@aaronsb/google-workspace-mcp 2.0.0-alpha.4

package/build/accounts/credentials.js

@@ -0,0 +1,52 @@
+import * as fs from 'node:fs/promises';
+import * as path from 'node:path';
+import { credentialPath, credentialsDir } from '../executor/paths.js';
+import { execute } from '../executor/gws.js';
+export async function hasCredential(email) {
+    try {
+        await fs.access(credentialPath(email));
+        return true;
+    }
+    catch {
+        return false;
+    }
+}
+export async function exportAndSaveCredential(email) {
+    // --unmasked is required; without it gws masks the client_secret
+    const result = await execute(['auth', 'export', '--unmasked']);
+    const credential = result.data;
+    if (credential?.type !== 'authorized_user') {
+        throw new Error('gws auth export did not return an authorized_user credential');
+    }
+    const filePath = credentialPath(email);
+    await fs.mkdir(path.dirname(filePath), { recursive: true, mode: 0o700 });
+    await fs.writeFile(filePath, JSON.stringify(credential, null, 2), { mode: 0o600 });
+    return filePath;
+}
+export async function readCredential(email) {
+    const filePath = credentialPath(email);
+    const content = await fs.readFile(filePath, 'utf-8');
+    return JSON.parse(content);
+}
+export async function removeCredential(email) {
+    try {
+        await fs.unlink(credentialPath(email));
+    }
+    catch (err) {
+        if (err.code !== 'ENOENT')
+            throw err;
+    }
+}
+export async function listCredentials() {
+    try {
+        const dir = credentialsDir();
+        const files = await fs.readdir(dir);
+        return files
+            .filter(f => f.endsWith('.json'))
+            .map(f => f.replace(/\.json$/, ''));
+    }
+    catch {
+        return [];
+    }
+}
+//# sourceMappingURL=credentials.js.map

package/build/accounts/credentials.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"credentials.js","sourceRoot":"","sources":["../../src/accounts/credentials.ts"],"names":[],"mappings":"AAAA,OAAO,KAAK,EAAE,MAAM,kBAAkB,CAAC;AACvC,OAAO,KAAK,IAAI,MAAM,WAAW,CAAC;AAClC,OAAO,EAAE,cAAc,EAAE,cAAc,EAAE,MAAM,sBAAsB,CAAC;AACtE,OAAO,EAAE,OAAO,EAAE,MAAM,oBAAoB,CAAC;AAS7C,MAAM,CAAC,KAAK,UAAU,aAAa,CAAC,KAAa;IAC/C,IAAI,CAAC;QACH,MAAM,EAAE,CAAC,MAAM,CAAC,cAAc,CAAC,KAAK,CAAC,CAAC,CAAC;QACvC,OAAO,IAAI,CAAC;IACd,CAAC;IAAC,MAAM,CAAC;QACP,OAAO,KAAK,CAAC;IACf,CAAC;AACH,CAAC;AAED,MAAM,CAAC,KAAK,UAAU,uBAAuB,CAAC,KAAa;IACzD,iEAAiE;IACjE,MAAM,MAAM,GAAG,MAAM,OAAO,CAAC,CAAC,MAAM,EAAE,QAAQ,EAAE,YAAY,CAAC,CAAC,CAAC;IAC/D,MAAM,UAAU,GAAG,MAAM,CAAC,IAAgC,CAAC;IAE3D,IAAI,UAAU,EAAE,IAAI,KAAK,iBAAiB,EAAE,CAAC;QAC3C,MAAM,IAAI,KAAK,CAAC,8DAA8D,CAAC,CAAC;IAClF,CAAC;IAED,MAAM,QAAQ,GAAG,cAAc,CAAC,KAAK,CAAC,CAAC;IACvC,MAAM,EAAE,CAAC,KAAK,CAAC,IAAI,CAAC,OAAO,CAAC,QAAQ,CAAC,EAAE,EAAE,SAAS,EAAE,IAAI,EAAE,IAAI,EAAE,KAAK,EAAE,CAAC,CAAC;IACzE,MAAM,EAAE,CAAC,SAAS,CAAC,QAAQ,EAAE,IAAI,CAAC,SAAS,CAAC,UAAU,EAAE,IAAI,EAAE,CAAC,CAAC,EAAE,EAAE,IAAI,EAAE,KAAK,EAAE,CAAC,CAAC;IAEnF,OAAO,QAAQ,CAAC;AAClB,CAAC;AAED,MAAM,CAAC,KAAK,UAAU,cAAc,CAAC,KAAa;IAChD,MAAM,QAAQ,GAAG,cAAc,CAAC,KAAK,CAAC,CAAC;IACvC,MAAM,OAAO,GAAG,MAAM,EAAE,CAAC,QAAQ,CAAC,QAAQ,EAAE,OAAO,CAAC,CAAC;IACrD,OAAO,IAAI,CAAC,KAAK,CAAC,OAAO,CAA6B,CAAC;AACzD,CAAC;AAED,MAAM,CAAC,KAAK,UAAU,gBAAgB,CAAC,KAAa;IAClD,IAAI,CAAC;QACH,MAAM,EAAE,CAAC,MAAM,CAAC,cAAc,CAAC,KAAK,CAAC,CAAC,CAAC;IACzC,CAAC;IAAC,OAAO,GAAY,EAAE,CAAC;QACtB,IAAK,GAA6B,CAAC,IAAI,KAAK,QAAQ;YAAE,MAAM,GAAG,CAAC;IAClE,CAAC;AACH,CAAC;AAED,MAAM,CAAC,KAAK,UAAU,eAAe;IACnC,IAAI,CAAC;QACH,MAAM,GAAG,GAAG,cAAc,EAAE,CAAC;QAC7B,MAAM,KAAK,GAAG,MAAM,EAAE,CAAC,OAAO,CAAC,GAAG,CAAC,CAAC;QACpC,OAAO,KAAK;aACT,MAAM,CAAC,CAAC,CAAC,EAAE,CAAC,CAAC,CAAC,QAAQ,CAAC,OAAO,CAAC,CAAC;aAChC,GAAG,CAAC,CAAC,CAAC,EAAE,CAAC,CAAC,CAAC,OAAO,CAAC,SAAS,EAAE,EAAE,CAAC,CAAC,CAAC;IACxC,CAAC;IAAC,MAAM,CAAC;QACP,OAAO,EAAE,CAAC;IACZ,CAAC;AACH,CAAC"}

package/build/accounts/index.d.ts

@@ -0,0 +1,6 @@
+export { authenticateAccount } from './auth.js';
+export type { AuthResult } from './auth.js';
+export { hasCredential, readCredential, removeCredential, listCredentials, exportAndSaveCredential } from './credentials.js';
+export type { AuthorizedUserCredential } from './credentials.js';
+export { listAccounts, getAccount, addAccount, removeAccount, authenticateAndAddAccount } from './registry.js';
+export type { Account } from './registry.js';

package/build/accounts/index.js

@@ -0,0 +1,4 @@
+export { authenticateAccount } from './auth.js';
+export { hasCredential, readCredential, removeCredential, listCredentials, exportAndSaveCredential } from './credentials.js';
+export { listAccounts, getAccount, addAccount, removeAccount, authenticateAndAddAccount } from './registry.js';
+//# sourceMappingURL=index.js.map

