@yoonion/mimi-seed-mcp 0.19.12 → 0.19.14

package/README.md

@@ -1,5 +1,25 @@
 # @yoonion/mimi-seed-mcp
 
+Connected app-release operations for Claude Code, Codex and other MCP clients.
+
+Start with a lightweight, account-free check in your app repository (Node 20+):
+
+```bash
+npx -y mimi-seed@latest check --local
+```
+
+Review identifiers, Target API and detectable Play Billing evidence first. Then connect stores for
+metadata, screenshot and uploaded-build checks. Local results do not guarantee store approval.
+
+[Install the plugin for Claude Code or Codex](https://github.com/jeonghwanko/mimi-seed-sdk#30-second-setup)
+· [English tool catalog](https://github.com/jeonghwanko/mimi-seed-sdk/blob/main/docs/domain/tool-catalog.md)
+· [Release guides](https://mimi-seed.pryzm.gg/guides/expo-release-readiness)
+
+Use `npx mimi-seed setup` to connect only the accounts you need, then open a fresh client session.
+Licensed under PolyForm Noncommercial; commercial use requires a separate license.
+
+## 한국어 가이드
+
 **Mimi Seed** — Firebase · AdMob · Google Play · App Store Connect를 AI 콘솔에서 관리. Claude Code / Codex / Cursor / 기타 MCP 클라이언트에서 한 줄 등록으로 사용.
 
 > 이 패키지는 Mimi Seed의 **로컬 MCP 서버**만 포함합니다. 웹 콘솔(Next.js 앱)은 <https://mimi-seed.pryzm.gg/tool>.

package/assets/agent-guide.md

@@ -84,7 +84,7 @@ you can paste. Pick the row for the job; batching two rows in one `select:` call
 | Android signing / keystore | `select:android_signing_setup,android_generate_keystore,jenkins_upload_keystore,jenkins_upload_playstore_sa` |
 | Service account end-to-end | `select:iam_list_service_accounts,iam_create_service_account,iam_list_keys,iam_create_key,iam_add_iam_policy_binding,setup_playstore_connection,playstore_register_service_account,playstore_verify_service_account,playstore_list_service_accounts,playstore_delete_service_account` |
 | Story → researched video | `select:video_save_plan,video_plan_from_story,video_research_youtube,video_search_stock_assets,video_synthesize_research,video_download_stock_assets,video_generate_image,video_add_local_asset,video_build_timeline,video_render,video_job_status,video_validate` |
-| YouTube upload / publish | `select:youtube_upload_video,youtube_get_video_status,youtube_update_video_privacy,mimi_seed_auth_start` |
+| YouTube upload / publish | `select:youtube_upload_video,youtube_get_video_status,youtube_update_video_privacy,mimi_seed_auth_start,mimi_seed_auth_status` |
 
 ---
 
@@ -301,3 +301,11 @@ domain, with the credential each domain needs — read it to answer "what can Mi
 ---
 
 _Keep this guide in sync with `README.md`'s tool list and the `skills/` directory._
+
+### YouTube account selection
+
+For multiple accounts/channels, use `mimi_seed_auth_start` with a named `profile`, `domains:["youtube"]`,
+and `expectedChannelId` from the user's target channel. Have the user select that Google/personal/Brand
+channel during consent, then check `mimi_seed_auth_status` with the same profile. Pass both `profile` and
+required `expectedChannelId` to `youtube_upload_video`; use that profile for status/privacy calls too.
+A missing profile never falls back to the default account. A channel mismatch stops before media transfer.

