mcp-google-gdrive 0.1.0 → 2.2.0

package/src/index.js

@@ -5,20 +5,27 @@ import { StdioServerTransport } from "@modelcontextprotocol/sdk/server/stdio.js"
 import { z } from "zod";
 import { google } from "googleapis";
 import TurndownService from "turndown";
+import yaml from "js-yaml";
 import { readFile, writeFile, mkdir, chmod } from "node:fs/promises";
-import { join } from "node:path";
+import { join, resolve, dirname } from "node:path";
 import { homedir } from "node:os";
+import { existsSync } from "node:fs";
 import { createInterface } from "node:readline";
 
 // ─── Constants ───────────────────────────────────────────────────────────────
 
-const SCOPES = ["https://www.googleapis.com/auth/drive"];
+const SCOPES = [
+  "https://www.googleapis.com/auth/drive",
+  "https://www.googleapis.com/auth/documents",
+  "https://www.googleapis.com/auth/spreadsheets",
+  "https://www.googleapis.com/auth/presentations",
+];
+
 const CONFIG_DIR = join(homedir(), ".config", "mcp-google-gdrive");
+const TOKENS_DIR = join(CONFIG_DIR, "tokens");
 const CREDENTIALS_PATH = join(CONFIG_DIR, "credentials.json");
-const TOKEN_PATH = join(CONFIG_DIR, "token.json");
-const MAX_FILE_SIZE = 10 * 1024 * 1024; // 10MB
-
-const DRIVE_ID_REGEX = /^[a-zA-Z0-9_-]+$/;
+const CONFIG_PATH = join(CONFIG_DIR, "config.json");
+const MAX_FILE_SIZE = 10 * 1024 * 1024;
 
 const turndown = new TurndownService({
   headingStyle: "atx",
@@ -28,28 +35,40 @@ const turndown = new TurndownService({
   strongDelimiter: "**",
 });
 
-// ─── Auth ────────────────────────────────────────────────────────────────────
+// ─── Multi-Account Auth ──────────────────────────────────────────────────────
 
-let authClient = null;
-let driveClient = null;
+const authClients = new Map();
+const apiClients = new Map();
 
-async function ensureConfigDir() {
+async function ensureConfigDirs() {
   await mkdir(CONFIG_DIR, { recursive: true });
+  await mkdir(TOKENS_DIR, { recursive: true });
+}
+
+async function loadConfig() {
+  try {
+    return JSON.parse(await readFile(CONFIG_PATH, "utf-8"));
+  } catch {
+    return { active: "primary", accounts: {} };
+  }
+}
+
+async function saveConfig(config) {
+  await writeFile(CONFIG_PATH, JSON.stringify(config, null, 2));
 }
 
 async function loadCredentials() {
   try {
-    const content = await readFile(CREDENTIALS_PATH, "utf-8");
-    return JSON.parse(content);
+    return JSON.parse(await readFile(CREDENTIALS_PATH, "utf-8"));
   } catch (err) {
     if (err.code === "ENOENT") {
       throw new Error(
         `credentials.json not found at ${CREDENTIALS_PATH}\n` +
-        "Setup instructions:\n" +
+        "Setup:\n" +
         "1. Go to https://console.cloud.google.com/\n" +
-        "2. Create a project and enable the Google Drive API\n" +
+        "2. Create a project and enable Drive, Docs, Sheets, Slides APIs\n" +
         "3. Create OAuth2 desktop credentials\n" +
-        "4. Download the JSON and save it to:\n" +
+        "4. Download JSON and save to:\n" +
         `   ${CREDENTIALS_PATH}`
       );
     }
@@ -57,72 +76,84 @@ async function loadCredentials() {
   }
 }
 
-async function loadToken() {
+function tokenPath(label) {
+  return join(TOKENS_DIR, `${validateLabel(label)}.json`);
+}
+
+async function loadToken(label) {
   try {
-    const content = await readFile(TOKEN_PATH, "utf-8");
-    return JSON.parse(content);
-  } catch (err) {
-    if (err.code === "ENOENT") return null;
-    throw err;
+    return JSON.parse(await readFile(tokenPath(label), "utf-8"));
+  } catch {
+    return null;
   }
 }
 
-async function saveToken(token) {
-  await writeFile(TOKEN_PATH, JSON.stringify(token, null, 2));
-  await chmod(TOKEN_PATH, 0o600);
+async function saveTokenFile(label, token) {
+  await writeFile(tokenPath(label), JSON.stringify(token, null, 2));
+  await chmod(tokenPath(label), 0o600);
 }
 
-async function authorize() {
-  await ensureConfigDir();
+async function createOAuth2Client() {
   const credentials = await loadCredentials();
-
   const { client_id, client_secret, redirect_uris } =
     credentials.installed || credentials.web;
-
-  const oauth2Client = new google.auth.OAuth2(
+  return new google.auth.OAuth2(
     client_id,
     client_secret,
     redirect_uris?.[0] || "urn:ietf:wg:oauth:2.0:oob"
   );
+}
+
+async function authorizeAccount(label) {
+  if (authClients.has(label)) return authClients.get(label);
+
+  const oauth2Client = await createOAuth2Client();
+  const token = await loadToken(label);
 
-  // Try loading existing token
-  const token = await loadToken();
   if (!token) {
     throw new Error(
-      `No token.json found. Run first-time authorization:\n` +
-      `  node src/index.js --auth\n\n` +
-      `This must be done before starting the MCP server.`
+      `No token found for account "${label}". Run:\n` +
+      `  node src/index.js --auth ${label}\n`
     );
   }
 
   oauth2Client.setCredentials(token);
 
-  // Auto-save on token refresh
   oauth2Client.on("tokens", async (newTokens) => {
     try {
-      const existing = await loadToken();
-      const merged = { ...existing, ...newTokens };
-      await saveToken(merged);
+      const existing = await loadToken(label) || {};
+      await saveTokenFile(label, { ...existing, ...newTokens });
     } catch (err) {
-      process.stderr.write(`Warning: Failed to save refreshed token: ${err.message}\n`);
+      process.stderr.write(`Warning: Failed to save refreshed token for ${label}: ${err.message}\n`);
     }
   });
 
+  authClients.set(label, oauth2Client);
   return oauth2Client;
 }
 
-async function interactiveAuth() {
-  await ensureConfigDir();
-  const credentials = await loadCredentials();
+async function getClients(accountLabel) {
+  const config = await loadConfig();
+  const label = accountLabel || config.active || "primary";
 
-  const { client_id, client_secret, redirect_uris } =
-    credentials.installed || credentials.web;
+  if (apiClients.has(label)) return apiClients.get(label);
 
-  const oauth2Client = new google.auth.OAuth2(
-    client_id,
-    client_secret,
-    redirect_uris?.[0] || "urn:ietf:wg:oauth:2.0:oob"
-  );
+  const auth = await authorizeAccount(label);
+  const clients = {
+    drive: google.drive({ version: "v3", auth }),
+    docs: google.docs({ version: "v1", auth }),
+    sheets: google.sheets({ version: "v4", auth }),
+    slides: google.slides({ version: "v1", auth }),
+    label,
+  };
+
+  apiClients.set(label, clients);
+  return clients;
+}
+
+async function interactiveAuth(label) {
+  await ensureConfigDirs();
+  const oauth2Client = await createOAuth2Client();
 
   const authUrl = oauth2Client.generateAuthUrl({
     access_type: "offline",
@@ -130,16 +161,12 @@ async function interactiveAuth() {
     prompt: "consent",
   });
 
-  process.stderr.write("\n═══ Google Drive MCP — First-Run Authorization ═══\n\n");
+  process.stderr.write(`\n═══ Google Drive MCP — Authorization for "${label}" ═══\n\n`);
   process.stderr.write("Open this URL in your browser:\n\n");
   process.stderr.write(`  ${authUrl}\n\n`);
   process.stderr.write("After granting access, paste the authorization code below.\n\n");
 
-  const rl = createInterface({
-    input: process.stdin,
-    output: process.stderr,
-  });
-
+  const rl = createInterface({ input: process.stdin, output: process.stderr });
   const code = await new Promise((resolve) => {
     rl.question("Authorization code: ", (answer) => {
       rl.close();
@@ -148,15 +175,25 @@ async function interactiveAuth() {
   });
 
   const { tokens } = await oauth2Client.getToken(code);
-  await saveToken(tokens);
+  await saveTokenFile(label, tokens);
 
-  process.stderr.write("\nAuthorization successful! Token saved.\n");
-  process.stderr.write(`Token stored at: ${TOKEN_PATH}\n\n`);
-}
+  oauth2Client.setCredentials(tokens);
+  const oauth2 = google.oauth2({ version: "v2", auth: oauth2Client });
+  let email = label;
+  try {
+    const userInfo = await oauth2.userinfo.get();
+    email = userInfo.data.email || label;
+  } catch { /* non-critical */ }
+
+  const config = await loadConfig();
+  config.accounts[label] = { email };
+  if (!config.active || Object.keys(config.accounts).length === 1) {
+    config.active = label;
+  }
+  await saveConfig(config);
 
