mcp-google-multi 5.1.0-alpha.4 → 5.1.0-alpha.5

package/README.md

@@ -96,6 +96,8 @@ Every read tool's `account` argument also accepts `"*"` (all configured accounts
 
 Fan-out is **read-only by design** (write tools take exactly one account), and the three read tools that save files to disk (`drive_download`, `drive_export`, `gmail_download_attachment`) are excluded so parallel accounts can't clobber the same path. `account_list` shows what's configured: alias, email, token health (`ok` / `expired_refreshable` / `needs_reauth` / `missing` / `decrypt_error`), and granted-vs-configured scopes — without ever touching token values.
 
+`drive_transfer` copies or moves a file between two of your accounts: server-side share+copy when possible (the temporary read grant on the source is revoked right after; the copy gets a clean name, never "Copy of"), download+upload as the fallback. `move: true` trashes the source after a successful copy — that part is **delete-gated by write-control**, so `safe-writes` can copy but never move. Comments, revision history, and permissions don't transfer; if the fallback has to change the format (Drawings export as PNG), the result is flagged `lossy` and a requested move keeps the source intact. Native files over Google's 10MB export cap and binaries over 1GB can't take the fallback path.
+
 ## Escape hatch: any Workspace REST method
 
 Two eager tools cover everything the curated set doesn't: `google_api_search` finds any method in Google's API Discovery index (including APIs with no dedicated tools here, like Slides), and `google_api_call` invokes a method by its Discovery id (`drive.revisions.list`, `slides.presentations.create`, …) with path/query params and a JSON body. Calls run through your account's OAuth client and the **same write-control policy** as named tools: the read/create/update/delete class is derived from the method's HTTP verb and name (POST deletes like `batchDelete`/`clear` count as deletes), and policy globs/`GOOGLE_TOOLSETS` match the same service names as named tools (`people` counts as `contacts`, `admin_*` as `admin`; `slides`/`driveactivity`/`drivelabels`/`groupssettings` have no named service and are always available).

package/dist/registry.d.ts

@@ -21,6 +21,7 @@ export declare function inferCud(name: string): Cud;
 export declare class ToolRegistry {
     private readonly server;
     readonly tools: ToolEntry[];
+    readonly policy: Policy;
     readonly registerTool: McpServer['registerTool'];
     private readonly revealed;
     private readonly jsonSchemaCache;

package/dist/registry.js

@@ -5,12 +5,12 @@ import { compactResult, trimEnabled } from './trim.js';
 import { fanoutAccountField, invalidAccountsResult, parseAccountSelector, runFanout } from './fanout.js';
 const CUD_OVERRIDES = {
     drive_untrash: 'update',
+    drive_transfer: 'create',
 };
 const SERVICE_OVERRIDES = {
     reports_activities_list: 'admin',
 };
-// Read tools that write to the local filesystem: fanning the same savePath
-// across accounts would clobber (last write wins).
+// read tools that write local files — same savePath fanned across accounts would clobber
 const FANOUT_EXCLUDE = new Set(['gmail_download_attachment', 'drive_download', 'drive_export']);
 function isAccountEnum(field) {
     return field?._zod?.def?.type === 'enum';
@@ -33,6 +33,7 @@ export function inferCud(name) {
 export class ToolRegistry {
     server;
     tools = [];
+    policy;
     registerTool;
     revealed = new Set();
     jsonSchemaCache = new Map();
@@ -40,6 +41,7 @@ export class ToolRegistry {
     registeringMeta = false;
     constructor(server, policy) {
         this.server = server;
+        this.policy = policy;
         this.registerTool = ((name, config, handler) => {
             const service = SERVICE_OVERRIDES[name] ?? (name.includes('_') ? name.slice(0, name.indexOf('_')) : name);
             const cud = inferCud(name);
@@ -49,8 +51,7 @@ export class ToolRegistry {
                 destructiveHint: cud === 'delete' || cud === 'update',
                 ...config.annotations,
             };
-            // Fan-out is read-only and never applies to meta tools: google_api_call's
-            // registry cud is "read" but it executes arbitrary writes.
+            // never fan out meta tools: google_api_call infers cud=read but executes writes
             let inputShape = config.inputSchema ?? {};
             let baseHandler = handler;
             if (cud === 'read' && !this.registeringMeta && !FANOUT_EXCLUDE.has(name) && isAccountEnum(inputShape.account)) {