package/dist/auth/cli.js

@@ -1,6 +1,6 @@
 #!/usr/bin/env node
 import readline from 'node:readline';
-import { startAuth, getStoredTokens, ensureFreshAccessToken, } from './google-auth.js';
+import { startAuth, googleProfilePath, listGoogleProfiles, getStoredTokens, ensureFreshAccessToken, } from './google-auth.js';
 import { AuthError, classifyError } from './errors.js';
 import { getMcpOAuthClient } from './constants.js';
 import { AUTH_DOMAINS, DOMAIN_IDS, parseDomainList, summarizeGrantedDomains, } from './scopes.js';
@@ -23,6 +23,8 @@ const ko = {
   옵션:
     --domains <ids>  요청할 권한 도메인 (쉼표 구분, 미지정 시 전체).
                      가능한 값: ${DOMAIN_IDS.join(', ')}
+    --profile <id>  Google login profile (isolated account/channel)
+    --channel <id>  Verify YouTube channel before saving (requires --profile)
     --no-browser     URL 자동 오픈 안 함 (직접 복붙)
     --timeout <초>   콜백 대기 시간 (기본 600)
     --force          기존 토큰 무시하고 강제 재로그인
@@ -87,6 +89,8 @@ const en = {
   Options:
     --domains <ids>  Permission domains to request (comma-separated; all when omitted).
                      Available: ${DOMAIN_IDS.join(', ')}
+    --profile <id>  Google login profile (isolated account/channel)
+    --channel <id>  Verify YouTube channel before saving (requires --profile)
     --no-browser     Do not open the URL automatically (copy-paste it yourself)
     --timeout <sec>  How long to wait for the callback (default 600)
     --force          Ignore the existing token and force a re-login
@@ -139,6 +143,8 @@ const en = {
 };
 const M = resolveLang() === 'en' ? en : ko;
 const args = process.argv.slice(2);
+let profile;
+let expectedChannelId;
 const hasFlag = (name) => args.includes(`--${name}`);
 const flagValue = (name) => {
     const i = args.indexOf(`--${name}`);
@@ -174,7 +180,10 @@ function printAuthError(p) {
 }
 /** 도메인 선택형 로그인 이후 토큰은 전체 권한이 아닐 수 있다 — 부여 현황을 함께 출력. */
 function printGrantedDomains() {
-    const summary = summarizeGrantedDomains(getStoredTokens()?.scope);
+    const channel = getStoredTokens(profile)?.youtubeChannel;
+    if (channel)
+        err(`YouTube: ${channel.title} (${channel.id})`);
+    const summary = summarizeGrantedDomains(getStoredTokens(profile)?.scope);
     if (!summary.known) {
         err(M.domainsUnknown);
         return;
@@ -186,8 +195,9 @@ function printGrantedDomains() {
 async function cmdStatus() {
     err('');
     err(M.statusTitle);
+    err(`Google profiles: ${JSON.stringify(listGoogleProfiles())}`);
     err('');
-    const r = await ensureFreshAccessToken();
+    const r = await ensureFreshAccessToken(undefined, profile);
     switch (r.status) {
         case 'fresh':
             err(M.statusFresh(fmtRemaining(r.msUntilExpiry)));
@@ -215,7 +225,7 @@ async function cmdRefresh() {
     err('');
     err(M.refreshTrying);
     err('');
-    const r = await ensureFreshAccessToken(0); // 무조건 갱신 시도
+    const r = await ensureFreshAccessToken(0, profile); // 무조건 갱신 시도
     switch (r.status) {
         case 'fresh':
             err(M.refreshNotNeeded(fmtRemaining(r.msUntilExpiry)));
@@ -241,7 +251,7 @@ async function cmdLogout() {
     const fs = await import('node:fs');
     const path = await import('node:path');
     const os = await import('node:os');
-    const tokenPath = path.join(os.homedir(), '.mimi-seed', 'tokens.json');
+    const tokenPath = profile !== undefined ? googleProfilePath(profile) : path.join(os.homedir(), '.mimi-seed', 'tokens.json');
     err('');
     if (fs.existsSync(tokenPath)) {
         fs.rmSync(tokenPath, { force: true });
@@ -279,11 +289,11 @@ async function cmdLogin() {
     err('');
     // 1) 기존 토큰이 있으면 silent refresh 먼저 시도.
     //    --domains 는 "권한을 추가로 부여하겠다"는 명시적 의도라 이 단축 경로를 건너뛴다.
-    if (!force && !domains) {
-        const existing = getStoredTokens();
+    if (!force && !domains && !expectedChannelId) {
+        const existing = getStoredTokens(profile);
         if (existing) {
             err(M.loginChecking);
-            const r = await ensureFreshAccessToken();
+            const r = await ensureFreshAccessToken(undefined, profile);
             if (r.status === 'fresh' || r.status === 'refreshed') {
                 const label = r.status === 'fresh' ? M.loginValid : M.loginRefreshed;
                 err(M.loginAlready(label, fmtRemaining(r.msUntilExpiry)));
@@ -311,6 +321,8 @@ async function cmdLogin() {
     try {
         const { clientId, clientSecret } = await getMcpOAuthClient();
         const r = startAuth(clientId, clientSecret, {
+            profile,
+            expectedChannelId,
             timeoutMs: timeoutSec * 1000,
             domains,
         });
@@ -384,6 +396,19 @@ async function main() {
         printHelp();
         process.exit(0);
     }
+    const readOption = (name) => {
+        const eq = args.find((arg) => arg.startsWith(`--${name}=`));
+        const value = eq ? eq.slice(name.length + 3) : flagValue(name);
+        if ((hasFlag(name) || eq !== undefined) && !value)
+            throw new Error(`--${name} requires a value.`);
+        return value;
+    };
+    profile = readOption('profile');
+    expectedChannelId = readOption('channel');
+    if (profile !== undefined)
+        googleProfilePath(profile);
+    if (expectedChannelId && !profile)
+        throw new Error('--channel requires --profile.');
     let code;
     if (hasFlag('status'))
         code = await cmdStatus();

