gogcli-mcp 4.4.0 → 4.5.1

package/tests/gmail-dispatch-guard.test.ts

@@ -94,7 +94,7 @@ describe('logGmailDispatch', () => {
     logGmailDispatch('gog_gmail_reply', ['me@example.com', 'outside@other.com'], 'me@example.com');
     const event = loggedEvent();
     expect(event.hasExternalRecipients).toBe(true);
-    expect(event.externalRecipients).toEqual(['outside@other.com']);
+    expect(event.externalDomains).toEqual(['other.com']);
     expect(event.externalRecipientCount).toBe(1);
   });
 
@@ -102,34 +102,34 @@ describe('logGmailDispatch', () => {
     process.env.GOG_ACCOUNT = 'me@example.com';
     logGmailDispatch('gog_gmail_send', ['me@example.com', 'outside@other.com']);
     const event = loggedEvent();
-    expect(event.externalRecipients).toEqual(['outside@other.com']);
+    expect(event.externalDomains).toEqual(['other.com']);
   });
 
   it('adds every domain in GOG_GMAIL_TRUSTED_DOMAINS on top of the account domain', () => {
     process.env.GOG_GMAIL_TRUSTED_DOMAINS = 'law-firm.example, partner.example';
     logGmailDispatch('gog_gmail_reply_all', ['counsel@law-firm.example', 'stranger@random.example'], 'me@example.com');
     const event = loggedEvent();
-    expect(event.externalRecipients).toEqual(['stranger@random.example']);
+    expect(event.externalDomains).toEqual(['random.example']);
   });
 
   it('reports no external recipients when every address is trusted', () => {
     logGmailDispatch('gog_gmail_forward', ['me@example.com'], 'me@example.com');
     const event = loggedEvent();
     expect(event.hasExternalRecipients).toBe(false);
-    expect(event.externalRecipients).toEqual([]);
+    expect(event.externalDomains).toEqual([]);
   });
 
   it('treats an account with no @ as contributing no trusted domain', () => {
     logGmailDispatch('gog_gmail_send', ['a@example.com'], 'not-an-email');
     const event = loggedEvent();
-    expect(event.externalRecipients).toEqual(['a@example.com']);
+    expect(event.externalDomains).toEqual(['example.com']);
   });
 
   it('ignores an empty segment in GOG_GMAIL_TRUSTED_DOMAINS (e.g. a trailing comma)', () => {
     process.env.GOG_GMAIL_TRUSTED_DOMAINS = 'law-firm.example,,';
     logGmailDispatch('gog_gmail_send', ['counsel@law-firm.example'], 'me@example.com');
     const event = loggedEvent();
-    expect(event.externalRecipients).toEqual([]);
+    expect(event.externalDomains).toEqual([]);
   });
 
   it('treats unresolved desktop placeholders as unset env vars', () => {
@@ -137,13 +137,29 @@ describe('logGmailDispatch', () => {
     process.env.GOG_ACCOUNT = '${user_config.account}';
     logGmailDispatch('gog_gmail_send', ['person@user_config.trusted_domains']);
     const event = loggedEvent();
-    expect(event.externalRecipients).toEqual(['person@user_config.trusted_domains']);
+    expect(event.externalDomains).toEqual(['user_config.trusted_domains']);
   });
 
   it('treats a recipient with no @ as external, not a crash', () => {
     logGmailDispatch('gog_gmail_send', ['not-an-email'], 'me@example.com');
     const event = loggedEvent();
-    expect(event.externalRecipients).toEqual(['not-an-email']);
+    expect(event.externalRecipientCount).toBe(1);
+    expect(event.externalDomains).toEqual(['(no domain)']);
+  });
+
+  // PRIV-1 (fleet-audit #1012): on mcp-host this line is host log data the user
+  // never sees, so it names domains, never addresses — the count and the
+  // domain are what the audit purpose needs (an unexpected law firm, a
+  // wrong-number alias), the local part is a third party's identity.
+  it('never writes a recipient address to stderr', () => {
+    logGmailDispatch('gog_gmail_reply_all', ['me@example.com', 'counsel@law-firm.example', 'second@law-firm.example', 'Kid@School.example'], 'me@example.com');
+    const line = writeSpy.mock.calls[0][0] as string;
+    expect(line).not.toMatch(/@/);
+    expect(line).not.toContain('externalRecipients');
+    const event = loggedEvent();
+    expect(event.recipientCount).toBe(4);
+    expect(event.externalRecipientCount).toBe(3);
+    expect(event.externalDomains).toEqual(['law-firm.example', 'school.example']);
   });
 });
 
