gogcli-mcp 4.2.5 → 4.4.0

package/tests/tools/run-vets.test.ts

@@ -0,0 +1,131 @@
+import { describe, it, expect, vi, beforeEach } from 'vitest';
+import { createTestHarness } from '@chrischall/mcp-utils/test';
+import * as runner from '../../src/runner.js';
+import { registerChatTools, vetChatRun } from '../../src/tools/chat.js';
+import { registerDriveTools, vetDriveRun } from '../../src/tools/drive.js';
+import { registerClassroomTools, vetClassroomRun } from '../../src/tools/classroom.js';
+import { registerCalendarTools, vetCalendarRun } from '../../src/tools/calendar.js';
+import { refusedApiCall } from '../../src/tools/api.js';
+
+vi.mock('../../src/runner.js');
+
+// ============================================================================
+// The escape hatches must not be a way around the dispatch rail (#400): every
+// action a dedicated tool asks the user about is refused by gog_<service>_run
+// and gog_api_call, under every alias gog accepts for it.
+// ============================================================================
+
+beforeEach(() => vi.clearAllMocks());
+
+describe('vetChatRun', () => {
+  it.each([
+    ['messages', ['send', 'spaces/A', '--text=hi']],
+    ['messages', ['create', 'spaces/A']],
+    ['messages', ['post', 'spaces/A']],
+    ['dm', ['send', 'a@example.com']],
+    ['DM', ['--color', 'never', 'POST', 'a@example.com']],
+  ])('refuses %s %j', (sub, args) => {
+    expect(vetChatRun(sub, args)).toMatch(/gog_chat_(messages|dm)_send.*asks the user/);
+  });
+
+  it.each([
+    ['messages', ['list', 'spaces/A']],
+    ['messages', ['react', 'spaces/A/messages/B', '--emoji=👍']],
+    ['dm', ['space', 'a@example.com']],
+    ['spaces', ['send']],
+    ['messages', ['search', '--query=send']],
+  ])('allows %s %j', (sub, args) => {
+    expect(vetChatRun(sub, args)).toBeUndefined();
+  });
+});
+
+describe('vetDriveRun', () => {
+  it.each(['share', 'SHARE'])('refuses %s', (sub) => {
+    expect(vetDriveRun(sub, ['f1', '--to=anyone'])).toMatch(/gog_drive_share.*asks the user/);
+  });
+
+  it.each(['permissions', 'unshare', 'copy'])('allows %s', (sub) => {
+    expect(vetDriveRun(sub, ['f1'])).toBeUndefined();
+  });
+});
+
+describe('vetClassroomRun', () => {
+  it.each([
+    ['announcements', ['create', 'c1', '--text=x']],
+    ['announcement', ['add', 'c1']],
+    ['ann', ['new', 'c1']],
+    ['invitations', ['create', 'c1', 'u1']],
+    ['invitation', ['add', 'c1', 'u1']],
+    ['invites', ['NEW', 'c1', 'u1']],
+  ])('refuses %s %j', (sub, args) => {
+    expect(vetClassroomRun(sub, args)).toMatch(/gog_classroom_(announcements|invitations)_create.*asks the user/);
+  });
+
+  it.each([
+    ['announcements', ['list', 'c1']],
+    ['invitations', ['accept', 'i1']],
+    ['guardians', ['create', 'c1']],
+    ['courses', ['create']],
+  ])('allows %s %j', (sub, args) => {