package/dist/auth/google-auth.d.ts

@@ -1,7 +1,22 @@
 import { type AuthErrorPayload } from './errors.js';
 import { type AuthDomainId } from './scopes.js';
 export type { AuthDomainId } from './scopes.js';
+export declare const GOOGLE_PROFILE_ID: RegExp;
+export declare function googleProfilePath(profile: string): string;
+/** Only safe metadata; never return tokens or OAuth client secrets to MCP callers. */
+export declare function listGoogleProfiles(): {
+    profile: string;
+    connected: boolean;
+    youtubeChannel: {
+        id: string;
+        title: string;
+    } | null;
+}[];
 export interface StoredTokens {
+    youtubeChannel?: {
+        id: string;
+        title: string;
+    };
     access_token: string;
     refresh_token: string;
     token_type: string;
@@ -9,25 +24,29 @@ export interface StoredTokens {
     /** 공백 구분 부여 스코프. 신규 도구(GA4 등) pre-flight 스코프 검사에 사용. 구 토큰은 undefined. */
     scope?: string;
 }
-export declare function getStoredCredentials(): {
+export declare function getStoredCredentials(profile?: string): {
     clientId: string;
     clientSecret: string;
 } | null;
 export declare function saveCredentials(clientId: string, clientSecret: string): void;
-export declare function getStoredTokens(): StoredTokens | null;
+export declare function getStoredTokens(profile?: string): StoredTokens | null;
 /**
  * tokens.json mtime — 마지막 refresh 시각의 근사값.
  * (saveTokens 가 매번 writeFileSync 으로 갱신하므로 mtime ≈ 마지막 갱신/저장.)
  * Google refresh_token 은 7일(미인증 앱) ~ 6개월(인증 앱) 미사용 시 revoke 됨.
  * auth_status 응답 enrichment 에 사용.
  */
-export declare function getTokensLastRefreshMs(): number | null;
+export declare function getTokensLastRefreshMs(profile?: string): number | null;
 export declare function createOAuth2Client(clientId: string, clientSecret: string): import("google-auth-library").OAuth2Client;
 /**
  * Get authenticated OAuth2 client.
  * Returns null if not authenticated yet.
  */
-export declare function getAuthenticatedClient(): ReturnType<typeof createOAuth2Client> | null;
+export declare function getAuthenticatedClient(profile?: string): ReturnType<typeof createOAuth2Client> | null;
+export declare function getGoogleAuthAttempt(profile?: string): {
+    status: "pending" | "succeeded" | "failed";
+    expectedChannelId?: string;
+} | null;
 /**
  * OAuth 플로우 시작.
  * URL과 대기 Promise를 즉시 반환. localhost:9876 콜백 서버는 백그라운드로 실행.
@@ -42,6 +61,8 @@ export declare function getAuthenticatedClient(): ReturnType<typeof createOAuth2
 export declare function startAuth(clientId: string, clientSecret: string, options?: {
     timeoutMs?: number;
     domains?: readonly AuthDomainId[];
+    profile?: string;
+    expectedChannelId?: string;
 }): {
     url: string;
     wait: Promise<StoredTokens>;
@@ -75,4 +96,4 @@ export type RefreshStatus = {
  * 통상 lifetime 이 1h 이므로, 5분 마진으로 매 도구 호출 시 만료 임박 시 사전 갱신해
  * "토큰 만료 → 도구 fail → 재호출" 의 단절 마찰 제거. 5분 마진은 평균 도구 작업 시간을 흡수.
  */
-export declare function ensureFreshAccessToken(marginMs?: number): Promise<RefreshStatus>;
+export declare function ensureFreshAccessToken(marginMs?: number, profile?: string): Promise<RefreshStatus>;