@@ -298,7 +314,7 @@ describe('attachmentDetails', () => {
 });
 
 // ============================================================================
-// THE TOKEN FALLBACK (GOG_SEND_CONFIRM_FALLBACK=token). Elicitation stays the
+// THE TOKEN FALLBACK (MCP_CONFIRM_MODE, default ask-user). Elicitation stays the
 // primary rail; this only replaces the REFUSAL a client that cannot be prompted
 // would otherwise get.
 // ============================================================================
@@ -308,9 +324,9 @@ describe('requireGmailDispatchConfirmation — token fallback', () => {
 
   beforeEach(() => {
     process.env = { ...ORIGINAL_ENV };
-    delete process.env.GOG_SEND_CONFIRM_FALLBACK;
-    delete process.env.GOG_CONFIRM_TTL_SECONDS;
-    delete process.env.GOG_CONFIRM_SECRET;
+    delete process.env.MCP_CONFIRM_MODE;
+    delete process.env.MCP_CONFIRM_TTL_SECONDS;
+    delete process.env.MCP_CONFIRM_SECRET;
     process.env.GOG_ACCOUNT = 'me@example.com';
     resetConfirmTokenState();
   });
@@ -341,37 +357,56 @@ describe('requireGmailDispatchConfirmation — token fallback', () => {
     return parse(r);
   }
 
-  it('with the env unset, keeps the refusal and names the switch', async () => {
+  it('with MCP_CONFIRM_MODE=refuse, keeps the refusal and names the switch', async () => {
+
+    process.env.MCP_CONFIRM_MODE = 'refuse';
     const fb = fallback();
     const r = parse(await requireGmailDispatchConfirmation(CANNOT_BE_ASKED, 'gmail.drafts-send', {}, fb));
     expect(r.reason).toBe('confirmation-unsupported');
-    expect(r.note).toContain('set GOG_SEND_CONFIRM_FALLBACK=token to enable two-step confirmation');
+    expect(r.note).toContain('Set MCP_CONFIRM_MODE=ask-user');
     expect(r.note).toContain('still saved');
     expect(fb.subject).not.toHaveBeenCalled();
   });
 
   it('names the switch even for an op with no other note (autoreply)', async () => {
+
+    process.env.MCP_CONFIRM_MODE = 'refuse';
     const r = parse(await requireGmailDispatchConfirmation(CANNOT_BE_ASKED, 'gmail.autoreply', {}, fallback()));
-    expect(r.note).toContain('GOG_SEND_CONFIRM_FALLBACK=token');
+    expect(r.note).toContain('MCP_CONFIRM_MODE=ask-user');
   });
 
   it('never offers the switch to a caller that passed no fallback (a forwarding filter)', async () => {
-    process.env.GOG_SEND_CONFIRM_FALLBACK = 'token';
+    process.env.MCP_CONFIRM_MODE = 'ask-user';
     const r = parse(await requireGmailDispatchConfirmation(CANNOT_BE_ASKED, 'gmail.filter-forward', {}));
     expect(r.reason).toBe('confirmation-unsupported');
-    expect(r.note).not.toContain('GOG_SEND_CONFIRM_FALLBACK');
+    expect(r.note).not.toContain('MCP_CONFIRM_MODE');
   });
 
   it('leaves elicitation untouched even with the env set and a token passed', async () => {
-    process.env.GOG_SEND_CONFIRM_FALLBACK = 'token';
-    const fb = fallback('gct1.anything.here');
+    process.env.MCP_CONFIRM_MODE = 'ask-user';
+    const fb = fallback('not-a-real-token');
     expect(await requireGmailDispatchConfirmation(CAN_BE_ASKED, 'gmail.drafts-send', {}, fb))
       .toMatchObject({ resultType: 'input_required' });
     expect(fb.subject).not.toHaveBeenCalled();
   });
 