package/dist/tools/drive.d.ts

@@ -1,2 +1,12 @@
 import type { ToolRegistry } from '../registry.js';
 export declare function registerDriveTools(server: ToolRegistry): void;
+export type TransferPlan = {
+    kind: 'binary';
+} | {
+    kind: 'native';
+    exportMime: string;
+    convertTo?: string;
+} | {
+    kind: 'unsupported';
+};
+export declare function transferExportPlan(mimeType: string | null | undefined): TransferPlan;

package/dist/tools/drive.js

@@ -1,16 +1,20 @@
 import { z } from 'zod';
 import { coerceArray, coerceBoolean } from './_coerce.js';
 import { google } from 'googleapis';
-import { ACCOUNTS } from '../accounts.js';
+import { ACCOUNTS, ACCOUNT_CONFIG } from '../accounts.js';
 import { getClient } from '../client.js';
 import { handleGoogleApiError } from './_errors.js';
+import { isAllowed, writeDisabledResult } from '../write-control.js';
 import { capText } from '../trim.js';
 import * as fs from 'fs';
 import * as path from 'path';
+import * as os from 'os';
+import * as crypto from 'crypto';
 import { pipeline } from 'node:stream/promises';
 import mime from 'mime-types';
 const accountEnum = z.enum(ACCOUNTS);
 const MAX_FILE_SIZE = 2 * 1024 * 1024; // 2MB
+const FALLBACK_MAX_BYTES = 1024 * 1024 * 1024; // 1GB
 const GOOGLE_WORKSPACE_TYPES = new Set([
     'application/vnd.google-apps.document',
     'application/vnd.google-apps.spreadsheet',
@@ -1067,6 +1071,134 @@ export function registerDriveTools(server) {
             return handleDriveError(error, account);
         }
     });
+    // ─── Cross-account transfer ────────────────────────────────────────────
+    server.registerTool('drive_transfer', {
+        description: 'Copy or move a file from one configured account to another (server-side share+copy, with a ' +
+            'download+upload fallback). The copy is owned by the target account with a clean name ' +
+            '(no "Copy of"); the temporary share on the source is revoked afterwards. Comments, ' +
+            'revision history, and permissions do not transfer. move=true trashes the source after a ' +
+            'successful copy and requires deletes to be allowed by write-control.',
+        inputSchema: {
+            fromAccount: accountEnum.describe('Source account alias'),
+            toAccount: accountEnum.describe('Target account alias'),
+            fileId: z.string().describe('File ID in the source account (folders are not supported)'),
+            parentFolderId: z.string().optional().describe('Target folder ID (default: target My Drive root)'),
+            newName: z.string().optional().describe('Rename the copy (default: keep the source name)'),
+            move: coerceBoolean.optional().describe('Trash the source after a successful copy (delete-gated)'),
+        },
+    }, async ({ fromAccount, toAccount, fileId, parentFolderId, newName, move }) => {
+        // op candidate is transfer_move, not transfer: allowing "drive:transfer" must not grant the delete
+        const moveRef = { name: 'drive_transfer_move', service: 'drive', cud: 'delete' };
+        if (move && !isAllowed(moveRef, server.policy)) {
+            return writeDisabledResult(moveRef, server.policy);
+        }
+        if (fromAccount === toAccount) {
+            return {
+                content: [{
+                        type: 'text',
+                        text: JSON.stringify({
+                            error: 'validation_error',
+                            message: 'fromAccount and toAccount are the same.',
+                            hint: 'Use drive_copy to duplicate a file within one account.',
+                            retriable: false,
+                        }),
+                    }],
+                isError: true,
+            };
+        }
+        let activeAccount = fromAccount;
+        try {
+            const sourceAuth = await getClient(fromAccount);
+            const sourceDrive = google.drive({ version: 'v3', auth: sourceAuth });
+            activeAccount = toAccount;
+            const targetAuth = await getClient(toAccount);
+            const targetDrive = google.drive({ version: 'v3', auth: targetAuth });
+            activeAccount = fromAccount;
+            const meta = await sourceDrive.files.get({
+                fileId,
+                fields: 'id,name,mimeType,size',
+                supportsAllDrives: true,
+            });
+            if (meta.data.mimeType === 'application/vnd.google-apps.folder') {
+                return {
+                    content: [{
+                            type: 'text',
+                            text: JSON.stringify({
+                                error: 'validation_error',
+                                message: 'Folders cannot be transferred.',
+                                hint: 'Transfer files individually, or create the folder on the target with drive_create_folder.',
+                                retriable: false,
+                            }),
+                        }],
+                    isError: true,
+                };
+            }
+            const intendedName = newName ?? meta.data.name ?? 'transferred-file';
