mcp-google-multi 5.4.1-alpha.2 → 6.0.0-alpha.2

package/dist/tools/google-api.js

@@ -1,12 +1,12 @@
 import { z } from 'zod';
 import { isAllowed, writeDisabledResult } from '../write-control.js';
-import { ACCOUNTS } from '../accounts.js';
+import { accountAliasSchema } from '../accounts.js';
 import { getClient } from '../client.js';
 import { coerceJson } from './_coerce.js';
 import { getToolsets, toolsetEnabled } from '../toolsets.js';
 import { executeApiMethod, jsonResult } from '../executor.js';
 import { WORKSPACE_APIS, cudFromMethod, loadMethodIndex, searchMethods, } from '../discovery-client.js';
-const accountEnum = z.enum(ACCOUNTS);
+const accountEnum = accountAliasSchema.optional();
 // Policy/toolset namespace for each API alias must match the NAMED tools' service
 // names, or user deny globs and GOOGLE_TOOLSETS silently miss escape-hatch calls.
 const SERVICE_FOR_ALIAS = {
@@ -95,7 +95,7 @@ export function registerEscapeTools(registry, policy, deps = {}) {
             'policy as named tools. Returns JSON only — for binary/file content (media downloads, ' +
             'drive.files.export) use drive_download / drive_export instead.',
         inputSchema: {
-            account: accountEnum.describe('Google account alias'),
+            account: accountEnum.describe('Google account alias (omit for the default account)'),
             api: z.string().describe(`API alias: ${apiList}`),
             methodId: z.string().describe('Discovery method id, e.g. "drive.revisions.list"'),
             pathParams: coerceJson(z.record(z.string(), z.union([z.string(), z.number()])).optional())
@@ -110,7 +110,10 @@ export function registerEscapeTools(registry, policy, deps = {}) {
                 .optional()).describe('Query-string parameters; use an array for repeated params (e.g. resourceNames)'),
             body: coerceJson(z.record(z.string(), z.unknown()).optional()).describe('JSON request body'),
         },
-        annotations: { readOnlyHint: false, destructiveHint: true, openWorldHint: true },
+        // idempotentHint:false is load-bearing: the computed default (cud=read)
+        // would invite retries that duplicate sends through the escape hatch.
+        annotations: { readOnlyHint: false, destructiveHint: true, idempotentHint: false, openWorldHint: true },
+        _meta: { 'anthropic/maxResultSizeChars': 100_000 },
     }, async ({ account, api, methodId, pathParams, queryParams, body }) => {
         if (!WORKSPACE_APIS[api]) {
             return jsonResult({ error: 'unknown_api', message: `Unknown api "${api}".`, hint: `Known APIs: ${apiList}`, retriable: false, account }, true);

package/dist/tools/meet.js

@@ -1,9 +1,9 @@
 import { z } from 'zod';
 import { meet as meetClient } from '@googleapis/meet';
-import { ACCOUNTS } from '../accounts.js';
+import { accountAliasSchema } from '../accounts.js';
 import { getClient } from '../client.js';
 import { handleGoogleApiError } from './_errors.js';
-const accountEnum = z.enum(ACCOUNTS);
+const accountEnum = accountAliasSchema.optional();
 export function registerMeetTools(server) {
     // ─── Conference records (past meetings) ────────────────────────────────
     server.registerTool('meet_conference_records_list', {

package/dist/tools/searchconsole.js

@@ -2,10 +2,10 @@ import { z } from 'zod';
 import { coerceArray, coerceJson } from './_coerce.js';
 import { searchconsole as searchconsoleClient } from '@googleapis/searchconsole';
 import { webmasters as webmastersClient } from '@googleapis/webmasters';
-import { ACCOUNTS } from '../accounts.js';
+import { accountAliasSchema } from '../accounts.js';
 import { getClient } from '../client.js';
 import { handleGoogleApiError } from './_errors.js';
-const accountEnum = z.enum(ACCOUNTS);
+const accountEnum = accountAliasSchema.optional();
 export function registerSearchConsoleTools(server) {
     // ─── Sites ───────────────────────────────────────────────
     server.registerTool('searchconsole_sites_list', {