package/build/accounts/index.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"index.js","sourceRoot":"","sources":["../../src/accounts/index.ts"],"names":[],"mappings":"AAAA,OAAO,EAAE,mBAAmB,EAAE,MAAM,WAAW,CAAC;AAEhD,OAAO,EAAE,aAAa,EAAE,cAAc,EAAE,gBAAgB,EAAE,eAAe,EAAE,uBAAuB,EAAE,MAAM,kBAAkB,CAAC;AAE7H,OAAO,EAAE,YAAY,EAAE,UAAU,EAAE,UAAU,EAAE,aAAa,EAAE,yBAAyB,EAAE,MAAM,eAAe,CAAC"}

package/build/accounts/registry.d.ts

@@ -0,0 +1,11 @@
+import { type AuthResult } from './auth.js';
+export interface Account {
+    email: string;
+    category: 'personal' | 'work' | 'other';
+    description?: string;
+}
+export declare function listAccounts(): Promise<Account[]>;
+export declare function getAccount(email: string): Promise<Account | undefined>;
+export declare function addAccount(email: string, category?: Account['category'], description?: string): Promise<Account>;
+export declare function removeAccount(email: string): Promise<void>;
+export declare function authenticateAndAddAccount(clientId: string, clientSecret: string, category?: Account['category'], description?: string): Promise<AuthResult>;

package/build/accounts/registry.js

@@ -0,0 +1,62 @@
+import * as fs from 'node:fs/promises';
+import { accountsFilePath, configDir } from '../executor/paths.js';
+import { hasCredential, removeCredential } from './credentials.js';
+import { authenticateAccount } from './auth.js';
+async function readAccounts() {
+    try {
+        const content = await fs.readFile(accountsFilePath(), 'utf-8');
+        return JSON.parse(content);
+    }
+    catch {
+        return { accounts: [] };
+    }
+}
+async function writeAccounts(data) {
+    const dir = configDir();
+    await fs.mkdir(dir, { recursive: true, mode: 0o700 });
+    await fs.writeFile(accountsFilePath(), JSON.stringify(data, null, 2), { mode: 0o600 });
+}
+export async function listAccounts() {
+    const { accounts } = await readAccounts();
+    // Enrich with credential status
+    const enriched = await Promise.all(accounts.map(async (account) => ({
+        ...account,
+        hasCredential: await hasCredential(account.email),
+    })));
+    return enriched;
+}
+export async function getAccount(email) {
+    const { accounts } = await readAccounts();
+    return accounts.find(a => a.email === email);
+}
+export async function addAccount(email, category = 'personal', description) {
+    const data = await readAccounts();
+    if (data.accounts.some(a => a.email === email)) {
+        throw new Error(`Account ${email} already exists`);
+    }
+    const account = { email, category, description };
+    data.accounts.push(account);
+    await writeAccounts(data);
+    return account;
+}
+export async function removeAccount(email) {
+    const data = await readAccounts();
+    const index = data.accounts.findIndex(a => a.email === email);
+    if (index === -1) {
+        throw new Error(`Account ${email} not found`);
+    }
+    data.accounts.splice(index, 1);
+    await writeAccounts(data);
+    await removeCredential(email);
+}
+export async function authenticateAndAddAccount(clientId, clientSecret, category = 'personal', description) {
+    const result = await authenticateAccount(clientId, clientSecret);
+    if (result.status === 'success' && result.account) {
+        const existing = await getAccount(result.account);
+        if (!existing) {
+            await addAccount(result.account, category, description);
+        }
+    }
+    return result;
+}
+//# sourceMappingURL=registry.js.map

package/build/accounts/registry.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"registry.js","sourceRoot":"","sources":["../../src/accounts/registry.ts"],"names":[],"mappings":"AAAA,OAAO,KAAK,EAAE,MAAM,kBAAkB,CAAC;AAEvC,OAAO,EAAE,gBAAgB,EAAE,SAAS,EAAE,MAAM,sBAAsB,CAAC;AACnE,OAAO,EAAE,aAAa,EAAE,gBAAgB,EAAE,MAAM,kBAAkB,CAAC;AACnE,OAAO,EAAE,mBAAmB,EAAmB,MAAM,WAAW,CAAC;AAYjE,KAAK,UAAU,YAAY;IACzB,IAAI,CAAC;QACH,MAAM,OAAO,GAAG,MAAM,EAAE,CAAC,QAAQ,CAAC,gBAAgB,EAAE,EAAE,OAAO,CAAC,CAAC;QAC/D,OAAO,IAAI,CAAC,KAAK,CAAC,OAAO,CAAiB,CAAC;IAC7C,CAAC;IAAC,MAAM,CAAC;QACP,OAAO,EAAE,QAAQ,EAAE,EAAE,EAAE,CAAC;IAC1B,CAAC;AACH,CAAC;AAED,KAAK,UAAU,aAAa,CAAC,IAAkB;IAC7C,MAAM,GAAG,GAAG,SAAS,EAAE,CAAC;IACxB,MAAM,EAAE,CAAC,KAAK,CAAC,GAAG,EAAE,EAAE,SAAS,EAAE,IAAI,EAAE,IAAI,EAAE,KAAK,EAAE,CAAC,CAAC;IACtD,MAAM,EAAE,CAAC,SAAS,CAAC,gBAAgB,EAAE,EAAE,IAAI,CAAC,SAAS,CAAC,IAAI,EAAE,IAAI,EAAE,CAAC,CAAC,EAAE,EAAE,IAAI,EAAE,KAAK,EAAE,CAAC,CAAC;AACzF,CAAC;AAED,MAAM,CAAC,KAAK,UAAU,YAAY;IAChC,MAAM,EAAE,QAAQ,EAAE,GAAG,MAAM,YAAY,EAAE,CAAC;IAC1C,gCAAgC;IAChC,MAAM,QAAQ,GAAG,MAAM,OAAO,CAAC,GAAG,CAChC,QAAQ,CAAC,GAAG,CAAC,KAAK,EAAE,OAAO,EAAE,EAAE,CAAC,CAAC;QAC/B,GAAG,OAAO;QACV,aAAa,EAAE,MAAM,aAAa,CAAC,OAAO,CAAC,KAAK,CAAC;KAClD,CAAC,CAAC,CACJ,CAAC;IACF,OAAO,QAAQ,CAAC;AAClB,CAAC;AAED,MAAM,CAAC,KAAK,UAAU,UAAU,CAAC,KAAa;IAC5C,MAAM,EAAE,QAAQ,EAAE,GAAG,MAAM,YAAY,EAAE,CAAC;IAC1C,OAAO,QAAQ,CAAC,IAAI,CAAC,CAAC,CAAC,EAAE,CAAC,CAAC,CAAC,KAAK,KAAK,KAAK,CAAC,CAAC;AAC/C,CAAC;AAED,MAAM,CAAC,KAAK,UAAU,UAAU,CAC9B,KAAa,EACb,WAAgC,UAAU,EAC1C,WAAoB;IAEpB,MAAM,IAAI,GAAG,MAAM,YAAY,EAAE,CAAC;IAElC,IAAI,IAAI,CAAC,QAAQ,CAAC,IAAI,CAAC,CAAC,CAAC,EAAE,CAAC,CAAC,CAAC,KAAK,KAAK,KAAK,CAAC,EAAE,CAAC;QAC/C,MAAM,IAAI,KAAK,CAAC,WAAW,KAAK,iBAAiB,CAAC,CAAC;IACrD,CAAC;IAED,MAAM,OAAO,GAAY,EAAE,KAAK,EAAE,QAAQ,EAAE,WAAW,EAAE,CAAC;IAC1D,IAAI,CAAC,QAAQ,CAAC,IAAI,CAAC,OAAO,CAAC,CAAC;IAC5B,MAAM,aAAa,CAAC,IAAI,CAAC,CAAC;IAC1B,OAAO,OAAO,CAAC;AACjB,CAAC;AAED,MAAM,CAAC,KAAK,UAAU,aAAa,CAAC,KAAa;IAC/C,MAAM,IAAI,GAAG,MAAM,YAAY,EAAE,CAAC;IAClC,MAAM,KAAK,GAAG,IAAI,CAAC,QAAQ,CAAC,SAAS,CAAC,CAAC,CAAC,EAAE,CAAC,CAAC,CAAC,KAAK,KAAK,KAAK,CAAC,CAAC;IAE9D,IAAI,KAAK,KAAK,CAAC,CAAC,EAAE,CAAC;QACjB,MAAM,IAAI,KAAK,CAAC,WAAW,KAAK,YAAY,CAAC,CAAC;IAChD,CAAC;IAED,IAAI,CAAC,QAAQ,CAAC,MAAM,CAAC,KAAK,EAAE,CAAC,CAAC,CAAC;IAC/B,MAAM,aAAa,CAAC,IAAI,CAAC,CAAC;IAC1B,MAAM,gBAAgB,CAAC,KAAK,CAAC,CAAC;AAChC,CAAC;AAED,MAAM,CAAC,KAAK,UAAU,yBAAyB,CAC7C,QAAgB,EAChB,YAAoB,EACpB,WAAgC,UAAU,EAC1C,WAAoB;IAEpB,MAAM,MAAM,GAAG,MAAM,mBAAmB,CAAC,QAAQ,EAAE,YAAY,CAAC,CAAC;IAEjE,IAAI,MAAM,CAAC,MAAM,KAAK,SAAS,IAAI,MAAM,CAAC,OAAO,EAAE,CAAC;QAClD,MAAM,QAAQ,GAAG,MAAM,UAAU,CAAC,MAAM,CAAC,OAAO,CAAC,CAAC;QAClD,IAAI,CAAC,QAAQ,EAAE,CAAC;YACd,MAAM,UAAU,CAAC,MAAM,CAAC,OAAO,EAAE,QAAQ,EAAE,WAAW,CAAC,CAAC;QAC1D,CAAC;IACH,CAAC;IAED,OAAO,MAAM,CAAC;AAChB,CAAC"}

