_gmail_send', SEND_ARGS));
+      const result = await harness.callTool('gog_gmail_send', { ...SEND_ARGS, confirmToken });
+      expect(result.content[0]!.text).toBe(SENT);
+      expect(sendCalls()).toHaveLength(1);
+      expect(sendCalls()[0]![0]).toContain('--bcc=secret-bcc@example.com');
+
+      const again = await harness.callTool('gog_gmail_send', { ...SEND_ARGS, confirmToken });
+      expect(json(again)).toMatchObject({ error: 'TOKEN_REUSED', dispatched: false });
+      expect(sendCalls()).toHaveLength(1);
+    });
+
+    it('phase 2 with ANY changed argument is DRAFT_CHANGED and sends nothing', async () => {
+      const harness = await noElicitation();
+      const { confirmToken } = json(await harness.callTool('gog_gmail_send', SEND_ARGS));
+      const body = json(await harness.callTool('gog_gmail_send', { ...SEND_ARGS, bcc: 'someone-else@example.com', confirmToken }));
+      expect(body).toMatchObject({ error: 'DRAFT_CHANGED', reason: 'payload-changed', dispatched: false });
+      expect(body.preview.bcc).toBe('someone-else@example.com');
+      expect(sendCalls()).toHaveLength(0);
+    });
+
+    it('binds a server-side attachment by content: a same-size swap is DRAFT_CHANGED', async () => {
+      const path = join(fileRoot, 'report.txt');
+      writeFileSync(path, 'v1');
+      const harness = await noElicitation();
+      const first = json(await harness.callTool('gog_gmail_send', { ...SEND_ARGS, attach: [path] }));
+      expect(first.preview.attachments).toEqual([{ name: path, size: 2 }]);
+      writeFileSync(path, 'v2');
+      const body = json(await harness.callTool('gog_gmail_send', { ...SEND_ARGS, attach: [path], confirmToken: first.confirmToken }));
+      expect(body.error).toBe('DRAFT_CHANGED');
+      expect(sendCalls()).toHaveLength(0);
+    });
+
+    it('rejects an expired token', async () => {
+      vi.useFakeTimers({ toFake: ['Date'] });
+      vi.setSystemTime(new Date('2026-09-24T10:00:00Z'));
+      const harness = await noElicitation();
+      const { confirmToken } = json(await harness.callTool('gog_gmail_send', SEND_ARGS));
+      vi.setSystemTime(new Date('2026-09-24T10:10:01Z'));
+      expect(json(await harness.callTool('gog_gmail_send', { ...SEND_ARGS, confirmToken }))).toMatchObject({ error: 'TOKEN_EXPIRED' });
+      expect(sendCalls()).toHaveLength(0);
+    });
+
+    it('rejects a tampered token', async () => {
+      const harness = await noElicitation();
+      const { confirmToken } = json(await harness.callTool('gog_gmail_send', SEND_ARGS));
+      const result = await harness.callTool('gog_gmail_send', { ...SEND_ARGS, confirmToken: `${confirmToken}x` });
+      expect(result.isError).toBe(true);
+      expect(json(result)).toMatchObject({ error: 'TOKEN_INVALID' });
+      expect(sendCalls()).toHaveLength(0);
+    });
+
+    it('rejects a token issued to a different account', async () => {
+      const harness = await noElicitation();
+      const { confirmToken } = json(await harness.callTool('gog_gmail_send', { ...SEND_ARGS, account: 'other@example.com' }));
+      expect(json(await harness.callTool('gog_gmail_send', { ...SEND_ARGS, confirmToken }))).toMatchObject({ error: 'TOKEN_INVALID' });
+    });
+  });
+});
+
+describe.each([
+  ['gog_gmail_reply', 'reply'],
+  ['gog_gmail_reply_all', 'reply-all'],
+] as const)('%s — token fallback', (tool, subcommand) => {
+  const metadata = (messageIdHeader = '<orig@mail.example.com>') => JSON.stringify({
+    message: { id: 'm1', threadId: 't1' },
+    headers: {
+      from: 'Alice <alice@example.com>',
+      to: 'me@example.com',
+      cc: 'Carol <carol@example.com>',
+      subject: 'Contract terms',
+      message_id: messageIdHeader,
+      references: '<root@mail.example.com>',
+    },
+  });
+  const replyCalls = () => vi.mocked(runner.run).mock.calls.filter(([args]) => args[1] === subcommand);
+
+  beforeEach(() => { process.env.GOG_SEND_CONFIRM_FALLBACK = 'token'; });
+
+  it('phase 1 previews the resolved recipients, Bcc, full body and In-Reply-To; nothing sent', async () => {
+    vi.mocked(runner.run).mockResolvedValue(metadata());
+    const harness = await noElicitation();
+    const body = json(await harness.callTool(tool, { messageId: 'm1', body: 'Agreed.', bcc: ['auditor@example.com'] }));