package/dist/tools/sheets.js

@@ -1,10 +1,10 @@
 import { z } from 'zod';
 import { coerceArray, coerceBoolean, coerceJson } from './_coerce.js';
 import { sheets as sheetsClient } from '@googleapis/sheets';
-import { ACCOUNTS } from '../accounts.js';
+import { accountAliasSchema } from '../accounts.js';
 import { getClient } from '../client.js';
 import { handleGoogleApiError } from './_errors.js';
-const accountEnum = z.enum(ACCOUNTS);
+const accountEnum = accountAliasSchema.optional();
 export function registerSheetsTools(server) {
     server.registerTool('sheets_create', {
         description: 'Create a new Google Sheets spreadsheet',
@@ -793,6 +793,8 @@ export function registerSheetsTools(server) {
         }
     });
     server.registerTool('sheets_find_replace', {
+        // Insert/append-capable or non-convergent: a retry duplicates content.
+        annotations: { idempotentHint: false },
         description: 'Find and replace text across a range, a sheet, or all sheets. Supports case sensitivity, full-cell match, regex, and formula scope.',
         inputSchema: {
             account: accountEnum.describe('Google account alias'),
@@ -1070,6 +1072,8 @@ export function registerSheetsTools(server) {
         }
     });
     server.registerTool('sheets_batch_update', {
+        // Insert/append-capable or non-convergent: a retry duplicates content.
+        annotations: { idempotentHint: false },
         description: 'Generic spreadsheets.batchUpdate pass-through. Accepts the full Request union (~70 types). Use this for advanced operations not covered by a dedicated tool. See https://developers.google.com/workspace/sheets/api/reference/rest/v4/spreadsheets/request',
         inputSchema: {
             account: accountEnum.describe('Google account alias'),

package/dist/tools/slides.js

@@ -1,11 +1,11 @@
 import { z } from 'zod';
 import { slides as slidesClient } from '@googleapis/slides';
-import { ACCOUNTS } from '../accounts.js';
+import { accountAliasSchema } from '../accounts.js';
 import { getClient } from '../client.js';
 import { handleGoogleApiError } from './_errors.js';
 import { coerceArray, coerceBoolean, coerceJson } from './_coerce.js';
 import { sliceClean } from '../trim.js';
-const accountEnum = z.enum(ACCOUNTS);
+const accountEnum = accountAliasSchema.optional();
 const SLIDE_TEXT_DIGEST_CHARS = 200;
 export function registerSlidesTools(server) {
     server.registerTool('slides_create', {
@@ -102,6 +102,8 @@ export function registerSlidesTools(server) {
         }
     });
     server.registerTool('slides_batch_update', {
+        // Insert/append-capable or non-convergent: a retry duplicates content.
+        annotations: { idempotentHint: false },
         description: 'Generic presentations.batchUpdate pass-through. Accepts the full Request union (create/move/delete slides, insert text/shapes/images/tables, styling, replaceAllText, …). See https://developers.google.com/workspace/slides/api/reference/rest/v1/presentations/request',
         inputSchema: {
             account: accountEnum.describe('Google account alias'),

package/dist/tools/tasks.js

@@ -1,10 +1,10 @@
 import { z } from 'zod';
 import { coerceBoolean } from './_coerce.js';
 import { tasks as tasksClient } from '@googleapis/tasks';
-import { ACCOUNTS } from '../accounts.js';
+import { accountAliasSchema } from '../accounts.js';
 import { getClient } from '../client.js';
 import { handleGoogleApiError } from './_errors.js';
-const accountEnum = z.enum(ACCOUNTS);
+const accountEnum = accountAliasSchema.optional();
 export function registerTasksTools(server) {
     // ─── Tasklists ─────────────────────────────────────────────────────────
     server.registerTool('tasks_lists_list', {

