gogcli-mcp 4.5.0 → 4.5.1

package/src/tools/utils.ts

@@ -302,10 +302,11 @@ export function formatAccountList(raw: string): string {
 
 // Turn a thrown error into a diagnosed error result (`isError: true`): the
 // error text, an actionable hint when the failure class is recognised (auth /
-// transient / off-grid write), and the list of configured accounts. Callers
-// that need to surface a failure without going through runOrDiagnose (e.g. a
-// pre-write verification read that must abort) can reuse this so the error
-// keeps the same diagnostic quality as everywhere else.
+// transient / off-grid write), and — on an auth failure only — the list of
+// configured accounts. Callers that need to surface a failure without going
+// through runOrDiagnose (e.g. a pre-write verification read that must abort)
+// can reuse this so the error keeps the same diagnostic quality as everywhere
+// else.
 export async function diagnose(err: unknown): Promise<CallToolResult> {
   const errText = errorText(err);
 
@@ -333,6 +334,11 @@ export async function diagnose(err: unknown): Promise<CallToolResult> {
         : isGridLimitError
           ? GRID_LIMIT_HINT
           : '';
+  // The account list answers one question — WHICH account is signed in — so it
+  // is appended only when the failure is about that (PRIV-1, fleet-audit
+  // #1012). Every other error used to echo every identity on the host to the
+  // model, and spawn a `gog auth list`, for nothing.
+  if (!isAuthError && !isInvalidGrant) return errorResult(`${errText}${hint}`);
   try {
     const accounts = formatAccountList(await run(['auth', 'list']));
     return errorResult(`${errText}\n\nConfigured accounts:\n${accounts || '(none)'}${hint}`);

package/tests/gmail-dispatch-guard.test.ts

@@ -94,7 +94,7 @@ describe('logGmailDispatch', () => {
     logGmailDispatch('gog_gmail_reply', ['me@example.com', 'outside@other.com'], 'me@example.com');
     const event = loggedEvent();
     expect(event.hasExternalRecipients).toBe(true);
-    expect(event.externalRecipients).toEqual(['outside@other.com']);
+    expect(event.externalDomains).toEqual(['other.com']);
     expect(event.externalRecipientCount).toBe(1);
   });
 
@@ -102,34 +102,34 @@ describe('logGmailDispatch', () => {
     process.env.GOG_ACCOUNT = 'me@example.com';
     logGmailDispatch('gog_gmail_send', ['me@example.com', 'outside@other.com']);
     const event = loggedEvent();
-    expect(event.externalRecipients).toEqual(['outside@other.com']);
+    expect(event.externalDomains).toEqual(['other.com']);
   });
 
   it('adds every domain in GOG_GMAIL_TRUSTED_DOMAINS on top of the account domain', () => {
     process.env.GOG_GMAIL_TRUSTED_DOMAINS = 'law-firm.example, partner.example';
     logGmailDispatch('gog_gmail_reply_all', ['counsel@law-firm.example', 'stranger@random.example'], 'me@example.com');
     const event = loggedEvent();
-    expect(event.externalRecipients).toEqual(['stranger@random.example']);
+    expect(event.externalDomains).toEqual(['random.example']);
   });
 
   it('reports no external recipients when every address is trusted', () => {
     logGmailDispatch('gog_gmail_forward', ['me@example.com'], 'me@example.com');
     const event = loggedEvent();
     expect(event.hasExternalRecipients).toBe(false);
-    expect(event.externalRecipients).toEqual([]);
+    expect(event.externalDomains).toEqual([]);
   });
 
   it('treats an account with no @ as contributing no trusted domain', () => {
     logGmailDispatch('gog_gmail_send', ['a@example.com'], 'not-an-email');
     const event = loggedEvent();
-    expect(event.externalRecipients).toEqual(['a@example.com']);
+    expect(event.externalDomains).toEqual(['example.com']);
   });
 
   it('ignores an empty segment in GOG_GMAIL_TRUSTED_DOMAINS (e.g. a trailing comma)', () => {
     process.env.GOG_GMAIL_TRUSTED_DOMAINS = 'law-firm.example,,';
     logGmailDispatch('gog_gmail_send', ['counsel@law-firm.example'], 'me@example.com');
     const event = loggedEvent();
-    expect(event.externalRecipients).toEqual([]);
+    expect(event.externalDomains).toEqual([]);
   });
 
