@dguido/google-workspace-mcp 3.0.0 → 3.0.1

package/dist/index.js

@@ -989,6 +989,30 @@ function getKeysFilePath() {
   }
   return path.join(process.cwd(), "gcp-oauth.keys.json");
 }
+function extractCredentials(keys) {
+  if (keys.installed?.client_id) {
+    return {
+      client_id: keys.installed.client_id,
+      client_secret: keys.installed.client_secret,
+      redirect_uris: keys.installed.redirect_uris
+    };
+  }
+  if (keys.web?.client_id) {
+    return {
+      client_id: keys.web.client_id,
+      client_secret: keys.web.client_secret,
+      redirect_uris: keys.web.redirect_uris
+    };
+  }
+  if (keys.client_id) {
+    return {
+      client_id: keys.client_id,
+      client_secret: keys.client_secret,
+      redirect_uris: keys.redirect_uris || ["http://127.0.0.1/oauth2callback"]
+    };
+  }
+  return null;
+}
 function generateCredentialsErrorMessage() {
   return `
 OAuth credentials not found. Please provide credentials using one of these methods:
@@ -1038,6 +1062,14 @@ var GoogleAuthError = class _GoogleAuthError extends Error {
       Error.captureStackTrace(this, _GoogleAuthError);
     }
   }
+  /** Check if this error indicates the OAuth client is invalid/deleted */
+  isClientInvalid() {
+    return this.code === "DELETED_CLIENT" || this.code === "INVALID_CLIENT";
+  }
+  /** Check if this error requires clearing stored tokens */
+  requiresTokenClear() {
+    return this.code === "INVALID_GRANT" || this.code === "TOKEN_REVOKED" || this.code === "DELETED_CLIENT";
+  }
   /**
    * Convert to structured data for MCP tool response.
    */
@@ -1111,6 +1143,8 @@ function mapGoogleError(error, context = {}) {
       return createRedirectUriMismatchError(description, error, context);
     case "invalid_client":
       return createInvalidClientError(description, error, context);
+    case "deleted_client":
+      return createDeletedClientError(description, error, context);
     case "invalid_grant":
       return createInvalidGrantError(description, error, context);
     case "access_denied":
@@ -1178,6 +1212,22 @@ function createInvalidClientError(description, originalError, context) {
     ...context
   });
 }
+function createDeletedClientError(description, originalError, context) {
+  return new GoogleAuthError({
+    code: "DELETED_CLIENT",
+    reason: `OAuth client has been deleted from Google Cloud: ${description}`,
+    fix: [
+      "The OAuth client in your credentials file no longer exists in Google Cloud",
+      "Go to Google Cloud Console > APIs & Services > Credentials",
+      "Create a new OAuth 2.0 Client ID (Desktop app type)",
+      "Download and save as gcp-oauth.keys.json",
+      "Delete existing tokens and re-authenticate"
+    ],
+    links: [{ label: "Create OAuth Credentials", url: `${CONSOLE_URL}/apis/credentials` }],
+    originalError,
+    ...context
+  });
+}
 function createInvalidGrantError(description, originalError, context) {
   return new GoogleAuthError({
     code: "INVALID_GRANT",
@@ -1377,8 +1427,9 @@ async function validateOAuthConfig() {
     );
     return { valid: false, errors, warnings };
   }
-  const clientId = credentials.installed?.client_id || credentials.web?.client_id || credentials.client_id;
-  const clientSecret = credentials.installed?.client_secret || credentials.web?.client_secret || credentials.client_secret;
+  const extracted = extractCredentials(credentials);
+  const clientId = extracted?.client_id;
+  const clientSecret = extracted?.client_secret;
   if (!clientId) {
     errors.push(
       new GoogleAuthError({
@@ -1484,29 +1535,13 @@ function parseStoredCredentials(content) {
 async function loadCredentialsFromFile() {
   const keysContent = await fs2.readFile(getKeysFilePath(), "utf-8");
   const keys = parseCredentialsFile(keysContent);
-  if (keys.installed?.client_id) {
-    return {
-      client_id: keys.installed.client_id,
-      client_secret: keys.installed.client_secret,
-      redirect_uris: keys.installed.redirect_uris
-    };
-  } else if (keys.web?.client_id) {
-    return {
-      client_id: keys.web.client_id,
-      client_secret: keys.web.client_secret,
-      redirect_uris: keys.web.redirect_uris
-    };
-  } else if (keys.client_id) {
-    return {
-      client_id: keys.client_id,
-      client_secret: keys.client_secret,
-      redirect_uris: keys.redirect_uris || ["http://127.0.0.1/oauth2callback"]
-    };
-  } else {
+  const credentials = extractCredentials(keys);
+  if (!credentials) {
     throw new Error(
       'Invalid credentials file format. Expected either "installed", "web" object or direct client_id field.'