+            const targetEmail = ACCOUNT_CONFIG[toAccount].email;
+            const finish = async (data, strategy, flags) => {
+                let moveFailed = false;
+                let moveSkipped = false;
+                if (move && flags.lossy) {
+                    moveSkipped = true;
+                }
+                else if (move) {
+                    activeAccount = fromAccount;
+                    try {
+                        await sourceDrive.files.update({ fileId, requestBody: { trashed: true }, supportsAllDrives: true });
+                    }
+                    catch {
+                        moveFailed = true;
+                    }
+                }
+                return transferResult(data, strategy, fromAccount, toAccount, {
+                    ...flags,
+                    moved: move ? !moveFailed && !moveSkipped : undefined,
+                    moveFailed,
+                    moveSkipped,
+                });
+            };
+            try {
+                const { data, cleanupFailed, renameFailed } = await shareAndCopy(sourceDrive, targetDrive, fileId, targetEmail, intendedName, parentFolderId);
+                return await finish(data, 'share_copy', { cleanupFailed, renameFailed });
+            }
+            catch {
+                // fall through to download+upload
+            }
+            const plan = transferExportPlan(meta.data.mimeType);
+            if (plan.kind === 'unsupported') {
+                return {
+                    content: [{
+                            type: 'text',
+                            text: JSON.stringify({
+                                error: 'unsupported_type',
+                                message: `Cannot transfer "${meta.data.mimeType}": share+copy was blocked and this native type has no export fallback.`,
+                                retriable: false,
+                            }),
+                        }],
+                    isError: true,
+                };
+            }
+            if (plan.kind === 'binary' && Number(meta.data.size ?? 0) > FALLBACK_MAX_BYTES) {
+                return {
+                    content: [{
+                            type: 'text',
+                            text: JSON.stringify({
+                                error: 'too_large',
+                                message: `Share+copy was blocked and the file (${meta.data.size} bytes) exceeds the ${FALLBACK_MAX_BYTES} byte download+upload fallback cap (uploads are not resumable).`,
+                                hint: 'Use drive_download + drive_upload manually, or fix sharing between the accounts.',
+                                retriable: false,
+                            }),
+                        }],
+                    isError: true,
+                };
+            }
+            const data = await downloadAndUpload(sourceDrive, targetDrive, fileId, meta.data.mimeType ?? null, plan, intendedName, parentFolderId, (side) => { activeAccount = (side === 'source' ? fromAccount : toAccount); });
+            return await finish(data, 'download_upload', { lossy: plan.kind === 'native' && !plan.convertTo });
+        }
+        catch (error) {
+            return handleDriveError(error, activeAccount);
+        }
+    });
     // ─── About ─────────────────────────────────────────────────────────────
     server.registerTool('drive_get_about', {
         description: 'Get Drive storage quota, user display name, and email for an account',
@@ -1092,3 +1224,152 @@ export function registerDriveTools(server) {
 function handleDriveError(error, account) {
     return handleGoogleApiError(error, account);
 }
+export function transferExportPlan(mimeType) {
+    if (!mimeType || !mimeType.startsWith('application/vnd.google-apps.'))
+        return { kind: 'binary' };
+    switch (mimeType) {
+        case 'application/vnd.google-apps.document':
+            return {
+                kind: 'native',
+                exportMime: 'application/vnd.openxmlformats-officedocument.wordprocessingml.document',
+                convertTo: mimeType,
+            };
+        case 'application/vnd.google-apps.spreadsheet':
+            return {
+                kind: 'native',
+                exportMime: 'application/vnd.openxmlformats-officedocument.spreadsheetml.sheet',
+                convertTo: mimeType,
+            };
+        case 'application/vnd.google-apps.presentation':
+            return {
+                kind: 'native',
+                exportMime: 'application/vnd.openxmlformats-officedocument.presentationml.presentation',
+                convertTo: mimeType,
+            };
+        case 'application/vnd.google-apps.drawing':
+            return { kind: 'native', exportMime: 'image/png' };
+        default:
+            return { kind: 'unsupported' };
+    }
+}
+function transferResult(data, strategy, from, to, flags) {
+    return {
+        content: [{
+                type: 'text',
+                text: JSON.stringify({
+                    id: data.id,
+                    name: data.name,
+                    mimeType: data.mimeType,
+                    webViewLink: data.webViewLink,
+                    strategy,