   it('treats unresolved desktop placeholders as unset env vars', () => {
@@ -137,13 +137,29 @@ describe('logGmailDispatch', () => {
     process.env.GOG_ACCOUNT = '${user_config.account}';
     logGmailDispatch('gog_gmail_send', ['person@user_config.trusted_domains']);
     const event = loggedEvent();
-    expect(event.externalRecipients).toEqual(['person@user_config.trusted_domains']);
+    expect(event.externalDomains).toEqual(['user_config.trusted_domains']);
   });
 
   it('treats a recipient with no @ as external, not a crash', () => {
     logGmailDispatch('gog_gmail_send', ['not-an-email'], 'me@example.com');
     const event = loggedEvent();
-    expect(event.externalRecipients).toEqual(['not-an-email']);
+    expect(event.externalRecipientCount).toBe(1);
+    expect(event.externalDomains).toEqual(['(no domain)']);
+  });
+
+  // PRIV-1 (fleet-audit #1012): on mcp-host this line is host log data the user
+  // never sees, so it names domains, never addresses — the count and the
+  // domain are what the audit purpose needs (an unexpected law firm, a
+  // wrong-number alias), the local part is a third party's identity.
+  it('never writes a recipient address to stderr', () => {
+    logGmailDispatch('gog_gmail_reply_all', ['me@example.com', 'counsel@law-firm.example', 'second@law-firm.example', 'Kid@School.example'], 'me@example.com');
+    const line = writeSpy.mock.calls[0][0] as string;
+    expect(line).not.toMatch(/@/);
+    expect(line).not.toContain('externalRecipients');
+    const event = loggedEvent();
+    expect(event.recipientCount).toBe(4);
+    expect(event.externalRecipientCount).toBe(3);
+    expect(event.externalDomains).toEqual(['law-firm.example', 'school.example']);
   });
 });
 

package/tests/tools/api.test.ts

@@ -1,14 +1,37 @@
 import { describe, it, expect, vi, beforeEach, afterEach } from 'vitest';
+import type { ElicitRequest, ElicitResult } from '@modelcontextprotocol/server';
 import { registerApiTools } from '../../src/tools/api.js';
 import * as runner from '../../src/runner.js';
 import { createTestHarness } from '@chrischall/mcp-utils/test';
 import { pos } from '../../src/argv.js';
+import { resetConfirmTokenState } from '../../src/send-confirm-token.js';
+import { CONFIRM_ACTION_INSTRUCTION } from '../../src/dispatch-confirmation.js';
 
 vi.mock('../../src/runner.js');
 
 const setupHandlers = () => createTestHarness(registerApiTools);
 
-beforeEach(() => vi.clearAllMocks());
+/** A client that CAN be prompted, answering with `answer` and recording the prompt. */
+async function prompted(answer: ElicitResult = { action: 'accept', content: { confirmed: true } }) {
+  const seen: ElicitRequest[] = [];
+  const harness = await createTestHarness(registerApiTools, { elicitation: async (r) => { seen.push(r); return answer; } });
+  const details = () => JSON.parse(seen[0]!.params.message.split('\n').slice(1).join('\n')).details;
+  return { harness, seen, details };
+}
+const json = (r: { content: Array<{ text?: string }> }) => JSON.parse(r.content[0]!.text as string);
+
+const ORIGINAL_ENV = { ...process.env };
+
+beforeEach(() => {
+  vi.clearAllMocks();
+  process.env = { ...ORIGINAL_ENV };
+  delete process.env.MCP_CONFIRM_MODE;
+  delete process.env.MCP_CONFIRM_TTL_SECONDS;
+  delete process.env.MCP_CONFIRM_SECRET;
+  resetConfirmTokenState();
+});
+
+afterEach(() => { process.env = ORIGINAL_ENV; });
 
 describe('gog_api_list', () => {
   it('lists the default API set', async () => {
@@ -76,7 +99,7 @@ describe('gog_api_call', () => {
     await harness.callTool('gog_api_call', {
       api: 'drive', version: 'v3', method: 'files.create',
       params: '{"fields":"id"}', body: '{"name":"f"}', scope: 'https://www.googleapis.com/auth/drive',
-      allowWrite: true, dryRun: true, account: 'a@b.com',
+      allowWrite: true, dryRun: true, account: 'a@example.com',
     });
     expect(runner.run).toHaveBeenCalledWith(
       [
@@ -84,13 +107,13 @@ describe('gog_api_call', () => {
         '--params={"fields":"id"}', '--body={"name":"f"}',
         '--scope=https://www.googleapis.com/auth/drive', '--allow-write', '--dry-run', '--force',
       ],
-      { account: 'a@b.com', gmailNoSend: true },
+      { account: 'a@example.com', gmailNoSend: true },
     );
   });
 
