mcp-gee-sweet 0.9.2.dev215__tar.gz → 0.9.2.dev221__tar.gz

{mcp_gee_sweet-0.9.2.dev215 → mcp_gee_sweet-0.9.2.dev221}/PKG-INFO

@@ -1,6 +1,6 @@
 Metadata-Version: 2.5
 Name: mcp-gee-sweet
-Version: 0.9.2.dev215
+Version: 0.9.2.dev221
 Summary: MCP server for Google Workspace — Sheets, Drive, Docs (HTML or Markdown), and Calendar.
 Project-URL: Homepage, https://github.com/khuisman/mcp-gee-sweet
 Project-URL: Bug Tracker, https://github.com/khuisman/mcp-gee-sweet/issues

{mcp_gee_sweet-0.9.2.dev215 → mcp_gee_sweet-0.9.2.dev221}/docs/qa/tests/drive_files.md

@@ -887,6 +887,32 @@ delete_file('invalidid123xyz') → HttpError 404 propagates cleanly, no crash. N
 
 ---
 
+### TC-D280: Permanent delete without permanent-delete permission — clear error, file kept (issue #876) ⚠️ destructive
+
+**Requires:** an identity with the **Content manager** role (not Manager) on the `mcp-gee-sweet-shared` Shared Drive. The QA service account is added at exactly that role (`setup.md` Step 1), so run this on a service-account server (`mcp-gee-sweet-sa`, or the lane's own server relaunched with `AUTH_METHOD=service_account`). An OAuth identity that manages the Shared Drive gets `canDelete: true` and can't reproduce this.
+
+**Setup:** `upload_file(name="QA-876-Delete-Denied.txt", content="x", folder_id={FOLDER_ID})` as the Content-manager identity. Note the returned file ID.
+
+**Steps**
+1. `delete_file(file_id=<id>, permanent=True)`
+2. `get_file_metadata(file_id=<id>)`
+3. `delete_file(file_id=<id>, permanent=False)`
+
+**Checks**
+- Step 1 fails with a `ValueError` saying the identity lacks permanent-delete permission, noting that on a Shared Drive this usually requires the Manager role, and suggesting `permanent=False`. It is **not** Drive's `HttpError 404 "File not found"`.
+- Step 2 returns the file with `trashed: false`: nothing was deleted.
+- Step 3 returns `{"fileId": <id>, "action": "trashed"}`.
+
+**Cleanup:** step 3 leaves the file in the Shared Drive's trash. Purge it with `delete_file(file_id=<id>, permanent=True)` from an identity with the Manager role (e.g. the lane's OAuth server), or leave it for a later `empty_trash(drive_id={SHARED_DRIVE_ID})` run.
+
+**Result (2026-10-04) ✅ PASS**
+Run as the QA service account (Content manager) from a fresh interpreter in the kit worktree driving PR #888's `delete_file` (kit's server is OAuth/Manager). Pre-check: `capabilities={canDelete: false, canTrash: true}`, file on the Shared Drive. Step 1 raised `ValueError` naming missing permanent-delete permission + `permanent=False` hint; no `files().delete` sent. Step 2 `trashed: false`. Baseline: a raw `files().delete` as the same SA still returns Drive's `404 "File not found"`, so the pre-flight check is what fixes it. Step 3 `{"action": "trashed"}`, then `trashed: true`. Cleanup: `delete_file(permanent=True)` via kit's OAuth (Manager) server returned `{"action": "deleted"}`, which also covers the `canDelete: true` path live.
+
+**Result (2026-10-04, round 2) ✅ PASS**
+Re-run the same way against `255512b` (Shared Drive note scoped to `driveId`). Step 1's `ValueError` now reads "...lacks permanent-delete permission on it. On a Shared Drive this usually requires the Manager role. Use permanent=False to move it to the trash instead." Steps 2–3 and the raw-delete 404 baseline as in round 1. Cleanup via kit's reconnected OAuth server: `{"action": "deleted"}`. The My Drive (no `driveId`) wording isn't live-tested: it needs a file owned by someone else, where a wrong result would be a real permanent delete. Unit test `test_delete_file_permanent_without_can_delete_on_my_drive_omits_shared_drive_note` covers it.
+
+---
+
 ## `restore_file`
 
 ### TC-D269: Restore a trashed file ⚠️ destructive

{mcp_gee_sweet-0.9.2.dev215 → mcp_gee_sweet-0.9.2.dev221}/docs/qa/tests/drive_transfer.md

@@ -1787,6 +1787,56 @@ Unit tests: full suite 1883 passed / 3 skipped; ruff clean. Fast-path re-verific
 