+    expect(vetClassroomRun(sub, args)).toBeUndefined();
+  });
+});
+
+describe('vetCalendarRun', () => {
+  it.each(['create', 'add', 'new', 'update', 'edit', 'set', 'respond', 'rsvp', 'reply', 'Create'])('refuses %s', (sub) => {
+    expect(vetCalendarRun(sub, ['primary'])).toMatch(/gog_calendar_(create|update|respond).*asks the user/);
+  });
+
+  it.each(['events', 'freebusy', 'calendars', 'create-calendar', 'focus-time'])('allows %s', (sub) => {
+    expect(vetCalendarRun(sub, [])).toBeUndefined();
+  });
+});
+
+describe('the vets are wired into the run tools', () => {
+  it.each([
+    [registerChatTools, 'gog_chat_run', { subcommand: 'messages', args: ['send', 'spaces/A', '--text=hi'] }],
+    [registerDriveTools, 'gog_drive_run', { subcommand: 'share', args: ['f1', '--to=anyone'] }],
+    [registerClassroomTools, 'gog_classroom_run', { subcommand: 'ann', args: ['create', 'c1', '--text=x'] }],
+    [registerCalendarTools, 'gog_calendar_run', { subcommand: 'rsvp', args: ['primary', 'e1', '--status=accepted'] }],
+  ] as const)('%#: %s refuses without spawning gog', async (register, tool, args) => {
+    const harness = await createTestHarness(register);
+    const result = await harness.callTool(tool, args);
+    expect(result.isError).toBe(true);
+    expect(result.content[0]!.text).toMatch(/asks the user to confirm/);
+    expect(runner.run).not.toHaveBeenCalled();
+  });
+});
+
+describe('refusedApiCall — the dispatch rail\'s other escape hatch', () => {
+  it.each([
+    ['chat', 'spaces.messages.create', 'gog_chat_messages_send'],
+    ['chat', 'chat.spaces.messages.create', 'gog_chat_messages_send'],
+    ['drive', 'permissions.create', 'gog_drive_share'],
+    ['drive', 'permissions.update', 'gog_drive_share'],
+    ['classroom', 'courses.announcements.create', 'gog_classroom_announcements_create'],
+    ['classroom', 'invitations.create', 'gog_classroom_invitations_create'],
+    ['calendar', 'events.insert', 'gog_calendar_create'],
+    ['Calendar', ' events.patch ', 'gog_calendar_update'],
+    ['calendar', 'events.update', 'gog_calendar_update'],
+    ['calendar', 'events.import', 'gog_calendar_create'],
+    ['calendar', 'events.quickAdd', 'gog_calendar_create'],
+  ])('refuses %s %s', (api, method, tool) => {
+    expect(refusedApiCall(api, method)).toContain(tool);
+  });
+
+  it.each([
+    ['chat', 'spaces.messages.list'],
+    ['drive', 'permissions.list'],
+    ['drive', 'permissions.delete'],
+    ['classroom', 'courses.announcements.list'],
+    ['calendar', 'events.list'],
+    ['calendar', 'events.delete'],
+    ['sheets', 'spreadsheets.values.update'],
+  ])('allows %s %s', (api, method) => {
+    expect(refusedApiCall(api, method)).toBeUndefined();
+  });
+
+  it('still refuses Gmail sends', () => {
+    expect(refusedApiCall('gmail', 'users.messages.send')).toMatch(/gog_gmail_send/);
+  });
+});

