mcp-google-multi 5.4.1-alpha.2 → 6.0.0-alpha.2

package/dist/tools/gmail-mime.js

@@ -1,50 +1,16 @@
-import { randomBytes } from 'node:crypto';
-/** RFC 2047 encoded-word (`=?utf-8?B?...?=`) for non-ASCII header text; long values fold into <=75-char chunks joined by CRLF SPACE per the RFC. */
-export function encodeHeaderValue(value) {
-    // Control chars in the span are intentional: testing "entirely ASCII", not "printable".
-    // eslint-disable-next-line no-control-regex
-    if (value === '' || /^[\x00-\x7F]*$/.test(value))
-        return value;
-    const prefix = '=?utf-8?B?';
-    const suffix = '?=';
-    const maxInner = 75 - prefix.length - suffix.length;
-    // base64 emits 4 output chars per 3 input bytes (always padded to a
-    // multiple of 4). Round maxInner DOWN to a multiple of 4 first.
-    const maxBytesPerChunk = Math.floor(maxInner / 4) * 3;
-    // Chunk on codepoint boundaries: many MUAs decode each encoded-word separately, so a mid-UTF-8-sequence split renders U+FFFD.
-    const chunks = [];
-    let buffered = [];
-    for (const char of value) {
-        const charBytes = Array.from(Buffer.from(char, 'utf-8'));
-        if (buffered.length + charBytes.length > maxBytesPerChunk && buffered.length > 0) {
-            chunks.push(`${prefix}${Buffer.from(buffered).toString('base64')}${suffix}`);
-            buffered = [];
-        }
-        buffered.push(...charBytes);
-    }
-    if (buffered.length > 0) {
-        chunks.push(`${prefix}${Buffer.from(buffered).toString('base64')}${suffix}`);
-    }
-    return chunks.join('\r\n ');
-}
-/** Address-list headers (To/Cc/Bcc/From): RFC 2047 forbids encoded-words in the addr-spec, so only display names are encoded. */
-export function encodeAddressHeader(value) {
-    if (value === '')
-        return '';
-    return value.split(',').map((part) => {
-        const trimmed = part.trim();
-        if (trimmed === '')
-            return '';
-        const m = trimmed.match(/^(.*?)<([^>]+)>$/);
-        if (m) {
-            const rawName = m[1].trim().replace(/^"(.*)"$/, '$1').trim();
-            const addr = m[2].trim();
-            if (rawName === '')
-                return `<${addr}>`;
-            return `${encodeHeaderValue(rawName)} <${addr}>`;
-        }
-        return trimmed;
-    }).filter(Boolean).join(', ');
+import MailComposer from 'nodemailer/lib/mail-composer/index.js';
+import MarkdownIt from 'markdown-it';
+import TurndownService from 'turndown';
+// @ts-expect-error turndown-plugin-gfm ships no type declarations
+import { gfm } from 'turndown-plugin-gfm';
+// D6 send: one symmetric text format. body is Markdown; text/plain = the
+// source verbatim, text/html = this render. html:false ESCAPES raw HTML in
+// the body (the XSS-safe default); allowRawHtml swaps to the html:true
+// instance so an audited caller can pass literal HTML (e.g. inline color).
+const mdSafe = new MarkdownIt({ html: false, linkify: true });
+const mdRaw = new MarkdownIt({ html: true, linkify: true });
+export function renderMarkdown(body, allowRawHtml = false) {
+    return (allowRawHtml ? mdRaw : mdSafe).render(body);
 }
 /** RFC 5322 §2.3 forbids bare CR or LF in bodies; normalize everything to CRLF. */
 export function normalizeBodyLineEndings(body) {
@@ -121,6 +87,23 @@ export function htmlToText(html) {
         .replace(/\n{3,}/g, '\n\n')
         .trim();
 }
+// D6 read: HTML-only bodies convert to Markdown so the model reads structure
+// (headings, links, lists, GFM tables), not a flat text dump. turndown's
+// bundled @mixmark-io/domino fork does NOT execute scripts; remove() drops
+// script/style/head entirely (turndown otherwise leaks their text content).
+const turndownService = new TurndownService({ headingStyle: 'atx', codeBlockStyle: 'fenced', bulletListMarker: '-' });
+turndownService.use(gfm);
+turndownService.remove(['script', 'style', 'head']);
+/** Convert HTML to Markdown; on any turndown failure fall back to the
+ * plain-text extractor (caller then reports bodyFormat 'plain', not 'markdown'). */
+export function htmlToMarkdown(html) {
+    try {
+        return { text: turndownService.turndown(html), ok: true };
+    }
+    catch {
+        return { text: htmlToText(html), ok: false };
+    }
+}
 /** In-Reply-To/References need the parent's real RFC 5322 Message-ID header, not the Gmail API id;
  * falls back to the API id so replies still thread inside Gmail. */
 export function buildReplyHeaders(fallbackId, parentMessageIdHeader, parentReferences) {
@@ -133,30 +116,51 @@ export function buildReplyHeaders(fallbackId, parentMessageIdHeader, parentRefer
         references: refs === '' ? parentId : `${refs} ${parentId}`,
     };
 }
-/** RFC 2046 §5.1.1 boundary token: hex output is all bcharsnospace, length well under the 70-char cap. */
-function generateMimeBoundary() {
-    // 5-char prefix + 32 hex chars = 37 chars, well under the 70-char limit.
-    return `=_gm_${randomBytes(16).toString('hex')}`;
+/** Header-injection guard slug; caller maps to a validation_error envelope. */
+export class HeaderInjectionError extends Error {
+    field;
+    constructor(field) {
+        super(`E_HEADER_INJECTION: "${field}" must not contain CR or LF (header injection).`);
+        this.field = field;
+    }
 }
-/** multipart/alternative (plain fallback + HTML); caller composes the message: headers (incl. returned Content-Type) + CRLF + body. */
-export function buildMultipartAlternative(plainBody, htmlBody) {
-    const boundary = generateMimeBoundary();
-    const parts = [
-        `--${boundary}`,
-        'Content-Type: text/plain; charset="UTF-8"',
-        'Content-Transfer-Encoding: 8bit',
-        '',
-        normalizeBodyLineEndings(plainBody),
-        `--${boundary}`,
-        'Content-Type: text/html; charset="UTF-8"',
-        'Content-Transfer-Encoding: 8bit',
-        '',
-        normalizeBodyLineEndings(htmlBody),
-        `--${boundary}--`,
-        '',
-    ];
-    return {
-        contentType: `multipart/alternative; boundary="${boundary}"`,
-        body: parts.join('\r\n'),
+/**
+ * The single MIME-assembly seam for gmail_send and gmail_create_draft (A4).
+ * MailComposer owns header/RFC-2047/address encoding and boundary generation,
+ * which closes the CRLF header-injection hole in the old hand-rolled encoders.
+ * A deterministic pre-check rejects CR/LF in address/subject headers with a
+ * named error (belt-and-suspenders over MailComposer's own stripping).
+ *
+ * Bare-LF defense (Gmail's raw upload skips SMTP line-ending normalization):
+ * normalize text/html to CRLF, build with newline:"\r\n" and base64 CTE.
+ */
+export async function composeRaw(input) {
+    for (const field of ['from', 'to', 'cc', 'subject']) {
+        const v = input[field];
+        if (typeof v === 'string' && /[\r\n]/.test(v))
+            throw new HeaderInjectionError(field);
+    }
+    const options = {
+        from: input.from,
+        to: input.to,
+        cc: input.cc || undefined,
+        subject: input.subject,
+        text: normalizeBodyLineEndings(input.text),
+        html: input.html ? normalizeBodyLineEndings(input.html) : undefined,
+        inReplyTo: input.inReplyTo,
+        references: input.references,
+        attachments: input.attachments,
+        newline: '\r\n',
+        textEncoding: 'base64',
+        // This server reads any attachment file itself and passes a Buffer;
+        // MailComposer must never touch the filesystem or network (SSRF / local
+        // file-read defense-in-depth).
+        disableFileAccess: true,
+        disableUrlAccess: true,
     };
+    const mail = new MailComposer(options);
+    const built = await new Promise((resolve, reject) => {
+        mail.compile().build((err, message) => (err ? reject(err) : resolve(message)));
+    });
+    return built.toString('base64url');
 }