     );
   }
+  return credentials;
 }
 async function loadCredentialsWithFallback() {
   try {
@@ -1517,21 +1552,11 @@ async function loadCredentialsWithFallback() {
       const legacyContent = await fs2.readFile(legacyPath, "utf-8");
       const legacyKeys = parseCredentialsFile(legacyContent);
       log("Warning: Using legacy client_secret.json. Please migrate to gcp-oauth.keys.json");
-      if (legacyKeys.installed?.client_id) {
-        return {
-          client_id: legacyKeys.installed.client_id,
-          client_secret: legacyKeys.installed.client_secret,
-          redirect_uris: legacyKeys.installed.redirect_uris
-        };
-      } else if (legacyKeys.web?.client_id) {
-        return {
-          client_id: legacyKeys.web.client_id,
-          client_secret: legacyKeys.web.client_secret,
-          redirect_uris: legacyKeys.web.redirect_uris
-        };
-      } else {
+      const credentials = extractCredentials(legacyKeys);
+      if (!credentials) {
         throw new Error("Invalid legacy credentials format");
       }
+      return credentials;
     } catch {
       const errorMessage = generateCredentialsErrorMessage();
       throw new Error(
@@ -1592,21 +1617,33 @@ import { CodeChallengeMethod, OAuth2Client as OAuth2Client2 } from "google-auth-
 // src/auth/tokenManager.ts
 import * as fs3 from "fs/promises";
 import * as path2 from "path";
+import { Mutex } from "async-mutex";
 init_utils();
-var lastAuthError = null;
+var activeTokenManager = null;
 function getLastTokenAuthError() {
-  return lastAuthError;
+  return activeTokenManager?.getLastError() ?? null;
 }
 var TokenManager = class {
   oauth2Client;
   tokenPath;
   accountEmail;
   refreshInProgress = null;
+  lastAuthError = null;
+  tokenFileMutex = new Mutex();
   constructor(oauth2Client, accountEmail) {
     this.oauth2Client = oauth2Client;
     this.tokenPath = getSecureTokenPath();
     this.accountEmail = accountEmail;
     this.setupTokenRefresh();
+    activeTokenManager = this;
+  }
+  /** Get the last auth error that occurred */
+  getLastError() {
+    return this.lastAuthError;
+  }
+  /** Clear the last auth error */
+  clearLastError() {
+    this.lastAuthError = null;
   }
   /** Method to expose the token path */
   getTokenPath() {
@@ -1634,7 +1671,7 @@ var TokenManager = class {
   async ensureTokenDirectoryExists() {
     try {
       const dir = path2.dirname(this.tokenPath);
-      await fs3.mkdir(dir, { recursive: true });
+      await fs3.mkdir(dir, { recursive: true, mode: 448 });
     } catch (error) {
       if (isNodeError(error) && error.code !== "EEXIST") {
         log("Failed to create token directory:", error);
@@ -1644,14 +1681,19 @@ var TokenManager = class {
   }
   /**
    * Sets up automatic token persistence when OAuth2Client emits 'tokens' events.
-   *
-   * Note: This handler has a potential race condition if multiple token refresh
-   * events fire rapidly (the file read/merge/write is not atomic). This is
-   * acceptable for single-user CLI usage but would need a mutex for multi-process
-   * scenarios.