package/tests/tools/sheets.test.ts

@@ -3,6 +3,7 @@ import { McpServer } from '@modelcontextprotocol/server';
 import { registerSheetsTools } from '../../src/tools/sheets.js';
 import * as runner from '../../src/runner.js';
 import { createTestHarness } from '@chrischall/mcp-utils/test';
+import { pos } from '../../src/argv.js';
 
 vi.mock('../../src/runner.js');
 
@@ -15,7 +16,7 @@ describe('gog_sheets_get', () => {
     vi.mocked(runner.run).mockResolvedValue('{"values":[["a","b"]]}');
     const harness = await setupHandlers();
     const result = await harness.callTool('gog_sheets_get', { spreadsheetId: 'sid', range: 'Sheet1!A1:B2' });
-    expect(runner.run).toHaveBeenCalledWith(['sheets', 'get', 'sid', 'Sheet1!A1:B2'], { account: undefined });
+    expect(runner.run).toHaveBeenCalledWith(['sheets', 'get', pos('sid'), pos('Sheet1!A1:B2')], { account: undefined });
     expect(result.content[0].text).toBe('{"values":[["a","b"]]}');
   });
 
@@ -23,7 +24,7 @@ describe('gog_sheets_get', () => {
     vi.mocked(runner.run).mockResolvedValue('{}');
     const harness = await setupHandlers();
     await harness.callTool('gog_sheets_get', { spreadsheetId: 'sid', range: 'A1', account: 'other@gmail.com' });
-    expect(runner.run).toHaveBeenCalledWith(['sheets', 'get', 'sid', 'A1'], { account: 'other@gmail.com' });
+    expect(runner.run).toHaveBeenCalledWith(['sheets', 'get', pos('sid'), pos('A1')], { account: 'other@gmail.com' });
   });
 
   it('appends auth list on failure when auth list succeeds', async () => {
@@ -59,7 +60,7 @@ describe('gog_sheets_update', () => {
     const values = [['hello', 'world']];
     await harness.callTool('gog_sheets_update', { spreadsheetId: 'sid', range: 'A1:B1', values });
     expect(runner.run).toHaveBeenCalledWith(
-      ['sheets', 'update', 'sid', 'A1:B1', `--values-json=${JSON.stringify(values)}`],
+      ['sheets', 'update', pos('sid'), pos('A1:B1'), `--values-json=${JSON.stringify(values)}`],
       { account: undefined },
     );
   });
@@ -92,7 +93,7 @@ describe('gog_sheets_update', () => {
     const values = [['x']];
     await harness.callTool('gog_sheets_update', { spreadsheetId: 'sid', range: 'A1', values, dry_run: true });
     expect(runner.run).toHaveBeenCalledWith(
-      ['sheets', 'update', 'sid', 'A1', `--values-json=${JSON.stringify(values)}`, '--dry-run'],
+      ['sheets', 'update', pos('sid'), pos('A1'), `--values-json=${JSON.stringify(values)}`, '--dry-run'],
       { account: undefined },
     );
   });
@@ -110,7 +111,7 @@ describe('gog_sheets_update', () => {
     const values = [['=1+1']];
     await harness.callTool('gog_sheets_update', { spreadsheetId: 'sid', range: 'A1', values, fail_on_formula_error: true });
     expect(runner.run).toHaveBeenCalledWith(
-      ['sheets', 'update', 'sid', 'A1', `--values-json=${JSON.stringify(values)}`, '--fail-on-formula-error'],
+      ['sheets', 'update', pos('sid'), pos('A1'), `--values-json=${JSON.stringify(values)}`, '--fail-on-formula-error'],
       { account: undefined },
     );
   });
@@ -125,7 +126,7 @@ describe('gog_sheets_update fail_if_not_empty guard', () => {
     });
     // Only the read happened — no update call.
     expect(runner.run).toHaveBeenCalledTimes(1);
-    expect(runner.run).toHaveBeenCalledWith(['sheets', 'get', 'sid', 'A1:A1'], { account: undefined });
+    expect(runner.run).toHaveBeenCalledWith(['sheets', 'get', pos('sid'), pos('A1:A1')], { account: undefined });
     expect(result.content[0].text).toContain('Write aborted');
     expect(result.content[0].text).toContain('A1:A1');
     expect(result.content[0].text).toContain('1 cell');
@@ -142,7 +143,7 @@ describe('gog_sheets_update fail_if_not_empty guard', () => {
     });
     expect(runner.run).toHaveBeenCalledTimes(2);
     expect(vi.mocked(runner.run).mock.calls[1]![0]).toEqual(
-      ['sheets', 'update', 'sid', 'A1', `--values-json=${JSON.stringify(values)}`],
+      ['sheets', 'update', pos('sid'), pos('A1'), `--values-json=${JSON.stringify(values)}`],
     );
     expect(result.content[0].text).toBe('{"updatedCells":1}');
   });
@@ -156,7 +157,7 @@ describe('gog_sheets_update fail_if_not_empty guard', () => {
       spreadsheetId: 'sid', range: 'Sheet1!A1',
       values: [['a', 'b'], ['c', 'd'], ['e', 'f']], fail_if_not_empty: true,
     });
-    expect(vi.mocked(runner.run).mock.calls[0]![0]).toEqual(['sheets', 'get', 'sid', 'Sheet1!A1:B3']);
+    expect(vi.mocked(runner.run).mock.calls[0]![0]).toEqual(['sheets', 'get', pos('sid'), pos('Sheet1!A1:B3')]);
   });
 