-function getDrive() {
-  if (!driveClient) throw new Error("Drive client not initialized. Auth may have failed.");
-  return driveClient;
+  process.stderr.write(`\nAuthorization successful! Account "${label}" (${email}) saved.\n`);
+  process.stderr.write(`Token stored at: ${tokenPath(label)}\n\n`);
 }
 
 // ─── Helpers ─────────────────────────────────────────────────────────────────
@@ -173,305 +210,981 @@ function errorResponse(message) {
   return { content: [{ type: "text", text: `Error: ${message}` }], isError: true };
 }
 
-const FILE_FIELDS = "id,name,mimeType,size,createdTime,modifiedTime,parents,webViewLink,owners,shared,description";
+function binaryResponse(data, label) {
+  const buf = Buffer.from(data);
+  return textResponse(`[${label}, ${buf.length} bytes]\nBase64:\n${buf.toString("base64")}`);
+}
+
+function validateLabel(label) {
+  if (/[\/\\.]/.test(label) || label.includes("..")) {
+    throw new Error(`Invalid account label: "${label}". Labels must not contain /, \\, or ..`);
+  }
+  return label;
+}
+
+function sanitizeDriveId(id) {
+  if (id && !/^[a-zA-Z0-9_-]+$/.test(id)) {
+    throw new Error(`Invalid Drive ID format: "${id}"`);
+  }
+  return id;
+}
+
+function validateSavePath(savePath) {
+  const resolved = resolve(savePath);
+  if (resolved.includes("\0")) {
+    throw new Error("Invalid save path: null bytes not allowed");
+  }
+  return resolved;
+}
+
+async function saveToDisk(data, savePath) {
+  const resolved = validateSavePath(savePath);
+  await mkdir(dirname(resolved), { recursive: true });
+  const buf = Buffer.from(data);
+  await writeFile(resolved, buf);
+  return { path: resolved, size: buf.length };
+}
+
+async function handleBinaryExport(data, format, savePath) {
+  if (savePath) {
+    const result = await saveToDisk(data, savePath);
+    return jsonResponse({ exported: format.toUpperCase(), path: result.path, size: result.size });
+  }
+  return binaryResponse(data, format.toUpperCase());
+}
+
+function markdownToHtml(md) {
+  return md
+    .replace(/^### (.+)$/gm, "<h3>$1</h3>")
+    .replace(/^## (.+)$/gm, "<h2>$1</h2>")
+    .replace(/^# (.+)$/gm, "<h1>$1</h1>")
+    .replace(/\*\*(.+?)\*\*/g, "<strong>$1</strong>")
+    .replace(/\*(.+?)\*/g, "<em>$1</em>")
+    .replace(/\n\n/g, "</p><p>")
+    .replace(/^/, "<p>").replace(/$/, "</p>");
+}
+
+// ─── Output Format ──────────────────────────────────────────────────────────
+
+const OUTPUT_FORMAT_SCHEMA = z.enum(["json", "yaml", "text"]).optional().default("json").describe("Output format: json (default), yaml, or text (compact human-readable)");
+
+function dataToText(data) {
+  if (Array.isArray(data) && data.length > 0 && typeof data[0] === "object") {
+    const keys = Object.keys(data[0]);
+    const widths = keys.map(k => k.length);
+    for (const row of data) { keys.forEach((k, i) => { const len = String(row[k] ?? "").length; if (len > widths[i]) widths[i] = len; }); }
+    const pad = (val, i) => String(val ?? "").padEnd(widths[i]);
+    const header = keys.map((k, i) => pad(k, i)).join("  ");
+    const sep = widths.map(w => "-".repeat(w)).join("  ");
+    const rows = data.map(row => keys.map((k, i) => pad(row[k], i)).join("  "));
+    return [header, sep, ...rows].join("\n");
+  }
+  if (Array.isArray(data) && data.length > 0 && Array.isArray(data[0])) {
+    return data.map(row => (row || []).map(c => String(c ?? "")).join("\t")).join("\n");
+  }
+  if (typeof data === "object" && data !== null) {
+    return Object.entries(data).map(([k, v]) => {
+      if (Array.isArray(v) && v.length > 0 && typeof v[0] === "object") return `${k}:\n${dataToText(v).split("\n").map(l => "  " + l).join("\n")}`;
+      if (Array.isArray(v)) return `${k}: ${v.join(", ")}`;
+      if (typeof v === "object" && v !== null) return `${k}: ${JSON.stringify(v)}`;
+      return `${k}: ${v}`;
+    }).join("\n");
+  }
+  return String(data);
+}
+
+function formatOutput(data, format) {
+  if (format === "yaml") return textResponse(yaml.dump(data, { lineWidth: 120, noRefs: true }));
+  if (format === "text") return textResponse(dataToText(data));
+  return jsonResponse(data);
+}
+
+const FILE_FIELDS = "id,name,mimeType,size,createdTime,modifiedTime,parents,webViewLink,owners,shared,description,trashed,starred";
 const LIST_FIELDS = "id,name,mimeType,modifiedTime,size,parents";
 
 // ─── Server ──────────────────────────────────────────────────────────────────
 
 const server = new McpServer({
   name: "mcp-google-gdrive",
-  version: "0.1.0",
-});
-
-// ─── Tool: gdrive_list_files ─────────────────────────────────────────────────
-
-server.registerTool(
-  "gdrive_list_files",
-  {
-    description:
-      "List files in Google Drive with optional search query and folder filtering. " +
-      "Use the query parameter for Drive search syntax (e.g., \"name contains 'report'\", " +
-      "\"mimeType = 'application/pdf'\"). Use folderId to list contents of a specific folder.",
-    inputSchema: {
-      query: z.string().optional().describe("Drive search query (e.g., \"name contains 'report'\")"),
-      folderId: z.string().regex(/^[a-zA-Z0-9_-]+$/, "Invalid folder ID format").optional().describe("List files in this folder only"),
-      pageSize: z.number().optional().default(20).describe("Results per page (max 100)"),
-      pageToken: z.string().optional().describe("Token for next page of results"),
-      orderBy: z.string().optional().default("modifiedTime desc").describe("Sort order"),
-    },
-    annotations: {
-      readOnlyHint: true,
-      destructiveHint: false,
-      idempotentHint: true,
-      openWorldHint: true,
-    },
-  },
-  async ({ query, folderId, pageSize, pageToken, orderBy }) => {
-    try {
-      const drive = await getDrive();
-
-      let q = "trashed = false";
-      if (folderId) q += ` and '${folderId}' in parents`;
-      if (query) q += ` and ${query}`;
-
-      const res = await drive.files.list({
-        q,
-        pageSize: Math.min(pageSize || 20, 100),
-        pageToken: pageToken || undefined,
-        orderBy: orderBy || "modifiedTime desc",
-        fields: `nextPageToken,files(${LIST_FIELDS})`,
-      });
-
-      return jsonResponse({
-        files: res.data.files || [],
-        nextPageToken: res.data.nextPageToken || null,
-        resultCount: (res.data.files || []).length,
-      });
-    } catch (err) {
-      return errorResponse(err.message);
-    }
-  }
-);
-
-// ─── Tool: gdrive_get_metadata ───────────────────────────────────────────────
-
-server.registerTool(
-  "gdrive_get_metadata",
-  {
-    description:
-      "Get detailed metadata for a specific file in Google Drive by its file ID. " +
-      "Returns name, type, size, dates, parents, web link, and sharing status.",
-    inputSchema: {
-      fileId: z.string().describe("Google Drive file ID"),
-    },
-    annotations: {
-      readOnlyHint: true,
-      destructiveHint: false,
-      idempotentHint: true,
-      openWorldHint: true,
-    },
-  },
-  async ({ fileId }) => {
-    try {
-      const drive = await getDrive();
-      const res = await drive.files.get({
-        fileId,
-        fields: FILE_FIELDS,
-      });
-      return jsonResponse(res.data);
-    } catch (err) {
-      if (err.code === 404) {
-        return errorResponse(`File not found: ${fileId}. Verify the file ID exists and you have access.`);
+  version: "2.0.0",
+});
+
+// ═══ ACCOUNT TOOLS ═══════════════════════════════════════════════════════════
+
+server.registerTool("gdrive_list_accounts", {
+  description: "List all configured Google accounts with their labels and email addresses.",
+  inputSchema: {
+    outputFormat: OUTPUT_FORMAT_SCHEMA,
+  },
+  annotations: { readOnlyHint: true, openWorldHint: false },
+}, async ({ outputFormat }) => {
+  try {
+    const config = await loadConfig();
+    const unresolved = Object.entries(config.accounts)
+      .filter(([, info]) => info.email === "migrated" || !info.email);
+    if (unresolved.length > 0) {
+      const results = await Promise.all(unresolved.map(async ([label]) => {
+        try {
+          const auth = await authorizeAccount(label);
+          const oauth2 = google.oauth2({ version: "v2", auth });
+          const userInfo = await oauth2.userinfo.get();
+          return { label, email: userInfo.data.email };
+        } catch { return null; }
+      }));
+      let configDirty = false;
+      for (const r of results) {
+        if (r?.email) { config.accounts[r.label].email = r.email; configDirty = true; }
       }
-      return errorResponse(err.message);
+      if (configDirty) await saveConfig(config);
     }
-  }
-);
-
-// ─── Tool: gdrive_read_file ─────────────────────────────────────────────────
-
-server.registerTool(
-  "gdrive_read_file",
-  {
-    description:
-      "Read the content of a file from Google Drive. Automatically detects Google Workspace types: " +
-      "Docs are exported as Markdown, Sheets as CSV, Slides as plain text. " +
-      "Binary files under 10MB are returned as base64. Files over 10MB return metadata only.",
-    inputSchema: {
-      fileId: z.string().describe("Google Drive file ID"),
-    },
-    annotations: {
-      readOnlyHint: true,
-      destructiveHint: false,
-      idempotentHint: true,
-      openWorldHint: true,
-    },
-  },
-  async ({ fileId }) => {
-    try {
-      const drive = await getDrive();
-
-      // Get file metadata first
-      const meta = await drive.files.get({
-        fileId,
-        fields: "id,name,mimeType,size,webViewLink",
-      });
-
-      const { mimeType, name, size } = meta.data;
-
-      // Google Workspace types — export
-      if (mimeType === "application/vnd.google-apps.document") {
-        const res = await drive.files.export({
-          fileId,
-          mimeType: "text/html",
-        }, { responseType: "text" });
-        const markdown = turndown.turndown(res.data);
-        return textResponse(markdown);
-      }
+    const accounts = Object.entries(config.accounts).map(([label, info]) => ({
+      label, email: info.email, active: label === config.active,
+    }));
+    return formatOutput({ accounts, activeAccount: config.active }, outputFormat);
+  } catch (err) { return errorResponse(err.message); }
+});
 