-  describe('with GOG_SEND_CONFIRM_FALLBACK=token', () => {
-    beforeEach(() => { process.env.GOG_SEND_CONFIRM_FALLBACK = 'token'; });
+  // The fleet default: with MCP_CONFIRM_MODE unset, a client that cannot be
+  // prompted gets the two-step flow rather than a refusal.
+  it('with MCP_CONFIRM_MODE unset, runs the two-step flow (ask-user is the default)', async () => {
+    const r = parse(await requireGmailDispatchConfirmation(CANNOT_BE_ASKED, 'gmail.drafts-send', {}, fallback()));
+    expect(r).toMatchObject({ status: 'confirmation-required', instruction: CONFIRM_INSTRUCTION });
+  });
+
+  it('with MCP_CONFIRM_MODE=auto, tells the model it may proceed after reviewing the preview', async () => {
+    process.env.MCP_CONFIRM_MODE = 'auto';
+    const r = parse(await requireGmailDispatchConfirmation(CANNOT_BE_ASKED, 'gmail.drafts-send', {}, fallback()));
+    expect(r.status).toBe('confirmation-required');
+    expect(r.instruction).toMatch(/MCP_CONFIRM_MODE=auto/);
+    expect(r.instruction).not.toBe(CONFIRM_INSTRUCTION);
+  });
+
+  describe('with MCP_CONFIRM_MODE=ask-user', () => {
+    beforeEach(() => { process.env.MCP_CONFIRM_MODE = 'ask-user'; });
 
     it('phase 1 returns the full preview, a token and the instruction, and does not proceed', async () => {
       const r = await phaseOne();
@@ -385,7 +420,7 @@ describe('requireGmailDispatchConfirmation — token fallback', () => {
         instruction: CONFIRM_INSTRUCTION,
       });
       expect(r.instruction).toBe('Show this preview to the user verbatim and send only after they explicitly approve in chat. Then call again with confirmToken.');
-      expect(r.confirmToken).toMatch(/^gct1\./);
+      expect(r.confirmToken).toMatch(/^mcpu\.token\.v1\./);
       expect(typeof r.expiresAt).toBe('string');
     });
 
@@ -400,8 +435,8 @@ describe('requireGmailDispatchConfirmation — token fallback', () => {
       const r = await requireGmailDispatchConfirmation(CANNOT_BE_ASKED, 'gmail.drafts-send', {}, fallback(confirmToken, rotated));
       expect((r as CallToolResult).isError).toBe(true);
       const body = parse(r);
-      expect(body).toMatchObject({ status: 'confirmation-rejected', error: 'DRAFT_CHANGED', reason: 'message-id-rotated', dispatched: false, instruction: CONFIRM_INSTRUCTION });
-      expect(body.note).toMatch(/messageId/);
+      expect(body).toMatchObject({ status: 'confirmation-rejected', error: 'DRAFT_CHANGED', reason: 'revision-changed', dispatched: false, instruction: CONFIRM_INSTRUCTION });
+      expect(body.note).toMatch(/edited since/);
       expect(body.confirmToken).not.toBe(confirmToken);
       expect(await requireGmailDispatchConfirmation(CANNOT_BE_ASKED, 'gmail.drafts-send', {}, fallback(body.confirmToken, rotated))).toBeUndefined();
     });
@@ -422,7 +457,7 @@ describe('requireGmailDispatchConfirmation — token fallback', () => {
     });
 
     it('TOKEN_EXPIRED after the TTL', async () => {
-      process.env.GOG_CONFIRM_TTL_SECONDS = '60';
+      process.env.MCP_CONFIRM_TTL_SECONDS = '60';
       vi.useFakeTimers();
       vi.setSystemTime(new Date('2026-09-24T10:00:00Z'));
       const { confirmToken } = await phaseOne();