 ---
 
+### TC-D279: downloads write to a temp file and rename it into place; a leftover temp file is never uploaded (issue #844) ⚠️ local-filesystem ⚠️ destructive
+
+**Background:** `sync_folder`, `download_file`, and `download_folder` used to stream straight into the destination. A download that failed partway left a truncated file with a current mtime, so the next bidirectional sync read it as locally newer and uploaded it over the intact Drive copy. Every download now goes through `_write_atomically`: it writes a sibling `.gee-sweet-partial-<16 hex>` file, stamps `sync_folder`'s Drive mtime on it, and renames it onto the destination only when complete. A temp file survives only a hard kill mid-write, and `sync_folder` and `upload_local_folder` skip one. The failure path itself (a dropped connection mid-download) can't be triggered through the tool surface; it's unit-tested in `tests/drive/test_transfer.py::TestSyncFolderFailedDownloadLeavesNoPartial`, `TestDownloadToolsFailedDownloadLeavesNoPartial`, and `TestWriteAtomically`. This case checks the success path through the new write, the mode and mtime it leaves, and the leftover-temp-file skip.
+
+**Setup**
+> 1. Call `create_folder(name="qa-279", parent_folder_id="{FOLDER_ID}")`; call the returned ID `{F}`.
+> 2. Run `rm -rf /tmp/qa-279 && mkdir -p /tmp/qa-279/src /tmp/qa-279/sync && head -c 3000000 /dev/urandom > /tmp/qa-279/src/big.bin`.
+> 3. Call `upload_local_file(local_path="/tmp/qa-279/src/big.bin", parent_folder_id="{F}")`; call the returned ID `{BIG}`. Call `get_file_metadata(file_id="{BIG}")` and note `modified_time` and `md5_checksum`.
+> 4. Plant a stale local copy and a leftover temp file: `printf 'stale' > /tmp/qa-279/sync/big.bin && chmod 640 /tmp/qa-279/sync/big.bin && touch -t 202001010000 /tmp/qa-279/sync/big.bin && printf 'half a file' > /tmp/qa-279/sync/.gee-sweet-partial-0123456789abcdef`.
+
+**Steps**
+> 1. `sync_folder(folder_id="{F}", local_path="/tmp/qa-279/sync/")` (real run, default `bidirectional`).
+> 2. Run `ls -la /tmp/qa-279/sync/ && md5 -q /tmp/qa-279/sync/big.bin && stat -f '%Sp %Sm' -t '%Y-%m-%dT%H:%M:%S' /tmp/qa-279/sync/big.bin` (Linux: `md5sum`, `stat -c '%A %y'`).
+> 3. `list_files(folder_id="{F}")`.
+> 4. `sync_folder(folder_id="{F}", local_path="/tmp/qa-279/sync/")` again.
+> 5. `upload_local_folder(local_path="/tmp/qa-279/sync/", parent_folder_id="{F}", skip_if_exists=false)`, then `list_files(folder_id="{F}")`.
+> 6. `download_file(file_id="{BIG}", local_path="/tmp/qa-279/sync/big.bin")`, then `ls -la /tmp/qa-279/sync/`.
+> 7. `download_folder(folder_id="{F}", local_path="/tmp/qa-279/dl/", skip_if_exists=false)`, then `ls -la /tmp/qa-279/dl/`.
+> 8. Make a read-only local copy: `printf 'protected' > /tmp/qa-279/ro.bin && chmod 444 /tmp/qa-279/ro.bin && chmod 4644 /tmp/qa-279/dl/big.bin`. Call `download_file(file_id="{BIG}", local_path="/tmp/qa-279/ro.bin")`. Then call `download_file(file_id="{BIG}", local_path="/tmp/qa-279/dl/big.bin")` and run `ls -la /tmp/qa-279/ /tmp/qa-279/dl/ && cat /tmp/qa-279/ro.bin`. (Not as root: root can write a `0444` file.)
+
+**Checks**
+- Step 1: `downloaded` is `["big.bin"]`. `uploaded` is empty, and `.gee-sweet-partial-0123456789abcdef` appears in no result list. `failed` is empty.
+- Step 2: `big.bin` is 3000000 bytes, its md5 matches setup step 3's `md5_checksum`, its mode is still `-rw-r-----` (the replaced file's mode is kept), and its mtime matches setup step 3's `modified_time` to the second (local time vs UTC aside). The only `.gee-sweet-partial-*` file in the directory is the planted `…0123456789abcdef`; no new one was left behind.
+- Step 3: `{F}` holds exactly one file, `big.bin`. No `.gee-sweet-partial-*` file was uploaded.
+- Step 4: `big.bin` in `skipped`; `uploaded` and `downloaded` empty (the restamped mtime round-trips, as in #346).
+- Step 5: `uploaded` lists only `big.bin` (a second copy, since `skip_if_exists=false`); the planted temp file is not uploaded and not in `failed`. `list_files` shows two `big.bin` and no `.gee-sweet-partial-*`.
+- Step 6: succeeds with `size_bytes` 3000000. The directory still holds only `big.bin` and the planted temp file.
+- Step 7: `downloaded` is `["big.bin"]` and `failed` has one duplicate-filename entry for the second `big.bin` (PR #351). `/tmp/qa-279/dl/` holds only `big.bin`, 3000000 bytes, and no `.gee-sweet-partial-*` file.
+- Step 8 (PR #884 QA round 1): the first `download_file` fails with a permission error. `ro.bin` still reads `protected`, still `-r--r--r--`, and no `.gee-sweet-partial-*` file is in `/tmp/qa-279/`. The second call succeeds, and `dl/big.bin` is `-rw-r--r--`: the setuid bit is not carried onto the new content.
+
+**Teardown**
+`delete_file` on `{F}` (takes its contents with it). `rm -rf /tmp/qa-279`.
+
+**Result (2026-10-04) ✅ PASS** — Sky, PR #884 round 1 (`b74ec2b`), OAuth, throwaway `qa-279` folder under `TEST_FOLDER_ID`. Drive `big.bin`: 3000000 B, md5 `f606776b…2c1a`, `modified_time` `17:42:20Z`.
+- **Step 1:** `downloaded: ["big.bin"]`; `uploaded`, `conflicts`, `failed` empty; the planted temp file appears in no list.
+- **Step 2:** `big.bin` 3000000 B, md5 matches, mode `-rw-r-----` kept, mtime `10:42:20-0700` (= `17:42:20Z`). Only the planted `…0123456789abcdef` temp file present.
+- **Step 3:** one file, `big.bin`.
+- **Step 4:** `skipped: ["big.bin"]`, nothing transferred.
+- **Step 5:** `uploaded: ["big.bin"]` only; `list_files` shows two `big.bin`, no temp file.
+- **Step 6:** `size_bytes` 3000000; directory still holds only `big.bin` + the planted temp file.
+- **Step 7:** `downloaded: ["big.bin"]`, one duplicate-filename `failed` entry; `dl/` holds only `big.bin`, 3000000 B.
+
+The case passes, but the PR goes back for a regression this case doesn't cover: a read-only (`0444`) local destination is now silently replaced. Live, after this case: `printf protected > big.bin && chmod 444 big.bin`, then `download_file(file_id="{BIG}", local_path=".../big.bin")` returned success and left a 3000000 B `-r--r--r--` file. Before this PR the `open("wb")` raised `PermissionError` and left the file alone. See the PR comment.
+
+**Result (2026-10-04) ✅ PASS** — Sky, PR #884 round 2 (`b4e7287`), step 8 only, after reconnecting to the fix. Steps 1–7 code paths are unchanged apart from the new up-front `os.access` check and the `0o777` mask. Fresh `qa-279` folder; setup plus step 7 (`download_folder` → `dl/big.bin`, 3000000 B) re-run first.
+- **Step 8, `ro.bin`:** `download_file` failed with `[Errno 13] Permission denied: '/tmp/qa-279/ro.bin'`. `ro.bin` still reads `protected`, still `-r--r--r--`, and there's no `.gee-sweet-partial-*` in `/tmp/qa-279/`.
+- **Step 8, `dl/big.bin` (`chmod 4644` first):** succeeded, `size_bytes` 3000000, and the file is now `-rw-r--r--`: setuid dropped.
+
+---
+
 ## `list_revisions`
 