+   * Uses a mutex to prevent race conditions when multiple refresh events fire rapidly.
    */
   setupTokenRefresh() {
-    this.oauth2Client.on("tokens", async (newTokens) => {
+    this.oauth2Client.on("tokens", (newTokens) => {
+      void this.updateTokensFile(newTokens);
+    });
+  }
+  /**
+   * Safely update the token file with new tokens, using mutex to prevent races.
+   * Merges new tokens with existing ones, preserving refresh_token and created_at.
+   */
+  async updateTokensFile(newTokens) {
+    await this.tokenFileMutex.runExclusive(async () => {
       try {
         await this.ensureTokenDirectoryExists();
         const content = await fs3.readFile(this.tokenPath, "utf-8");
@@ -1742,9 +1784,9 @@ var TokenManager = class {
         return true;
       } catch (refreshError) {
         const authError = mapGoogleError(refreshError, { account: this.accountEmail });
-        lastAuthError = authError;
+        this.lastAuthError = authError;
         log("Token refresh failed:", authError.toToolResponse());
-        if (authError.code === "INVALID_GRANT" || authError.code === "TOKEN_REVOKED") {
+        if (authError.requiresTokenClear()) {
           await this.clearTokens();
         }
         return false;
@@ -1837,10 +1879,148 @@ function getScopesForEnabledServices() {
   return [...scopes];
 }
 
-// src/auth/server.ts
+// src/auth/templates.ts
 function escapeHtml(str) {
   return str.replace(/&/g, "&amp;").replace(/</g, "&lt;").replace(/>/g, "&gt;").replace(/"/g, "&quot;").replace(/'/g, "&#39;");
 }
+var BASE_STYLES = `
+  body {
+    font-family: sans-serif;
+    display: flex;
+    justify-content: center;
+    align-items: center;
+    min-height: 100vh;
+    background-color: #f4f4f4;
+    margin: 0;
+    padding: 1em;
+  }
+  .container {
+    text-align: center;
+    padding: 2em;
+    background-color: #fff;
+    border-radius: 8px;
+    box-shadow: 0 2px 4px rgba(0,0,0,0.1);
+    max-width: 600px;
+  }
+`;
+var SUCCESS_STYLES = `
+  ${BASE_STYLES}
+  h1 { color: #4CAF50; }
+  p { color: #333; margin-bottom: 0.5em; }
+  code {
+    background-color: #eee;
+    padding: 0.2em 0.4em;
+    border-radius: 3px;
+    font-size: 0.9em;
+  }
+  .warning {
+    background-color: #fff3cd;
+    border: 1px solid #ffc107;
+    border-radius: 4px;
+    padding: 1em;
+    margin-top: 1em;
+  }
+  .warning p { color: #856404; margin: 0.3em 0; }
+`;
+var ERROR_STYLES = `
+  ${BASE_STYLES}
+  .container { text-align: left; }
+  h1 { color: #F44336; text-align: center; }
+  .error-code {
+    background-color: #ffebee;
+    color: #c62828;
+    padding: 0.5em 1em;
+    border-radius: 4px;
+    font-family: monospace;
+    margin: 1em 0;
+  }
+  .reason { color: #333; margin-bottom: 1.5em; }
+  h2 { color: #1976d2; font-size: 1.1em; margin-top: 1.5em; }
+  ol { padding-left: 1.5em; }
+  li { margin-bottom: 0.5em; color: #555; }
+  ul { padding-left: 1em; list-style: none; }
+  ul li { margin-bottom: 0.3em; }
+  a { color: #1976d2; }
+`;
+var CSRF_ERROR_STYLES = `
+  ${BASE_STYLES}
+  h1 { color: #F44336; }
+`;
+function renderSuccessPage(tokenPath, gitignoreWarning) {
+  return `
+    <!DOCTYPE html>
+    <html lang="en">
+    <head>
+      <meta charset="UTF-8">
+      <meta name="viewport" content="width=device-width, initial-scale=1.0">
+      <title>Authentication Successful</title>
+      <style>${SUCCESS_STYLES}</style>
+    </head>
+    <body>
+      <div class="container">
+        <h1>Authentication Successful!</h1>
+        <p>Your authentication tokens have been saved successfully to:</p>
+        <p><code>${escapeHtml(tokenPath)}</code></p>${gitignoreWarning}
+        <p style="margin-top: 1em;">You can now close this browser window.</p>
+      </div>
+    </body>
+    </html>
+  `;
+}
+function buildGitignoreWarning(credentialsDir) {
+  return `
+    <div class="warning">