   it('aborts without writing and diagnoses the error when the verification read fails', async () => {
@@ -234,7 +235,7 @@ describe('gog_sheets_append', () => {
     const values = [['r1c1', 'r1c2'], ['r2c1', 'r2c2']];
     await harness.callTool('gog_sheets_append', { spreadsheetId: 'sid', range: 'Sheet1!A:B', values });
     expect(runner.run).toHaveBeenCalledWith(
-      ['sheets', 'append', 'sid', 'Sheet1!A:B', `--values-json=${JSON.stringify(values)}`],
+      ['sheets', 'append', pos('sid'), pos('Sheet1!A:B'), `--values-json=${JSON.stringify(values)}`],
       { account: undefined },
     );
   });
@@ -252,7 +253,7 @@ describe('gog_sheets_append', () => {
     const values = [['x']];
     await harness.callTool('gog_sheets_append', { spreadsheetId: 'sid', range: 'Sheet1!A:A', values, dry_run: true });
     expect(runner.run).toHaveBeenCalledWith(
-      ['sheets', 'append', 'sid', 'Sheet1!A:A', `--values-json=${JSON.stringify(values)}`, '--dry-run'],
+      ['sheets', 'append', pos('sid'), pos('Sheet1!A:A'), `--values-json=${JSON.stringify(values)}`, '--dry-run'],
       { account: undefined },
     );
   });
@@ -263,7 +264,7 @@ describe('gog_sheets_clear', () => {
     vi.mocked(runner.run).mockResolvedValue('{}');
     const harness = await setupHandlers();
     await harness.callTool('gog_sheets_clear', { spreadsheetId: 'sid', range: 'Sheet1!A1:Z100' });
-    expect(runner.run).toHaveBeenCalledWith(['sheets', 'clear', 'sid', 'Sheet1!A1:Z100'], { account: undefined });
+    expect(runner.run).toHaveBeenCalledWith(['sheets', 'clear', pos('sid'), pos('Sheet1!A1:Z100')], { account: undefined });
   });
 
   it('returns error text on failure', async () => {
@@ -278,7 +279,7 @@ describe('gog_sheets_clear', () => {
     const harness = await setupHandlers();
     await harness.callTool('gog_sheets_clear', { spreadsheetId: 'sid', range: 'Sheet1!A1:Z100', dry_run: true });
     expect(runner.run).toHaveBeenCalledWith(
-      ['sheets', 'clear', 'sid', 'Sheet1!A1:Z100', '--dry-run'],
+      ['sheets', 'clear', pos('sid'), pos('Sheet1!A1:Z100'), '--dry-run'],
       { account: undefined },
     );
   });
@@ -300,7 +301,7 @@ describe('gog_sheets_metadata', () => {
     vi.mocked(runner.run).mockResolvedValue('{"title":"My Sheet","sheets":[{"title":"Sheet1"}]}');
     const harness = await setupHandlers();
     const result = await harness.callTool('gog_sheets_metadata', { spreadsheetId: 'sid' });
-    expect(runner.run).toHaveBeenCalledWith(['sheets', 'metadata', 'sid'], { account: undefined });
+    expect(runner.run).toHaveBeenCalledWith(['sheets', 'metadata', pos('sid')], { account: undefined });
     expect(result.content[0].text).toContain('My Sheet');
   });
 
@@ -317,7 +318,7 @@ describe('gog_sheets_create', () => {
     vi.mocked(runner.run).mockResolvedValue('{"spreadsheetId":"newid","title":"Budget 2026"}');
     const harness = await setupHandlers();
     await harness.callTool('gog_sheets_create', { title: 'Budget 2026' });
-    expect(runner.run).toHaveBeenCalledWith(['sheets', 'create', 'Budget 2026'], { account: undefined });
+    expect(runner.run).toHaveBeenCalledWith(['sheets', 'create', pos('Budget 2026')], { account: undefined });
   });
 