package/build/executor/errors.d.ts

@@ -0,0 +1,15 @@
+export declare enum GwsExitCode {
+    Success = 0,
+    ApiError = 1,
+    AuthError = 2,
+    ValidationError = 3,
+    DiscoveryError = 4,
+    InternalError = 5
+}
+export declare class GwsError extends Error {
+    readonly exitCode: GwsExitCode;
+    readonly reason?: string | undefined;
+    readonly stderr?: string | undefined;
+    constructor(message: string, exitCode: GwsExitCode, reason?: string | undefined, stderr?: string | undefined);
+}
+export declare function parseGwsError(exitCode: number, stdout: string, stderr: string): GwsError;

package/build/executor/errors.js

@@ -0,0 +1,37 @@
+export var GwsExitCode;
+(function (GwsExitCode) {
+    GwsExitCode[GwsExitCode["Success"] = 0] = "Success";
+    GwsExitCode[GwsExitCode["ApiError"] = 1] = "ApiError";
+    GwsExitCode[GwsExitCode["AuthError"] = 2] = "AuthError";
+    GwsExitCode[GwsExitCode["ValidationError"] = 3] = "ValidationError";
+    GwsExitCode[GwsExitCode["DiscoveryError"] = 4] = "DiscoveryError";
+    GwsExitCode[GwsExitCode["InternalError"] = 5] = "InternalError";
+})(GwsExitCode || (GwsExitCode = {}));
+export class GwsError extends Error {
+    exitCode;
+    reason;
+    stderr;
+    constructor(message, exitCode, reason, stderr) {
+        super(message);
+        this.exitCode = exitCode;
+        this.reason = reason;
+        this.stderr = stderr;
+        this.name = 'GwsError';
+    }
+}
+export function parseGwsError(exitCode, stdout, stderr) {
+    // Try to extract structured error from stdout
+    try {
+        const parsed = JSON.parse(stdout);
+        if (parsed?.error) {
+            return new GwsError(parsed.error.message || 'Unknown gws error', exitCode, parsed.error.reason, stderr);
+        }
+    }
+    catch {
+        // stdout wasn't JSON — fall through
+    }
+    const label = GwsExitCode[exitCode] ?? 'Unknown';
+    const message = stderr.trim() || `gws exited with code ${exitCode} (${label})`;
+    return new GwsError(message, exitCode, undefined, stderr);
+}
+//# sourceMappingURL=errors.js.map

package/build/executor/errors.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"errors.js","sourceRoot":"","sources":["../../src/executor/errors.ts"],"names":[],"mappings":"AAAA,MAAM,CAAN,IAAY,WAOX;AAPD,WAAY,WAAW;IACrB,mDAAW,CAAA;IACX,qDAAY,CAAA;IACZ,uDAAa,CAAA;IACb,mEAAmB,CAAA;IACnB,iEAAkB,CAAA;IAClB,+DAAiB,CAAA;AACnB,CAAC,EAPW,WAAW,KAAX,WAAW,QAOtB;AAED,MAAM,OAAO,QAAS,SAAQ,KAAK;IAGf;IACA;IACA;IAJlB,YACE,OAAe,EACC,QAAqB,EACrB,MAAe,EACf,MAAe;QAE/B,KAAK,CAAC,OAAO,CAAC,CAAC;QAJC,aAAQ,GAAR,QAAQ,CAAa;QACrB,WAAM,GAAN,MAAM,CAAS;QACf,WAAM,GAAN,MAAM,CAAS;QAG/B,IAAI,CAAC,IAAI,GAAG,UAAU,CAAC;IACzB,CAAC;CACF;AAED,MAAM,UAAU,aAAa,CAAC,QAAgB,EAAE,MAAc,EAAE,MAAc;IAC5E,8CAA8C;IAC9C,IAAI,CAAC;QACH,MAAM,MAAM,GAAG,IAAI,CAAC,KAAK,CAAC,MAAM,CAAC,CAAC;QAClC,IAAI,MAAM,EAAE,KAAK,EAAE,CAAC;YAClB,OAAO,IAAI,QAAQ,CACjB,MAAM,CAAC,KAAK,CAAC,OAAO,IAAI,mBAAmB,EAC3C,QAAuB,EACvB,MAAM,CAAC,KAAK,CAAC,MAAM,EACnB,MAAM,CACP,CAAC;QACJ,CAAC;IACH,CAAC;IAAC,MAAM,CAAC;QACP,oCAAoC;IACtC,CAAC;IAED,MAAM,KAAK,GAAG,WAAW,CAAC,QAAuB,CAAC,IAAI,SAAS,CAAC;IAChE,MAAM,OAAO,GAAG,MAAM,CAAC,IAAI,EAAE,IAAI,wBAAwB,QAAQ,KAAK,KAAK,GAAG,CAAC;IAC/E,OAAO,IAAI,QAAQ,CAAC,OAAO,EAAE,QAAuB,EAAE,SAAS,EAAE,MAAM,CAAC,CAAC;AAC3E,CAAC"}