-  it('appends --force last even when dry-run is absent', async () => {
+  it('appends --force last even when dry-run is absent, once the user has confirmed', async () => {
     vi.mocked(runner.run).mockResolvedValue('{}');
-    const harness = await setupHandlers();
+    const { harness } = await prompted();
     await harness.callTool('gog_api_call', {
       api: 'drive', version: 'v3', method: 'files.create', allowWrite: true,
     });
@@ -99,6 +122,108 @@ describe('gog_api_call', () => {
     expect(passedArgs[passedArgs.length - 1]).toBe('--force');
   });
 
+  // SEC-2 (fleet-audit #931): allowWrite is a boolean the MODEL sets, and
+  // --force skips gog's own confirmation, so a method blocklist could never be
+  // complete (events.move/delete, acl.insert, sendAs.create, updateVacation,
+  // batchDelete, ...). Every write now asks the user about the exact
+  // api/method/params/body before anything is sent.
+  describe('the write gate', () => {
+    const write = {
+      api: 'calendar', version: 'v3', method: 'events.delete',
+      params: '{"calendarId":"primary","eventId":"e1","sendUpdates":"all"}',
+    };
+
+    it('prompts with the api, version, method, params and body, then runs once accepted', async () => {
+      vi.mocked(runner.run).mockResolvedValue('{}');
+      const { harness, details, seen } = await prompted();
+      await harness.callTool('gog_api_call', { ...write, body: '{"a":1}', scope: 'https://www.googleapis.com/auth/calendar', allowWrite: true, account: 'a@example.com' });
+      expect(seen[0]!.params.message).toMatch(/calendar v3 events\.delete/);
+      expect(details()).toEqual({
+        api: 'calendar', version: 'v3', method: 'events.delete',
+        params: { calendarId: 'primary', eventId: 'e1', sendUpdates: 'all' },
+        body: { a: 1 },
+        scope: 'https://www.googleapis.com/auth/calendar',
+      });
+      expect(runner.run).toHaveBeenCalledWith(
+        ['api', 'call', pos('calendar'), pos('v3'), pos('events.delete'), `--params=${write.params}`, '--body={"a":1}',
+          '--scope=https://www.googleapis.com/auth/calendar', '--allow-write', '--force'],
+        { account: 'a@example.com', gmailNoSend: true },
+      );
+    });
+
+    it('shows a body that is not JSON (an @file reference) as the string it is', async () => {
+      vi.mocked(runner.run).mockResolvedValue('{}');
+      const { harness, details } = await prompted({ action: 'decline' });
+      await harness.callTool('gog_api_call', { api: 'drive', version: 'v3', method: 'files.create', body: '@/body.json', params: 'not json', allowWrite: true });
+      expect(details()).toEqual({ api: 'drive', version: 'v3', method: 'files.create', params: 'not json', body: '@/body.json' });
+    });
+
+    it('bounds an oversized body in the prompt, marking the cut', async () => {
+      vi.mocked(runner.run).mockResolvedValue('{}');
+      const { harness, details } = await prompted({ action: 'decline' });
+      const body = JSON.stringify({ text: 'x'.repeat(3000) });
+      await harness.callTool('gog_api_call', { api: 'docs', version: 'v1', method: 'documents.batchUpdate', body, allowWrite: true });
+      const shown = details().body as string;
+      expect(shown.startsWith(body.slice(0, 2048))).toBe(true);
+      expect(shown).toMatch(/more characters not shown\]$/);
+    });
+
+    it('runs nothing when the user declines', async () => {
+      const { harness } = await prompted({ action: 'decline' });
+      const r = json(await harness.callTool('gog_api_call', { ...write, allowWrite: true }));
+      expect(r).toMatchObject({ confirmed: false, cancelled: true, action: 'api.call' });
+      expect(runner.run).not.toHaveBeenCalled();
+    });
+
+    it.each([
+      ['a read', { api: 'calendar', version: 'v3', method: 'events.list' }],
+      ['a dry run', { ...write, allowWrite: true, dryRun: true }],
+      ['a write without allowWrite (gog refuses it itself)', { ...write }],
+    ])('does not ask for %s', async (_label, args) => {
+      process.env.MCP_CONFIRM_MODE = 'refuse';
+      vi.mocked(runner.run).mockResolvedValue('{}');
+      const harness = await setupHandlers();
+      const r = await harness.callTool('gog_api_call', args);
+      expect(r.isError).toBeFalsy();
+      expect(runner.run).toHaveBeenCalledTimes(1);
+    });
+
+    it('refuses a client that cannot be prompted under MCP_CONFIRM_MODE=refuse, naming the way through', async () => {
+      process.env.MCP_CONFIRM_MODE = 'refuse';
+      const harness = await setupHandlers();
+      const r = json(await harness.callTool('gog_api_call', { ...write, allowWrite: true }));
+      expect(r).toMatchObject({ reason: 'confirmation-unsupported', action: 'api.call' });
+      expect(r.note).toMatch(/dryRun/);
+      expect(runner.run).not.toHaveBeenCalled();
+    });
+
+    it('token fallback: previews in full, refuses a changed payload, runs on phase 2', async () => {
+      process.env.MCP_CONFIRM_MODE = 'ask-user';
+      vi.mocked(runner.run).mockResolvedValue('{}');
+      const harness = await setupHandlers();
+      const args = { ...write, body: '{"a":1}', allowWrite: true };
+      const p1 = json(await harness.callTool('gog_api_call', args));
+      expect(p1).toMatchObject({
+        status: 'confirmation-required',
+        preview: {
+          api: 'calendar', version: 'v3', method: 'events.delete',
+          params: { calendarId: 'primary', eventId: 'e1', sendUpdates: 'all' },
+          body: { a: 1 },
+        },
+        instruction: CONFIRM_ACTION_INSTRUCTION,
+      });
+      expect(runner.run).not.toHaveBeenCalled();
+      expect(json(await harness.callTool('gog_api_call', { ...args, body: '{"a":2}', confirmToken: p1.confirmToken })))
+        .toMatchObject({ error: 'DRAFT_CHANGED' });
+      expect(json(await harness.callTool('gog_api_call', { ...args, params: '{"calendarId":"primary","eventId":"e2"}', confirmToken: p1.confirmToken })))
+        .toMatchObject({ error: 'DRAFT_CHANGED' });
+      expect(runner.run).not.toHaveBeenCalled();
+      await harness.callTool('gog_api_call', { ...args, confirmToken: p1.confirmToken });
+      expect(runner.run).toHaveBeenCalledTimes(1);
+      expect(vi.mocked(runner.run).mock.calls[0][0]).toContain('--allow-write');
+    });
+  });
+
   it('returns error text on failure', async () => {
     vi.mocked(runner.run).mockRejectedValue(new Error('Call failed'));
     const harness = await setupHandlers();