package/dist/types.d.ts

@@ -32,7 +32,7 @@ export interface GmailMessageFull {
     cc: string;
     date: string;
     body: string;
-    bodyOrigin?: 'text/plain' | 'text/html';
+    bodyFormat: 'plain' | 'markdown' | 'html';
     bodyTruncated?: boolean;
     bodyTotalChars?: number;
     messageIdHeader?: string;

package/dist/write-control.d.ts

@@ -1,17 +1,40 @@
 import type { Cud } from './registry.js';
 export type Profile = 'read-only' | 'safe-writes' | 'full-writes';
+export type Transport = 'stdio' | 'http';
 export interface Policy {
     profile: Profile;
     readOnly: boolean;
     allow: string[];
     deny: string[];
+    /**
+     * B14 reserved seam (cc-write-control "HTTP posture", LOCKED to OQ-5
+     * "annotations only"): the dispatch transport is threaded into the resolved
+     * policy for the EE/future seam, but in v6 alpha it does NOT stiffen the
+     * profile or alter any `isAllowed` verdict. "Stricter on HTTP" is achieved
+     * entirely by the `anthropic/requiresUserInteraction` annotation on the
+     * irreversible set (A12), emitted identically on both transports.
+     * Optional so existing Policy literals (codegen/tests) need no change;
+     * resolvePolicy always populates it.
+     */
+    transport?: Transport;
 }
 interface ToolRef {
     name: string;
     service: string;
     cud: Cud;
 }
-export declare function resolvePolicy(env?: NodeJS.ProcessEnv): Policy;
+/** The irreversible set (frozen, cc-write-control): real sends leave the
+ * user's (or org's) identity unrecallably; permanent deletes bypass Trash.
+ * Includes the callable GENERATED twins of the curated ops — the surface is
+ * always callable by name, so a prompt-free twin would defeat the layer.
+ * Reversible mutations (trash/untrash, draft create/update, labels, calendar
+ * edits) are deliberately excluded so the approval prompt never nags. The
+ * escape hatch is documented as outside this layer (server write-control
+ * still gates it). */
+export declare const IRREVERSIBLE_TOOLS: Set<string>;
+export declare function resolvePolicy(env?: NodeJS.ProcessEnv, opts?: {
+    transport?: Transport;
+}): Policy;
 export declare function isAllowed(tool: ToolRef, policy: Policy): boolean;
 export declare function writeDisabledResult(tool: ToolRef, policy: Policy): {
     content: {

package/dist/write-control.js

@@ -1,8 +1,31 @@
 const PROFILES = ['read-only', 'safe-writes', 'full-writes'];
+/** The irreversible set (frozen, cc-write-control): real sends leave the
+ * user's (or org's) identity unrecallably; permanent deletes bypass Trash.
+ * Includes the callable GENERATED twins of the curated ops — the surface is
+ * always callable by name, so a prompt-free twin would defeat the layer.
+ * Reversible mutations (trash/untrash, draft create/update, labels, calendar
+ * edits) are deliberately excluded so the approval prompt never nags. The
+ * escape hatch is documented as outside this layer (server write-control
+ * still gates it). */
+export const IRREVERSIBLE_TOOLS = new Set([
+    // curated
+    'gmail_send',
+    'gmail_send_draft',
+    'gmail_delete',
+    'gmail_batch_delete',
+    'drive_delete',
+    'drive_empty_trash',
+    // generated twins (permanent deletes / real sends)
+    'gmail_users_threads_delete',
+    'gmail_users_drafts_delete',
+    'chat_spaces_messages_delete',
+    'cloudidentity_customers_userinvitations_send',
+    'vault_matters_holds_delete',
+]);
 function parseGlobs(value) {
     return (value ?? '').split(',').map((s) => s.trim()).filter(Boolean);
 }
-export function resolvePolicy(env = process.env) {
+export function resolvePolicy(env = process.env, opts = {}) {
     const raw = (env.GOOGLE_PROFILE ?? 'read-only').trim();
     if (raw && !PROFILES.includes(raw)) {
         // Fail-closed to read-only, but say so — a typo'd profile otherwise looks
@@ -14,6 +37,8 @@ export function resolvePolicy(env = process.env) {
         readOnly: /^(1|true|yes)$/i.test(env.GOOGLE_READ_ONLY ?? ''),
         allow: parseGlobs(env.GOOGLE_WRITE_ALLOW),
         deny: parseGlobs(env.GOOGLE_WRITE_DENY),
+        // Reserved seam only (see Policy.transport): does not affect the verdict.
+        transport: opts.transport ?? 'stdio',
     };
 }
 function globToRegExp(glob) {