package/dist/auth/google-auth.js

@@ -1,12 +1,14 @@
 import { google } from '../lib/googleapis-lite.js';
 import http from 'node:http';
+import { randomUUID } from 'node:crypto';
+import { verifyYouTubeChannel, YOUTUBE_CHANNEL_ID } from './youtube-channel.js';
 import fs from 'node:fs';
 import path from 'node:path';
 import os from 'node:os';
 import { getMcpOAuthClient } from './constants.js';
 import { AuthError, classifyError } from './errors.js';
 // 스코프 목록의 SSOT 는 scopes.ts (도메인 → 스코프 매핑). 여기서는 로그인 요청 조립만 한다.
-import { scopesForDomains, mergeScopeStrings } from './scopes.js';
+import { scopesForDomains } from './scopes.js';
 import { writeCredentialJson } from '../lib/atomic-write.js';
 // Primary config dir. Legacy `~/.preseed` is read as a fallback during the
 // rebrand so existing auth sessions don't force a re-login; new writes go to
@@ -16,7 +18,36 @@ const LEGACY_TOKEN_DIR = path.join(os.homedir(), '.preseed');
 const TOKEN_PATH = path.join(TOKEN_DIR, 'tokens.json');
 const LEGACY_TOKEN_PATH = path.join(LEGACY_TOKEN_DIR, 'tokens.json');
 const CREDENTIALS_PATH = path.join(TOKEN_DIR, 'credentials.json');
-export function getStoredCredentials() {
+export const GOOGLE_PROFILE_ID = /^[a-z0-9][a-z0-9_-]{0,63}$/;
+export function googleProfilePath(profile) {
+    if (!GOOGLE_PROFILE_ID.test(profile))
+        throw new Error('Invalid Google profile ID: use lowercase letters, digits, _ or - (1–64 characters).');
+    return path.join(TOKEN_DIR, 'google-profiles', `${profile}.json`);
+}
+function readProfile(profile) {
+    const file = googleProfilePath(profile);
+    try {
+        return JSON.parse(fs.readFileSync(file, 'utf-8'));
+    }
+    catch {
+        return null;
+    }
+}
+/** Only safe metadata; never return tokens or OAuth client secrets to MCP callers. */
+export function listGoogleProfiles() {
+    const dir = path.join(TOKEN_DIR, 'google-profiles');
+    if (!fs.existsSync(dir))
+        return [];
+    return fs.readdirSync(dir).filter((file) => file.endsWith('.json') && GOOGLE_PROFILE_ID.test(file.slice(0, -5)))
+        .sort().map((file) => {
+        const profile = file.slice(0, -5);
+        const tokens = readProfile(profile)?.tokens;
+        return { profile, connected: !!tokens?.refresh_token, youtubeChannel: tokens?.youtubeChannel ?? null };
+    });
+}
+export function getStoredCredentials(profile) {
+    if (profile !== undefined)
+        return readProfile(profile)?.credentials ?? null;
     if (!fs.existsSync(CREDENTIALS_PATH))
         return null;
     try {
@@ -30,7 +61,9 @@ export function getStoredCredentials() {
 export function saveCredentials(clientId, clientSecret) {
     writeCredentialJson(CREDENTIALS_PATH, { clientId, clientSecret });
 }
-export function getStoredTokens() {
+export function getStoredTokens(profile) {
+    if (profile !== undefined)
+        return readProfile(profile)?.tokens ?? null;
     // Prefer new dir; fall back to legacy ~/.preseed during the rebrand window.
     const pathToRead = fs.existsSync(TOKEN_PATH)
         ? TOKEN_PATH
@@ -52,7 +85,16 @@ export function getStoredTokens() {
  * Google refresh_token 은 7일(미인증 앱) ~ 6개월(인증 앱) 미사용 시 revoke 됨.
  * auth_status 응답 enrichment 에 사용.
  */
-export function getTokensLastRefreshMs() {
+export function getTokensLastRefreshMs(profile) {
+    if (profile !== undefined) {
+        const file = googleProfilePath(profile);
+        try {
+            return fs.statSync(file).mtimeMs;
+        }
+        catch {
+            return null;
+        }
+    }
     const pathToRead = fs.existsSync(TOKEN_PATH)
         ? TOKEN_PATH
         : fs.existsSync(LEGACY_TOKEN_PATH)
@@ -69,8 +111,19 @@ export function getTokensLastRefreshMs() {
 }
 // 원자적 교체가 특히 중요한 지점 — 이 함수는 access_token 만료 5분 전마다 다시 불리고,
 // MCP 서버 인스턴스 여러 개와 CLI 가 같은 tokens.json 을 동시에 노린다.
-function saveTokens(tokens) {
-    writeCredentialJson(TOKEN_PATH, tokens);
+function saveTokens(tokens, profile, credentials) {
+    if (profile !== undefined) {
+        const creds = credentials ?? getStoredCredentials(profile);
+        if (!creds)
+            throw new Error(`Missing OAuth credentials for profile ${profile}. Sign in again.`);
+        // Client credentials and tokens belong to one grant and commit together.
+        writeCredentialJson(googleProfilePath(profile), { credentials: creds, tokens });
+    }
+    else {