package/build/executor/file-output.d.ts

@@ -0,0 +1,23 @@
+/**
+ * File output utility — saves files to workspace and returns content inline
+ * when possible. Solves the containerization problem: agents running in
+ * sandboxed environments (Claude Desktop) can't read the MCP server's
+ * local filesystem, so text content must be included in the response.
+ *
+ * Used by: getAttachment (gmail), download (drive), export (drive)
+ */
+/** Check if a file should have its content returned inline. */
+export declare function isTextFile(filename: string, mimeType?: string): boolean;
+export interface FileOutputResult {
+    filename: string;
+    path: string;
+    size: number;
+    /** Text content included inline for containerized agents. Undefined for binary files. */
+    content?: string;
+}
+/**
+ * Save a buffer to the workspace directory and optionally return text content inline.
+ */
+export declare function saveToWorkspace(filename: string, buffer: Buffer, mimeType?: string): Promise<FileOutputResult>;
+/** Format a file output result as markdown for the MCP response. */
+export declare function formatFileOutput(result: FileOutputResult): string;

package/build/executor/file-output.js

@@ -0,0 +1,67 @@
+/**
+ * File output utility — saves files to workspace and returns content inline
+ * when possible. Solves the containerization problem: agents running in
+ * sandboxed environments (Claude Desktop) can't read the MCP server's
+ * local filesystem, so text content must be included in the response.
+ *
+ * Used by: getAttachment (gmail), download (drive), export (drive)
+ */
+import * as fs from 'node:fs/promises';
+import * as path from 'node:path';
+import { ensureWorkspaceDir, resolveWorkspacePath, verifyPathSafety } from './workspace.js';
+/** MIME types and extensions considered text-safe for inline return. */
+const TEXT_MIME_PREFIXES = [
+    'text/', 'application/json', 'application/xml', 'application/javascript',
+    'application/x-yaml', 'application/toml', 'application/csv',
+];
+const TEXT_EXTENSIONS = [
+    '.md', '.txt', '.csv', '.json', '.yaml', '.yml', '.xml', '.html',
+    '.htm', '.eml', '.log', '.ini', '.toml', '.js', '.ts', '.py',
+    '.sh', '.bash', '.zsh', '.css', '.svg',
+];
+const MAX_INLINE_SIZE = 100_000; // 100KB — larger text files are saved only
+/** Check if a file should have its content returned inline. */
+export function isTextFile(filename, mimeType) {
+    if (mimeType && TEXT_MIME_PREFIXES.some(p => mimeType.startsWith(p)))
+        return true;
+    const ext = path.extname(filename).toLowerCase();
+    return TEXT_EXTENSIONS.includes(ext);
+}
+/**
+ * Save a buffer to the workspace directory and optionally return text content inline.
+ */
+export async function saveToWorkspace(filename, buffer, mimeType) {
+    const wsStatus = await ensureWorkspaceDir();
+    if (!wsStatus.valid) {
+        throw new Error(`Workspace directory invalid: ${wsStatus.warning}`);
+    }
+    const outputPath = resolveWorkspacePath(filename);
+    await verifyPathSafety(outputPath);
+    await fs.mkdir(path.dirname(outputPath), { recursive: true });
+    await fs.writeFile(outputPath, buffer);
+    const result = {
+        filename,
+        path: outputPath,
+        size: buffer.length,
+    };
+    if (isTextFile(filename, mimeType) && buffer.length < MAX_INLINE_SIZE) {
+        result.content = buffer.toString('utf-8');
+    }
+    return result;
+}
+/** Format a file output result as markdown for the MCP response. */
+export function formatFileOutput(result) {
+    const parts = [
+        `**${result.filename}** saved to workspace`,
+        '',
+        `**Path:** ${result.path}`,
+        `**Size:** ${result.size} bytes`,
+    ];
+    if (result.content) {
+        // Escape any triple backticks in the content to prevent markdown fence injection
+        const safeContent = result.content.replace(/```/g, '` ` `');
+        parts.push('', '---', '', '```', safeContent, '```');
+    }
+    return parts.join('\n');
+}
+//# sourceMappingURL=file-output.js.map

package/build/executor/file-output.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"file-output.js","sourceRoot":"","sources":["../../src/executor/file-output.ts"],"names":[],"mappings":"AAAA;;;;;;;GAOG;AAEH,OAAO,KAAK,EAAE,MAAM,kBAAkB,CAAC;AACvC,OAAO,KAAK,IAAI,MAAM,WAAW,CAAC;AAClC,OAAO,EAAE,kBAAkB,EAAE,oBAAoB,EAAE,gBAAgB,EAAE,MAAM,gBAAgB,CAAC;AAE5F,wEAAwE;AACxE,MAAM,kBAAkB,GAAG;IACzB,OAAO,EAAE,kBAAkB,EAAE,iBAAiB,EAAE,wBAAwB;IACxE,oBAAoB,EAAE,kBAAkB,EAAE,iBAAiB;CAC5D,CAAC;AAEF,MAAM,eAAe,GAAG;IACtB,KAAK,EAAE,MAAM,EAAE,MAAM,EAAE,OAAO,EAAE,OAAO,EAAE,MAAM,EAAE,MAAM,EAAE,OAAO;IAChE,MAAM,EAAE,MAAM,EAAE,MAAM,EAAE,MAAM,EAAE,OAAO,EAAE,KAAK,EAAE,KAAK,EAAE,KAAK;IAC5D,KAAK,EAAE,OAAO,EAAE,MAAM,EAAE,MAAM,EAAE,MAAM;CACvC,CAAC;AAEF,MAAM,eAAe,GAAG,OAAO,CAAC,CAAC,2CAA2C;AAE5E,+DAA+D;AAC/D,MAAM,UAAU,UAAU,CAAC,QAAgB,EAAE,QAAiB;IAC5D,IAAI,QAAQ,IAAI,kBAAkB,CAAC,IAAI,CAAC,CAAC,CAAC,EAAE,CAAC,QAAQ,CAAC,UAAU,CAAC,CAAC,CAAC,CAAC;QAAE,OAAO,IAAI,CAAC;IAClF,MAAM,GAAG,GAAG,IAAI,CAAC,OAAO,CAAC,QAAQ,CAAC,CAAC,WAAW,EAAE,CAAC;IACjD,OAAO,eAAe,CAAC,QAAQ,CAAC,GAAG,CAAC,CAAC;AACvC,CAAC;AAUD;;GAEG;AACH,MAAM,CAAC,KAAK,UAAU,eAAe,CACnC,QAAgB,EAChB,MAAc,EACd,QAAiB;IAEjB,MAAM,QAAQ,GAAG,MAAM,kBAAkB,EAAE,CAAC;IAC5C,IAAI,CAAC,QAAQ,CAAC,KAAK,EAAE,CAAC;QACpB,MAAM,IAAI,KAAK,CAAC,gCAAgC,QAAQ,CAAC,OAAO,EAAE,CAAC,CAAC;IACtE,CAAC;IAED,MAAM,UAAU,GAAG,oBAAoB,CAAC,QAAQ,CAAC,CAAC;IAClD,MAAM,gBAAgB,CAAC,UAAU,CAAC,CAAC;IACnC,MAAM,EAAE,CAAC,KAAK,CAAC,IAAI,CAAC,OAAO,CAAC,UAAU,CAAC,EAAE,EAAE,SAAS,EAAE,IAAI,EAAE,CAAC,CAAC;IAC9D,MAAM,EAAE,CAAC,SAAS,CAAC,UAAU,EAAE,MAAM,CAAC,CAAC;IAEvC,MAAM,MAAM,GAAqB;QAC/B,QAAQ;QACR,IAAI,EAAE,UAAU;QAChB,IAAI,EAAE,MAAM,CAAC,MAAM;KACpB,CAAC;IAEF,IAAI,UAAU,CAAC,QAAQ,EAAE,QAAQ,CAAC,IAAI,MAAM,CAAC,MAAM,GAAG,eAAe,EAAE,CAAC;QACtE,MAAM,CAAC,OAAO,GAAG,MAAM,CAAC,QAAQ,CAAC,OAAO,CAAC,CAAC;IAC5C,CAAC;IAED,OAAO,MAAM,CAAC;AAChB,CAAC;AAED,oEAAoE;AACpE,MAAM,UAAU,gBAAgB,CAAC,MAAwB;IACvD,MAAM,KAAK,GAAG;QACZ,KAAK,MAAM,CAAC,QAAQ,uBAAuB;QAC3C,EAAE;QACF,aAAa,MAAM,CAAC,IAAI,EAAE;QAC1B,aAAa,MAAM,CAAC,IAAI,QAAQ;KACjC,CAAC;IAEF,IAAI,MAAM,CAAC,OAAO,EAAE,CAAC;QACnB,iFAAiF;QACjF,MAAM,WAAW,GAAG,MAAM,CAAC,OAAO,CAAC,OAAO,CAAC,MAAM,EAAE,OAAO,CAAC,CAAC;QAC5D,KAAK,CAAC,IAAI,CAAC,EAAE,EAAE,KAAK,EAAE,EAAE,EAAE,KAAK,EAAE,WAAW,EAAE,KAAK,CAAC,CAAC;IACvD,CAAC;IAED,OAAO,KAAK,CAAC,IAAI,CAAC,IAAI,CAAC,CAAC;AAC1B,CAAC"}