package/tests/send-confirm-token.test.ts

@@ -1,200 +1,20 @@
-import { describe, it, expect, beforeEach, afterEach } from 'vitest';
-import {
-  CONFIRM_TOKEN_TTL_DEFAULT_SECONDS,
-  confirmTokenTtlSeconds,
-  hashSendPayload,
-  issueConfirmToken,
-  resetConfirmTokenState,
-  sendConfirmFallbackEnabled,
-  verifyConfirmToken,
-  type ConfirmBinding,
-} from '../src/send-confirm-token.js';
-
-const ORIGINAL_ENV = { ...process.env };
-
-const BINDING: ConfirmBinding = {
-  tool: 'gog_gmail_drafts_send',
-  account: 'me@example.com',
-  target: 'r123',
-  revision: 'msg-1',
-  payloadHash: hashSendPayload({ to: 'a@example.com', body: 'hello' }),
-};
-
-const NOW = 1_800_000_000_000;
-
-beforeEach(() => {
-  process.env = { ...ORIGINAL_ENV };
-  delete process.env.GOG_SEND_CONFIRM_FALLBACK;
-  delete process.env.GOG_CONFIRM_SECRET;
-  delete process.env.GOG_CONFIRM_TTL_SECONDS;
-  resetConfirmTokenState();
-});
-
-afterEach(() => {
-  process.env = ORIGINAL_ENV;
-  resetConfirmTokenState();
-});
-
-describe('hashSendPayload', () => {
-  it('is independent of key order, so a re-read payload hashes the same', () => {
-    expect(hashSendPayload({ a: 1, b: { c: 2, d: [1, 2] } }))
-      .toBe(hashSendPayload({ b: { d: [1, 2], c: 2 }, a: 1 }));
-  });
-
-  it('changes when any value changes, including array order', () => {
-    const base = hashSendPayload({ to: ['a', 'b'], body: 'x' });
-    expect(hashSendPayload({ to: ['b', 'a'], body: 'x' })).not.toBe(base);
-    expect(hashSendPayload({ to: ['a', 'b'], body: 'x ' })).not.toBe(base);
-  });
-
-  it('treats an undefined field as absent', () => {
-    expect(hashSendPayload({ a: 1, b: undefined })).toBe(hashSendPayload({ a: 1 }));
-  });
-
-  it('distinguishes null from absent', () => {
-    expect(hashSendPayload({ a: null })).not.toBe(hashSendPayload({}));
-  });
-});
-
-describe('sendConfirmFallbackEnabled', () => {
-  it('is off unless GOG_SEND_CONFIRM_FALLBACK is exactly "token" (case-insensitive)', () => {
-    expect(sendConfirmFallbackEnabled()).toBe(false);
-    process.env.GOG_SEND_CONFIRM_FALLBACK = '1';
-    expect(sendConfirmFallbackEnabled()).toBe(false);
-    process.env.GOG_SEND_CONFIRM_FALLBACK = ' Token ';
-    expect(sendConfirmFallbackEnabled()).toBe(true);
-  });
-
-  it('treats an unresolved .mcpb placeholder as unset', () => {
-    process.env.GOG_SEND_CONFIRM_FALLBACK = '${user_config.send_confirm_fallback}';
-    expect(sendConfirmFallbackEnabled()).toBe(false);
-  });
-});
-
-describe('confirmTokenTtlSeconds', () => {
-  it('defaults to ten minutes', () => {
-    expect(CONFIRM_TOKEN_TTL_DEFAULT_SECONDS).toBe(600);
-    expect(confirmTokenTtlSeconds()).toBe(600);
-  });
-
-  it('honours a positive integer GOG_CONFIRM_TTL_SECONDS', () => {
-    process.env.GOG_CONFIRM_TTL_SECONDS = '30';
-    expect(confirmTokenTtlSeconds()).toBe(30);
-  });
-
-  it.each(['0', '-5', 'abc', '1.5', ''])('falls back to the default for %j', (value) => {
-    process.env.GOG_CONFIRM_TTL_SECONDS = value;
-    expect(confirmTokenTtlSeconds()).toBe(600);
-  });
-});
-
-describe('issueConfirmToken / verifyConfirmToken', () => {
-  it('accepts a fresh token for the exact binding it was issued for', () => {
-    const { token, expiresAt } = issueConfirmToken(BINDING, NOW);
-    expect(expiresAt).toBe(new Date(NOW + 600_000).toISOString());
-    expect(verifyConfirmToken(token, BINDING, NOW + 1_000)).toEqual({ ok: true });
-  });
-
-  it('is single-use: the second presentation is TOKEN_REUSED', () => {
-    const { token } = issueConfirmToken(BINDING, NOW);
-    expect(verifyConfirmToken(token, BINDING, NOW)).toEqual({ ok: true });
-    expect(verifyConfirmToken(token, BINDING, NOW)).toMatchObject({ ok: false, error: 'TOKEN_REUSED' });
-  });
-
-  it('expires after the TTL', () => {
-    const { token } = issueConfirmToken(BINDING, NOW);
-    expect(verifyConfirmToken(token, BINDING, NOW + 600_001)).toMatchObject({ ok: false, error: 'TOKEN_EXPIRED' });
-  });
-
-  it('uses GOG_CONFIRM_TTL_SECONDS at issue time', () => {
-    process.env.GOG_CONFIRM_TTL_SECONDS = '5';
-    const { token } = issueConfirmToken(BINDING, NOW);
-    expect(verifyConfirmToken(token, BINDING, NOW + 5_001)).toMatchObject({ ok: false, error: 'TOKEN_EXPIRED' });
-  });
-
-  it('does not consume a token that failed verification', () => {
-    const { token } = issueConfirmToken(BINDING, NOW);
-    const changed = { ...BINDING, payloadHash: hashSendPayload({ to: 'b@example.com' }) };
-    expect(verifyConfirmToken(token, changed, NOW)).toMatchObject({ ok: false, error: 'DRAFT_CHANGED' });
-    expect(verifyConfirmToken(token, BINDING, NOW)).toEqual({ ok: true });
-  });
-
-  it('reports DRAFT_CHANGED with reason payload-changed when the payload hash differs', () => {
-    const { token } = issueConfirmToken(BINDING, NOW);
-    const changed = { ...BINDING, payloadHash: hashSendPayload({ to: 'a@example.com', body: 'HELLO' }) };
-    expect(verifyConfirmToken(token, changed, NOW)).toEqual({ ok: false, error: 'DRAFT_CHANGED', reason: 'payload-changed' });