+      <p><strong>\u26A0\uFE0F Security:</strong> Add your credentials directory to .gitignore:</p>
+      <p><code>${escapeHtml(credentialsDir)}/</code></p>
+    </div>`;
+}
+function renderErrorPage(authError) {
+  const fixStepsHtml = authError.fix.map((step, i) => `<li>${i + 1}. ${escapeHtml(step)}</li>`).join("");
+  const linksHtml = authError.links ? authError.links.map(
+    (link) => `<li><a href="${escapeHtml(link.url)}" target="_blank">${escapeHtml(link.label)}</a></li>`
+  ).join("") : "";
+  return `
+    <!DOCTYPE html>
+    <html lang="en">
+    <head>
+      <meta charset="UTF-8">
+      <meta name="viewport" content="width=device-width, initial-scale=1.0">
+      <title>Authentication Failed</title>
+      <style>${ERROR_STYLES}</style>
+    </head>
+    <body>
+      <div class="container">
+        <h1>Authentication Failed</h1>
+        <div class="error-code">${escapeHtml(authError.code)}</div>
+        <p class="reason">${escapeHtml(authError.reason)}</p>
+        <h2>How to fix:</h2>
+        <ol>${fixStepsHtml}</ol>
+        ${linksHtml ? `<h2>Helpful links:</h2><ul>${linksHtml}</ul>` : ""}
+      </div>
+    </body>
+    </html>
+  `;
+}
+function renderCsrfErrorPage() {
+  return `
+    <!DOCTYPE html>
+    <html lang="en">
+    <head>
+      <title>Authentication Failed</title>
+      <style>${CSRF_ERROR_STYLES}</style>
+    </head>
+    <body>
+      <div class="container">
+        <h1>Authentication Failed</h1>
+        <p>Invalid state parameter. This may indicate a CSRF attack.</p>
+        <p>Please close this window and try again.</p>
+      </div>
+    </body>
+    </html>
+  `;
+}
+
+// src/auth/server.ts
 function timingSafeEqual(a, b) {
   const bufA = Buffer.from(a);
   const bufB = Buffer.from(b);
@@ -1860,154 +2040,94 @@ var AuthServer = class {
   constructor(oauth2Client) {
     this.tokenManager = new TokenManager(oauth2Client);
   }
+  isClientInvalidError() {
+    const lastError = getLastTokenAuthError();
+    return lastError?.isClientInvalid() ?? false;
+  }
+  /** Handle root request - show auth link page */
+  handleRootRequest(res) {
+    if (!this.flowOAuth2Client) {
+      res.writeHead(503, { "Content-Type": "text/plain" });
+      res.end("Authentication server is starting. Please wait and refresh.");
+      return;
+    }
+    if (!this.codeChallenge || !this.expectedState) {
+      res.writeHead(500, { "Content-Type": "text/plain" });
+      res.end("PKCE not initialized - call start() first");
+      return;
+    }
+    const authUrl = this.flowOAuth2Client.generateAuthUrl({
+      access_type: "offline",
+      scope: getScopesForEnabledServices(),
+      prompt: "consent",
+      code_challenge_method: CodeChallengeMethod.S256,
+      code_challenge: this.codeChallenge,
+      state: this.expectedState
+    });
+    res.writeHead(200, { "Content-Type": "text/html" });
+    res.end(
+      `<h1>Google Drive Authentication</h1><a href="${authUrl}">Authenticate with Google</a>`
+    );
+  }
+  /** Handle OAuth callback - exchange code for tokens */
+  async handleOAuthCallback(url, res) {
+    const receivedState = url.searchParams.get("state");
+    if (!this.expectedState || !receivedState || !timingSafeEqual(receivedState, this.expectedState)) {
+      res.writeHead(400, { "Content-Type": "text/html" });
+      res.end(renderCsrfErrorPage());
+      return;
+    }
+    const code = url.searchParams.get("code");
+    if (!code) {
+      res.writeHead(400, { "Content-Type": "text/plain" });
+      res.end("Authorization code missing");
+      return;
+    }
+    if (!this.flowOAuth2Client) {
+      res.writeHead(500, { "Content-Type": "text/plain" });
+      res.end("Authentication flow not properly initiated.");
+      return;
+    }
+    try {
+      const { tokens } = await this.flowOAuth2Client.getToken({