+        if (credentials)
+            saveCredentials(credentials.clientId, credentials.clientSecret);
+        writeCredentialJson(TOKEN_PATH, tokens);
+    }
 }
 export function createOAuth2Client(clientId, clientSecret) {
     return new google.auth.OAuth2(clientId, clientSecret, 'http://localhost:9876/callback');
@@ -79,32 +132,34 @@ export function createOAuth2Client(clientId, clientSecret) {
  * Get authenticated OAuth2 client.
  * Returns null if not authenticated yet.
  */
-export function getAuthenticatedClient() {
-    const creds = getStoredCredentials();
+export function getAuthenticatedClient(profile) {
+    const creds = getStoredCredentials(profile);
     if (!creds)
         return null;
-    const tokens = getStoredTokens();
+    const tokens = getStoredTokens(profile);
     if (!tokens)
         return null;
     const client = createOAuth2Client(creds.clientId, creds.clientSecret);
     client.setCredentials(tokens);
     // Auto-refresh
     client.on('tokens', (newTokens) => {
-        const stored = getStoredTokens();
-        if (stored) {
+        const stored = getStoredTokens(profile);
+        if (stored && stored.refresh_token === tokens.refresh_token) {
             saveTokens({
                 ...stored,
                 ...(newTokens.access_token && { access_token: newTokens.access_token }),
                 ...(newTokens.refresh_token && { refresh_token: newTokens.refresh_token }),
                 ...(newTokens.expiry_date && { expiry_date: newTokens.expiry_date }),
                 ...(newTokens.scope && { scope: newTokens.scope }),
-            });
+            }, profile);
         }
     });
     return client;
 }
 // 동시 실행 방지용 — 활성 콜백 서버 참조
-let activeAuthServer = null;
+let cancelActiveAuth = null;
+const authAttempts = new Map();
+export function getGoogleAuthAttempt(profile) { return authAttempts.get(profile ?? '') ?? null; }
 /**
  * OAuth 플로우 시작.
  * URL과 대기 Promise를 즉시 반환. localhost:9876 콜백 서버는 백그라운드로 실행.
@@ -117,17 +172,21 @@ let activeAuthServer = null;
  * 얹는다(incremental authorization) — 토큰 응답의 scope 필드에도 누적 전체가 온다.
  */
 export function startAuth(clientId, clientSecret, options = {}) {
-    if (activeAuthServer) {
-        try {
-            activeAuthServer.close();
-        }
-        catch { /* noop */ }
-        activeAuthServer = null;
+    const { profile, expectedChannelId } = options;
+    if (profile !== undefined)
+        googleProfilePath(profile);
+    if (expectedChannelId !== undefined && (!profile || !YOUTUBE_CHANNEL_ID.test(expectedChannelId))) {
+        throw new Error('expectedChannelId requires a named profile and a valid YouTube channel ID.');
     }
-    saveCredentials(clientId, clientSecret);
+    if (cancelActiveAuth)
+        cancelActiveAuth();
+    const attempt = { status: 'pending', expectedChannelId };
+    authAttempts.set(profile ?? '', attempt);
     const oauth2Client = createOAuth2Client(clientId, clientSecret);
-    const requestedScopes = scopesForDomains(options.domains);
+    const requestedScopes = scopesForDomains(expectedChannelId && options.domains ? [...new Set([...options.domains, 'youtube'])] : options.domains);
+    const state = randomUUID();
     const authUrl = oauth2Client.generateAuthUrl({
+        state,
         access_type: 'offline',
         scope: requestedScopes,
         // Private windows can still share cookies with an already-running private session.
@@ -136,8 +195,12 @@ export function startAuth(clientId, clientSecret, options = {}) {
         prompt: 'consent select_account',
         include_granted_scopes: true,
     });
+    let exchanging = false;
     const wait = new Promise((resolve, reject) => {
-        const rejectAuth = (e) => reject(new AuthError(classifyError(e, { phase: 'login' })));
+        const rejectAuth = (e) => {
+            attempt.status = 'failed';
+            reject(new AuthError(classifyError(e, { phase: 'login' })));
+        };
         // 핸들러 전체가 try/catch 로 감싸여 있고 모든 경로가 응답 후 rejectAuth 로 끝난다 —
         // createServer 가 void 를 기대하지만 여기서 새어 나갈 rejection 은 없다.
         // eslint-disable-next-line @typescript-eslint/no-misused-promises
@@ -149,16 +212,20 @@ export function startAuth(clientId, clientSecret, options = {}) {
                     res.end();
                     return;
                 }
+                if (url.searchParams.get('state') !== state) {