-  });
-
-  it('reports DRAFT_CHANGED with reason message-id-rotated when the revision rotated', () => {
-    const { token } = issueConfirmToken(BINDING, NOW);
-    expect(verifyConfirmToken(token, { ...BINDING, revision: 'msg-2' }, NOW))
-      .toEqual({ ok: false, error: 'DRAFT_CHANGED', reason: 'message-id-rotated' });
-  });
-
-  it.each([
-    ['tool', { tool: 'gog_gmail_send' }],
-    ['account', { account: 'other@example.com' }],
-    ['draft/message', { target: 'r999' }],
-  ] as const)('never accepts a token issued for a different %s', (_label, override) => {
-    const { token } = issueConfirmToken(BINDING, NOW);
-    expect(verifyConfirmToken(token, { ...BINDING, ...override }, NOW)).toMatchObject({ ok: false, error: 'TOKEN_INVALID' });
-  });
-
-  it('rejects a tampered claim as TOKEN_INVALID', () => {
-    const { token } = issueConfirmToken(BINDING, NOW);
-    const [prefix, claims, sig] = token.split('.');
-    const decoded = JSON.parse(Buffer.from(claims!, 'base64url').toString('utf8'));
-    decoded.exp += 3_600_000;
-    const forged = `${prefix}.${Buffer.from(JSON.stringify(decoded)).toString('base64url')}.${sig}`;
-    expect(verifyConfirmToken(forged, BINDING, NOW)).toMatchObject({ ok: false, error: 'TOKEN_INVALID' });
-  });
-
-  it('rejects a tampered signature as TOKEN_INVALID', () => {
-    const { token } = issueConfirmToken(BINDING, NOW);
-    const flipped = token.slice(0, -2) + (token.endsWith('AA') ? 'BB' : 'AA');
-    expect(verifyConfirmToken(flipped, BINDING, NOW)).toMatchObject({ ok: false, error: 'TOKEN_INVALID' });
-  });
-
-  it.each(['', 'garbage', 'gct1.a.b', 'x.y.z', 'gct1..', 'gct1.a.b.c'])('rejects malformed token %j as TOKEN_INVALID', (token) => {
-    expect(verifyConfirmToken(token, BINDING, NOW)).toMatchObject({ ok: false, error: 'TOKEN_INVALID' });
-  });
-
-  it('rejects a correctly signed token whose claims are not JSON', async () => {
-    const { createHmac } = await import('node:crypto');
-    process.env.GOG_CONFIRM_SECRET = 'a-shared-secret';
+import { describe, it, expect } from 'vitest';
+import { confirmKeyFromEnv, issueConfirmToken, verifyConfirmToken } from '@chrischall/mcp-utils';
+import { confirmSpentStore, resetConfirmTokenState } from '../src/send-confirm-token.js';
+
+// The token mechanism and the MCP_CONFIRM_* env layer live in
+// @chrischall/mcp-utils and are tested there. What stays here is this server's
+// spent-token store and the seam its tests reset it with.
+describe('confirmSpentStore', () => {
+  it('is one store for the process, emptied by resetConfirmTokenState', () => {
+    const binding = { tool: 'gog_gmail_send', account: 'me@example.com', target: '', payloadHash: 'h' };
+    const key = confirmKeyFromEnv({});
+    const { token } = issueConfirmToken(key, binding);
+    expect(verifyConfirmToken(key, token, binding, { spent: confirmSpentStore() })).toEqual({ ok: true });
+    expect(confirmSpentStore()).toBe(confirmSpentStore());
+    expect(confirmSpentStore().size).toBe(1);
+    expect(verifyConfirmToken(key, token, binding, { spent: confirmSpentStore() })).toEqual({ ok: false, error: 'TOKEN_REUSED' });
     resetConfirmTokenState();
-    const claims = Buffer.from('not json').toString('base64url');
-    const sig = createHmac('sha256', 'a-shared-secret').update(`gct1.${claims}`).digest('base64url');
-    expect(verifyConfirmToken(`gct1.${claims}.${sig}`, BINDING, NOW)).toMatchObject({ ok: false, error: 'TOKEN_INVALID' });
-  });
-
-  it('rejects a token signed by a previous process (per-process secret)', () => {
-    const { token } = issueConfirmToken(BINDING, NOW);
-    resetConfirmTokenState();
-    expect(verifyConfirmToken(token, BINDING, NOW)).toMatchObject({ ok: false, error: 'TOKEN_INVALID' });
-  });
-
-  it('with GOG_CONFIRM_SECRET set, a token survives a restart', () => {
-    process.env.GOG_CONFIRM_SECRET = 'a-shared-secret';
-    resetConfirmTokenState();
-    const { token } = issueConfirmToken(BINDING, NOW);
-    resetConfirmTokenState();
-    expect(verifyConfirmToken(token, BINDING, NOW)).toEqual({ ok: true });
-  });
-
-  it('binds a revision-less subject too', () => {
-    const noRevision = { ...BINDING, revision: undefined };
-    const { token } = issueConfirmToken(noRevision, NOW);
-    expect(verifyConfirmToken(token, noRevision, NOW)).toEqual({ ok: true });
-  });
-
-  it('forgets used tokens once they would have expired anyway', () => {
-    const first = issueConfirmToken(BINDING, NOW);
-    expect(verifyConfirmToken(first.token, BINDING, NOW)).toEqual({ ok: true });
-    // A later verification prunes the spent entry; the old token is then
-    // rejected as expired rather than remembered forever.
-    const second = issueConfirmToken(BINDING, NOW + 700_000);
-    expect(verifyConfirmToken(second.token, BINDING, NOW + 700_000)).toEqual({ ok: true });
-    expect(verifyConfirmToken(first.token, BINDING, NOW + 700_000)).toMatchObject({ ok: false, error: 'TOKEN_EXPIRED' });
+    expect(confirmSpentStore().size).toBe(0);
   });
 });