+                    from,
+                    to,
+                    ...(flags.lossy ? { lossy: true } : {}),
+                    ...(flags.moved !== undefined ? { moved: flags.moved } : {}),
+                    ...(flags.moveSkipped ? { hint: 'Move skipped: the fallback changed the file format (e.g. Drawing → PNG), so the editable source was kept. Trash it manually if intended.' } : {}),
+                    ...(flags.moveFailed ? { moveFailed: true, hint: 'Copy succeeded but trashing the source failed — the source file is still present.' } : {}),
+                    ...(flags.renameFailed ? { renameFailed: true } : {}),
+                    ...(flags.cleanupFailed ? { cleanupFailed: true } : {}),
+                }, null, 2),
+            }],
+    };
+}
+async function shareAndCopy(sourceDrive, targetDrive, fileId, targetEmail, intendedName, parentFolderId) {
+    const perm = await sourceDrive.permissions.create({
+        fileId,
+        requestBody: {
+            type: 'user',
+            role: 'reader',
+            emailAddress: targetEmail,
+            expirationTime: new Date(Date.now() + 60 * 60 * 1000).toISOString(),
+        },
+        sendNotificationEmail: false,
+        supportsAllDrives: true,
+        fields: 'id',
+    });
+    let cleanupFailed = false;
+    let renameFailed = false;
+    let data;
+    try {
+        const copy = await targetDrive.files.copy({
+            fileId,
+            requestBody: {
+                name: intendedName,
+                // cross-account copy with omitted parents lands in an indeterminate place
+                parents: [parentFolderId ?? 'root'],
+            },
+            supportsAllDrives: true,
+            fields: 'id,name,mimeType,webViewLink',
+        });
+        data = copy.data;
+        if (data.name !== intendedName && data.id) {
+            // copy already succeeded — a failed cosmetic rename must not trigger the fallback
+            try {
+                const renamed = await targetDrive.files.update({
+                    fileId: data.id,
+                    requestBody: { name: intendedName },
+                    supportsAllDrives: true,
+                    fields: 'id,name,mimeType,webViewLink',
+                });
+                data = renamed.data;
+            }
+            catch {
+                renameFailed = true;
+            }
+        }
+    }
+    finally {
+        if (perm.data.id) {
+            try {
+                await sourceDrive.permissions.delete({ fileId, permissionId: perm.data.id, supportsAllDrives: true });
+            }
+            catch {
+                cleanupFailed = true;
+            }
+        }
+    }
+    return { data, cleanupFailed, renameFailed };
+}
+async function downloadAndUpload(sourceDrive, targetDrive, fileId, sourceMime, plan, intendedName, parentFolderId, onSide) {
+    const tmp = path.join(os.tmpdir(), `gmulti-transfer-${crypto.randomBytes(8).toString('hex')}`);
+    try {
+        onSide('source');
+        let download;
+        try {
+            download =
+                plan.kind === 'native'
+                    ? await sourceDrive.files.export({ fileId, mimeType: plan.exportMime }, { responseType: 'stream' })
+                    : await sourceDrive.files.get({ fileId, alt: 'media', supportsAllDrives: true }, { responseType: 'stream' });
+        }
+        catch (err) {
+            if (plan.kind === 'native' && /too large/i.test(err.message ?? '')) {
+                throw new Error("Google caps native-file exports at 10MB and share+copy was blocked — use drive_export + drive_upload manually, or google_api_call (drive.files.download).", { cause: err });
+            }
+            throw err;
+        }
+        try {
+            await pipeline(download.data, fs.createWriteStream(tmp, { mode: 0o600 }));
+        }
+        catch (err) {
+            throw new Error(`Local temp-file write failed (not a Google error): ${err.message}`, { cause: err });
+        }
+        onSide('target');
+        const created = await targetDrive.files.create({
+            requestBody: {
+                name: intendedName,
+                ...(plan.kind === 'native' && plan.convertTo ? { mimeType: plan.convertTo } : {}),
+                ...(parentFolderId ? { parents: [parentFolderId] } : {}),
+            },
+            media: {
+                mimeType: plan.kind === 'native' ? plan.exportMime : (sourceMime ?? 'application/octet-stream'),
+                body: fs.createReadStream(tmp),
+            },
+            supportsAllDrives: true,
+            fields: 'id,name,mimeType,webViewLink',
+        });
+        return created.data;
+    }
+    finally {
+        await fs.promises.unlink(tmp).catch(() => { });
+    }
+}

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "mcp-google-multi",
-  "version": "5.1.0-alpha.4",
+  "version": "5.1.0-alpha.5",
   "description": "Local MCP server for Google Workspace (Gmail, Drive, Calendar, Sheets, Docs, Contacts, Tasks, Meet, Search Console, +Forms/Chat/Admin) across multiple accounts — OAuth-only, encrypted token storage, deny-by-default writes.",
   "type": "module",
   "license": "MIT",