+                    res.writeHead(400);
+                    res.end('Invalid OAuth state');
+                    return;
+                }
                 // Google이 동의 거부 시 ?error=access_denied 로 콜백
                 const errParam = url.searchParams.get('error');
                 if (errParam) {
-                    res.writeHead(400, { 'Content-Type': 'text/html; charset=utf-8' });
-                    res.end(`<html><body><h2>❌ 인증 거부됨 (${errParam})</h2></body></html>`);
+                    res.writeHead(400, { 'Content-Type': 'text/plain; charset=utf-8' });
+                    res.end('Google authentication was denied.');
                     try {
                         server.close();
                     }
                     catch { /* noop */ }
-                    activeAuthServer = null;
                     rejectAuth(new Error(errParam));
                     return;
                 }
@@ -168,6 +235,12 @@ export function startAuth(clientId, clientSecret, options = {}) {
                     res.end('No code');
                     return;
                 }
+                if (attempt.status !== 'pending' || exchanging) {
+                    res.writeHead(409);
+                    res.end('Login is no longer accepting callbacks.');
+                    return;
+                }
+                exchanging = true;
                 let tokenResponse;
                 try {
                     tokenResponse = await oauth2Client.getToken(code);
@@ -179,7 +252,6 @@ export function startAuth(clientId, clientSecret, options = {}) {
                         server.close();
                     }
                     catch { /* noop */ }
-                    activeAuthServer = null;
                     rejectAuth(e);
                     return;
                 }
@@ -191,7 +263,7 @@ export function startAuth(clientId, clientSecret, options = {}) {
                         server.close();
                     }
                     catch { /* noop */ }
-                    activeAuthServer = null;
+                    attempt.status = 'failed';
                     reject(new AuthError({
                         code: 'TOKEN_RESPONSE_INVALID',
                         message: 'Google 응답에 access_token 또는 refresh_token이 누락되었습니다.',
@@ -202,22 +274,22 @@ export function startAuth(clientId, clientSecret, options = {}) {
                     }));
                     return;
                 }
-                // scope 는 항상 기록한다 — 그리고 누적(monotonic)으로 저장한다.
-                //   1) include_granted_scopes 로 Google 측 grant 는 (기존 부여분 ∪ 이번 요청분)이다.
-                //   2) 응답의 tokens.scope 는 그 합집합이어야 하지만, 만약 Google 이 좁혀서 주거나
-                //      생략하면(빈 값) 여기서 기존 기록 + 이번 요청 스코프로 보정한다.
-                // 이렇게 해야 "scope 미기록 = 추적 이전 legacy 토큰" 불변식이 유지된다 — 도메인
-                // 선택형 로그인이 이를 깨서, 좁은 로그인이 legacy 로 오인돼 pre-flight 를 우회하는
-                // 것을 막는다. (기존엔 응답 scope 로 통째 덮어써서 이 두 위험에 모두 노출됐다.)
-                const priorScope = getStoredTokens()?.scope;
+                oauth2Client.setCredentials(tokens);
+                const youtubeChannel = (expectedChannelId || (profile && requestedScopes.some((scope) => scope.includes('/auth/youtube'))))
+                    ? await verifyYouTubeChannel(oauth2Client, expectedChannelId) : undefined;
+                // A fresh login may be another Google account. Never union its scopes with
+                // the previous account's grant; Google's response is authoritative.
                 const stored = {
                     access_token: tokens.access_token,
                     refresh_token: tokens.refresh_token,
                     token_type: tokens.token_type ?? 'Bearer',
                     expiry_date: tokens.expiry_date ?? Date.now() + 3600_000,
-                    scope: mergeScopeStrings(priorScope, tokens.scope ?? requestedScopes.join(' ')),
+                    scope: tokens.scope ?? requestedScopes.join(' '),
+                    ...(youtubeChannel && { youtubeChannel }),
                 };
-                saveTokens(stored);
+                if (attempt.status !== 'pending')
+                    throw new Error('Login cancelled or timed out; credentials were not saved.');
+                saveTokens(stored, profile, { clientId, clientSecret });
                 res.writeHead(200, { 'Content-Type': 'text/html; charset=utf-8' });