package/tests/tools/api.test.ts

@@ -1,14 +1,37 @@
 import { describe, it, expect, vi, beforeEach, afterEach } from 'vitest';
+import type { ElicitRequest, ElicitResult } from '@modelcontextprotocol/server';
 import { registerApiTools } from '../../src/tools/api.js';
 import * as runner from '../../src/runner.js';
 import { createTestHarness } from '@chrischall/mcp-utils/test';
 import { pos } from '../../src/argv.js';
+import { resetConfirmTokenState } from '../../src/send-confirm-token.js';
+import { CONFIRM_ACTION_INSTRUCTION } from '../../src/dispatch-confirmation.js';
 
 vi.mock('../../src/runner.js');
 
 const setupHandlers = () => createTestHarness(registerApiTools);
 
-beforeEach(() => vi.clearAllMocks());
+/** A client that CAN be prompted, answering with `answer` and recording the prompt. */
+async function prompted(answer: ElicitResult = { action: 'accept', content: { confirmed: true } }) {
+  const seen: ElicitRequest[] = [];
+  const harness = await createTestHarness(registerApiTools, { elicitation: async (r) => { seen.push(r); return answer; } });
+  const details = () => JSON.parse(seen[0]!.params.message.split('\n').slice(1).join('\n')).details;
+  return { harness, seen, details };
+}
+const json = (r: { content: Array<{ text?: string }> }) => JSON.parse(r.content[0]!.text as string);
+
+const ORIGINAL_ENV = { ...process.env };
+
+beforeEach(() => {
+  vi.clearAllMocks();
+  process.env = { ...ORIGINAL_ENV };
+  delete process.env.MCP_CONFIRM_MODE;
+  delete process.env.MCP_CONFIRM_TTL_SECONDS;
+  delete process.env.MCP_CONFIRM_SECRET;
+  resetConfirmTokenState();
+});
+
+afterEach(() => { process.env = ORIGINAL_ENV; });
 
 describe('gog_api_list', () => {
   it('lists the default API set', async () => {
@@ -76,7 +99,7 @@ describe('gog_api_call', () => {
     await harness.callTool('gog_api_call', {
       api: 'drive', version: 'v3', method: 'files.create',
       params: '{"fields":"id"}', body: '{"name":"f"}', scope: 'https://www.googleapis.com/auth/drive',
-      allowWrite: true, dryRun: true, account: 'a@b.com',
+      allowWrite: true, dryRun: true, account: 'a@example.com',
     });
     expect(runner.run).toHaveBeenCalledWith(
       [
@@ -84,13 +107,13 @@ describe('gog_api_call', () => {
         '--params={"fields":"id"}', '--body={"name":"f"}',
         '--scope=https://www.googleapis.com/auth/drive', '--allow-write', '--dry-run', '--force',
       ],
-      { account: 'a@b.com', gmailNoSend: true },
+      { account: 'a@example.com', gmailNoSend: true },
     );
   });
 