 ### TC-D146: List revisions for a spreadsheet

{mcp_gee_sweet-0.9.2.dev215 → mcp_gee_sweet-0.9.2.dev221}/docs/roadmap.md

@@ -192,10 +192,8 @@ Same shape as v0.8.1 — stabilize on defects that surfaced since v0.9.0 shipped
 - [x] `create_paragraph_bullets` (`style.py`) has the same isolated-run collapse-to-`nestingLevel 0` bug #439 fixed in `emitter.py` only — port PR #711's anchor-paragraph approach to the sibling path (PR #723) ([#713](https://github.com/khuisman/mcp-gee-sweet/issues/713))
 - [x] Lock in the isolated-run rendering rule — an isolated bullet run renders at its true depth (`depth N` → `nestingLevel N`) at *every* depth, never clamped (decided 2026-09-09: consistency over avoiding orphaned indent; the markup generator owns the depth it emits). Extend TC-DOC190 with a `min_depth >= 2` case; state the rule in `emitter.py`'s bullet-pass comment and the `docs/emitter.py` paragraph of `CLAUDE.md` (PR #731) ([#714](https://github.com/khuisman/mcp-gee-sweet/issues/714))
 - [x] `create_doc` markdown: a fenced code block whose body is raw HTML tags renders as loose plain paragraphs (fence ignored, indentation flattened) instead of a monospaced code block — python-markdown's raw-HTML-block handling appears to pre-empt `fenced_code`. Surfaced during #714 triage (PR #730) ([#719](https://github.com/khuisman/mcp-gee-sweet/issues/719))
-- [ ] `_auth_status_json` silently overrides a caller passing an inconsistent `is_service_account_identity` instead of erroring or reconciling ([#614](https://github.com/khuisman/mcp-gee-sweet/issues/614))
-- [ ] `_timed` logs a `200` status for tool calls that catch their own exception and return `{error: ...}` — observability reports success for a call that actually failed ([#579](https://github.com/khuisman/mcp-gee-sweet/issues/579))
-- [ ] `emitter.py` table-cell images have no cursor-advance handling — latent infinite loop if that code path is ever reached ([#509](https://github.com/khuisman/mcp-gee-sweet/issues/509))
-- [ ] Calendar ACL tools use a bare `except Exception` instead of the `HttpError` friendly-error pattern used elsewhere in `calendar.py` ([#459](https://github.com/khuisman/mcp-gee-sweet/issues/459))
+- [ ] **Bundle:** Docs write side (emitter, html_parser, images, content), one PR closing [#509](https://github.com/khuisman/mcp-gee-sweet/issues/509), [#567](https://github.com/khuisman/mcp-gee-sweet/issues/567), [#581](https://github.com/khuisman/mcp-gee-sweet/issues/581), [#638](https://github.com/khuisman/mcp-gee-sweet/issues/638), [#715](https://github.com/khuisman/mcp-gee-sweet/issues/715) — lane A ([#894](https://github.com/khuisman/mcp-gee-sweet/issues/894))
+- [ ] **Bundle:** Calendar hardening, one PR closing [#459](https://github.com/khuisman/mcp-gee-sweet/issues/459), [#615](https://github.com/khuisman/mcp-gee-sweet/issues/615), [#626](https://github.com/khuisman/mcp-gee-sweet/issues/626), [#627](https://github.com/khuisman/mcp-gee-sweet/issues/627), [#726](https://github.com/khuisman/mcp-gee-sweet/issues/726) — lane B ([#890](https://github.com/khuisman/mcp-gee-sweet/issues/890))
 - [ ] `delete_file(permanent=True)` surfaces a misleading 404 when the caller can trash but not permanently delete (Shared Drive Content manager) — an agent can read it as "already gone" and skip cleanup; check `capabilities.canDelete` first — lane B ([#876](https://github.com/khuisman/mcp-gee-sweet/issues/876))
 - [ ] SSE: SIGTERM with an SSE stream open logs an "Exception in ASGI application" traceback; the server still exits cleanly, pre-existing before #833 — lane A ([#868](https://github.com/khuisman/mcp-gee-sweet/issues/868))
 - [x] `sync_folder`'s `convert_markdown` restamp-failure handling: quota-message gap, duplicated create()+update() try/except, test fixture isolation — companion to #420 (PR #669) ([#650](https://github.com/khuisman/mcp-gee-sweet/issues/650))
@@ -238,20 +236,14 @@ Same shape as v0.8.1 — stabilize on defects that surfaced since v0.9.0 shipped
 - [x] `content.py`: image-fetch-failure retry mechanism is fragile, resends the whole document per bad image ([#510](https://github.com/khuisman/mcp-gee-sweet/issues/510)) (PR #787)
 - [x] `content.py`: duplicated image upload/share/revoke logic across `create_doc` and `insert_local_images`, plus an avoidable extra Drive round trip ([#511](https://github.com/khuisman/mcp-gee-sweet/issues/511)) (PR #842)
 - [x] `docs/images.py` oversized-image handling: duplicated logic + unneeded full pixel decode (#400 follow-up) ([#560](https://github.com/khuisman/mcp-gee-sweet/issues/560)) (PR #801)
-- [ ] `content.py`: `update_doc_from_file` duplicates `create_doc_from_file`'s file-reading logic; `_replace_doc_content` has a wide positional-bool signature ([#567](https://github.com/khuisman/mcp-gee-sweet/issues/567))
-- [ ] Inline-image size validation: shrink-loop postcondition, check-order inconsistency, unguarded size parsing (#562 follow-up) ([#581](https://github.com/khuisman/mcp-gee-sweet/issues/581))
-- [ ] `doc_to_ast.py` duplicates `style.py`'s glyph-inference and color-extraction logic ([#596](https://github.com/khuisman/mcp-gee-sweet/issues/596))
-- [ ] `ast_to_markdown.py`: image-render duplication + falsy-based code-block buffer flush ([#600](https://github.com/khuisman/mcp-gee-sweet/issues/600))
-- [ ] `html_parser.py` `handle_data`: a SIM114 lint merge conflates two structurally distinct buffering triggers ([#638](https://github.com/khuisman/mcp-gee-sweet/issues/638))
+- [ ] **Bundle:** Docs read side (`doc_to_ast`/`ast_to_markdown`), one PR closing [#596](https://github.com/khuisman/mcp-gee-sweet/issues/596), [#600](https://github.com/khuisman/mcp-gee-sweet/issues/600), [#732](https://github.com/khuisman/mcp-gee-sweet/issues/732) — lane B ([#893](https://github.com/khuisman/mcp-gee-sweet/issues/893))
 - [ ] Docs image-sharing failure paths: unrevocable `anyone:reader` grant + missing folder-cache invalidation in `_replace_doc_content` ([#666](https://github.com/khuisman/mcp-gee-sweet/issues/666))
 - [ ] `write_doc_content`/`update_doc_from_file` leave the doc empty when the replacement fails after the clear — decided 2026-10-04: record the pre-clear revision ID and name it in the error so the caller can recover via `export_revision` ([#878](https://github.com/khuisman/mcp-gee-sweet/issues/878))
 - [ ] `insert_local_images`: temporary `anyone:reader` image shares aren't revoked when the call is cancelled — apply PR #877's shielded-cleanup pattern — lane B ([#883](https://github.com/khuisman/mcp-gee-sweet/issues/883))
 - [x] `_apply_doc_content`: temporary `anyone:reader` image shares aren't revoked when the doc edit raises — revoke pass should run in a `finally`. Same share/revoke surface as #666 and #511 ([#789](https://github.com/khuisman/mcp-gee-sweet/issues/789)) (PR #877)
 - [ ] Docstrings: `create_paragraph_bullets` carries internal API-quirk mechanics plus residual bare issue refs in `style.py` tool docstrings ([#683](https://github.com/khuisman/mcp-gee-sweet/issues/683))
-- [ ] `TestIsolatedDepthRunGlyph` asserts request shape, not rendered nesting outcome (PR #711) ([#715](https://github.com/khuisman/mcp-gee-sweet/issues/715))
 - [ ] `style_doc_range` has no `font_family` parameter — can't apply monospace to an existing range ([#720](https://github.com/khuisman/mcp-gee-sweet/issues/720))
 - [x] Extract a shared helper for the isolated-bullet-run zero-tab anchor mechanic (`emitter.py` ↔ `style.py`); harden its regression test (`lane-a`) ([#727](https://github.com/khuisman/mcp-gee-sweet/issues/727)) (PR #735)
-- [ ] `doc_to_ast.py`'s Courier-New soft-break reversal is per-run, not per-paragraph — mismatched-style edge case can emit malformed inline code with an embedded newline (PR #730 follow-up) ([#732](https://github.com/khuisman/mcp-gee-sweet/issues/732))
 