+        code,
+        codeVerifier: this.codeVerifier || void 0
+      });
+      await this.tokenManager.saveTokens(tokens);
+      this.authCompletedSuccessfully = true;
+      this.clearPkceState();
+      setTimeout(() => {
+        this.stop().catch((err) => log("Auth server shutdown error:", err));
+      }, 2e3);
+      const tokenPath = this.tokenManager.getTokenPath();
+      const homeConfig = path3.join(os2.homedir(), ".config");
+      const isProjectLevel = !tokenPath.startsWith(homeConfig);
+      const credentialsDir = path3.basename(path3.dirname(tokenPath));
+      const gitignoreWarning = isProjectLevel ? buildGitignoreWarning(credentialsDir) : "";
+      res.writeHead(200, { "Content-Type": "text/html" });
+      res.end(renderSuccessPage(tokenPath, gitignoreWarning));
+    } catch (error) {
+      this.authCompletedSuccessfully = false;
+      this.clearPkceState();
+      const authError = mapGoogleError(error);
+      log("OAuth callback error:", authError.toToolResponse());
+      res.writeHead(500, { "Content-Type": "text/html" });
+      res.end(renderErrorPage(authError));
+    }
+  }
+  /** Clear sensitive PKCE/state values */
+  clearPkceState() {
+    this.codeVerifier = null;
+    this.codeChallenge = null;
+    this.expectedState = null;
+  }
   createServer() {
     return http.createServer(async (req, res) => {
       const url = new URL(req.url || "/", `http://127.0.0.1`);
       if (url.pathname === "/") {
-        if (!this.flowOAuth2Client) {
-          res.writeHead(503, { "Content-Type": "text/plain" });
-          res.end("Authentication server is starting. Please wait and refresh.");
-          return;
-        }
-        if (!this.codeChallenge || !this.expectedState) {
-          res.writeHead(500, { "Content-Type": "text/plain" });
-          res.end("PKCE not initialized - call start() first");
-          return;
-        }
-        const authUrl = this.flowOAuth2Client.generateAuthUrl({
-          access_type: "offline",
-          scope: getScopesForEnabledServices(),
-          prompt: "consent",
-          code_challenge_method: CodeChallengeMethod.S256,
-          code_challenge: this.codeChallenge,
-          state: this.expectedState
-        });
-        res.writeHead(200, { "Content-Type": "text/html" });
-        res.end(
-          `<h1>Google Drive Authentication</h1><a href="${authUrl}">Authenticate with Google</a>`
-        );
+        this.handleRootRequest(res);
       } else if (url.pathname === "/oauth2callback") {
-        const receivedState = url.searchParams.get("state");
-        if (!this.expectedState || !receivedState || !timingSafeEqual(receivedState, this.expectedState)) {
-          res.writeHead(400, { "Content-Type": "text/html" });
-          res.end(`
-            <!DOCTYPE html>
-            <html lang="en">
-            <head><title>Authentication Failed</title>
-            <style>body{font-family:sans-serif;display:flex;justify-content:center;align-items:center;height:100vh;background:#f4f4f4;margin:0}.container{text-align:center;padding:2em;background:#fff;border-radius:8px;box-shadow:0 2px 4px rgba(0,0,0,0.1)}h1{color:#F44336}</style>
-            </head>
-            <body><div class="container"><h1>Authentication Failed</h1><p>Invalid state parameter. This may indicate a CSRF attack.</p><p>Please close this window and try again.</p></div></body>
-            </html>
-          `);
-          return;
-        }
-        const code = url.searchParams.get("code");
-        if (!code) {
-          res.writeHead(400, { "Content-Type": "text/plain" });
-          res.end("Authorization code missing");
-          return;
-        }
-        if (!this.flowOAuth2Client) {
-          res.writeHead(500, { "Content-Type": "text/plain" });
-          res.end("Authentication flow not properly initiated.");
-          return;