-      if (mimeType === "application/vnd.google-apps.spreadsheet") {
-        const res = await drive.files.export({
-          fileId,
-          mimeType: "text/csv",
-        }, { responseType: "text" });
-        return textResponse(res.data);
-      }
+server.registerTool("gdrive_switch_account", {
+  description: "Set the active Google account for subsequent tool calls.",
+  inputSchema: {
+    account: z.string().describe("Account label to make active (from gdrive_list_accounts)"),
+  },
+  annotations: { readOnlyHint: false, openWorldHint: false },
+}, async ({ account }) => {
+  try {
+    const config = await loadConfig();
+    if (!config.accounts[account]) {
+      return errorResponse(`Account "${account}" not found. Available: ${Object.keys(config.accounts).join(", ") || "none"}`);
+    }
+    config.active = account;
+    await saveConfig(config);
+    return jsonResponse({ active: account, email: config.accounts[account].email });
+  } catch (err) { return errorResponse(err.message); }
+});
 
-      if (mimeType === "application/vnd.google-apps.presentation") {
-        const res = await drive.files.export({
-          fileId,
-          mimeType: "text/plain",
-        }, { responseType: "text" });
-        return textResponse(res.data);
-      }
+server.registerTool("gdrive_add_account", {
+  description: "Generate an authorization URL to add a new Google account.",
+  inputSchema: {
+    label: z.string().describe("Short label for this account (e.g., 'work', 'personal')"),
+  },
+  annotations: { readOnlyHint: false, openWorldHint: true },
+}, async ({ label }) => {
+  try {
+    await ensureConfigDirs();
+    const oauth2Client = await createOAuth2Client();
+    const authUrl = oauth2Client.generateAuthUrl({ access_type: "offline", scope: SCOPES, prompt: "consent" });
+    return textResponse(
+      `To add account "${label}", open this URL in your browser:\n\n${authUrl}\n\n` +
+      `After granting access, run:\n  node src/index.js --auth ${label}\nand paste the authorization code.`
+    );
+  } catch (err) { return errorResponse(err.message); }
+});
 
-      if (mimeType === "application/vnd.google-apps.drawing") {
-        return textResponse(`[Google Drawing: ${name}] — Export not supported in read_file. Use export tools.`);
-      }
+// ═══ FILE TOOLS ══════════════════════════════════════════════════════════════
+
+server.registerTool("gdrive_list_files", {
+  description: "List files in Google Drive with optional search query and folder filtering.",
+  inputSchema: {
+    query: z.string().optional().describe("Drive search query (e.g., \"name contains 'report'\")"),
+    folderId: z.string().optional().describe("List files in this folder only"),
+    pageSize: z.number().optional().default(20).describe("Results per page (max 100, default: 20)"),
+    pageToken: z.string().optional().describe("Token for next page of results"),
+    orderBy: z.string().optional().default("modifiedTime desc").describe("Sort order"),
+    outputFormat: OUTPUT_FORMAT_SCHEMA,
+    account: z.string().optional().describe("Account label (default: active account)"),
+  },
+  annotations: { readOnlyHint: true, destructiveHint: false, idempotentHint: true, openWorldHint: true },
+}, async ({ query, folderId, pageSize, pageToken, orderBy, outputFormat, account }) => {
+  try {
+    const { drive } = await getClients(account);
+    let q = "trashed = false";
+    if (folderId) q += ` and '${sanitizeDriveId(folderId)}' in parents`;
+    if (query) q += ` and ${query}`;
+    const res = await drive.files.list({
+      q, pageSize: Math.min(pageSize || 20, 100), pageToken: pageToken || undefined,
+      orderBy: orderBy || "modifiedTime desc", fields: `nextPageToken,files(${LIST_FIELDS})`,
+      supportsAllDrives: true, includeItemsFromAllDrives: true,
+    });
+    return formatOutput({ files: res.data.files || [], nextPageToken: res.data.nextPageToken || null, resultCount: (res.data.files || []).length }, outputFormat);
+  } catch (err) { return errorResponse(err.message); }
+});
 
-      if (mimeType && mimeType.startsWith("application/vnd.google-apps.")) {
-        return errorResponse(`Cannot read Google Workspace type: ${mimeType}. File: ${name}`);
-      }
+server.registerTool("gdrive_get_metadata", {
+  description: "Get detailed metadata for a specific file in Google Drive.",
+  inputSchema: {
+    fileId: z.string().describe("Google Drive file ID"),
+    outputFormat: OUTPUT_FORMAT_SCHEMA,
+    account: z.string().optional().describe("Account label (default: active account)"),
+  },
+  annotations: { readOnlyHint: true, destructiveHint: false, idempotentHint: true, openWorldHint: true },
+}, async ({ fileId, outputFormat, account }) => {
+  try {
+    const { drive } = await getClients(account);
+    const res = await drive.files.get({ fileId, fields: FILE_FIELDS, supportsAllDrives: true });
+    return formatOutput(res.data, outputFormat);
+  } catch (err) { return errorResponse(err.code === 404 ? `File not found: ${fileId}` : err.message); }
+});
 
-      // Regular files — check size
-      const fileSize = parseInt(size, 10) || 0;
-      if (fileSize > MAX_FILE_SIZE) {
-        return jsonResponse({
-          warning: "File exceeds 10MB limit. Returning metadata only.",
-          name,
-          mimeType,
-          size: fileSize,
-          sizeFormatted: `${(fileSize / (1024 * 1024)).toFixed(1)} MB`,
-          webViewLink: meta.data.webViewLink,
-        });
-      }
+server.registerTool("gdrive_read_file", {
+  description: "Read file content. Auto-detects Workspace types: Docs→Markdown, Sheets→CSV, Slides→text. Binary under 10MB as base64.",
+  inputSchema: {
+    fileId: z.string().describe("Google Drive file ID"),
+    account: z.string().optional().describe("Account label (default: active account)"),
+  },
+  annotations: { readOnlyHint: true, destructiveHint: false, idempotentHint: true, openWorldHint: true },
+}, async ({ fileId, account }) => {
+  try {
+    const { drive } = await getClients(account);
+    const meta = await drive.files.get({ fileId, fields: "id,name,mimeType,size,webViewLink", supportsAllDrives: true });
+    const { mimeType, name, size } = meta.data;
 
-      // Download regular file
-      const res = await drive.files.get(
-        { fileId, alt: "media" },
-        { responseType: mimeType?.startsWith("text/") ? "text" : "arraybuffer" }
-      );
+    if (mimeType === "application/vnd.google-apps.document") {
+      const res = await drive.files.export({ fileId, mimeType: "text/html" }, { responseType: "text" });
+      return textResponse(turndown.turndown(res.data));
+    }
+    if (mimeType === "application/vnd.google-apps.spreadsheet") {
+      const res = await drive.files.export({ fileId, mimeType: "text/csv" }, { responseType: "text" });
+      return textResponse(res.data);
+    }
+    if (mimeType === "application/vnd.google-apps.presentation") {
+      const res = await drive.files.export({ fileId, mimeType: "text/plain" }, { responseType: "text" });
+      return textResponse(res.data);
+    }
+    if (mimeType?.startsWith("application/vnd.google-apps.")) {
+      return errorResponse(`Unsupported Workspace type: ${mimeType}. File: ${name}`);
+    }
 