 **Drive hardening & dedup** _(triaged out of `backlog` 2026-09-11)_
 - [x] `download_folder`/`sync_folder` progress notifications: report bytes transferred, not just file count ([#352](https://github.com/khuisman/mcp-gee-sweet/issues/352)) (PR #739)
@@ -273,37 +265,24 @@ Same shape as v0.8.1 — stabilize on defects that surfaced since v0.9.0 shipped
 - [x] `sync_folder(convert_markdown=True)`: a `.md` name over ~95 bytes overflows Drive's 124-byte property cap — upload fails with `propertyLengthLimitExceeded` but Drive still creates an unmarked orphan Doc, repeated on every sync. Needs a design call on converted-Doc recognition (PR #800 follow-up) ([#805](https://github.com/khuisman/mcp-gee-sweet/issues/805)) (PR #812)
 - [x] Deduplicate the `max_results` clamp expression, hand-copied 8x across `drive/files.py` with inconsistent caps (PR #736 follow-up) ([#737](https://github.com/khuisman/mcp-gee-sweet/issues/737)) (PR #781)
 - [x] `download_file`: one pre-flight `local_path` check before any Drive call, for both trailing-slash and plain branches, naming the blocking path (#724/#827 follow-up; on-deck, `good first issue`) (PR #855) ([#836](https://github.com/khuisman/mcp-gee-sweet/issues/836))
-- [ ] `sync_folder`: a failed mid-stream download leaves a truncated local file with a fresh mtime, which the next sync uploads over the intact Drive copy — download to a temp file and `os.replace` on success; check `download_file`/`download_folder` too. Found by code review, not yet observed live (lane-a, after #814 since both touch `_run_one`) ([#844](https://github.com/khuisman/mcp-gee-sweet/issues/844))
-- [ ] `download_file` local-path preflight follow-ups (#836/PR #855): mkdir-race fallback, trailing `/.` treated as a file destination, dangling-symlink inconsistency — lane A ([#874](https://github.com/khuisman/mcp-gee-sweet/issues/874))
+- [x] `sync_folder`: a failed mid-stream download leaves a truncated local file with a fresh mtime, which the next sync uploads over the intact Drive copy — download to a temp file and `os.replace` on success; check `download_file`/`download_folder` too. Found by code review, not yet observed live (lane-a, after #814 since both touch `_run_one`) ([#844](https://github.com/khuisman/mcp-gee-sweet/issues/844)) (PR #884)
+- [ ] **Bundle:** Drive transfer follow-ups (`download_file` preflight + `_write_atomically`), one PR closing [#874](https://github.com/khuisman/mcp-gee-sweet/issues/874), [#887](https://github.com/khuisman/mcp-gee-sweet/issues/887) — lane A ([#895](https://github.com/khuisman/mcp-gee-sweet/issues/895))
 
 **Calendar hardening** _(triaged out of `backlog` 2026-09-11)_
-- [ ] `list_calendar_acl` pagination fix (#460) needs a response-size cap, loop safety bound, and partial-failure handling ([#615](https://github.com/khuisman/mcp-gee-sweet/issues/615))
-- [ ] `list_all_events` concurrency cap: per-invocation only, no env override ([#626](https://github.com/khuisman/mcp-gee-sweet/issues/626))
-- [ ] `_shape_event`: `get_event` still duplicates it, no null-guard, no kwarg-collision guard ([#627](https://github.com/khuisman/mcp-gee-sweet/issues/627))
-- [ ] `find_free_slots`/`list_all_events`: unify duplicated id-to-summary lookup, align empty-string fallback (PR #725 follow-up) ([#726](https://github.com/khuisman/mcp-gee-sweet/issues/726))
 
 **Testing** _(triaged out of `backlog` 2026-09-11)_
-- [ ] Duplicate fake-Sheets-service test scaffolding in `test_helpers.py` ([#392](https://github.com/khuisman/mcp-gee-sweet/issues/392))
-- [ ] Add unit test coverage for `sync_folder`'s SA-limitations caveat text ([#526](https://github.com/khuisman/mcp-gee-sweet/issues/526))
-- [ ] `test`: strengthen `download_file` unit test assertions (metadata call signature, export str-fallback) ([#551](https://github.com/khuisman/mcp-gee-sweet/issues/551))
-- [ ] `test(drive)`: dedupe `skip_if_exists` companion-test boilerplate in `test_transfer.py` ([#561](https://github.com/khuisman/mcp-gee-sweet/issues/561))
+- [ ] **Bundle:** test-suite tightening, one PR closing [#392](https://github.com/khuisman/mcp-gee-sweet/issues/392), [#526](https://github.com/khuisman/mcp-gee-sweet/issues/526), [#551](https://github.com/khuisman/mcp-gee-sweet/issues/551), [#561](https://github.com/khuisman/mcp-gee-sweet/issues/561), [#574](https://github.com/khuisman/mcp-gee-sweet/issues/574) — lane B ([#891](https://github.com/khuisman/mcp-gee-sweet/issues/891))
 - [ ] `qa`: `search_files` has no unit test coverage for the error-dict path ([#573](https://github.com/khuisman/mcp-gee-sweet/issues/573))
-- [ ] `test`: brittle exact-equality assertion in `test_api_error_returns_error_dict_not_raised` (`test_files.py`) ([#574](https://github.com/khuisman/mcp-gee-sweet/issues/574))
 