package/build/executor/gws.d.ts

@@ -0,0 +1,23 @@
+export interface GwsResult {
+    success: boolean;
+    data: unknown;
+    stderr: string;
+}
+export interface GwsOptions {
+    account?: string;
+    timeout?: number;
+    format?: 'json' | 'table' | 'yaml' | 'csv';
+}
+/**
+ * Resolve gws binary location.
+ *
+ * Priority:
+ * 1. GWS_BINARY_PATH env var (set by mcpb manifest for bundled binary)
+ *    - If path is a directory, appends platform-appropriate binary name
+ *    - If path is a file, uses it directly
+ * 2. node_modules/.bin/gws (npm dependency)
+ */
+export declare function resolveGwsBinary(): string;
+export declare function resolvePackageBinDir(): string;
+export declare function execute(args: string[], options?: GwsOptions): Promise<GwsResult>;
+export declare function gwsVersion(): Promise<string>;

package/build/executor/gws.js

@@ -0,0 +1,144 @@
+import { spawn } from 'node:child_process';
+import * as path from 'node:path';
+import { credentialPath } from './paths.js';
+import { GwsExitCode, GwsError, parseGwsError } from './errors.js';
+const DEFAULT_TIMEOUT = 120_000; // Hard ceiling (2min) — process dies after this regardless
+const STALL_TIMEOUT = 30_000; // Kill if no stdout/stderr activity for 30s
+// (generous: gws may do OAuth refresh, API pagination, cold start)
+const IS_WINDOWS = process.platform === 'win32';
+const GWS_BINARY_NAME = IS_WINDOWS ? 'gws.exe' : 'gws';
+/**
+ * Resolve gws binary location.
+ *
+ * Priority:
+ * 1. GWS_BINARY_PATH env var (set by mcpb manifest for bundled binary)
+ *    - If path is a directory, appends platform-appropriate binary name
+ *    - If path is a file, uses it directly
+ * 2. node_modules/.bin/gws (npm dependency)
+ */
+export function resolveGwsBinary() {
+    const envPath = process.env.GWS_BINARY_PATH;
+    if (envPath) {
+        // Support both direct binary path and directory path
+        if (envPath.endsWith('.exe') || envPath.endsWith('/gws') || envPath.endsWith('\\gws')) {
+            return envPath;
+        }
+        return path.join(envPath, GWS_BINARY_NAME);
+    }
+    return path.join(process.cwd(), 'node_modules', '.bin', GWS_BINARY_NAME);
+}
+// Kept for backward compatibility with tests
+export function resolvePackageBinDir() {
+    return path.join(process.cwd(), 'node_modules', '.bin');
+}
+// Stderr lines that are diagnostic noise, not errors
+const STDERR_NOISE = [
+    /^Using keyring backend:/,
+];
+function filterStderr(stderr) {
+    return stderr
+        .split('\n')
+        .filter(line => !STDERR_NOISE.some(pattern => pattern.test(line)))
+        .join('\n')
+        .trim();
+}
+export async function execute(args, options = {}) {
+    const { account, timeout = DEFAULT_TIMEOUT, format = 'json' } = options;
+    const env = { ...process.env };
+    if (account) {
+        env.GOOGLE_WORKSPACE_CLI_CREDENTIALS_FILE = credentialPath(account);
+    }
+    const fullArgs = [...args, '--format', format];
+    // Resolve gws binary — bundled (mcpb) or npm dependency
+    const gwsBinary = resolveGwsBinary();
+    process.stderr.write(`[gws-mcp] exec: ${gwsBinary} ${fullArgs.join(' ')}\n`);
+    if (account) {
+        process.stderr.write(`[gws-mcp] cred: ${env.GOOGLE_WORKSPACE_CLI_CREDENTIALS_FILE}\n`);
+    }
+    // Still prepend bin dir to PATH for non-bundled case
+    env.PATH = `${resolvePackageBinDir()}:${env.PATH || ''}`;
+    return new Promise((resolve, reject) => {
+        let settled = false;
+        const settle = (fn) => { if (!settled) {
+            settled = true;
+            fn();
+        } };
+        const proc = spawn(gwsBinary, fullArgs, { env, stdio: ['ignore', 'pipe', 'pipe'] });
+        let stdout = '';
+        let stderr = '';
+        // Activity-based stall detection: kill if process goes silent
+        let lastActivity = Date.now();
+        const resetStall = () => { lastActivity = Date.now(); };
+        proc.stdout.on('data', (chunk) => { stdout += chunk.toString(); resetStall(); });
+        proc.stderr.on('data', (chunk) => { stderr += chunk.toString(); resetStall(); });
+        const killProc = (reason) => {
+            process.stderr.write(`[gws-mcp] ${reason}\n`);
+            proc.kill('SIGTERM');
+            const killTimer = setTimeout(() => {
+                try {
+                    proc.kill('SIGKILL');
+                }
+                catch { /* already dead */ }
+            }, 3000);
+            killTimer.unref();
+        };
+        // Stall detector — checks periodically if the process has gone silent
+        const stallCheck = setInterval(() => {
+            if (Date.now() - lastActivity > STALL_TIMEOUT) {
+                clearInterval(stallCheck);
+                killProc(`stall: no output for ${STALL_TIMEOUT / 1000}s, killing gws`);
+                settle(() => reject(new GwsError(`gws stalled (no output for ${STALL_TIMEOUT / 1000}s)`, GwsExitCode.InternalError, 'stall', stderr)));
+            }
+        }, 5000);
+        stallCheck.unref();
+        // Hard timeout — absolute ceiling regardless of activity
+        const timer = setTimeout(() => {
+            clearInterval(stallCheck);
+            killProc(`hard timeout: killing gws after ${timeout / 1000}s`);
+            settle(() => reject(new GwsError('gws command timed out', GwsExitCode.InternalError, 'timeout', stderr)));
+        }, timeout);
+        proc.on('error', (err) => {
+            clearTimeout(timer);
+            process.stderr.write(`[gws-mcp] spawn error: ${err.message}\n`);
+            settle(() => reject(new GwsError(`Failed to spawn gws: ${err.message}`, GwsExitCode.InternalError, 'spawn_error', stderr)));
+        });
+        // Ensure child process is cleaned up if the parent exits
+        const cleanup = () => { try {
+            proc.kill('SIGTERM');
+        }
+        catch { /* already dead */ } };
+        process.once('exit', cleanup);
+        proc.on('close', (code) => {
+            clearInterval(stallCheck);
+            process.removeListener('exit', cleanup);
+            clearTimeout(timer);
+            const exitCode = code ?? 1;
+            const filteredStderr = filterStderr(stderr);
+            if (exitCode !== GwsExitCode.Success) {
+                settle(() => reject(parseGwsError(exitCode, stdout, filteredStderr)));
+                return;
+            }
+            // Parse JSON output
+            let data;
+            if (format === 'json' && stdout.trim()) {
+                try {
+                    data = JSON.parse(stdout);
+                }
+                catch {
+                    settle(() => reject(new GwsError('Failed to parse gws JSON output', GwsExitCode.InternalError, 'parse_error', stdout)));
+                    return;
+                }
+            }
+            else {
+                data = stdout;
+            }
+            settle(() => resolve({ success: true, data, stderr: filteredStderr }));
+        });
+    });
+}
+export async function gwsVersion() {
+    // --version outputs plain text, not JSON
+    const result = await execute(['--version'], { format: 'table' });
+    return String(result.data).trim();
+}
+//# sourceMappingURL=gws.js.map