-      if (mimeType?.startsWith("text/")) {
-        return textResponse(res.data);
-      }
+    const fileSize = parseInt(size, 10) || 0;
+    if (fileSize > MAX_FILE_SIZE) {
+      return jsonResponse({ warning: "File exceeds 10MB. Metadata only.", name, mimeType, size: fileSize, webViewLink: meta.data.webViewLink });
+    }
 
-      // Binary — return base64
-      const buffer = Buffer.from(res.data);
-      return textResponse(`[Binary file: ${name} (${mimeType}, ${buffer.length} bytes)]\n\nBase64:\n${buffer.toString("base64")}`);
-    } catch (err) {
-      if (err.code === 404) {
-        return errorResponse(`File not found: ${fileId}. Verify the file ID exists and you have access.`);
-      }
-      return errorResponse(err.message);
+    const res = await drive.files.get({ fileId, alt: "media" }, { responseType: mimeType?.startsWith("text/") ? "text" : "arraybuffer" });
+    if (mimeType?.startsWith("text/")) return textResponse(res.data);
+    return binaryResponse(res.data, `Binary: ${name} (${mimeType})`);
+  } catch (err) { return errorResponse(err.code === 404 ? `File not found: ${fileId}` : err.message); }
+});
+
+server.registerTool("gdrive_download_file", {
+  description: "Download a file from Google Drive to a local disk path. For Workspace files (Docs/Sheets/Slides), exports to the specified format first.",
+  inputSchema: {
+    fileId: z.string().describe("Google Drive file ID"),
+    savePath: z.string().describe("Local file path to save to (absolute or relative)"),
+    exportFormat: z.enum(["pdf", "docx", "xlsx", "pptx", "csv", "txt", "html", "markdown"]).optional().describe("Export format for Workspace files (default: pdf for Docs/Slides, csv for Sheets)"),
+    account: z.string().optional().describe("Account label (default: active account)"),
+  },
+  annotations: { readOnlyHint: false, destructiveHint: false, idempotentHint: true, openWorldHint: true },
+}, async ({ fileId, savePath, exportFormat, account }) => {
+  try {
+    const { drive } = await getClients(account);
+    const meta = await drive.files.get({ fileId, fields: "id,name,mimeType,size", supportsAllDrives: true });
+    const { name, mimeType, size } = meta.data;
+
+    const workspaceExportMap = {
+      "application/vnd.google-apps.document": { default: "pdf", mimeTypes: { pdf: "application/pdf", docx: "application/vnd.openxmlformats-officedocument.wordprocessingml.document", txt: "text/plain", html: "text/html", markdown: "text/html" } },
+      "application/vnd.google-apps.spreadsheet": { default: "csv", mimeTypes: { csv: "text/csv", xlsx: "application/vnd.openxmlformats-officedocument.spreadsheetml.sheet", pdf: "application/pdf" } },
+      "application/vnd.google-apps.presentation": { default: "pdf", mimeTypes: { pdf: "application/pdf", pptx: "application/vnd.openxmlformats-officedocument.presentationml.presentation", txt: "text/plain" } },
+    };
+
+    const wsConfig = workspaceExportMap[mimeType];
+    let data;
+
+    if (wsConfig) {
+      const fmt = exportFormat || wsConfig.default;
+      const exportMime = wsConfig.mimeTypes[fmt];
+      if (!exportMime) return errorResponse(`Unsupported export format "${fmt}" for ${mimeType}. Available: ${Object.keys(wsConfig.mimeTypes).join(", ")}`);
+      const res = await drive.files.export({ fileId, mimeType: exportMime }, { responseType: "arraybuffer" });
+      data = res.data;
+    } else {
+      const res = await drive.files.get({ fileId, alt: "media", supportsAllDrives: true }, { responseType: "arraybuffer" });
+      data = res.data;
     }
-  }
-);
-
-// ─── Tool: gdrive_create_file ────────────────────────────────────────────────
-
-server.registerTool(
-  "gdrive_create_file",
-  {
-    description:
-      "Create a new file in Google Drive with the specified name and content. " +
-      "Optionally specify a parent folder and MIME type.",
-    inputSchema: {
-      name: z.string().describe("File name including extension (e.g., 'notes.txt')"),
-      content: z.string().describe("File content (text)"),
-      mimeType: z.string().optional().default("text/plain").describe("MIME type of content"),
-      parentFolderId: z.string().optional().describe("Parent folder ID (default: root)"),
-    },
-    annotations: {
-      readOnlyHint: false,
-      destructiveHint: false,
-      idempotentHint: false,
-      openWorldHint: true,
-    },
-  },
-  async ({ name, content, mimeType, parentFolderId }) => {
-    try {
-      const drive = await getDrive();
 
-      const fileMetadata = { name };
-      if (parentFolderId) fileMetadata.parents = [parentFolderId];
+    const result = await saveToDisk(data, savePath);
+    return jsonResponse({ downloaded: name, format: exportFormat || (wsConfig ? wsConfig.default : mimeType), path: result.path, size: result.size });
+  } catch (err) { return errorResponse(err.message); }
+});
+
+server.registerTool("gdrive_create_file", {
+  description: "Create a new file in Google Drive. Set ocrLanguage to trigger OCR on image/PDF uploads.",
+  inputSchema: {
+    name: z.string().describe("File name including extension"),
+    content: z.string().describe("File content (text)"),
+    mimeType: z.string().optional().default("text/plain").describe("MIME type of content"),
+    parentFolderId: z.string().optional().describe("Parent folder ID (default: root)"),
+    ocrLanguage: z.string().optional().describe("OCR language hint (e.g., 'en'). Triggers OCR on image/PDF uploads"),
+    account: z.string().optional().describe("Account label (default: active account)"),
+  },
+  annotations: { readOnlyHint: false, destructiveHint: false, idempotentHint: false, openWorldHint: true },
+}, async ({ name, content, mimeType, parentFolderId, ocrLanguage, account }) => {
+  try {
+    const { drive } = await getClients(account);
+    const metadata = { name };
+    if (parentFolderId) metadata.parents = [parentFolderId];
+    const params = { requestBody: metadata, media: { mimeType: mimeType || "text/plain", body: content }, fields: "id,name,mimeType,webViewLink", supportsAllDrives: true };
+    if (ocrLanguage) params.ocrLanguage = ocrLanguage;
+    const res = await drive.files.create(params);
+    return jsonResponse(res.data);
+  } catch (err) { return errorResponse(err.message); }
+});
+
+server.registerTool("gdrive_update_file", {
+  description: "Update an existing file's content, name, or description.",
+  inputSchema: {
+    fileId: z.string().describe("File ID to update"),
+    content: z.string().optional().describe("New file content"),
+    name: z.string().optional().describe("New file name"),
+    description: z.string().optional().describe("New file description"),
+    mimeType: z.string().optional().describe("MIME type of new content"),
+    account: z.string().optional().describe("Account label (default: active account)"),
+  },
+  annotations: { readOnlyHint: false, destructiveHint: false, idempotentHint: true, openWorldHint: true },
+}, async ({ fileId, content, name, description, mimeType, account }) => {
+  try {
+    const { drive } = await getClients(account);
+    const params = { fileId, supportsAllDrives: true, fields: "id,name,mimeType,modifiedTime,webViewLink" };
+    const metadata = {};
+    if (name) metadata.name = name;
+    if (description !== undefined) metadata.description = description;
+    if (Object.keys(metadata).length) params.requestBody = metadata;
+    if (content) params.media = { mimeType: mimeType || "text/plain", body: content };
+    const res = await drive.files.update(params);
+    return jsonResponse(res.data);
+  } catch (err) { return errorResponse(err.message); }
+});
 
-      const media = {
-        mimeType: mimeType || "text/plain",
-        body: content,
-      };
+server.registerTool("gdrive_copy_file", {
+  description: "Copy a file, optionally to a different folder with a new name.",
+  inputSchema: {
+    fileId: z.string().describe("Source file ID"),
+    name: z.string().optional().describe("Name for the copy (default: 'Copy of {original}')"),
+    parentFolderId: z.string().optional().describe("Destination folder ID"),
+    account: z.string().optional().describe("Account label (default: active account)"),
+  },
+  annotations: { readOnlyHint: false, destructiveHint: false, idempotentHint: false, openWorldHint: true },
+}, async ({ fileId, name, parentFolderId, account }) => {
+  try {
+    const { drive } = await getClients(account);
+    const body = {};
+    if (name) body.name = name;
+    if (parentFolderId) body.parents = [parentFolderId];
+    const res = await drive.files.copy({ fileId, requestBody: body, fields: "id,name,mimeType,webViewLink", supportsAllDrives: true });
+    return jsonResponse(res.data);
+  } catch (err) { return errorResponse(err.message); }
+});
 