 **Infrastructure**
 - [ ] Interaction-log middleware for tool calls — structured, append-only JSONL log per call (inputs, duration, cache hit, error), opt-in ID redaction, swappable backend ([#646](https://github.com/khuisman/mcp-gee-sweet/issues/646))
 - [ ] Automated tooling for dependency-bump security review — today's manual skim can miss a well-disguised supply-chain compromise ([#520](https://github.com/khuisman/mcp-gee-sweet/issues/520))
-- [ ] CI: dedupe lint/format-check and lockfile-check across the Python version matrix ([#619](https://github.com/khuisman/mcp-gee-sweet/issues/619))
-- [ ] Consolidate `uv lock --check` + `uv sync --frozen` into a single `uv sync --locked` step ([#536](https://github.com/khuisman/mcp-gee-sweet/issues/536))
-- [ ] Catch stale hardcoded tool counts in prose docs at commit time, instead of by hand each time drift is caught ([#308](https://github.com/khuisman/mcp-gee-sweet/issues/308))
+- [ ] **Bundle:** CI tidy (on deck, no lane), one PR closing [#536](https://github.com/khuisman/mcp-gee-sweet/issues/536), [#619](https://github.com/khuisman/mcp-gee-sweet/issues/619), [#308](https://github.com/khuisman/mcp-gee-sweet/issues/308), [#708](https://github.com/khuisman/mcp-gee-sweet/issues/708) ([#897](https://github.com/khuisman/mcp-gee-sweet/issues/897))
 - [ ] Automate the mechanical `release.md` steps as GitHub Actions ([#660](https://github.com/khuisman/mcp-gee-sweet/issues/660))
-- [ ] Guard `README.md` against non-absolute image URLs — PyPI's `readme_renderer` silently strips them (shipped a logo-less v0.9.0 page, #706). CI guard test; release/prep-for-pr backstop routed to Bob (#709) ([#708](https://github.com/khuisman/mcp-gee-sweet/issues/708))
 - [ ] `/release` + `prep-for-pr` backstop checks for README render breakage on PyPI — the human-facing companion to #708's CI guard, routed to Bob ([#709](https://github.com/khuisman/mcp-gee-sweet/issues/709))
 - [x] `supportsAllDrives=True` is hand-inlined at ~58 Drive call sites — retrofitted twice now (#687 plus its own original miss); wants a shared wrapper or lint guard so a new call site can't omit it ([#696](https://github.com/khuisman/mcp-gee-sweet/issues/696)) (PR #784)
 - [x] Extract a shared `_BaseCache` helper for the `rows_fetched` sufficiency check + epoch-guarded store — #688's fix copy-pasted the pattern into `DriveFolderCache` instead, and the epoch guard is still missing there ([#698](https://github.com/khuisman/mcp-gee-sweet/issues/698)) (PR #788)
-- [ ] `_SA_LIMITATIONS` (`server.py`) hygiene: no registry tying restricted tools to entries, redundant per-call flatten, duplicated alternatives text — triaged out of `backlog` 2026-09-11 ([#517](https://github.com/khuisman/mcp-gee-sweet/issues/517))
-- [ ] `server.json`/`test_server_json.py`: minor hardening findings from PR #603's review — triaged out of `backlog` 2026-09-11 ([#607](https://github.com/khuisman/mcp-gee-sweet/issues/607))
-- [ ] Restore the explanatory comment for the `annotations=None` stub param in `gen_tool_docs.py` — triaged out of `backlog` 2026-09-11 ([#637](https://github.com/khuisman/mcp-gee-sweet/issues/637))
+- [ ] **Bundle:** server/infra hygiene (start after #872), one PR closing [#517](https://github.com/khuisman/mcp-gee-sweet/issues/517), [#607](https://github.com/khuisman/mcp-gee-sweet/issues/607), [#614](https://github.com/khuisman/mcp-gee-sweet/issues/614), [#579](https://github.com/khuisman/mcp-gee-sweet/issues/579), [#637](https://github.com/khuisman/mcp-gee-sweet/issues/637) — lane B ([#892](https://github.com/khuisman/mcp-gee-sweet/issues/892))
 - [x] Team setup: give each worktree only its own MCP server — other roles' tool names are an estimated ~15–20k of the ~80k lane bootstrap; measure first. Prioritized 2026-09-29, lane-b ahead of #789 ([#850](https://github.com/khuisman/mcp-gee-sweet/issues/850)) (PR #856)
 - [x] Context-size backstop hook for lane sessions, plus a warning before a cold `--resume` — code half of #843; lane-b after #850 ([#847](https://github.com/khuisman/mcp-gee-sweet/issues/847)) (PR #866)
 - [ ] Cut `CLAUDE.md` and the role files down to lasting rules + pointers, moving per-PR history to `docs/design/`/`docs/decisions/` — Amy writes it (user-assigned), Bob reviews each PR under the prompt-QA gate; can land as one PR per file ([#849](https://github.com/khuisman/mcp-gee-sweet/issues/849))
@@ -315,13 +294,11 @@ Same shape as v0.8.1 — stabilize on defects that surfaced since v0.9.0 shipped
 - [x] `reply_to_message` should honor Reply-To and handle replies to your own sent mail ([#791](https://github.com/khuisman/mcp-gee-sweet/issues/791)) (PR #815)
 - [x] Decode message bodies using the part's charset; tolerate missing base64 padding ([#792](https://github.com/khuisman/mcp-gee-sweet/issues/792)) (PR #816)
 - [x] `get_message`/`get_thread` return no body when Gmail delivers a large (~MB) `text/plain`/`text/html` part by `attachmentId`. Found in #803's live QA ([#825](https://github.com/khuisman/mcp-gee-sweet/issues/825)) (PR #829)
-- [ ] `get_thread`/`get_message`: add a body-less option — a long thread trips the response-size cap and there's no other way to get its message IDs, so it can't be read at all ([#793](https://github.com/khuisman/mcp-gee-sweet/issues/793))
-- [ ] Reply-all self-exclusion (silent `getProfile` failure, send-as aliases), attachment reads blocking the event loop, attachment MIME guessing ([#802](https://github.com/khuisman/mcp-gee-sweet/issues/802))
-- [ ] Deduplicate `send_message`/`create_draft` compose and `list_messages`/`list_threads` kwargs/pagination helpers ([#795](https://github.com/khuisman/mcp-gee-sweet/issues/795))
+- [x] `get_thread`/`get_message`: add a body-less option — a long thread trips the response-size cap and there's no other way to get its message IDs, so it can't be read at all ([#793](https://github.com/khuisman/mcp-gee-sweet/issues/793)) (PR #885)
+- [ ] **Bundle:** Gmail cleanup, one PR closing [#795](https://github.com/khuisman/mcp-gee-sweet/issues/795), [#802](https://github.com/khuisman/mcp-gee-sweet/issues/802), [#823](https://github.com/khuisman/mcp-gee-sweet/issues/823) — lane B ([#896](https://github.com/khuisman/mcp-gee-sweet/issues/896))
 - [ ] Local-file read policy across local-path tools — in a remote/SSE deployment these read the server's own filesystem (token, SA key), and Gmail attachments can now mail them out. One consistent policy (e.g. a config switch), not per-tool patches. Decision-needed; Joy scopes ([#796](https://github.com/khuisman/mcp-gee-sweet/issues/796))
 - [ ] Release-pass Gmail QA (`docs/qa/tests/gmail.md`, added by #786). Many cases are destructive (send/draft/trash), so they need a dedicated mailbox fixture plan — Aziz ([#803](https://github.com/khuisman/mcp-gee-sweet/issues/803))
 - [ ] Rewrite TC-GM01–22 prescriptively, add TC-GM26–44 and the Smoke rows, per `docs/qa/gmail-test-plan.md` §4. Part of #803, Aziz ([#822](https://github.com/khuisman/mcp-gee-sweet/issues/822))
-- [ ] Gmail unit-test hardening: MIME build branches, label validation, subject normalization, `max_results` clamping (plan §5 P4–P9; nothing observed failing) ([#823](https://github.com/khuisman/mcp-gee-sweet/issues/823))
 