   it('returns error text on failure', async () => {
@@ -333,7 +334,7 @@ describe('gog_sheets_find_replace', () => {
     vi.mocked(runner.run).mockResolvedValue('{"occurrencesChanged":3}');
     const harness = await setupHandlers();
     await harness.callTool('gog_sheets_find_replace', { spreadsheetId: 'sid', find: 'foo', replace: 'bar' });
-    expect(runner.run).toHaveBeenCalledWith(['sheets', 'find-replace', 'sid', 'foo', 'bar'], { account: undefined });
+    expect(runner.run).toHaveBeenCalledWith(['sheets', 'find-replace', pos('sid'), pos('foo'), pos('bar')], { account: undefined });
   });
 
   it('returns error text on failure', async () => {

package/tests/tools/slides.test.ts

@@ -2,6 +2,7 @@ import { describe, it, expect, vi, beforeEach } from 'vitest';
 import { registerSlidesTools } from '../../src/tools/slides.js';
 import * as runner from '../../src/runner.js';
 import { createTestHarness } from '@chrischall/mcp-utils/test';
+import { pos } from '../../src/argv.js';
 
 vi.mock('../../src/runner.js');
 
@@ -14,7 +15,7 @@ describe('gog_slides_export', () => {
     vi.mocked(runner.run).mockResolvedValue('{}');
     const harness = await setupHandlers();
     await harness.callTool('gog_slides_export', { presentationId: 'p1' });
-    expect(runner.run).toHaveBeenCalledWith(['slides', 'export', 'p1'], { account: undefined });
+    expect(runner.run).toHaveBeenCalledWith(['slides', 'export', pos('p1')], { account: undefined });
   });
 
   it('passes --out and --format when provided', async () => {
@@ -22,7 +23,7 @@ describe('gog_slides_export', () => {
     const harness = await setupHandlers();
     await harness.callTool('gog_slides_export', { presentationId: 'p1', out: '/tmp/deck.pdf', format: 'pdf' });
     expect(runner.run).toHaveBeenCalledWith(
-      ['slides', 'export', 'p1', '--out=/tmp/deck.pdf', '--format=pdf'],
+      ['slides', 'export', pos('p1'), '--out=/tmp/deck.pdf', '--format=pdf'],
       { account: undefined },
     );
   });
@@ -32,7 +33,7 @@ describe('gog_slides_export', () => {
     const harness = await setupHandlers();
     await harness.callTool('gog_slides_export', { presentationId: 'p1', out: '/tmp/deck.pptx', overwrite: true });
     expect(runner.run).toHaveBeenCalledWith(
-      ['slides', 'export', 'p1', '--out=/tmp/deck.pptx', '--overwrite'],
+      ['slides', 'export', pos('p1'), '--out=/tmp/deck.pptx', '--overwrite'],
       { account: undefined },
     );
   });
@@ -50,7 +51,7 @@ describe('gog_slides_info', () => {
     vi.mocked(runner.run).mockResolvedValue('{}');
     const harness = await setupHandlers();
     await harness.callTool('gog_slides_info', { presentationId: 'p1' });
-    expect(runner.run).toHaveBeenCalledWith(['slides', 'info', 'p1'], { account: undefined });
+    expect(runner.run).toHaveBeenCalledWith(['slides', 'info', pos('p1')], { account: undefined });
   });
 
   it('returns error text on failure', async () => {
@@ -66,7 +67,7 @@ describe('gog_slides_create', () => {
     vi.mocked(runner.run).mockResolvedValue('{}');
     const harness = await setupHandlers();
     await harness.callTool('gog_slides_create', { title: 'Deck' });
-    expect(runner.run).toHaveBeenCalledWith(['slides', 'create', 'Deck'], { account: undefined });
+    expect(runner.run).toHaveBeenCalledWith(['slides', 'create', pos('Deck')], { account: undefined });
   });
 