-      const res = await drive.files.create({
-        requestBody: fileMetadata,
-        media,
-        fields: "id,name,mimeType,webViewLink",
-      });
+server.registerTool("gdrive_move_file", {
+  description: "Move a file to a different folder.",
+  inputSchema: {
+    fileId: z.string().describe("File ID to move"),
+    destinationFolderId: z.string().describe("Target folder ID"),
+    account: z.string().optional().describe("Account label (default: active account)"),
+  },
+  annotations: { readOnlyHint: false, destructiveHint: false, idempotentHint: true, openWorldHint: true },
+}, async ({ fileId, destinationFolderId, account }) => {
+  try {
+    const { drive } = await getClients(account);
+    const file = await drive.files.get({ fileId, fields: "parents", supportsAllDrives: true });
+    const res = await drive.files.update({
+      fileId, addParents: destinationFolderId, removeParents: (file.data.parents || []).join(","),
+      fields: "id,name,parents,webViewLink", supportsAllDrives: true,
+    });
+    return jsonResponse(res.data);
+  } catch (err) { return errorResponse(err.message); }
+});
 
-      return jsonResponse(res.data);
-    } catch (err) {
-      if (err.code === 404) {
-        return errorResponse(`Parent folder not found: ${parentFolderId}`);
-      }
-      return errorResponse(err.message);
+server.registerTool("gdrive_search_files", {
+  description: "Full-text search across file names and content in Google Drive.",
+  inputSchema: {
+    text: z.string().describe("Search text (searches file names and content)"),
+    mimeType: z.string().optional().describe("Filter by MIME type (e.g., 'application/pdf')"),
+    modifiedAfter: z.string().optional().describe("ISO date — only files modified after this date"),
+    trashed: z.boolean().optional().default(false).describe("Include trashed files (default: false)"),
+    maxResults: z.number().optional().default(20).describe("Maximum results (default: 20)"),
+    outputFormat: OUTPUT_FORMAT_SCHEMA,
+    account: z.string().optional().describe("Account label (default: active account)"),
+  },
+  annotations: { readOnlyHint: true, destructiveHint: false, idempotentHint: true, openWorldHint: true },
+}, async ({ text, mimeType, modifiedAfter, trashed, maxResults, outputFormat, account }) => {
+  try {
+    const { drive } = await getClients(account);
+    const parts = [`fullText contains '${text.replace(/'/g, "\\'")}'`];
+    if (!trashed) parts.push("trashed = false");
+    if (mimeType) parts.push(`mimeType = '${mimeType}'`);
+    if (modifiedAfter) parts.push(`modifiedTime > '${modifiedAfter}'`);
+    const res = await drive.files.list({
+      q: parts.join(" and "), pageSize: Math.min(maxResults || 20, 100),
+      fields: `files(${LIST_FIELDS},description)`,
+      supportsAllDrives: true, includeItemsFromAllDrives: true,
+    });
+    return formatOutput({ files: res.data.files || [], resultCount: (res.data.files || []).length }, outputFormat);
+  } catch (err) { return errorResponse(err.message); }
+});
+
+// ═══ FOLDER TOOLS ════════════════════════════════════════════════════════════
+
+server.registerTool("gdrive_create_folder", {
+  description: "Create a new folder in Google Drive.",
+  inputSchema: {
+    name: z.string().describe("Folder name"),
+    parentFolderId: z.string().optional().describe("Parent folder ID (default: root)"),
+    account: z.string().optional().describe("Account label (default: active account)"),
+  },
+  annotations: { readOnlyHint: false, destructiveHint: false, idempotentHint: false, openWorldHint: true },
+}, async ({ name, parentFolderId, account }) => {
+  try {
+    const { drive } = await getClients(account);
+    const metadata = { name, mimeType: "application/vnd.google-apps.folder" };
+    if (parentFolderId) metadata.parents = [parentFolderId];
+    const res = await drive.files.create({ requestBody: metadata, fields: "id,name,mimeType,webViewLink", supportsAllDrives: true });
+    return jsonResponse(res.data);
+  } catch (err) { return errorResponse(err.message); }
+});
+
+server.registerTool("gdrive_list_folder", {
+  description: "List contents of a specific folder.",
+  inputSchema: {
+    folderId: z.string().describe("Folder ID to list contents of"),
+    pageSize: z.number().optional().default(50).describe("Results per page (max 100, default: 50)"),
+    pageToken: z.string().optional().describe("Token for next page"),
+    orderBy: z.string().optional().default("folder,name").describe("Sort order (default: folders first, then by name)"),
+    outputFormat: OUTPUT_FORMAT_SCHEMA,
+    account: z.string().optional().describe("Account label (default: active account)"),
+  },
+  annotations: { readOnlyHint: true, destructiveHint: false, idempotentHint: true, openWorldHint: true },
+}, async ({ folderId, pageSize, pageToken, orderBy, outputFormat, account }) => {
+  try {
+    const { drive } = await getClients(account);
+    const res = await drive.files.list({
+      q: `'${sanitizeDriveId(folderId)}' in parents and trashed = false`,
+      pageSize: Math.min(pageSize || 50, 100), pageToken: pageToken || undefined,
+      orderBy: orderBy || "folder,name", fields: `nextPageToken,files(${LIST_FIELDS})`,
+      supportsAllDrives: true, includeItemsFromAllDrives: true,
+    });
+    return formatOutput({ files: res.data.files || [], nextPageToken: res.data.nextPageToken || null }, outputFormat);
+  } catch (err) { return errorResponse(err.message); }
+});
+
+server.registerTool("gdrive_delete_folder", {
+  description: "Delete a folder (move to trash or permanently delete).",
+  inputSchema: {
+    folderId: z.string().describe("Folder ID to delete"),
+    permanent: z.boolean().optional().default(false).describe("true = permanent delete, false = move to trash (default)"),
+    account: z.string().optional().describe("Account label (default: active account)"),
+  },
+  annotations: { readOnlyHint: false, destructiveHint: true, idempotentHint: false, openWorldHint: true },
+}, async ({ folderId, permanent, account }) => {
+  try {
+    const { drive } = await getClients(account);
+    if (permanent) {
+      await drive.files.delete({ fileId: folderId, supportsAllDrives: true });
+      return textResponse(`Permanently deleted folder ${folderId}`);
     }
-  }
-);
-
-// ─── Tool: gdrive_create_folder ──────────────────────────────────────────────
-
-server.registerTool(
-  "gdrive_create_folder",
-  {
-    description:
-      "Create a new folder in Google Drive. Optionally specify a parent folder.",
-    inputSchema: {
-      name: z.string().describe("Folder name"),
-      parentFolderId: z.string().optional().describe("Parent folder ID (default: root)"),
-    },
-    annotations: {
-      readOnlyHint: false,
-      destructiveHint: false,
-      idempotentHint: false,
-      openWorldHint: true,
-    },
-  },
-  async ({ name, parentFolderId }) => {
-    try {
-      const drive = await getDrive();
+    await drive.files.update({ fileId: folderId, requestBody: { trashed: true }, supportsAllDrives: true });
+    return textResponse(`Moved folder ${folderId} to trash`);
+  } catch (err) { return errorResponse(err.message); }
+});
 
-      const fileMetadata = {
-        name,
-        mimeType: "application/vnd.google-apps.folder",
-      };
-      if (parentFolderId) fileMetadata.parents = [parentFolderId];
+// ═══ TRASH TOOLS ═════════════════════════════════════════════════════════════
 
-      const res = await drive.files.create({
-        requestBody: fileMetadata,
-        fields: "id,name,mimeType,webViewLink",
-      });
+server.registerTool("gdrive_trash_file", {
+  description: "Move a file or folder to trash.",
+  inputSchema: {
+    fileId: z.string().describe("File or folder ID to trash"),
+    account: z.string().optional().describe("Account label (default: active account)"),
+  },
+  annotations: { readOnlyHint: false, destructiveHint: true, idempotentHint: true, openWorldHint: true },
+}, async ({ fileId, account }) => {
+  try {
+    const { drive } = await getClients(account);
+    const res = await drive.files.update({ fileId, requestBody: { trashed: true }, fields: "id,name,trashed", supportsAllDrives: true });
+    return jsonResponse(res.data);
+  } catch (err) { return errorResponse(err.message); }
+});
 