 Tool surface (from the original v1.1+ plan):
 

{mcp_gee_sweet-0.9.2.dev215 → mcp_gee_sweet-0.9.2.dev221}/src/mcp_gee_sweet/tools/drive/files.py

@@ -1260,6 +1260,9 @@ def register(tool):
             file_id: The ID of the file or folder to remove.
             permanent: If False (default), moves to trash (recoverable).
                        If True, permanently deletes — this cannot be undone.
+                       Raises ValueError, without deleting anything, if the
+                       caller can't permanently delete the file (e.g. a
+                       Content manager on a Shared Drive, who can only trash).
 
         Returns:
             Confirmation with fileId and action taken ('trashed' or 'deleted').
@@ -1267,13 +1270,38 @@ def register(tool):
         lc = ctx.request_context.lifespan_context
         drive_service = lc.drive_service
 
-        # Fetch parents before deletion so we can invalidate the cache
+        # Fetch parents before deletion so we can invalidate the cache, plus
+        # capabilities: on a Shared Drive a Content manager can trash but not
+        # permanently delete, and Drive reports that missing permission as a
+        # misleading 404 "File not found" (#876).
         existing = await execute_in_thread(
             drive_service.files()
-            .get(fileId=file_id, fields="parents", supportsAllDrives=True)
+            .get(
+                fileId=file_id,
+                fields="parents,driveId,capabilities(canDelete,canTrash)",
+                supportsAllDrives=True,
+            )
             .execute,
             drive_service,
         )
+        capabilities = existing.get("capabilities", {})
+        if permanent and capabilities.get("canDelete") is False:
+            # canDelete is also false for a non-owner editor of a My Drive
+            # file, so only mention Shared Drive roles when the file is on one.
+            shared_drive_note = (
+                " On a Shared Drive this usually requires the Manager role."
+                if existing.get("driveId")
+                else ""
+            )
+            trash_hint = (
+                " Use permanent=False to move it to the trash instead."
+                if capabilities.get("canTrash")
+                else ""
+            )
+            raise ValueError(
+                f"Cannot permanently delete file {file_id}: the authenticated identity "
+                f"lacks permanent-delete permission on it.{shared_drive_note}{trash_hint}"
+            )
         for parent in existing.get("parents", []):
             lc.drive_folder_cache.mark_dirty(parent)
 

{mcp_gee_sweet-0.9.2.dev215 → mcp_gee_sweet-0.9.2.dev221}/src/mcp_gee_sweet/tools/drive/transfer.py

@@ -1,15 +1,19 @@
 import asyncio
 import base64
+import contextlib
+import errno
 import hashlib
 import io
 import logging
 import mimetypes
 import os
-from collections.abc import Iterable
+import re
+import secrets
+from collections.abc import Callable, Iterable
 from dataclasses import dataclass
 from datetime import datetime, timezone
 from pathlib import Path
-from typing import Any, Literal
+from typing import Any, BinaryIO, Literal
 
 import markdown as _md
 from googleapiclient.errors import HttpError
@@ -39,6 +43,15 @@ _EXPORT_MIME: dict[str, tuple[str, str]] = {
 
 _SYSTEM_FILES = {".DS_Store", "Thumbs.db", "desktop.ini", ".localized"}
 
+# Every download writes to a sibling temp file with this name and renames it
+# onto the destination only once complete (_write_atomically, #844). A temp
+# file only outlives its download when the process is killed mid-write;
+# sync_folder and upload_local_folder skip one so a leftover partial is never
+# uploaded. No part of the destination's name is embedded, so the temp name
+# can't exceed the filesystem's name-length limit.
+_PARTIAL_DOWNLOAD_PREFIX = ".gee-sweet-partial-"
+_PARTIAL_DOWNLOAD_RE = re.compile(r"\.gee-sweet-partial-[0-9a-f]{16}")
+
 _SYNC_MTIME_TOLERANCE = 5  # seconds — absorbs clock skew and upload-time drift
 
 # use_checksum hashes every both-sides pair with a Drive md5Checksum (#716), so
@@ -375,6 +388,55 @@ def _drive_time_str(dt: datetime) -> str:
     return dt.strftime("%Y-%m-%dT%H:%M:%S.000Z")
 
