mcp-google-multi 5.1.0-beta.1 → 5.1.1-alpha.1

package/dist/client.js

@@ -1,6 +1,6 @@
 import { google } from 'googleapis';
 import { ACCOUNT_CONFIG } from './accounts.js';
-import { readToken, writeToken } from './token-store.js';
+import { readToken, updateToken } from './token-store.js';
 export async function getClient(account) {
     const config = ACCOUNT_CONFIG[account];
     if (!process.env.GOOGLE_CLIENT_ID || !process.env.GOOGLE_CLIENT_SECRET) {
@@ -15,8 +15,7 @@ export async function getClient(account) {
     }
     oauth2Client.setCredentials(tokenData);
     oauth2Client.on('tokens', (tokens) => {
-        const existing = readToken(account) ?? {};
-        writeToken(account, { ...existing, ...tokens });
+        updateToken(account, tokens);
     });
     return oauth2Client;
 }

package/dist/token-store.d.ts

@@ -4,4 +4,5 @@ export declare function encryptToken(data: object, masterKey: string): string;
 export declare function decryptToken(fileContents: string, masterKey: string): TokenData;
 export declare function readToken(alias: string): TokenData | null;
 export declare function writeToken(alias: string, data: object): void;
+export declare function updateToken(alias: string, updates: object): void;
 export declare function hasToken(alias: string): boolean;

package/dist/token-store.js

@@ -4,6 +4,8 @@ import path from 'node:path';
 import { ACCOUNT_CONFIG } from './accounts.js';
 const ENC_VERSION = 1;
 const ALGO = 'aes-256-gcm';
+const LOCK_TIMEOUT_MS = 5_000;
+const LOCK_RETRY_MS = 10;
 export function deriveKey(masterKey) {
     if (!masterKey) {
         throw new Error('MASTER_KEY is required to encrypt/decrypt tokens. Generate one with: openssl rand -base64 32');
@@ -56,10 +58,94 @@ export function readToken(alias) {
     }
     return decryptToken(contents, masterKey());
 }
-export function writeToken(alias, data) {
+function sleep(ms) {
+    Atomics.wait(new Int32Array(new SharedArrayBuffer(4)), 0, 0, ms);
+}
+function withTokenLock(alias, fn) {
+    const p = ACCOUNT_CONFIG[alias].encPath;
+    const dir = path.dirname(p);
+    const lock = path.join(dir, `.${path.basename(p)}.lock`);
+    const ownerFile = `${lock}.${process.pid}.${randomBytes(6).toString('hex')}.owner`;
+    fs.mkdirSync(dir, { recursive: true });
+    fs.writeFileSync(ownerFile, String(process.pid), { mode: 0o600, flag: 'wx' });
+    const deadline = Date.now() + LOCK_TIMEOUT_MS;
+    try {
+        while (true) {
+            try {
+                fs.linkSync(ownerFile, lock);
+                break;
+            }
+            catch (error) {
+                const err = error;
+                if (err.code !== 'EEXIST')
+                    throw error;
+                try {
+                    const observedOwner = fs.readFileSync(lock, 'utf8');
+                    const owner = Number(observedOwner);
+                    if (Number.isSafeInteger(owner) && owner > 0) {
+                        try {
+                            process.kill(owner, 0);
+                        }
+                        catch (ownerError) {
+                            if (ownerError.code !== 'ESRCH')
+                                throw ownerError;
+                            if (fs.readFileSync(lock, 'utf8') === observedOwner)
+                                fs.rmSync(lock, { force: true });
+                            continue;
+                        }
+                    }
+                }
+                catch (readError) {
+                    if (readError.code === 'ENOENT') {
+                        continue;
+                    }
+                    throw readError;
+                }
+                if (Date.now() >= deadline) {
+                    throw new Error(`Timed out waiting for token lock: ${alias}`, { cause: error });
+                }
+                sleep(LOCK_RETRY_MS);
+            }
+        }
+    }
+    finally {
+        fs.rmSync(ownerFile, { force: true });
+    }
+    try {
+        return fn();
+    }
+    finally {
+        fs.rmSync(lock, { force: true });
+    }
+}
+function writeTokenAtomic(alias, data) {
     const p = ACCOUNT_CONFIG[alias].encPath;
-    fs.mkdirSync(path.dirname(p), { recursive: true });
-    fs.writeFileSync(p, encryptToken(data, masterKey()), { mode: 0o600 });
+    const dir = path.dirname(p);
+    const tmp = path.join(dir, `.${path.basename(p)}.${process.pid}.${randomBytes(6).toString('hex')}.tmp`);
+    try {
+        fs.writeFileSync(tmp, encryptToken(data, masterKey()), { mode: 0o600, flag: 'wx' });
+        const fd = fs.openSync(tmp, 'r');
+        try {
+            fs.fsyncSync(fd);
+        }
+        finally {
+            fs.closeSync(fd);
+        }
+        fs.renameSync(tmp, p);
+    }
+    finally {
+        fs.rmSync(tmp, { force: true });
+    }
+}
+export function writeToken(alias, data) {
+    withTokenLock(alias, () => writeTokenAtomic(alias, data));
+}
+export function updateToken(alias, updates) {
+    withTokenLock(alias, () => {
+        const existing = readToken(alias) ?? {};
+        const definedUpdates = Object.fromEntries(Object.entries(updates).filter(([, value]) => value !== null && value !== undefined));
+        writeTokenAtomic(alias, { ...existing, ...definedUpdates });
+    });
 }
 export function hasToken(alias) {
     return fs.existsSync(ACCOUNT_CONFIG[alias].encPath);