-  it('appends --force last even when dry-run is absent', async () => {
+  it('appends --force last even when dry-run is absent, once the user has confirmed', async () => {
     vi.mocked(runner.run).mockResolvedValue('{}');
-    const harness = await setupHandlers();
+    const { harness } = await prompted();
     await harness.callTool('gog_api_call', {
       api: 'drive', version: 'v3', method: 'files.create', allowWrite: true,
     });
@@ -99,6 +122,108 @@ describe('gog_api_call', () => {
     expect(passedArgs[passedArgs.length - 1]).toBe('--force');
   });
 
+  // SEC-2 (fleet-audit #931): allowWrite is a boolean the MODEL sets, and
+  // --force skips gog's own confirmation, so a method blocklist could never be
+  // complete (events.move/delete, acl.insert, sendAs.create, updateVacation,
+  // batchDelete, ...). Every write now asks the user about the exact
+  // api/method/params/body before anything is sent.
+  describe('the write gate', () => {
+    const write = {
+      api: 'calendar', version: 'v3', method: 'events.delete',
+      params: '{"calendarId":"primary","eventId":"e1","sendUpdates":"all"}',
+    };
+
+    it('prompts with the api, version, method, params and body, then runs once accepted', async () => {
+      vi.mocked(runner.run).mockResolvedValue('{}');
+      const { harness, details, seen } = await prompted();
+      await harness.callTool('gog_api_call', { ...write, body: '{"a":1}', scope: 'https://www.googleapis.com/auth/calendar', allowWrite: true, account: 'a@example.com' });
+      expect(seen[0]!.params.message).toMatch(/calendar v3 events\.delete/);
+      expect(details()).toEqual({
+        api: 'calendar', version: 'v3', method: 'events.delete',
+        params: { calendarId: 'primary', eventId: 'e1', sendUpdates: 'all' },
+        body: { a: 1 },
+        scope: 'https://www.googleapis.com/auth/calendar',
+      });
+      expect(runner.run).toHaveBeenCalledWith(
+        ['api', 'call', pos('calendar'), pos('v3'), pos('events.delete'), `--params=${write.params}`, '--body={"a":1}',
+          '--scope=https://www.googleapis.com/auth/calendar', '--allow-write', '--force'],
+        { account: 'a@example.com', gmailNoSend: true },
+      );
+    });
+
+    it('shows a body that is not JSON (an @file reference) as the string it is', async () => {
+      vi.mocked(runner.run).mockResolvedValue('{}');
+      const { harness, details } = await prompted({ action: 'decline' });
+      await harness.callTool('gog_api_call', { api: 'drive', version: 'v3', method: 'files.create', body: '@/body.json', params: 'not json', allowWrite: true });
+      expect(details()).toEqual({ api: 'drive', version: 'v3', method: 'files.create', params: 'not json', body: '@/body.json' });
+    });
+
+    it('bounds an oversized body in the prompt, marking the cut', async () => {
+      vi.mocked(runner.run).mockResolvedValue('{}');
+      const { harness, details } = await prompted({ action: 'decline' });
+      const body = JSON.stringify({ text: 'x'.repeat(3000) });
+      await harness.callTool('gog_api_call', { api: 'docs', version: 'v1', method: 'documents.batchUpdate', body, allowWrite: true });
+      const shown = details().body as string;
+      expect(shown.startsWith(body.slice(0, 2048))).toBe(true);
+      expect(shown).toMatch(/more characters not shown\]$/);
+    });
+
+    it('runs nothing when the user declines', async () => {
+      const { harness } = await prompted({ action: 'decline' });
+      const r = json(await harness.callTool('gog_api_call', { ...write, allowWrite: true }));
+      expect(r).toMatchObject({ confirmed: false, cancelled: true, action: 'api.call' });
+      expect(runner.run).not.toHaveBeenCalled();
+    });
+
+    it.each([
+      ['a read', { api: 'calendar', version: 'v3', method: 'events.list' }],
+      ['a dry run', { ...write, allowWrite: true, dryRun: true }],
+      ['a write without allowWrite (gog refuses it itself)', { ...write }],
+    ])('does not ask for %s', async (_label, args) => {
+      process.env.MCP_CONFIRM_MODE = 'refuse';
+      vi.mocked(runner.run).mockResolvedValue('{}');
+      const harness = await setupHandlers();
+      const r = await harness.callTool('gog_api_call', args);
+      expect(r.isError).toBeFalsy();
+      expect(runner.run).toHaveBeenCalledTimes(1);
+    });
+
+    it('refuses a client that cannot be prompted under MCP_CONFIRM_MODE=refuse, naming the way through', async () => {
+      process.env.MCP_CONFIRM_MODE = 'refuse';
+      const harness = await setupHandlers();
+      const r = json(await harness.callTool('gog_api_call', { ...write, allowWrite: true }));
+      expect(r).toMatchObject({ reason: 'confirmation-unsupported', action: 'api.call' });
+      expect(r.note).toMatch(/dryRun/);
+      expect(runner.run).not.toHaveBeenCalled();
+    });
+
+    it('token fallback: previews in full, refuses a changed payload, runs on phase 2', async () => {
+      process.env.MCP_CONFIRM_MODE = 'ask-user';
+      vi.mocked(runner.run).mockResolvedValue('{}');
+      const harness = await setupHandlers();
+      const args = { ...write, body: '{"a":1}', allowWrite: true };
+      const p1 = json(await harness.callTool('gog_api_call', args));
+      expect(p1).toMatchObject({
+        status: 'confirmation-required',
+        preview: {
+          api: 'calendar', version: 'v3', method: 'events.delete',
+          params: { calendarId: 'primary', eventId: 'e1', sendUpdates: 'all' },
+          body: { a: 1 },
+        },
+        instruction: CONFIRM_ACTION_INSTRUCTION,
+      });
+      expect(runner.run).not.toHaveBeenCalled();
+      expect(json(await harness.callTool('gog_api_call', { ...args, body: '{"a":2}', confirmToken: p1.confirmToken })))
+        .toMatchObject({ error: 'DRAFT_CHANGED' });
+      expect(json(await harness.callTool('gog_api_call', { ...args, params: '{"calendarId":"primary","eventId":"e2"}', confirmToken: p1.confirmToken })))
+        .toMatchObject({ error: 'DRAFT_CHANGED' });
+      expect(runner.run).not.toHaveBeenCalled();
+      await harness.callTool('gog_api_call', { ...args, confirmToken: p1.confirmToken });
+      expect(runner.run).toHaveBeenCalledTimes(1);
+      expect(vi.mocked(runner.run).mock.calls[0][0]).toContain('--allow-write');
+    });
+  });
+
   it('returns error text on failure', async () => {
     vi.mocked(runner.run).mockRejectedValue(new Error('Call failed'));
     const harness = await setupHandlers();