package/build/executor/gws.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"gws.js","sourceRoot":"","sources":["../../src/executor/gws.ts"],"names":[],"mappings":"AAAA,OAAO,EAAE,KAAK,EAAE,MAAM,oBAAoB,CAAC;AAC3C,OAAO,KAAK,IAAI,MAAM,WAAW,CAAC;AAClC,OAAO,EAAE,cAAc,EAAE,MAAM,YAAY,CAAC;AAC5C,OAAO,EAAE,WAAW,EAAE,QAAQ,EAAE,aAAa,EAAE,MAAM,aAAa,CAAC;AAcnE,MAAM,eAAe,GAAG,OAAO,CAAC,CAAC,2DAA2D;AAC5F,MAAM,aAAa,GAAG,MAAM,CAAC,CAAG,4CAA4C;AAC5C,mEAAmE;AAEnG,MAAM,UAAU,GAAG,OAAO,CAAC,QAAQ,KAAK,OAAO,CAAC;AAChD,MAAM,eAAe,GAAG,UAAU,CAAC,CAAC,CAAC,SAAS,CAAC,CAAC,CAAC,KAAK,CAAC;AAEvD;;;;;;;;GAQG;AACH,MAAM,UAAU,gBAAgB;IAC9B,MAAM,OAAO,GAAG,OAAO,CAAC,GAAG,CAAC,eAAe,CAAC;IAC5C,IAAI,OAAO,EAAE,CAAC;QACZ,qDAAqD;QACrD,IAAI,OAAO,CAAC,QAAQ,CAAC,MAAM,CAAC,IAAI,OAAO,CAAC,QAAQ,CAAC,MAAM,CAAC,IAAI,OAAO,CAAC,QAAQ,CAAC,OAAO,CAAC,EAAE,CAAC;YACtF,OAAO,OAAO,CAAC;QACjB,CAAC;QACD,OAAO,IAAI,CAAC,IAAI,CAAC,OAAO,EAAE,eAAe,CAAC,CAAC;IAC7C,CAAC;IACD,OAAO,IAAI,CAAC,IAAI,CAAC,OAAO,CAAC,GAAG,EAAE,EAAE,cAAc,EAAE,MAAM,EAAE,eAAe,CAAC,CAAC;AAC3E,CAAC;AAED,6CAA6C;AAC7C,MAAM,UAAU,oBAAoB;IAClC,OAAO,IAAI,CAAC,IAAI,CAAC,OAAO,CAAC,GAAG,EAAE,EAAE,cAAc,EAAE,MAAM,CAAC,CAAC;AAC1D,CAAC;AAED,qDAAqD;AACrD,MAAM,YAAY,GAAG;IACnB,yBAAyB;CAC1B,CAAC;AAEF,SAAS,YAAY,CAAC,MAAc;IAClC,OAAO,MAAM;SACV,KAAK,CAAC,IAAI,CAAC;SACX,MAAM,CAAC,IAAI,CAAC,EAAE,CAAC,CAAC,YAAY,CAAC,IAAI,CAAC,OAAO,CAAC,EAAE,CAAC,OAAO,CAAC,IAAI,CAAC,IAAI,CAAC,CAAC,CAAC;SACjE,IAAI,CAAC,IAAI,CAAC;SACV,IAAI,EAAE,CAAC;AACZ,CAAC;AAED,MAAM,CAAC,KAAK,UAAU,OAAO,CAAC,IAAc,EAAE,UAAsB,EAAE;IACpE,MAAM,EAAE,OAAO,EAAE,OAAO,GAAG,eAAe,EAAE,MAAM,GAAG,MAAM,EAAE,GAAG,OAAO,CAAC;IAExE,MAAM,GAAG,GAA2B,EAAE,GAAG,OAAO,CAAC,GAA6B,EAAE,CAAC;IAEjF,IAAI,OAAO,EAAE,CAAC;QACZ,GAAG,CAAC,qCAAqC,GAAG,cAAc,CAAC,OAAO,CAAC,CAAC;IACtE,CAAC;IAED,MAAM,QAAQ,GAAG,CAAC,GAAG,IAAI,EAAE,UAAU,EAAE,MAAM,CAAC,CAAC;IAE/C,wDAAwD;IACxD,MAAM,SAAS,GAAG,gBAAgB,EAAE,CAAC;IACrC,OAAO,CAAC,MAAM,CAAC,KAAK,CAAC,mBAAmB,SAAS,IAAI,QAAQ,CAAC,IAAI,CAAC,GAAG,CAAC,IAAI,CAAC,CAAC;IAC7E,IAAI,OAAO,EAAE,CAAC;QACZ,OAAO,CAAC,MAAM,CAAC,KAAK,CAAC,mBAAmB,GAAG,CAAC,qCAAqC,IAAI,CAAC,CAAC;IACzF,CAAC;IAED,qDAAqD;IACrD,GAAG,CAAC,IAAI,GAAG,GAAG,oBAAoB,EAAE,IAAI,GAAG,CAAC,IAAI,IAAI,EAAE,EAAE,CAAC;IAEzD,OAAO,IAAI,OAAO,CAAC,CAAC,OAAO,EAAE,MAAM,EAAE,EAAE;QACrC,IAAI,OAAO,GAAG,KAAK,CAAC;QACpB,MAAM,MAAM,GAAG,CAAC,EAAc,EAAE,EAAE,GAAG,IAAI,CAAC,OAAO,EAAE,CAAC;YAAC,OAAO,GAAG,IAAI,CAAC;YAAC,EAAE,EAAE,CAAC;QAAC,CAAC,CAAC,CAAC,CAAC;QAE/E,MAAM,IAAI,GAAG,KAAK,CAAC,SAAS,EAAE,QAAQ,EAAE,EAAE,GAAG,EAAE,KAAK,EAAE,CAAC,QAAQ,EAAE,MAAM,EAAE,MAAM,CAAC,EAAE,CAAC,CAAC;QAEpF,IAAI,MAAM,GAAG,EAAE,CAAC;QAChB,IAAI,MAAM,GAAG,EAAE,CAAC;QAEhB,8DAA8D;QAC9D,IAAI,YAAY,GAAG,IAAI,CAAC,GAAG,EAAE,CAAC;QAC9B,MAAM,UAAU,GAAG,GAAG,EAAE,GAAG,YAAY,GAAG,IAAI,CAAC,GAAG,EAAE,CAAC,CAAC,CAAC,CAAC;QAExD,IAAI,CAAC,MAAM,CAAC,EAAE,CAAC,MAAM,EAAE,CAAC,KAAa,EAAE,EAAE,GAAG,MAAM,IAAI,KAAK,CAAC,QAAQ,EAAE,CAAC,CAAC,UAAU,EAAE,CAAC,CAAC,CAAC,CAAC,CAAC;QACzF,IAAI,CAAC,MAAM,CAAC,EAAE,CAAC,MAAM,EAAE,CAAC,KAAa,EAAE,EAAE,GAAG,MAAM,IAAI,KAAK,CAAC,QAAQ,EAAE,CAAC,CAAC,UAAU,EAAE,CAAC,CAAC,CAAC,CAAC,CAAC;QAEzF,MAAM,QAAQ,GAAG,CAAC,MAAc,EAAE,EAAE;YAClC,OAAO,CAAC,MAAM,CAAC,KAAK,CAAC,aAAa,MAAM,IAAI,CAAC,CAAC;YAC9C,IAAI,CAAC,IAAI,CAAC,SAAS,CAAC,CAAC;YACrB,MAAM,SAAS,GAAG,UAAU,CAAC,GAAG,EAAE;gBAChC,IAAI,CAAC;oBAAC,IAAI,CAAC,IAAI,CAAC,SAAS,CAAC,CAAC;gBAAC,CAAC;gBAAC,MAAM,CAAC,CAAC,kBAAkB,CAAC,CAAC;YAC5D,CAAC,EAAE,IAAI,CAAC,CAAC;YACT,SAAS,CAAC,KAAK,EAAE,CAAC;QACpB,CAAC,CAAC;QAEF,sEAAsE;QACtE,MAAM,UAAU,GAAG,WAAW,CAAC,GAAG,EAAE;YAClC,IAAI,IAAI,CAAC,GAAG,EAAE,GAAG,YAAY,GAAG,aAAa,EAAE,CAAC;gBAC9C,aAAa,CAAC,UAAU,CAAC,CAAC;gBAC1B,QAAQ,CAAC,wBAAwB,aAAa,GAAG,IAAI,gBAAgB,CAAC,CAAC;gBACvE,MAAM,CAAC,GAAG,EAAE,CAAC,MAAM,CAAC,IAAI,QAAQ,CAC9B,8BAA8B,aAAa,GAAG,IAAI,IAAI,EACtD,WAAW,CAAC,aAAa,EAAE,OAAO,EAAE,MAAM,CAC3C,CAAC,CAAC,CAAC;YACN,CAAC;QACH,CAAC,EAAE,IAAI,CAAC,CAAC;QACT,UAAU,CAAC,KAAK,EAAE,CAAC;QAEnB,yDAAyD;QACzD,MAAM,KAAK,GAAG,UAAU,CAAC,GAAG,EAAE;YAC5B,aAAa,CAAC,UAAU,CAAC,CAAC;YAC1B,QAAQ,CAAC,mCAAmC,OAAO,GAAG,IAAI,GAAG,CAAC,CAAC;YAC/D,MAAM,CAAC,GAAG,EAAE,CAAC,MAAM,CAAC,IAAI,QAAQ,CAAC,uBAAuB,EAAE,WAAW,CAAC,aAAa,EAAE,SAAS,EAAE,MAAM,CAAC,CAAC,CAAC,CAAC;QAC5G,CAAC,EAAE,OAAO,CAAC,CAAC;QAEZ,IAAI,CAAC,EAAE,CAAC,OAAO,EAAE,CAAC,GAAG,EAAE,EAAE;YACvB,YAAY,CAAC,KAAK,CAAC,CAAC;YACpB,OAAO,CAAC,MAAM,CAAC,KAAK,CAAC,0BAA0B,GAAG,CAAC,OAAO,IAAI,CAAC,CAAC;YAChE,MAAM,CAAC,GAAG,EAAE,CAAC,MAAM,CAAC,IAAI,QAAQ,CAC9B,wBAAwB,GAAG,CAAC,OAAO,EAAE,EACrC,WAAW,CAAC,aAAa,EACzB,aAAa,EACb,MAAM,CACP,CAAC,CAAC,CAAC;QACN,CAAC,CAAC,CAAC;QAEH,yDAAyD;QACzD,MAAM,OAAO,GAAG,GAAG,EAAE,GAAG,IAAI,CAAC;YAAC,IAAI,CAAC,IAAI,CAAC,SAAS,CAAC,CAAC;QAAC,CAAC;QAAC,MAAM,CAAC,CAAC,kBAAkB,CAAC,CAAC,CAAC,CAAC,CAAC;QACrF,OAAO,CAAC,IAAI,CAAC,MAAM,EAAE,OAAO,CAAC,CAAC;QAE9B,IAAI,CAAC,EAAE,CAAC,OAAO,EAAE,CAAC,IAAI,EAAE,EAAE;YACxB,aAAa,CAAC,UAAU,CAAC,CAAC;YAC1B,OAAO,CAAC,cAAc,CAAC,MAAM,EAAE,OAAO,CAAC,CAAC;YACxC,YAAY,CAAC,KAAK,CAAC,CAAC;YACpB,MAAM,QAAQ,GAAG,IAAI,IAAI,CAAC,CAAC;YAC3B,MAAM,cAAc,GAAG,YAAY,CAAC,MAAM,CAAC,CAAC;YAE5C,IAAI,QAAQ,KAAK,WAAW,CAAC,OAAO,EAAE,CAAC;gBACrC,MAAM,CAAC,GAAG,EAAE,CAAC,MAAM,CAAC,aAAa,CAAC,QAAQ,EAAE,MAAM,EAAE,cAAc,CAAC,CAAC,CAAC,CAAC;gBACtE,OAAO;YACT,CAAC;YAED,oBAAoB;YACpB,IAAI,IAAa,CAAC;YAClB,IAAI,MAAM,KAAK,MAAM,IAAI,MAAM,CAAC,IAAI,EAAE,EAAE,CAAC;gBACvC,IAAI,CAAC;oBACH,IAAI,GAAG,IAAI,CAAC,KAAK,CAAC,MAAM,CAAC,CAAC;gBAC5B,CAAC;gBAAC,MAAM,CAAC;oBACP,MAAM,CAAC,GAAG,EAAE,CAAC,MAAM,CAAC,IAAI,QAAQ,CAC9B,iCAAiC,EACjC,WAAW,CAAC,aAAa,EACzB,aAAa,EACb,MAAM,CACP,CAAC,CAAC,CAAC;oBACJ,OAAO;gBACT,CAAC;YACH,CAAC;iBAAM,CAAC;gBACN,IAAI,GAAG,MAAM,CAAC;YAChB,CAAC;YAED,MAAM,CAAC,GAAG,EAAE,CAAC,OAAO,CAAC,EAAE,OAAO,EAAE,IAAI,EAAE,IAAI,EAAE,MAAM,EAAE,cAAc,EAAE,CAAC,CAAC,CAAC;QACzE,CAAC,CAAC,CAAC;IACL,CAAC,CAAC,CAAC;AACL,CAAC;AAED,MAAM,CAAC,KAAK,UAAU,UAAU;IAC9B,yCAAyC;IACzC,MAAM,MAAM,GAAG,MAAM,OAAO,CAAC,CAAC,WAAW,CAAC,EAAE,EAAE,MAAM,EAAE,OAAO,EAAE,CAAC,CAAC;IACjE,OAAO,MAAM,CAAC,MAAM,CAAC,IAAI,CAAC,CAAC,IAAI,EAAE,CAAC;AACpC,CAAC"}