-        }
-        try {
-          const { tokens } = await this.flowOAuth2Client.getToken({
-            code,
-            codeVerifier: this.codeVerifier || void 0
-          });
-          await this.tokenManager.saveTokens(tokens);
-          this.authCompletedSuccessfully = true;
-          this.codeVerifier = null;
-          this.codeChallenge = null;
-          this.expectedState = null;
-          setTimeout(() => {
-            this.stop().catch((err) => log("Auth server shutdown error:", err));
-          }, 2e3);
-          const tokenPath = this.tokenManager.getTokenPath();
-          const homeConfig = path3.join(os2.homedir(), ".config");
-          const isProjectLevel = !tokenPath.startsWith(homeConfig);
-          const credentialsDir = path3.basename(path3.dirname(tokenPath));
-          const gitignoreWarning = isProjectLevel ? `
-                    <div class="warning">
-                        <p><strong>\u26A0\uFE0F Security:</strong> Add your credentials directory to .gitignore:</p>
-                        <p><code>${escapeHtml(credentialsDir)}/</code></p>
-                    </div>` : "";
-          res.writeHead(200, { "Content-Type": "text/html" });
-          res.end(`
-            <!DOCTYPE html>
-            <html lang="en">
-            <head>
-                <meta charset="UTF-8">
-                <meta name="viewport" content="width=device-width, initial-scale=1.0">
-                <title>Authentication Successful</title>
-                <style>
-                    body { font-family: sans-serif; display: flex; justify-content: center; align-items: center; height: 100vh; background-color: #f4f4f4; margin: 0; }
-                    .container { text-align: center; padding: 2em; background-color: #fff; border-radius: 8px; box-shadow: 0 2px 4px rgba(0,0,0,0.1); max-width: 500px; }
-                    h1 { color: #4CAF50; }
-                    p { color: #333; margin-bottom: 0.5em; }
-                    code { background-color: #eee; padding: 0.2em 0.4em; border-radius: 3px; font-size: 0.9em; }
-                    .warning { background-color: #fff3cd; border: 1px solid #ffc107; border-radius: 4px; padding: 1em; margin-top: 1em; }
-                    .warning p { color: #856404; margin: 0.3em 0; }
-                </style>
-            </head>
-            <body>
-                <div class="container">
-                    <h1>Authentication Successful!</h1>
-                    <p>Your authentication tokens have been saved successfully to:</p>
-                    <p><code>${escapeHtml(tokenPath)}</code></p>${gitignoreWarning}
-                    <p style="margin-top: 1em;">You can now close this browser window.</p>
-                </div>
-            </body>
-            </html>
-          `);
-        } catch (error) {
-          this.authCompletedSuccessfully = false;
-          this.codeVerifier = null;
-          this.codeChallenge = null;
-          this.expectedState = null;
-          const authError = mapGoogleError(error);
-          log("OAuth callback error:", authError.toToolResponse());
-          const fixStepsHtml = authError.fix.map((step, i) => `<li>${i + 1}. ${escapeHtml(step)}</li>`).join("");
-          const linksHtml = authError.links ? authError.links.map(
-            (link) => `<li><a href="${escapeHtml(link.url)}" target="_blank">${escapeHtml(link.label)}</a></li>`
-          ).join("") : "";
-          res.writeHead(500, { "Content-Type": "text/html" });
-          res.end(`
-            <!DOCTYPE html>
-            <html lang="en">
-            <head>
-                <meta charset="UTF-8">
-                <meta name="viewport" content="width=device-width, initial-scale=1.0">
-                <title>Authentication Failed</title>
-                <style>