                 res.end(`
           <html><body style="font-family:system-ui;display:flex;justify-content:center;align-items:center;height:100vh;margin:0">
@@ -228,28 +300,36 @@ export function startAuth(clientId, clientSecret, options = {}) {
           </body></html>
         `);
                 server.close();
-                activeAuthServer = null;
+                attempt.status = 'succeeded';
                 resolve(stored);
             }
             catch (err) {
                 try {
                     res.writeHead(500);
-                    res.end('Auth error');
+                    res.end(err instanceof Error && err.message.startsWith('YouTube') ? err.message : 'Auth error. Check the MCP/CLI login status.');
                 }
                 catch { /* noop — already responded */ }
                 try {
                     server.close();
                 }
                 catch { /* noop */ }
-                activeAuthServer = null;
                 rejectAuth(err);
             }
         });
+        cancelActiveAuth = () => {
+            if (attempt.status !== 'pending')
+                return;
+            try {
+                server.close();
+            }
+            catch { /* noop */ }
+            rejectAuth(new Error('Login replaced by a new authentication request.'));
+        };
         server.on('error', (err) => {
             rejectAuth(err);
         });
         server.listen(9876, () => {
-            activeAuthServer = server;
+            // Callback server is ready.
         });
         const timeoutMs = options.timeoutMs ?? 10 * 60 * 1000;
         setTimeout(() => {
@@ -258,10 +338,9 @@ export function startAuth(clientId, clientSecret, options = {}) {
                     server.close();
                 }
                 catch { /* noop */ }
-                activeAuthServer = null;
                 rejectAuth(new Error(`Auth timeout (${Math.round(timeoutMs / 1000)}s).`));
             }
-        }, timeoutMs);
+        }, timeoutMs).unref();
     });
     return { url: authUrl, wait };
 }
@@ -278,8 +357,8 @@ export function startAuth(clientId, clientSecret, options = {}) {
  * 통상 lifetime 이 1h 이므로, 5분 마진으로 매 도구 호출 시 만료 임박 시 사전 갱신해
  * "토큰 만료 → 도구 fail → 재호출" 의 단절 마찰 제거. 5분 마진은 평균 도구 작업 시간을 흡수.
  */
-export async function ensureFreshAccessToken(marginMs = 300_000) {
-    const tokens = getStoredTokens();
+export async function ensureFreshAccessToken(marginMs = 300_000, profile) {
+    const tokens = getStoredTokens(profile);
     if (!tokens) {
         return {
             status: 'unauthenticated',
@@ -316,12 +395,14 @@ export async function ensureFreshAccessToken(marginMs = 300_000) {
     // 원격 의존을 최초 1회로 끝낸다. 조회 실패는 raw throw 가 아니라 분류된 에러로 반환.
     let clientId;
     let clientSecret;
-    const stored = getStoredCredentials();
+    const stored = getStoredCredentials(profile);
     if (stored?.clientId && stored?.clientSecret) {
         ({ clientId, clientSecret } = stored);
     }
     else {
         try {
+            if (profile !== undefined)
+                throw new Error(`Missing credentials for profile ${profile}. Sign in again.`);
             ({ clientId, clientSecret } = await getMcpOAuthClient());
             saveCredentials(clientId, clientSecret);
         }
@@ -338,6 +419,7 @@ export async function ensureFreshAccessToken(marginMs = 300_000) {
     try {
         const { credentials } = await client.refreshAccessToken();
         const refreshed = {
+            ...tokens,
             access_token: credentials.access_token ?? tokens.access_token,
             refresh_token: credentials.refresh_token ?? tokens.refresh_token,
             token_type: credentials.token_type ?? tokens.token_type ?? 'Bearer',
@@ -345,7 +427,10 @@ export async function ensureFreshAccessToken(marginMs = 300_000) {
             // refresh 응답은 scope 를 생략할 수 있으므로 기존 값을 보존(blank 방지).
             scope: credentials.scope ?? tokens.scope,
         };
-        saveTokens(refreshed);
+        if (getStoredTokens(profile)?.refresh_token !== tokens.refresh_token) {
+            throw new Error('Google login changed during refresh. Retry with the selected profile.');
+        }
+        saveTokens(refreshed, profile);
         return {
             status: 'refreshed',
             tokens: refreshed,