   it('passes --parent and --template when provided', async () => {
@@ -74,7 +75,7 @@ describe('gog_slides_create', () => {
     const harness = await setupHandlers();
     await harness.callTool('gog_slides_create', { title: 'Deck', parent: 'folder1', template: 'tpl1' });
     expect(runner.run).toHaveBeenCalledWith(
-      ['slides', 'create', 'Deck', '--parent=folder1', '--template=tpl1'],
+      ['slides', 'create', pos('Deck'), '--parent=folder1', '--template=tpl1'],
       { account: undefined },
     );
   });
@@ -93,7 +94,7 @@ describe('gog_slides_copy', () => {
     const harness = await setupHandlers();
     await harness.callTool('gog_slides_copy', { presentationId: 'p1', title: 'Copy' });
     expect(runner.run).toHaveBeenCalledWith(
-      ['slides', 'copy', 'p1', 'Copy'],
+      ['slides', 'copy', pos('p1'), pos('Copy')],
       { account: undefined },
     );
   });
@@ -103,7 +104,7 @@ describe('gog_slides_copy', () => {
     const harness = await setupHandlers();
     await harness.callTool('gog_slides_copy', { presentationId: 'p1', title: 'Copy', parent: 'folder1' });
     expect(runner.run).toHaveBeenCalledWith(
-      ['slides', 'copy', 'p1', 'Copy', '--parent=folder1'],
+      ['slides', 'copy', pos('p1'), pos('Copy'), '--parent=folder1'],
       { account: undefined },
     );
   });
@@ -121,7 +122,7 @@ describe('gog_slides_list_slides', () => {
     vi.mocked(runner.run).mockResolvedValue('{}');
     const harness = await setupHandlers();
     await harness.callTool('gog_slides_list_slides', { presentationId: 'p1' });
-    expect(runner.run).toHaveBeenCalledWith(['slides', 'list-slides', 'p1'], { account: undefined });
+    expect(runner.run).toHaveBeenCalledWith(['slides', 'list-slides', pos('p1')], { account: undefined });
   });
 
   it('returns error text on failure', async () => {
@@ -138,7 +139,7 @@ describe('gog_slides_read_slide', () => {
     const harness = await setupHandlers();
     await harness.callTool('gog_slides_read_slide', { presentationId: 'p1', slideId: 's1' });
     expect(runner.run).toHaveBeenCalledWith(
-      ['slides', 'read-slide', 'p1', 's1'],
+      ['slides', 'read-slide', pos('p1'), pos('s1')],
       { account: undefined },
     );
   });
@@ -148,7 +149,7 @@ describe('gog_slides_read_slide', () => {
     const harness = await setupHandlers();
     await harness.callTool('gog_slides_read_slide', { presentationId: 'p1', slideId: 's1', detail: true });
     expect(runner.run).toHaveBeenCalledWith(
-      ['slides', 'read-slide', 'p1', 's1', '--detail'],
+      ['slides', 'read-slide', pos('p1'), pos('s1'), '--detail'],
       { account: undefined },
     );
   });
@@ -176,3 +177,38 @@ describe('gog_slides_run', () => {
     expect(result.content[0].text).toBe('Error: Run failed');
   });
 });
+
+// SEC-3/SEC-4: every model-supplied server path must resolve inside an
+// operator-configured root (GOG_FILE_ROOTS). The suite runs with '/' so the
+// arg-shape tests can use any path; these narrow it.
+async function withFileRoots<T>(roots: string, fn: () => Promise<T>): Promise<T> {
+  const prev = process.env.GOG_FILE_ROOTS;
+  process.env.GOG_FILE_ROOTS = roots;
+  try {
+    return await fn();
+  } finally {
+    process.env.GOG_FILE_ROOTS = prev;
+  }
+}
+
+describe('gog_slides_export — writes to disk', () => {
+  it('refuses an out path outside GOG_FILE_ROOTS', async () => {
+    const harness = await setupHandlers();
+    const result = await withFileRoots('/srv/gog-files', () => harness.callTool('gog_slides_export', {
+      presentationId: 'p1', out: '/Users/me/.zshrc', overwrite: true,
+    }));
+    expect(result.isError).toBe(true);
+    expect(result.content[0].text).toContain('out "/Users/me/.zshrc" is outside');
+    expect(runner.run).not.toHaveBeenCalled();
+  });
+
+  // SEC-4: clients auto-approve readOnlyHint tools; this one writes a file and
+  // can overwrite one, so the client must be allowed to ask.
+  it('is not advertised as read-only, and is marked destructive', async () => {
+    const harness = await setupHandlers();
+    const { tools } = await harness.client.listTools();
+    const tool = tools.find((t) => t.name === 'gog_slides_export')!;
+    expect(tool.annotations?.readOnlyHint).not.toBe(true);
+    expect(tool.annotations?.destructiveHint).toBe(true);
+  });
+});