package/build/executor/index.d.ts

@@ -0,0 +1,4 @@
+export { execute, gwsVersion } from './gws.js';
+export type { GwsResult, GwsOptions } from './gws.js';
+export { GwsError, GwsExitCode, parseGwsError } from './errors.js';
+export { configDir, dataDir, credentialsDir, credentialPath, accountsFilePath, emailToSlug } from './paths.js';

package/build/executor/index.js

@@ -0,0 +1,4 @@
+export { execute, gwsVersion } from './gws.js';
+export { GwsError, GwsExitCode, parseGwsError } from './errors.js';
+export { configDir, dataDir, credentialsDir, credentialPath, accountsFilePath, emailToSlug } from './paths.js';
+//# sourceMappingURL=index.js.map

package/build/executor/index.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"index.js","sourceRoot":"","sources":["../../src/executor/index.ts"],"names":[],"mappings":"AAAA,OAAO,EAAE,OAAO,EAAE,UAAU,EAAE,MAAM,UAAU,CAAC;AAE/C,OAAO,EAAE,QAAQ,EAAE,WAAW,EAAE,aAAa,EAAE,MAAM,aAAa,CAAC;AACnE,OAAO,EAAE,SAAS,EAAE,OAAO,EAAE,cAAc,EAAE,cAAc,EAAE,gBAAgB,EAAE,WAAW,EAAE,MAAM,YAAY,CAAC"}

package/build/executor/paths.d.ts

@@ -0,0 +1,6 @@
+export declare function configDir(): string;
+export declare function dataDir(): string;
+export declare function credentialsDir(): string;
+export declare function emailToSlug(email: string): string;
+export declare function credentialPath(email: string): string;
+export declare function accountsFilePath(): string;

package/build/executor/paths.js

@@ -0,0 +1,25 @@
+import * as path from 'node:path';
+import * as os from 'node:os';
+const APP_NAME = 'google-workspace-mcp';
+export function configDir() {
+    const base = process.env.XDG_CONFIG_HOME || path.join(os.homedir(), '.config');
+    return path.join(base, APP_NAME);
+}
+export function dataDir() {
+    const base = process.env.XDG_DATA_HOME || path.join(os.homedir(), '.local', 'share');
+    return path.join(base, APP_NAME);
+}
+export function credentialsDir() {
+    return path.join(dataDir(), 'credentials');
+}
+export function emailToSlug(email) {
+    // Preserve uniqueness: @ → _at_, dots → _dot_, hyphens stay as-is
+    return email.replace(/@/g, '_at_').replace(/\./g, '_dot_');
+}
+export function credentialPath(email) {
+    return path.join(credentialsDir(), `${emailToSlug(email)}.json`);
+}
+export function accountsFilePath() {
+    return path.join(configDir(), 'accounts.json');
+}
+//# sourceMappingURL=paths.js.map

package/build/executor/paths.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"paths.js","sourceRoot":"","sources":["../../src/executor/paths.ts"],"names":[],"mappings":"AAAA,OAAO,KAAK,IAAI,MAAM,WAAW,CAAC;AAClC,OAAO,KAAK,EAAE,MAAM,SAAS,CAAC;AAE9B,MAAM,QAAQ,GAAG,sBAAsB,CAAC;AAExC,MAAM,UAAU,SAAS;IACvB,MAAM,IAAI,GAAG,OAAO,CAAC,GAAG,CAAC,eAAe,IAAI,IAAI,CAAC,IAAI,CAAC,EAAE,CAAC,OAAO,EAAE,EAAE,SAAS,CAAC,CAAC;IAC/E,OAAO,IAAI,CAAC,IAAI,CAAC,IAAI,EAAE,QAAQ,CAAC,CAAC;AACnC,CAAC;AAED,MAAM,UAAU,OAAO;IACrB,MAAM,IAAI,GAAG,OAAO,CAAC,GAAG,CAAC,aAAa,IAAI,IAAI,CAAC,IAAI,CAAC,EAAE,CAAC,OAAO,EAAE,EAAE,QAAQ,EAAE,OAAO,CAAC,CAAC;IACrF,OAAO,IAAI,CAAC,IAAI,CAAC,IAAI,EAAE,QAAQ,CAAC,CAAC;AACnC,CAAC;AAED,MAAM,UAAU,cAAc;IAC5B,OAAO,IAAI,CAAC,IAAI,CAAC,OAAO,EAAE,EAAE,aAAa,CAAC,CAAC;AAC7C,CAAC;AAED,MAAM,UAAU,WAAW,CAAC,KAAa;IACvC,kEAAkE;IAClE,OAAO,KAAK,CAAC,OAAO,CAAC,IAAI,EAAE,MAAM,CAAC,CAAC,OAAO,CAAC,KAAK,EAAE,OAAO,CAAC,CAAC;AAC7D,CAAC;AAED,MAAM,UAAU,cAAc,CAAC,KAAa;IAC1C,OAAO,IAAI,CAAC,IAAI,CAAC,cAAc,EAAE,EAAE,GAAG,WAAW,CAAC,KAAK,CAAC,OAAO,CAAC,CAAC;AACnE,CAAC;AAED,MAAM,UAAU,gBAAgB;IAC9B,OAAO,IAAI,CAAC,IAAI,CAAC,SAAS,EAAE,EAAE,eAAe,CAAC,CAAC;AACjD,CAAC"}

package/build/executor/workspace.d.ts

@@ -0,0 +1,38 @@
+/**
+ * Workspace directory — safe sandbox for file I/O operations.
+ *
+ * All file operations (Drive upload/download, Docs export, Sheets CSV export)
+ * are jailed to this directory. Prevents agents from accidentally operating on
+ * home directories, document folders, or Google Drive mount points.
+ */
+/** Validate and return the workspace directory path. */
+export declare function getWorkspaceDir(): string;
+/**
+ * Validate workspace dir is safe. Throws if it IS a protected directory.
+ * Being a subdirectory OF a protected directory is fine (e.g. ~/Documents/mcp-workspace/).
+ */
+export declare function validateWorkspaceDir(dir: string): void;
+export interface WorkspaceStatus {
+    path: string;
+    valid: boolean;
+    warning?: string;
+}
+/** Check workspace directory status without crashing. */
+export declare function checkWorkspaceStatus(): WorkspaceStatus;
+/** Ensure the workspace directory exists and is validated. Returns status instead of throwing. */
+export declare function ensureWorkspaceDir(): Promise<WorkspaceStatus>;
+/**
+ * Sanitize a filename from external sources (email attachments, Drive metadata).
+ * Strips null bytes, control characters, path separators, and other dangerous chars.
+ */
+export declare function sanitizeFilename(filename: string): string;
+/**
+ * Resolve a file path within the workspace directory.
+ * Prevents path traversal (e.g. ../../etc/passwd) and sanitizes the filename.
+ */
+export declare function resolveWorkspacePath(filename: string): string;
+/**
+ * Verify a file path is safe to read/write after symlink resolution.
+ * Must be called before any fs operation on a workspace path.
+ */
+export declare function verifyPathSafety(filePath: string): Promise<void>;