 
+def _is_partial_download(name: str) -> bool:
+    """Whether `name` is a temp file _write_atomically left behind."""
+    return _PARTIAL_DOWNLOAD_RE.fullmatch(name) is not None
+
+
+def _write_atomically(
+    dest: Path, write: Callable[[BinaryIO], object], mtime: float | None = None
+) -> None:
+    """Run `write` against a sibling temp file, then rename it onto `dest`.
+
+    `dest` only ever holds its previous content or the complete new content.
+    Writing straight into `dest` left a truncated file behind when a download
+    failed partway, with a current mtime that made sync_folder treat it as the
+    newer copy and upload it over the intact Drive file (#844). `mtime`, when
+    given, is stamped on the temp file before the rename, so a failed restamp
+    also leaves `dest` untouched. The temp file is removed on any failure.
+
+    A symlink at `dest` is written through, as the old `open("wb")` did: the
+    temp file goes next to the link's target and replaces the target. The new
+    file gets the mode a fresh `open("wb")` would (0o666 less the umask), or the
+    replaced file's permission bits when there was one (never its
+    setuid/setgid/sticky bits, which an in-place write would have cleared). A
+    hard link to the old file keeps the old content, since the rename swaps in
+    a new inode.
+
+    A rename needs write permission on the directory, not the file, so an
+    existing file this process couldn't open for writing is refused up front
+    with the same PermissionError `open("wb")` raised; otherwise a file the
+    user made read-only would be silently replaced (PR #884 QA round 1).
+    """
+    target = Path(os.path.realpath(dest)) if dest.is_symlink() else dest
+    if target.exists() and not os.access(target, os.W_OK):
+        raise PermissionError(errno.EACCES, os.strerror(errno.EACCES), str(target))
+    tmp = target.with_name(_PARTIAL_DOWNLOAD_PREFIX + secrets.token_hex(8))
+    fd = os.open(tmp, os.O_WRONLY | os.O_CREAT | os.O_EXCL | getattr(os, "O_BINARY", 0), 0o666)
+    try:
+        with os.fdopen(fd, "wb") as fh:
+            write(fh)
+        with contextlib.suppress(FileNotFoundError):
+            os.chmod(tmp, target.stat().st_mode & 0o777)
+        if mtime is not None:
+            os.utime(tmp, (mtime, mtime))
+        os.replace(tmp, target)
+    except BaseException:
+        with contextlib.suppress(OSError):
+            os.unlink(tmp)
+        raise
+
+
 def _local_mtime_str(path: Path) -> str:
     """_local_mtime_dt in the RFC 3339 form Drive's modifiedTime field takes."""
     return _drive_time_str(_local_mtime_dt(path))
@@ -1328,6 +1390,8 @@ async def _sync_level(
                 continue
             if skip_system_files and p.name in _SYSTEM_FILES:
                 continue
+            if _is_partial_download(p.name):
+                continue
             # Only a backslash (a separator on Windows, legal in a POSIX name) can
             # fail this for a name the OS listed. Such a file would upload under
             # a name this check then refuses on the Drive side, so it'd never
@@ -1899,6 +1963,15 @@ async def _sync_level(
                 # The plan already routed unsafe names to 'unsafe_name'; this is
                 # the shared backstop, and a refusal lands as download_fail.
                 dest_file = _safe_local_dest(dest_dir, name, resolved_dest_dir)
+                # Mirror what the upload branch above does in reverse: set the
+                # local file's mtime to Drive's modifiedTime so the round trip
+                # stays within _SYNC_MTIME_TOLERANCE on the next sync. Without
+                # this the local mtime is "now" (write time), which is always
+                # later than Drive's original timestamp — the next sync sees the
+                # file as locally newer and re-uploads it, indefinitely (#346).
+                # _write_atomically stamps it before the rename, so a failed
+                # download never leaves a "newer" partial in place (#844).
+                drive_ts = _drive_mtime(entry).timestamp()
                 if is_workspace:
                     target_mime = _EXPORT_MIME[export_format][0]
                     content = await execute_in_thread(
@@ -1907,7 +1980,9 @@ async def _sync_level(
                     )
                     if not isinstance(content, bytes):
                         content = content.encode("utf-8")
-                    await asyncio.to_thread(dest_file.write_bytes, content)
+                    await asyncio.to_thread(
+                        _write_atomically, dest_file, lambda fh, c=content: fh.write(c), drive_ts
+                    )
                 else:
 
                     def _download_to_completion(fid=fid, dest_file=dest_file) -> None:
@@ -1915,21 +1990,16 @@ async def _sync_level(
                             fileId=fid, supportsAllDrives=True
                         )
                         request.http = thread_http(drive_service)
-                        with dest_file.open("wb") as fh:
+
+                        def _stream(fh: BinaryIO) -> None:
                             downloader = MediaIoBaseDownload(fh, request)
                             done = False
                             while not done:
                                 _, done = downloader.next_chunk()
 
+                        _write_atomically(dest_file, _stream, drive_ts)
+
                     await asyncio.to_thread(_download_to_completion)
-                # Mirror what the upload branch above does in reverse: set the
-                # local file's mtime to Drive's modifiedTime so the round trip
-                # stays within _SYNC_MTIME_TOLERANCE on the next sync. Without
-                # this the local mtime is "now" (write time), which is always
-                # later than Drive's original timestamp — the next sync sees the
-                # file as locally newer and re-uploads it, indefinitely (#346).
-                dtime = _drive_mtime(entry)
-                os.utime(dest_file, (dtime.timestamp(), dtime.timestamp()))
                 size = dest_file.stat().st_size
                 logger.debug("Synced (download) Drive → %s%s (%d bytes)", rel_prefix, name, size)
                 return {"kind": "download_ok", "name": name, "bytes": size}
@@ -2628,7 +2698,9 @@ def register(tool):
         if not folder.is_dir():
             raise ValueError(f"No directory found at {local_path!r}")
 
-        candidates = [p for p in folder.iterdir() if p.is_file()]
+        candidates = [
+            p for p in folder.iterdir() if p.is_file() and not _is_partial_download(p.name)
+        ]
         if skip_system_files:
             candidates = [p for p in candidates if p.name not in _SYSTEM_FILES]
 