package/tests/tools/appscript.test.ts

@@ -7,6 +7,10 @@ import { pos } from '../../src/argv.js';
 vi.mock('../../src/runner.js');
 
 const setupHandlers = () => createTestHarness(registerAppScriptTools);
+// gog_appscript_run_function asks first (dispatch-gates-more.test.ts covers the prompt itself).
+const acceptingHandlers = () => createTestHarness(registerAppScriptTools, {
+  elicitation: async () => ({ action: 'accept', content: { confirmed: true } }),
+});
 
 beforeEach(() => vi.clearAllMocks());
 
@@ -114,14 +118,14 @@ describe('gog_appscript_versions', () => {
 describe('gog_appscript_run_function', () => {
   it('runs a deployed function', async () => {
     vi.mocked(runner.run).mockResolvedValue('{}');
-    const harness = await setupHandlers();
+    const harness = await acceptingHandlers();
     await harness.callTool('gog_appscript_run_function', { scriptId: 'S1', functionName: 'doWork' });
     expect(runner.run).toHaveBeenCalledWith(['appscript', 'run', pos('S1'), pos('doWork')], { account: undefined });
   });
 
   it('passes params and --dev-mode', async () => {
     vi.mocked(runner.run).mockResolvedValue('{}');
-    const harness = await setupHandlers();
+    const harness = await acceptingHandlers();
     await harness.callTool('gog_appscript_run_function', {
       scriptId: 'S1', functionName: 'doWork', params: '["a",1]', devMode: true,
     });