mcp-google-multi 6.0.0-alpha.31 → 6.0.0-alpha.32

package/dist/tools/account-wizard.d.ts

@@ -27,6 +27,16 @@ export type AddValidation = {
 /** Validate the collected form against the alias rules, dup check, and the
  * bundle catalog. Pure (no I/O) for unit testing. */
 export declare function validateAddForm(input: Partial<AddForm>, existingAliases: string[]): AddValidation;
+/** URL-mode elicitation params. `elicitationId` is REQUIRED by the spec
+ * schema; omitting it made every url-mode request fail client-side
+ * validation, so the branch silently never worked. Pure, so the shape is
+ * testable against the SDK's own schema without a live client. */
+export declare function urlElicitationParams(alias: string, url: string, elicitationId: string): {
+    mode: 'url';
+    elicitationId: string;
+    message: string;
+    url: string;
+};
 /** Map direct tool arguments onto the elicitation form shape: the argument-
  * mode fallback for clients without form elicitation. All bundle picks travel
  * through otherBundles, which validateAddForm resolves and validates. Pure. */

package/dist/tools/account-wizard.js

@@ -71,6 +71,18 @@ export function validateAddForm(input, existingAliases) {
     }
     return { ok: true, alias, email, bundles, admin: input.admin === true };
 }
+/** URL-mode elicitation params. `elicitationId` is REQUIRED by the spec
+ * schema; omitting it made every url-mode request fail client-side
+ * validation, so the branch silently never worked. Pure, so the shape is
+ * testable against the SDK's own schema without a live client. */
+export function urlElicitationParams(alias, url, elicitationId) {
+    return {
+        mode: 'url',
+        elicitationId,
+        message: `Authorize the "${alias}" Google account in your browser.`,
+        url,
+    };
+}
 /** Map direct tool arguments onto the elicitation form shape: the argument-
  * mode fallback for clients without form elicitation. All bundle picks travel
  * through otherBundles, which validateAddForm resolves and validates. Pure. */
@@ -125,11 +137,16 @@ async function runConsent(server, alias) {
     const scopes = resolveScopesForAccount(alias);
     const url = client.generateAuthUrl({ access_type: 'offline', prompt: 'consent', scope: scopes, login_hint: cfg.email, state: expectedState });
     const consent = loop.finish(client, expectedState);
+    // Capability probe: the spec advertises each elicitation mode as a PRESENT
+    // object, not a boolean, so test presence rather than truthiness.
     const caps = server.server.getClientCapabilities?.();
     let opened = false;
-    if (caps?.elicitation?.url) {
+    if (caps?.elicitation?.url !== undefined) {
         try {
-            const r = await server.server.elicitInput({ mode: 'url', message: `Authorize the "${alias}" Google account in your browser.`, url });
+            // elicitationId is REQUIRED by the spec schema; omitting it made every
+            // url-mode request fail client-side validation, so this branch always
+            // fell through to the server-side browser open.
+            const r = await server.server.elicitInput(urlElicitationParams(alias, url, randomBytes(16).toString('hex')));
             if (r.action !== 'accept') {
                 loop.close();
                 return { ok: false, text: 'confirmation_declined: consent was cancelled; the account row was kept but no token was stored (doctor will show it as "missing").' };
@@ -148,7 +165,9 @@ async function runConsent(server, alias) {
         tokens = await consent;
     }
     catch (e) {
-        return { ok: false, text: `${e.message}${opened ? '' : `\nOpen this URL to authorize:\n${url}`}` };
+        // Always surface the URL: the browser hand-off can succeed and consent
+        // still fail (declined, timed out), and the URL is the only recovery.
+        return { ok: false, text: `${e.message}\nOpen this URL to authorize:\n${url}` };
     }
     writeToken(alias, tokens);
     return { ok: true, missing: scopeGrantDiff(scopes, typeof tokens.scope === 'string' ? tokens.scope : undefined) };
@@ -196,15 +215,16 @@ export function registerAccountWizardTools(registry, server) {
                 input = argsToAddForm(a);
             }
             else {
+                // Modes are advertised as PRESENT objects, not booleans.
                 const caps = server.server.getClientCapabilities?.();
-                if (!caps?.elicitation?.form) {
+                if (caps?.elicitation?.form === undefined) {
                     return textResult('E_NO_FORM_ELICITATION: this client does not support the interactive form. Call account_add again with arguments instead, e.g. {"alias": "work", "email": "you@example.com"} (optional: "bundles" as a comma-separated list, "allBundles": true, "admin": true).', true);
                 }
                 const form = await server.server.elicitInput({ message: 'Add a Google account', requestedSchema: addFormSchema() });
                 if (form.action !== 'accept') {
                     return textResult('confirmation_declined: no account was added.');
                 }
-                input = form.content ?? {};
+                input = (form.content ?? {});
             }
             const validated = validateAddForm(input, getAccountSet().aliases);
             if (!validated.ok)

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "mcp-google-multi",
-  "version": "6.0.0-alpha.31",
+  "version": "6.0.0-alpha.32",
   "mcpName": "io.github.bakissation/mcp-google-multi",
   "description": "Local MCP server for Google Workspace (Gmail, Drive, Calendar, Sheets, Docs, Contacts, Tasks, Meet, Search Console, +Forms/Chat/Admin) across multiple accounts — OAuth-only, encrypted token storage, deny-by-default writes.",
   "type": "module",