package/tests/tools/appscript.test.ts

@@ -7,6 +7,10 @@ import { pos } from '../../src/argv.js';
 vi.mock('../../src/runner.js');
 
 const setupHandlers = () => createTestHarness(registerAppScriptTools);
+// gog_appscript_run_function asks first (dispatch-gates-more.test.ts covers the prompt itself).
+const acceptingHandlers = () => createTestHarness(registerAppScriptTools, {
+  elicitation: async () => ({ action: 'accept', content: { confirmed: true } }),
+});
 
 beforeEach(() => vi.clearAllMocks());
 
@@ -114,14 +118,14 @@ describe('gog_appscript_versions', () => {
 describe('gog_appscript_run_function', () => {
   it('runs a deployed function', async () => {
     vi.mocked(runner.run).mockResolvedValue('{}');
-    const harness = await setupHandlers();
+    const harness = await acceptingHandlers();
     await harness.callTool('gog_appscript_run_function', { scriptId: 'S1', functionName: 'doWork' });
     expect(runner.run).toHaveBeenCalledWith(['appscript', 'run', pos('S1'), pos('doWork')], { account: undefined });
   });
 
   it('passes params and --dev-mode', async () => {
     vi.mocked(runner.run).mockResolvedValue('{}');
-    const harness = await setupHandlers();
+    const harness = await acceptingHandlers();
     await harness.callTool('gog_appscript_run_function', {
       scriptId: 'S1', functionName: 'doWork', params: '["a",1]', devMode: true,
     });