package/dist/tools/gmail.d.ts

@@ -1,6 +1,37 @@
 import type { ToolRegistry } from '../registry.js';
+import type { Account } from '../accounts.js';
+import { type ComposeAttachment } from './gmail-mime.js';
 import type { GmailMessageFull } from '../types.js';
+/** Re: prefix unless the subject already carries one (case-insensitive, after
+ * trimming); never double-prefix. */
+export declare function deriveReplySubject(sourceSubject: string): string;
+interface ReplyDerivation {
+    inReplyTo: string;
+    references: string;
+    sourceFound: boolean;
+    to?: string;
+    cc?: string;
+    subject?: string;
+}
+/** Fetch the reply source once and derive threading headers plus (auto-fill)
+ * to/cc/subject. On any fetch failure, degrade to the API id for threading and
+ * report sourceFound:false so the caller can decide (per A8 error dispositions). */
+export declare function resolveReply(gmail: any, account: string, primaryEmail: string, replyToMessageId: string, replyAll: boolean): Promise<ReplyDerivation>;
+export declare function readAttachments(raw: Array<{
+    path: string;
+    filename?: string;
+    contentType?: string;
+}> | undefined, bodyBytes: number): Promise<ComposeAttachment[] | undefined>;
 export declare function parseMessage(msg: any, bodyCap?: number, opts?: {
     rawHtml?: boolean;
 }): GmailMessageFull;
+/**
+ * A9 gmail_read_batch core: fetch N ids with bounded parallelism, parse each,
+ * and bound the aggregate output. Order is preserved by input index. A per-id
+ * failure becomes a `{ id, error }` entry; an account-wide auth/scope failure
+ * is rethrown so the caller maps it to a whole-call isError. Returns the
+ * ordered per-id entries followed by a trailing counts summary.
+ */
+export declare function readBatch(gmail: any, account: Account, ids: string[], full: boolean, rawHtml: boolean): Promise<any[]>;
 export declare function registerGmailTools(server: ToolRegistry): void;
+export {};