@@ -2867,18 +2939,21 @@ def register(tool):
             )
             if not isinstance(content, bytes):
                 content = content.encode("utf-8")
-            await asyncio.to_thread(dest.write_bytes, content)
+            await asyncio.to_thread(_write_atomically, dest, lambda fh: fh.write(content))
         else:
 
             def _download_to_completion() -> None:
                 request = drive_service.files().get_media(fileId=file_id, supportsAllDrives=True)
                 request.http = thread_http(drive_service)
-                with dest.open("wb") as fh:
+
+                def _stream(fh: BinaryIO) -> None:
                     downloader = MediaIoBaseDownload(fh, request)
                     done = False
                     while not done:
                         _, done = downloader.next_chunk()
 
+                _write_atomically(dest, _stream)
+
             await asyncio.to_thread(_download_to_completion)
 
         size = dest.stat().st_size
@@ -3086,7 +3161,9 @@ def register(tool):
                     )
                     if not isinstance(content, bytes):
                         content = content.encode("utf-8")
-                    await asyncio.to_thread(candidate.dest_file.write_bytes, content)
+                    await asyncio.to_thread(
+                        _write_atomically, candidate.dest_file, lambda fh: fh.write(content)
+                    )
                 else:
 
                     def _download_to_completion(
@@ -3096,12 +3173,15 @@ def register(tool):
                             fileId=fid, supportsAllDrives=True
                         )
                         request.http = thread_http(drive_service)
-                        with dest_file.open("wb") as fh:
+
+                        def _stream(fh: BinaryIO) -> None:
                             downloader = MediaIoBaseDownload(fh, request)
                             done = False
                             while not done:
                                 _, done = downloader.next_chunk()
 
+                        _write_atomically(dest_file, _stream)
+
                     await asyncio.to_thread(_download_to_completion)
 
                 size = candidate.dest_file.stat().st_size

{mcp_gee_sweet-0.9.2.dev215 → mcp_gee_sweet-0.9.2.dev221}/tests/drive/test_files.py

@@ -255,6 +255,88 @@ class TestFileMutations:
         await _drive_tools["delete_file"](file_id="fid1", permanent=True, ctx=ctx)
         folder_cache.mark_dirty.assert_called_once_with("par1")
 
+    async def test_delete_file_requests_capabilities_in_parents_lookup(self):
+        """#876: the capability check rides on the existing get, no extra request."""
+        mock = MagicMock()
+        mock.files.return_value.get.return_value.execute.return_value = {"parents": ["par1"]}
+        ctx = _make_ctx(drive_service=mock, drive_folder_cache=MagicMock())
+        await _drive_tools["delete_file"](file_id="fid1", permanent=True, ctx=ctx)
+        mock.files.return_value.get.assert_called_once()
+        fields = mock.files.return_value.get.call_args.kwargs["fields"]
+        assert "canDelete" in fields
+        assert "canTrash" in fields
+        assert "driveId" in fields
+
+    async def test_delete_file_permanent_without_can_delete_raises_before_delete(self):
+        """#876: Content manager on a Shared Drive gets a clear error, not Drive's 404."""
+        mock = MagicMock()
+        mock.files.return_value.get.return_value.execute.return_value = {
+            "parents": ["par1"],
+            "driveId": "drive1",
+            "capabilities": {"canDelete": False, "canTrash": True},
+        }
+        folder_cache = MagicMock()
+        ctx = _make_ctx(drive_service=mock, drive_folder_cache=folder_cache)
+        with pytest.raises(ValueError, match="permanent=False") as exc_info:
+            await _drive_tools["delete_file"](file_id="fid1", permanent=True, ctx=ctx)
+        assert "Shared Drive" in str(exc_info.value)
+        mock.files.return_value.delete.assert_not_called()
+        folder_cache.mark_dirty.assert_not_called()
+
+    async def test_delete_file_permanent_without_can_delete_on_my_drive_omits_shared_drive_note(
+        self,
+    ):
+        """A non-owner editor of a My Drive file also lacks canDelete; no Shared Drive aside."""
+        mock = MagicMock()
+        mock.files.return_value.get.return_value.execute.return_value = {
+            "parents": ["par1"],
+            "capabilities": {"canDelete": False, "canTrash": True},
+        }
+        ctx = _make_ctx(drive_service=mock, drive_folder_cache=MagicMock())
+        with pytest.raises(ValueError) as exc_info:
+            await _drive_tools["delete_file"](file_id="fid1", permanent=True, ctx=ctx)
+        assert "Shared Drive" not in str(exc_info.value)
+        assert "permanent=False" in str(exc_info.value)
+        mock.files.return_value.delete.assert_not_called()
+
+    async def test_delete_file_permanent_without_delete_or_trash_omits_trash_hint(self):
+        mock = MagicMock()
+        mock.files.return_value.get.return_value.execute.return_value = {
+            "parents": ["par1"],
+            "capabilities": {"canDelete": False, "canTrash": False},
+        }
+        ctx = _make_ctx(drive_service=mock, drive_folder_cache=MagicMock())
+        with pytest.raises(ValueError) as exc_info:
+            await _drive_tools["delete_file"](file_id="fid1", permanent=True, ctx=ctx)
+        assert "permanent=False" not in str(exc_info.value)
+        mock.files.return_value.delete.assert_not_called()
+
+    async def test_delete_file_permanent_with_can_delete_calls_delete(self):
+        mock = MagicMock()
+        mock.files.return_value.get.return_value.execute.return_value = {
+            "parents": ["par1"],
+            "capabilities": {"canDelete": True, "canTrash": True},
+        }
+        mock.files.return_value.delete.return_value.execute.return_value = None
+        ctx = _make_ctx(drive_service=mock, drive_folder_cache=MagicMock())
+        result = await _drive_tools["delete_file"](file_id="fid1", permanent=True, ctx=ctx)
+        mock.files.return_value.delete.assert_called_once_with(
+            fileId="fid1", supportsAllDrives=True
+        )
+        assert result == {"fileId": "fid1", "action": "deleted"}
+
+    async def test_delete_file_trash_ignores_can_delete_false(self):
+        """Trashing only needs canTrash; a missing canDelete must not block it."""
+        mock = MagicMock()
+        mock.files.return_value.get.return_value.execute.return_value = {
+            "parents": ["par1"],
+            "capabilities": {"canDelete": False, "canTrash": True},
+        }
+        mock.files.return_value.update.return_value.execute.return_value = {"id": "fid1"}
+        ctx = _make_ctx(drive_service=mock, drive_folder_cache=MagicMock())
+        result = await _drive_tools["delete_file"](file_id="fid1", permanent=False, ctx=ctx)
+        assert result == {"fileId": "fid1", "action": "trashed"}
+
     async def test_restore_file_marks_parent_dirty(self):
         mock = MagicMock()
         mock.files.return_value.update.return_value.execute.return_value = {