-                    body { font-family: sans-serif; display: flex; justify-content: center; align-items: center; min-height: 100vh; background-color: #f4f4f4; margin: 0; padding: 1em; }
-                    .container { text-align: left; padding: 2em; background-color: #fff; border-radius: 8px; box-shadow: 0 2px 4px rgba(0,0,0,0.1); max-width: 600px; }
-                    h1 { color: #F44336; text-align: center; }
-                    .error-code { background-color: #ffebee; color: #c62828; padding: 0.5em 1em; border-radius: 4px; font-family: monospace; margin: 1em 0; }
-                    .reason { color: #333; margin-bottom: 1.5em; }
-                    h2 { color: #1976d2; font-size: 1.1em; margin-top: 1.5em; }
-                    ol { padding-left: 1.5em; }
-                    li { margin-bottom: 0.5em; color: #555; }
-                    ul { padding-left: 1em; list-style: none; }
-                    ul li { margin-bottom: 0.3em; }
-                    a { color: #1976d2; }
-                </style>
-            </head>
-            <body>
-                <div class="container">
-                    <h1>Authentication Failed</h1>
-                    <div class="error-code">${escapeHtml(authError.code)}</div>
-                    <p class="reason">${escapeHtml(authError.reason)}</p>
-                    <h2>How to fix:</h2>
-                    <ol>${fixStepsHtml}</ol>
-                    ${linksHtml ? `<h2>Helpful links:</h2><ul>${linksHtml}</ul>` : ""}
-                </div>
-            </body>
-            </html>
-          `);
-        }
+        await this.handleOAuthCallback(url, res);
       } else {
         res.writeHead(404, { "Content-Type": "text/plain" });
         res.end("Not Found");
@@ -2042,6 +2162,23 @@ var AuthServer = class {
       return false;
     }
     if (openBrowser) {
+      if (this.isClientInvalidError()) {
+        const lastError = getLastTokenAuthError();
+        console.error("\n\u274C AUTHENTICATION BLOCKED");
+        console.error("\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550");
+        console.error(`
+Error: ${lastError?.reason}`);
+        console.error("\nHow to fix:");
+        lastError?.fix.forEach((step, i) => console.error(`  ${i + 1}. ${step}`));
+        if (lastError?.links && lastError.links.length > 0) {
+          console.error("\nHelpful links:");
+          lastError.links.forEach((link) => console.error(`  - ${link.label}: ${link.url}`));
+        }
+        console.error("");
+        this.authCompletedSuccessfully = false;
+        await this.stop();
+        return false;
+      }
       if (!this.codeChallenge || !this.expectedState) {
         throw new Error("PKCE not initialized - internal error");
       }
@@ -12912,21 +13049,21 @@ function ensureDriveService() {
     hasAccessToken: !!authClient.credentials?.access_token
   });
 }
-var lastAuthError2 = null;
+var lastAuthError = null;
 async function verifyAuthHealth() {
   if (!drive) {
-    lastAuthError2 = "Drive service not initialized";
+    lastAuthError = "Drive service not initialized";
     return false;
   }
   try {
     const response = await drive.about.get({ fields: "user" });
     log("Auth verification successful, user:", response.data.user?.emailAddress);
-    lastAuthError2 = null;
+    lastAuthError = null;
     return true;
   } catch (error) {
     const err = error;
-    lastAuthError2 = err.message || String(error);
-    log("WARNING: Auth verification failed:", lastAuthError2);
+    lastAuthError = err.message || String(error);
+    log("WARNING: Auth verification failed:", lastAuthError);
     if (err.response) {
       log("Auth error details:", {
         status: err.response.status,
@@ -12937,7 +13074,7 @@ async function verifyAuthHealth() {
   }
 }
 function getLastAuthError() {
-  return lastAuthError2;
+  return lastAuthError;
 }
 var server = new Server(
   {