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "mcp-google-multi",
-  "version": "5.4.1-alpha.2",
+  "version": "6.0.0-alpha.2",
   "description": "Local MCP server for Google Workspace (Gmail, Drive, Calendar, Sheets, Docs, Contacts, Tasks, Meet, Search Console, +Forms/Chat/Admin) across multiple accounts — OAuth-only, encrypted token storage, deny-by-default writes.",
   "type": "module",
   "license": "MIT",
@@ -12,7 +12,7 @@
     "dist"
   ],
   "engines": {
-    "node": ">=20"
+    "node": ">=22"
   },
   "repository": {
     "type": "git",
@@ -57,7 +57,8 @@
     "test:watch": "vitest",
     "gen:discovery": "tsx scripts/fetch-discovery.ts",
     "gen:tools": "tsx scripts/gen-tools.ts",
-    "gen:coverage": "tsx scripts/gen-coverage.ts"
+    "gen:coverage": "tsx scripts/gen-coverage.ts",
+    "pack:mcpb": "mcpb pack . mcp-google-multi.mcpb"
   },
   "dependencies": {
     "@googleapis/admin": "^33.0.0",
@@ -74,22 +75,40 @@
     "@googleapis/slides": "^6.0.0",
     "@googleapis/tasks": "^13.0.0",
     "@googleapis/webmasters": "^4.0.0",
-    "@modelcontextprotocol/sdk": "^1.29.0",
-    "dotenv": "^17.4.0",
+    "@modelcontextprotocol/sdk": "^1.30.0",
     "googleapis-common": "^8.0.3",
+    "jose": "^6.2.8",
+    "markdown-it": "15.0.0",
     "mime-types": "^3.0.2",
-    "open": "^11.0.0",
+    "nodemailer": "9.1.1",
+    "turndown": "7.2.4",
+    "turndown-plugin-gfm": "1.0.2",
     "zod": "^4.3.6"
   },
   "devDependencies": {
+    "@anthropic-ai/mcpb": "^2.1.2",
     "@eslint/js": "^10.0.1",
+    "@types/js-yaml": "^4.0.9",
+    "@types/markdown-it": "^14.1.2",
     "@types/mime-types": "^3.0.1",
-    "@types/node": "^25.6.0",
+    "@types/node": "^22.20.1",
+    "@types/nodemailer": "^8.0.1",
+    "@types/turndown": "^5.0.6",
     "eslint": "^10.2.1",
+    "js-yaml": "^4.3.2",
     "semantic-release": "^25.0.3",
     "tsx": "^4.23.1",
     "typescript": "^6.0.3",
     "typescript-eslint": "^8.59.1",
     "vitest": "^3.2.6"
+  },
+  "optionalDependencies": {
+    "@napi-rs/keyring": "1.3.0"
+  },
+  "overrides": {
+    "tmp": "^0.2.4",
+    "fast-uri": "^3.1.6",
+    "hono": "^4.13.5",
+    "qs": "^6.16.0"
   }
 }