-      return jsonResponse(res.data);
-    } catch (err) {
-      if (err.code === 404) {
-        return errorResponse(`Parent folder not found: ${parentFolderId}`);
-      }
-      return errorResponse(err.message);
+server.registerTool("gdrive_untrash_file", {
+  description: "Restore a file or folder from trash.",
+  inputSchema: {
+    fileId: z.string().describe("File or folder ID to restore"),
+    account: z.string().optional().describe("Account label (default: active account)"),
+  },
+  annotations: { readOnlyHint: false, destructiveHint: false, idempotentHint: true, openWorldHint: true },
+}, async ({ fileId, account }) => {
+  try {
+    const { drive } = await getClients(account);
+    const res = await drive.files.update({ fileId, requestBody: { trashed: false }, fields: "id,name,trashed", supportsAllDrives: true });
+    return jsonResponse(res.data);
+  } catch (err) { return errorResponse(err.message); }
+});
+
+server.registerTool("gdrive_empty_trash", {
+  description: "Permanently delete ALL files in trash. Irreversible. Note: Google returns success before files are fully purged (eventual consistency — files may still appear briefly in trash listings).",
+  inputSchema: {
+    account: z.string().optional().describe("Account label (default: active account)"),
+  },
+  annotations: { readOnlyHint: false, destructiveHint: true, idempotentHint: true, openWorldHint: true },
+}, async ({ account }) => {
+  try {
+    const { drive } = await getClients(account);
+    await drive.files.emptyTrash({ supportsAllDrives: true });
+    return textResponse("Trash emptied. All trashed files permanently deleted.");
+  } catch (err) { return errorResponse(err.message); }
+});
+
+server.registerTool("gdrive_list_trash", {
+  description: "List files currently in trash.",
+  inputSchema: {
+    pageSize: z.number().optional().default(20).describe("Results per page (max 100, default: 20)"),
+    pageToken: z.string().optional().describe("Token for next page"),
+    outputFormat: OUTPUT_FORMAT_SCHEMA,
+    account: z.string().optional().describe("Account label (default: active account)"),
+  },
+  annotations: { readOnlyHint: true, destructiveHint: false, idempotentHint: true, openWorldHint: true },
+}, async ({ pageSize, pageToken, outputFormat, account }) => {
+  try {
+    const { drive } = await getClients(account);
+    const res = await drive.files.list({
+      q: "trashed = true", pageSize: Math.min(pageSize || 20, 100),
+      pageToken: pageToken || undefined, fields: `nextPageToken,files(${LIST_FIELDS},trashedTime)`, orderBy: "modifiedTime desc",
+      supportsAllDrives: true, includeItemsFromAllDrives: true,
+    });
+    return formatOutput({ files: res.data.files || [], nextPageToken: res.data.nextPageToken || null }, outputFormat);
+  } catch (err) { return errorResponse(err.message); }
+});
+
+// ═══ PERMISSION TOOLS ════════════════════════════════════════════════════════
+
+server.registerTool("gdrive_share_file", {
+  description: "Share a file or folder with a user, group, domain, or anyone.",
+  inputSchema: {
+    fileId: z.string().describe("File or folder ID to share"),
+    role: z.enum(["reader", "commenter", "writer", "organizer"]).describe("Permission role"),
+    type: z.enum(["user", "group", "domain", "anyone"]).optional().default("user").describe("Permission type (default: user)"),
+    email: z.string().optional().describe("Email address (required for type=user or type=group)"),
+    domain: z.string().optional().describe("Domain (required for type=domain)"),
+    sendNotification: z.boolean().optional().default(true).describe("Send email notification (default: true)"),
+    message: z.string().optional().describe("Custom message in the notification email"),
+    account: z.string().optional().describe("Account label (default: active account)"),
+  },
+  annotations: { readOnlyHint: false, destructiveHint: false, idempotentHint: false, openWorldHint: true },
+}, async ({ fileId, role, type, email, domain, sendNotification, message, account }) => {
+  try {
+    const { drive } = await getClients(account);
+    const permission = { role, type };
+    if (email) permission.emailAddress = email;
+    if (domain) permission.domain = domain;
+    const res = await drive.permissions.create({
+      fileId, requestBody: permission, sendNotificationEmail: sendNotification,
+      emailMessage: message || undefined, fields: "id,role,type,emailAddress,domain", supportsAllDrives: true,
+    });
+    return jsonResponse(res.data);
+  } catch (err) { return errorResponse(err.message); }
+});
+
+server.registerTool("gdrive_list_permissions", {
+  description: "List all permissions (sharing) on a file or folder.",
+  inputSchema: {
+    fileId: z.string().describe("File or folder ID"),
+    outputFormat: OUTPUT_FORMAT_SCHEMA,
+    account: z.string().optional().describe("Account label (default: active account)"),
+  },
+  annotations: { readOnlyHint: true, destructiveHint: false, idempotentHint: true, openWorldHint: true },
+}, async ({ fileId, outputFormat, account }) => {
+  try {
+    const { drive } = await getClients(account);
+    const res = await drive.permissions.list({
+      fileId, fields: "permissions(id,role,type,emailAddress,domain,displayName)", supportsAllDrives: true,
+    });
+    return formatOutput({ permissions: res.data.permissions || [] }, outputFormat);
+  } catch (err) { return errorResponse(err.message); }
+});
+
+server.registerTool("gdrive_update_permission", {
+  description: "Update a permission's role on a file or folder.",
+  inputSchema: {
+    fileId: z.string().describe("File or folder ID"),
+    permissionId: z.string().describe("Permission ID (from gdrive_list_permissions)"),
+    role: z.enum(["reader", "commenter", "writer", "organizer"]).describe("New role"),
+    account: z.string().optional().describe("Account label (default: active account)"),
+  },
+  annotations: { readOnlyHint: false, destructiveHint: false, idempotentHint: true, openWorldHint: true },
+}, async ({ fileId, permissionId, role, account }) => {
+  try {
+    const { drive } = await getClients(account);
+    const res = await drive.permissions.update({
+      fileId, permissionId, requestBody: { role }, fields: "id,role,type,emailAddress", supportsAllDrives: true,
+    });
+    return jsonResponse(res.data);
+  } catch (err) { return errorResponse(err.message); }
+});
+
+server.registerTool("gdrive_remove_permission", {
+  description: "Remove a permission (unshare) from a file or folder.",
+  inputSchema: {
+    fileId: z.string().describe("File or folder ID"),
+    permissionId: z.string().describe("Permission ID to remove"),
+    account: z.string().optional().describe("Account label (default: active account)"),
+  },
+  annotations: { readOnlyHint: false, destructiveHint: true, idempotentHint: true, openWorldHint: true },
+}, async ({ fileId, permissionId, account }) => {
+  try {
+    const { drive } = await getClients(account);
+    await drive.permissions.delete({ fileId, permissionId, supportsAllDrives: true });
+    return textResponse(`Permission ${permissionId} removed from ${fileId}`);
+  } catch (err) { return errorResponse(err.message); }
+});
+
+server.registerTool("gdrive_transfer_ownership", {
+  description: "Transfer ownership of a file to another user. Note: cross-organization transfers (e.g., personal to Workspace) are blocked by Google.",
+  inputSchema: {
+    fileId: z.string().describe("File ID to transfer"),
+    email: z.string().describe("New owner's email address"),
+    account: z.string().optional().describe("Account label (default: active account)"),
+  },
+  annotations: { readOnlyHint: false, destructiveHint: true, idempotentHint: true, openWorldHint: true },
+}, async ({ fileId, email, account }) => {
+  try {
+    const { drive } = await getClients(account);
+    const res = await drive.permissions.create({
+      fileId, requestBody: { role: "owner", type: "user", emailAddress: email },
+      transferOwnership: true, fields: "id,role,type,emailAddress", supportsAllDrives: true,
+    });
+    return jsonResponse(res.data);
+  } catch (err) { return errorResponse(err.message); }
+});
+
+// ═══ LABEL TOOLS ═════════════════════════════════════════════════════════════
+
+server.registerTool("gdrive_list_labels", {
+  description: "List available Drive labels that can be applied to files.",
+  inputSchema: {
+    outputFormat: OUTPUT_FORMAT_SCHEMA,
+    account: z.string().optional().describe("Account label (default: active account)"),
+  },
+  annotations: { readOnlyHint: true, destructiveHint: false, idempotentHint: true, openWorldHint: true },
+}, async ({ outputFormat, account }) => {
+  try {
+    const config = await loadConfig();
+    const label = account || config.active || "primary";
+    const auth = await authorizeAccount(label);
+    const labels = google.drivelabels({ version: "v2", auth });
+    const res = await labels.labels.list({ publishedOnly: true, view: "LABEL_VIEW_FULL" });
+    return formatOutput({ labels: res.data.labels || [] }, outputFormat);
+  } catch (err) { return errorResponse(err.message); }
+});
+
+server.registerTool("gdrive_list_file_labels", {
+  description: "List labels currently applied to a file.",
+  inputSchema: {
+    fileId: z.string().describe("File ID"),
+    outputFormat: OUTPUT_FORMAT_SCHEMA,
+    account: z.string().optional().describe("Account label (default: active account)"),
+  },
+  annotations: { readOnlyHint: true, destructiveHint: false, idempotentHint: true, openWorldHint: true },
+}, async ({ fileId, outputFormat, account }) => {
+  try {
+    const { drive } = await getClients(account);
+    const res = await drive.files.listLabels({ fileId });
+    return formatOutput({ labels: res.data.labels || [] }, outputFormat);
+  } catch (err) { return errorResponse(err.message); }
+});
+
+server.registerTool("gdrive_set_file_labels", {
+  description: "Add, update, or remove a label on a file.",
+  inputSchema: {
+    fileId: z.string().describe("File ID"),
+    labelId: z.string().describe("Label ID (from gdrive_list_labels)"),
+    fields: z.record(z.string(), z.union([z.string(), z.number(), z.boolean(), z.null()])).optional().describe("Field values to set (key: fieldId, value: field value)"),
+    remove: z.boolean().optional().default(false).describe("true = remove this label from the file"),
+    account: z.string().optional().describe("Account label (default: active account)"),
+  },
+  annotations: { readOnlyHint: false, destructiveHint: false, idempotentHint: true, openWorldHint: true },
+}, async ({ fileId, labelId, fields, remove, account }) => {
+  try {
+    const { drive } = await getClients(account);
+    const mod = { labelId };
+    if (remove) {
+      mod.removeLabel = true;
+    } else if (fields) {
+      mod.fieldModifications = Object.entries(fields).map(([fieldId, value]) => ({
+        fieldId, setValues: value !== null ? [value] : undefined, unsetValues: value === null ? true : undefined,
+      }));
     }
-  }
-);
+    const res = await drive.files.modifyLabels({ fileId, requestBody: { labelModifications: [mod] } });
+    return jsonResponse(res.data);
+  } catch (err) { return errorResponse(err.message); }
+});
+
+// ═══ DOCS TOOLS ══════════════════════════════════════════════════════════════
+
+server.registerTool("gdrive_export_doc", {
+  description: "Export a Google Doc. Default: markdown. Also: html, text, docx, pdf. Use savePath to save binary formats to disk.",
+  inputSchema: {
+    fileId: z.string().describe("Google Doc file ID"),
+    format: z.enum(["markdown", "html", "text", "docx", "pdf"]).optional().default("markdown").describe("Export format (default: markdown)"),
+    savePath: z.string().optional().describe("Local file path to save binary exports (docx/pdf). If omitted, returns base64."),
+    account: z.string().optional().describe("Account label (default: active account)"),
+  },
+  annotations: { readOnlyHint: true, destructiveHint: false, idempotentHint: true, openWorldHint: true },
+}, async ({ fileId, format, savePath, account }) => {
+  try {
+    const { drive } = await getClients(account);
+    const mimeMap = { markdown: "text/html", html: "text/html", text: "text/plain", docx: "application/vnd.openxmlformats-officedocument.wordprocessingml.document", pdf: "application/pdf" };
+    const isBinary = ["docx", "pdf"].includes(format);
+    const res = await drive.files.export({ fileId, mimeType: mimeMap[format] }, { responseType: isBinary ? "arraybuffer" : "text" });
+    if (format === "markdown") return textResponse(turndown.turndown(res.data));
+    if (isBinary) return handleBinaryExport(res.data, format, savePath);
+    return textResponse(res.data);
+  } catch (err) { return errorResponse(err.message); }
+});
+
+server.registerTool("gdrive_create_doc", {
+  description: "Create a new Google Doc from Markdown content.",