package/dist/auth/youtube-channel.d.ts

@@ -0,0 +1,8 @@
+import type { OAuth2Client } from 'google-auth-library';
+export declare const YOUTUBE_CHANNEL_ID: RegExp;
+/** A channel ID is a guard, not a videos.insert routing parameter. Google selects
+ * the personal/Brand channel during OAuth; ambiguous or mismatched grants fail closed. */
+export declare function verifyYouTubeChannel(auth: OAuth2Client, expectedChannelId?: string): Promise<{
+    id: string;
+    title: string;
+}>;

package/dist/auth/youtube-channel.js

@@ -0,0 +1,26 @@
+import { google } from '../lib/googleapis-lite.js';
+import { friendlyGoogleError } from '../lib/google-errors.js';
+export const YOUTUBE_CHANNEL_ID = /^UC[\w-]{22}$/;
+/** A channel ID is a guard, not a videos.insert routing parameter. Google selects
+ * the personal/Brand channel during OAuth; ambiguous or mismatched grants fail closed. */
+export async function verifyYouTubeChannel(auth, expectedChannelId) {
+    if (expectedChannelId !== undefined && !YOUTUBE_CHANNEL_ID.test(expectedChannelId)) {
+        throw new Error('Invalid YouTube channel ID (expected UC + 22 characters).');
+    }
+    let response;
+    try {
+        response = await google.youtube({ version: 'v3', auth }).channels.list({ part: ['snippet'], mine: true, maxResults: 50 });
+    }
+    catch (error) {
+        throw friendlyGoogleError(error);
+    }
+    const channels = response.data.items ?? [];
+    if (channels.length !== 1 || !channels[0].id || response.data.nextPageToken) {
+        throw new Error('YouTube login must resolve to exactly one channel. Sign in again and select the intended personal/Brand channel.');
+    }
+    const channel = { id: channels[0].id, title: channels[0].snippet?.title ?? '' };
+    if (expectedChannelId && channel.id !== expectedChannelId) {
+        throw new Error(`YouTube channel mismatch: expected ${expectedChannelId}, authenticated ${channel.id} (${channel.title}). Sign in again with the intended channel. Nothing was uploaded.`);
+    }
+    return channel;
+}

package/dist/googleads/errors.d.ts

@@ -0,0 +1,2 @@
+/** Preserve provider diagnostics without exposing authentication material. */
+export declare function googleAdsError(status: number, body: string, secrets: string[]): Error;