package/tests/tools/tasks.test.ts

@@ -2,6 +2,7 @@ import { describe, it, expect, vi, beforeEach } from 'vitest';
 import { registerTasksTools } from '../../src/tools/tasks.js';
 import * as runner from '../../src/runner.js';
 import { createTestHarness } from '@chrischall/mcp-utils/test';
+import { pos } from '../../src/argv.js';
 
 vi.mock('../../src/runner.js');
 
@@ -30,7 +31,7 @@ describe('gog_tasks_list', () => {
     vi.mocked(runner.run).mockResolvedValue('{"items":[]}');
     const harness = await setupHandlers();
     await harness.callTool('gog_tasks_list', { tasklistId: 'list1' });
-    expect(runner.run).toHaveBeenCalledWith(['tasks', 'list', 'list1'], { account: undefined });
+    expect(runner.run).toHaveBeenCalledWith(['tasks', 'list', pos('list1')], { account: undefined });
   });
 
   it('returns error text on failure', async () => {
@@ -46,7 +47,7 @@ describe('gog_tasks_get', () => {
     vi.mocked(runner.run).mockResolvedValue('{"id":"task1"}');
     const harness = await setupHandlers();
     await harness.callTool('gog_tasks_get', { tasklistId: 'list1', taskId: 'task1' });
-    expect(runner.run).toHaveBeenCalledWith(['tasks', 'get', 'list1', 'task1'], { account: undefined });
+    expect(runner.run).toHaveBeenCalledWith(['tasks', 'get', pos('list1'), pos('task1')], { account: undefined });
   });
 
   it('returns error text on failure', async () => {
@@ -63,7 +64,7 @@ describe('gog_tasks_add', () => {
     const harness = await setupHandlers();
     await harness.callTool('gog_tasks_add', { tasklistId: 'list1', title: 'Buy milk' });
     expect(runner.run).toHaveBeenCalledWith(
-      ['tasks', 'add', 'list1', '--title=Buy milk'],
+      ['tasks', 'add', pos('list1'), '--title=Buy milk'],
       { account: undefined },
     );
   });
@@ -73,7 +74,7 @@ describe('gog_tasks_add', () => {
     const harness = await setupHandlers();
     await harness.callTool('gog_tasks_add', { tasklistId: 'list1', title: 'Buy milk', notes: 'Whole milk', due: '2026-04-20' });
     expect(runner.run).toHaveBeenCalledWith(
-      ['tasks', 'add', 'list1', '--title=Buy milk', '--notes=Whole milk', '--due=2026-04-20'],
+      ['tasks', 'add', pos('list1'), '--title=Buy milk', '--notes=Whole milk', '--due=2026-04-20'],
       { account: undefined },
     );
   });
@@ -91,7 +92,7 @@ describe('gog_tasks_done', () => {
     vi.mocked(runner.run).mockResolvedValue('{}');
     const harness = await setupHandlers();
     await harness.callTool('gog_tasks_done', { tasklistId: 'list1', taskId: 'task1' });
-    expect(runner.run).toHaveBeenCalledWith(['tasks', 'done', 'list1', 'task1'], { account: undefined });
+    expect(runner.run).toHaveBeenCalledWith(['tasks', 'done', pos('list1'), pos('task1')], { account: undefined });
   });
 
   it('returns error text on failure', async () => {
@@ -107,7 +108,7 @@ describe('gog_tasks_delete', () => {
     vi.mocked(runner.run).mockResolvedValue('{}');
     const harness = await setupHandlers();
     await harness.callTool('gog_tasks_delete', { tasklistId: 'list1', taskId: 'task1' });
-    expect(runner.run).toHaveBeenCalledWith(['tasks', 'delete', 'list1', 'task1', '--force'], { account: undefined });
+    expect(runner.run).toHaveBeenCalledWith(['tasks', 'delete', pos('list1'), pos('task1'), '--force'], { account: undefined });
   });
 
   it('returns error text on failure', async () => {