+  inputSchema: {
+    name: z.string().describe("Document title"),
+    markdownContent: z.string().describe("Markdown content to convert to Google Doc"),
+    parentFolderId: z.string().optional().describe("Parent folder ID (default: root)"),
+    account: z.string().optional().describe("Account label (default: active account)"),
+  },
+  annotations: { readOnlyHint: false, destructiveHint: false, idempotentHint: false, openWorldHint: true },
+}, async ({ name, markdownContent, parentFolderId, account }) => {
+  try {
+    const { drive } = await getClients(account);
+    const metadata = { name, mimeType: "application/vnd.google-apps.document" };
+    if (parentFolderId) metadata.parents = [parentFolderId];
+    const res = await drive.files.create({
+      requestBody: metadata, media: { mimeType: "text/html", body: markdownToHtml(markdownContent) },
+      fields: "id,name,mimeType,webViewLink", supportsAllDrives: true,
+    });
+    return jsonResponse(res.data);
+  } catch (err) { return errorResponse(err.message); }
+});
+
+server.registerTool("gdrive_update_doc", {
+  description: "Replace a Google Doc's content with new Markdown.",
+  inputSchema: {
+    fileId: z.string().describe("Google Doc file ID"),
+    markdownContent: z.string().describe("New Markdown content (replaces entire document)"),
+    account: z.string().optional().describe("Account label (default: active account)"),
+  },
+  annotations: { readOnlyHint: false, destructiveHint: false, idempotentHint: true, openWorldHint: true },
+}, async ({ fileId, markdownContent, account }) => {
+  try {
+    const { drive } = await getClients(account);
+    const res = await drive.files.update({
+      fileId, media: { mimeType: "text/html", body: markdownToHtml(markdownContent) },
+      fields: "id,name,modifiedTime,webViewLink", supportsAllDrives: true,
+    });
+    return jsonResponse(res.data);
+  } catch (err) { return errorResponse(err.message); }
+});
+
+// ═══ SHEETS TOOLS ════════════════════════════════════════════════════════════
+
+server.registerTool("gdrive_create_sheet", {
+  description: "Create a new Google Spreadsheet.",
+  inputSchema: {
+    name: z.string().describe("Spreadsheet title"),
+    sheetNames: z.array(z.string()).optional().describe("Sheet/tab names (default: ['Sheet1'])"),
+    parentFolderId: z.string().optional().describe("Parent folder ID (default: root)"),
+    account: z.string().optional().describe("Account label (default: active account)"),
+  },
+  annotations: { readOnlyHint: false, destructiveHint: false, idempotentHint: false, openWorldHint: true },
+}, async ({ name, sheetNames, parentFolderId, account }) => {
+  try {
+    const { sheets, drive } = await getClients(account);
+    const sheetProps = (sheetNames || ["Sheet1"]).map((title, i) => ({ properties: { title, index: i } }));
+    const res = await sheets.spreadsheets.create({ requestBody: { properties: { title: name }, sheets: sheetProps } });
+    if (parentFolderId) {
+      await drive.files.update({ fileId: res.data.spreadsheetId, addParents: parentFolderId, removeParents: "root", supportsAllDrives: true });
+    }
+    return jsonResponse({ spreadsheetId: res.data.spreadsheetId, title: res.data.properties.title, url: res.data.spreadsheetUrl });
+  } catch (err) { return errorResponse(err.message); }
+});
+
+server.registerTool("gdrive_export_sheet", {
+  description: "Export a Google Sheet to CSV, JSON, or XLSX. Use savePath to save XLSX to disk.",
+  inputSchema: {
+    fileId: z.string().describe("Google Sheet file ID"),
+    format: z.enum(["csv", "json", "xlsx"]).optional().default("csv").describe("Export format (default: csv)"),
+    sheetName: z.string().optional().describe("Specific sheet/tab name (default: first sheet). Only for csv/json."),
+    savePath: z.string().optional().describe("Local file path to save XLSX export. If omitted, returns base64."),
+    account: z.string().optional().describe("Account label (default: active account)"),
+  },
+  annotations: { readOnlyHint: true, destructiveHint: false, idempotentHint: true, openWorldHint: true },
+}, async ({ fileId, format, sheetName, savePath, account }) => {
+  try {
+    const { sheets, drive } = await getClients(account);
+    if (format === "xlsx") {
+      const res = await drive.files.export({ fileId, mimeType: "application/vnd.openxmlformats-officedocument.spreadsheetml.sheet" }, { responseType: "arraybuffer" });
+      return handleBinaryExport(res.data, "xlsx", savePath);
+    }
+    let rangeParam = sheetName;
+    if (!rangeParam) {
+      const meta = await sheets.spreadsheets.get({ spreadsheetId: fileId, fields: "sheets.properties" });
+      rangeParam = meta.data.sheets?.[0]?.properties?.title || "Sheet1";
+    }
+    const res = await sheets.spreadsheets.values.get({ spreadsheetId: fileId, range: rangeParam, valueRenderOption: "FORMATTED_VALUE" });
+    const rows = res.data.values || [];
+    if (format === "json" && rows.length > 0) {
+      const headers = rows[0];
+      return jsonResponse(rows.slice(1).map(row => {
+        const obj = {};
+        headers.forEach((h, i) => { obj[h] = row[i] ?? null; });
+        return obj;
+      }));
+    }
+    return textResponse(rows.map(row => row.map(cell => {
+      const s = String(cell ?? "");
+      return s.includes(",") || s.includes('"') || s.includes("\n") ? `"${s.replace(/"/g, '""')}"` : s;
+    }).join(",")).join("\n"));
+  } catch (err) { return errorResponse(err.message); }
+});
+
+server.registerTool("gdrive_list_sheets", {
+  description: "List all sheets/tabs in a Google Spreadsheet.",
+  inputSchema: {
+    fileId: z.string().describe("Google Sheet file ID"),
+    outputFormat: OUTPUT_FORMAT_SCHEMA,
+    account: z.string().optional().describe("Account label (default: active account)"),
+  },
+  annotations: { readOnlyHint: true, destructiveHint: false, idempotentHint: true, openWorldHint: true },
+}, async ({ fileId, outputFormat, account }) => {
+  try {
+    const { sheets } = await getClients(account);
+    const res = await sheets.spreadsheets.get({ spreadsheetId: fileId, fields: "sheets.properties" });
+    return formatOutput({ sheets: (res.data.sheets || []).map(s => ({ title: s.properties.title, sheetId: s.properties.sheetId, index: s.properties.index, rowCount: s.properties.gridProperties?.rowCount, columnCount: s.properties.gridProperties?.columnCount })) }, outputFormat);
+  } catch (err) { return errorResponse(err.message); }
+});
+
+server.registerTool("gdrive_read_sheet_range", {
+  description: "Read a specific range from a Google Sheet tab.",
+  inputSchema: {
+    fileId: z.string().describe("Google Sheet file ID"),
+    range: z.string().describe("A1 notation range (e.g., 'Sheet1!A1:D10', 'Sales!A:A')"),
+    valueRender: z.enum(["formatted", "unformatted", "formula"]).optional().default("formatted").describe("How to render values (default: formatted)"),
+    outputFormat: OUTPUT_FORMAT_SCHEMA,
+    account: z.string().optional().describe("Account label (default: active account)"),
+  },
+  annotations: { readOnlyHint: true, destructiveHint: false, idempotentHint: true, openWorldHint: true },
+}, async ({ fileId, range, valueRender, outputFormat, account }) => {
+  try {
+    const { sheets } = await getClients(account);
+    const renderMap = { formatted: "FORMATTED_VALUE", unformatted: "UNFORMATTED_VALUE", formula: "FORMULA" };
+    const res = await sheets.spreadsheets.values.get({ spreadsheetId: fileId, range, valueRenderOption: renderMap[valueRender] || "FORMATTED_VALUE" });
+    return formatOutput({ range: res.data.range, values: res.data.values || [] }, outputFormat);
+  } catch (err) { return errorResponse(err.message); }
+});
+
+server.registerTool("gdrive_write_sheet_range", {
+  description: "Write data to a specific range in a Google Sheet.",
+  inputSchema: {
+    fileId: z.string().describe("Google Sheet file ID"),
+    range: z.string().describe("A1 notation range (e.g., 'Sheet1!A1')"),
+    values: z.array(z.array(z.union([z.string(), z.number(), z.boolean(), z.null()]))).describe("2D array of values (rows x columns)"),
+    valueInput: z.enum(["raw", "user_entered"]).optional().default("user_entered").describe("How to interpret values (default: user_entered)"),
+    account: z.string().optional().describe("Account label (default: active account)"),
+  },
+  annotations: { readOnlyHint: false, destructiveHint: false, idempotentHint: true, openWorldHint: true },
+}, async ({ fileId, range, values, valueInput, account }) => {
+  try {
+    const { sheets } = await getClients(account);
+    const res = await sheets.spreadsheets.values.update({
+      spreadsheetId: fileId, range, valueInputOption: valueInput === "raw" ? "RAW" : "USER_ENTERED", requestBody: { values },
+    });
+    return jsonResponse({ updatedRange: res.data.updatedRange, updatedRows: res.data.updatedRows, updatedColumns: res.data.updatedColumns, updatedCells: res.data.updatedCells });
+  } catch (err) { return errorResponse(err.message); }
+});
+
+// ═══ SLIDES TOOLS ════════════════════════════════════════════════════════════
+
+server.registerTool("gdrive_create_slides", {
+  description: "Create a new Google Slides presentation.",
+  inputSchema: {
+    name: z.string().describe("Presentation title"),
+    parentFolderId: z.string().optional().describe("Parent folder ID (default: root)"),
+    account: z.string().optional().describe("Account label (default: active account)"),
+  },
+  annotations: { readOnlyHint: false, destructiveHint: false, idempotentHint: false, openWorldHint: true },
+}, async ({ name, parentFolderId, account }) => {
+  try {
+    const { slides, drive } = await getClients(account);
+    const res = await slides.presentations.create({ requestBody: { title: name } });
+    if (parentFolderId) {
+      await drive.files.update({ fileId: res.data.presentationId, addParents: parentFolderId, removeParents: "root", supportsAllDrives: true });
+    }
+    return jsonResponse({ presentationId: res.data.presentationId, title: res.data.title, url: `https://docs.google.com/presentation/d/${res.data.presentationId}` });
+  } catch (err) { return errorResponse(err.message); }
+});
+
+server.registerTool("gdrive_export_slides", {
+  description: "Export Google Slides to text, PDF, or PPTX. Use savePath to save binary formats to disk.",
+  inputSchema: {
+    fileId: z.string().describe("Google Slides file ID"),
+    format: z.enum(["text", "pdf", "pptx"]).optional().default("text").describe("Export format (default: text)"),
+    savePath: z.string().optional().describe("Local file path to save binary exports (pdf/pptx). If omitted, returns base64."),
+    account: z.string().optional().describe("Account label (default: active account)"),
+  },
+  annotations: { readOnlyHint: true, destructiveHint: false, idempotentHint: true, openWorldHint: true },
+}, async ({ fileId, format, savePath, account }) => {
+  try {
+    const { drive } = await getClients(account);
+    const mimeMap = { text: "text/plain", pdf: "application/pdf", pptx: "application/vnd.openxmlformats-officedocument.presentationml.presentation" };
+    const isBinary = ["pdf", "pptx"].includes(format);
+    const res = await drive.files.export({ fileId, mimeType: mimeMap[format] }, { responseType: isBinary ? "arraybuffer" : "text" });
+    if (isBinary) return handleBinaryExport(res.data, format, savePath);
+    return textResponse(res.data);
+  } catch (err) { return errorResponse(err.message); }
+});
+
+server.registerTool("gdrive_get_slide_thumbnail", {
+  description: "Get a thumbnail image URL for a specific slide.",
+  inputSchema: {
+    fileId: z.string().describe("Google Slides file ID"),
+    slideIndex: z.number().optional().default(0).describe("Slide index, 0-based (default: first slide)"),
+    outputFormat: OUTPUT_FORMAT_SCHEMA,
+    account: z.string().optional().describe("Account label (default: active account)"),
+  },
+  annotations: { readOnlyHint: true, destructiveHint: false, idempotentHint: true, openWorldHint: true },
+}, async ({ fileId, slideIndex, outputFormat, account }) => {
+  try {
+    const { slides } = await getClients(account);
+    const pres = await slides.presentations.get({ presentationId: fileId, fields: "slides.objectId" });
+    const pages = pres.data.slides || [];
+    if (slideIndex >= pages.length) return errorResponse(`Slide index ${slideIndex} out of range (${pages.length} slides)`);
+    const thumb = await slides.presentations.pages.getThumbnail({ presentationId: fileId, pageObjectId: pages[slideIndex].objectId, "thumbnailProperties.mimeType": "PNG" });
+    return formatOutput({ slideIndex, pageId: pages[slideIndex].objectId, thumbnailUrl: thumb.data.contentUrl, width: thumb.data.width, height: thumb.data.height }, outputFormat);
+  } catch (err) { return errorResponse(err.message); }
+});
 