+    expect(body.status).toBe('confirmation-required');
+    expect(body.preview).toMatchObject({
+      from: 'me@example.com',
+      to: subcommand === 'reply' ? ['alice@example.com'] : ['alice@example.com', 'me@example.com'],
+      cc: subcommand === 'reply' ? [] : ['carol@example.com'],
+      bcc: ['auditor@example.com'],
+      subject: 'Re: Contract terms',
+      body: 'Agreed.',
+      quotesOriginal: true,
+      threadId: 't1',
+      inReplyTo: '<orig@mail.example.com>',
+      replyingToMessageId: 'm1',
+    });
+    expect(runner.run).toHaveBeenCalledTimes(1);
+    expect(replyCalls()).toHaveLength(0);
+  });
+
+  it('phase 2 re-reads the original and sends with a valid token', async () => {
+    vi.mocked(runner.run).mockResolvedValue(metadata());
+    const harness = await noElicitation();
+    const { confirmToken } = json(await harness.callTool(tool, { messageId: 'm1', body: 'Agreed.' }));
+    vi.mocked(runner.run).mockResolvedValueOnce(metadata()).mockResolvedValueOnce(SENT);
+    const result = await harness.callTool(tool, { messageId: 'm1', body: 'Agreed.', confirmToken });
+    expect(result.content[0]!.text).toBe(SENT);
+    expect(runner.run).toHaveBeenLastCalledWith(
+      ['gmail', subcommand, pos('m1'), '--body=Agreed.', '--auto-from-addressed-alias=false'],
+      { account: undefined },
+    );
+  });
+
+  it('refuses when the original re-reads differently (DRAFT_CHANGED)', async () => {
+    vi.mocked(runner.run).mockResolvedValue(metadata());
+    const harness = await noElicitation();
+    const { confirmToken } = json(await harness.callTool(tool, { messageId: 'm1', body: 'Agreed.' }));
+    vi.mocked(runner.run).mockResolvedValue(metadata('<different@mail.example.com>'));
+    const body = json(await harness.callTool(tool, { messageId: 'm1', body: 'Agreed.', confirmToken }));
+    expect(body).toMatchObject({ error: 'DRAFT_CHANGED', dispatched: false });
+    expect(replyCalls()).toHaveLength(0);
+  });
+
+  it('rejects a token issued for a different message', async () => {
+    vi.mocked(runner.run).mockResolvedValue(metadata());
+    const harness = await noElicitation();
+    const { confirmToken } = json(await harness.callTool(tool, { messageId: 'm-other', body: 'Agreed.' }));
+    expect(json(await harness.callTool(tool, { messageId: 'm1', body: 'Agreed.', confirmToken }))).toMatchObject({ error: 'TOKEN_INVALID' });
+    expect(replyCalls()).toHaveLength(0);
+  });
+
+  it('shows the alias choice, HTML body, file-backed body and signature when set', async () => {
+    vi.mocked(runner.run).mockResolvedValue('not json');
+    const htmlPath = join(fileRoot, 'body.html');
+    writeFileSync(htmlPath, '<p>hi</p>');
+    const harness = await noElicitation();
+    const a = json(await harness.callTool(tool, { messageId: 'm1', bodyHtmlFile: htmlPath, autoFromAddressedAlias: true, signature: true, noQuote: true }));
+    expect(a.preview).toMatchObject({
+      from: 'the send-as alias the original was addressed to',
+      bodyHtmlFile: htmlPath,
+      signature: 'the Gmail signature of the sending address',
+      quotesOriginal: false,
+    });
+    expect(a.preview.threadId).toBeUndefined();
+    const b = json(await harness.callTool(tool, { messageId: 'm1', bodyHtml: '<b>x</b>', from: 'alias@example.com', signatureFrom: 'alias@example.com', remove: ['alice@example.com'] }));
+    expect(b.preview).toMatchObject({ from: 'alias@example.com', bodyHtml: '<b>x</b>', signature: 'alias@example.com' });
+  });
+
+  it('elicitation supported: unchanged', async () => {
+    vi.mocked(runner.run).mockResolvedValueOnce(metadata()).mockResolvedValueOnce(metadata()).mockResolvedValueOnce(SENT);
+    const harness = await withElicitation();
+    const result = await harness.callTool(tool, { messageId: 'm1', body: 'Agreed.' });
+    expect(result.content[0]!.text).toBe(SENT);
+  });
+});
+
+describe('metadataThreadId', () => {
+  it('reads message.threadId and ignores anything else', () => {
+    expect(metadataThreadId('{"message":{"threadId":"t1"}}')).toBe('t1');
+    expect(metadataThreadId('{"message":{"threadId":5}}')).toBeUndefined();
+    expect(metadataThreadId('null')).toBeUndefined();
+    expect(metadataThreadId('not json')).toBeUndefined();
+  });
+});