package/dist/tools/calendar.d.ts

@@ -3,6 +3,8 @@ export declare function registerCalendarTools(server: ToolRegistry): void;
 export declare function formatEvent(event: any, opts?: {
     full?: boolean;
 }): {
+    [k: string]: any;
+} | {
     id: any;
     summary: any;
     description: string;
@@ -17,6 +19,4 @@ export declare function formatEvent(event: any, opts?: {
     hangoutLink: any;
     created: any;
     updated: any;
-} | {
-    [k: string]: any;
 };

package/dist/tools/google-api.js

@@ -16,18 +16,18 @@ const SERVICE_FOR_ALIAS = {
     calendar: 'calendar',
     sheets: 'sheets',
     docs: 'docs',
-    slides: null,
+    slides: 'slides',
     forms: 'forms',
     people: 'contacts',
     searchconsole: 'searchconsole',
     tasks: 'tasks',
     chat: 'chat',
     meet: 'meet',
-    driveactivity: null,
-    drivelabels: null,
+    driveactivity: 'driveactivity',
+    drivelabels: 'drivelabels',
     admin_directory: 'admin',
     admin_reports: 'admin',
-    groupssettings: null,
+    groupssettings: 'groupssettings',
 };
 function buildQueryString(queryParams) {
     const usp = new URLSearchParams();
@@ -61,15 +61,15 @@ function describeMethod(m) {
 export function registerEscapeTools(registry, policy, deps = {}) {
     const getClientFn = deps.getClientFn ?? getClient;
     const toolsets = deps.toolsets ?? getToolsets();
+    const serviceForAlias = (alias) => SERVICE_FOR_ALIAS[alias] ?? alias;
     const apiEnabled = (alias) => {
-        const service = SERVICE_FOR_ALIAS[alias];
-        return service === null || service === undefined || toolsetEnabled(toolsets, service);
+        return toolsetEnabled(toolsets, serviceForAlias(alias));
     };
     const enabledApis = Object.keys(WORKSPACE_APIS).filter(apiEnabled);
     const apiList = enabledApis.join(', ');
     const toolsetDisabled = (alias) => jsonResult({
         error: 'toolset_disabled',
-        message: `API "${alias}" maps to service "${SERVICE_FOR_ALIAS[alias]}", which is excluded by GOOGLE_TOOLSETS.`,
+        message: `API "${alias}" maps to service "${serviceForAlias(alias)}", which is excluded by GOOGLE_TOOLSETS.`,
         hint: 'Add the service to GOOGLE_TOOLSETS (or unset it) to use this API.',
         retriable: false,
     }, true);
@@ -159,7 +159,7 @@ export function registerEscapeTools(registry, policy, deps = {}) {
             }, true);
         }
         const cud = cudFromMethod(method);
-        const policyService = SERVICE_FOR_ALIAS[api] ?? api;
+        const policyService = serviceForAlias(api);
         const lastSegment = method.id.split('.').pop() ?? method.id;
         const toolRef = { name: `${policyService}_${lastSegment}`, service: policyService, cud };
         if (cud !== 'read' && !isAllowed(toolRef, policy)) {

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "mcp-google-multi",
-  "version": "5.1.0-beta.1",
+  "version": "5.1.1-alpha.1",
   "description": "Local MCP server for Google Workspace (Gmail, Drive, Calendar, Sheets, Docs, Contacts, Tasks, Meet, Search Console, +Forms/Chat/Admin) across multiple accounts — OAuth-only, encrypted token storage, deny-by-default writes.",
   "type": "module",
   "license": "MIT",