 // ─── Start ───────────────────────────────────────────────────────────────────
 
 async function main() {
-  // Handle --auth flag for interactive first-run authorization
-  if (process.argv.includes("--auth")) {
-    await interactiveAuth();
+  const authIndex = process.argv.indexOf("--auth");
+  if (authIndex !== -1) {
+    const label = process.argv[authIndex + 1] || "primary";
+    await interactiveAuth(label);
     process.exit(0);
   }
 
+  await ensureConfigDirs();
+  const config = await loadConfig();
+
+  // Migrate legacy single token.json
+  if (Object.keys(config.accounts).length === 0) {
+    const legacyToken = join(CONFIG_DIR, "token.json");
+    if (existsSync(legacyToken)) {
+      const token = JSON.parse(await readFile(legacyToken, "utf-8"));
+      await saveTokenFile("primary", token);
+      config.accounts.primary = { email: "migrated" };
+      config.active = "primary";
+      await saveConfig(config);
+      process.stderr.write("Migrated legacy token.json to tokens/primary.json\n");
+    }
+  }
+
   try {
-    authClient = await authorize();
-    driveClient = google.drive({ version: "v3", auth: authClient });
+    await getClients(config.active);
   } catch (err) {
     process.stderr.write(`\nAuth error: ${err.message}\n`);
     process.exit(1);