mcp-google-multi 6.0.0-alpha.35 → 6.0.0-alpha.37

package/dist/accounts.js

@@ -2,7 +2,7 @@ import path from 'node:path';
 import fs from 'node:fs';
 import { z } from 'zod';
 import { loadEnvFiles } from './env-load.js';
-import { CONFIG_VERSION, configDir, configFilePath, failStartup, loadConfigFile, mutateConfigFile } from './config-file.js';
+import { ALIAS_RE, CONFIG_VERSION, configDir, configFilePath, failStartup, isReservedAlias, loadConfigFile, mutateConfigFile } from './config-file.js';
 import { BUNDLE_CATALOG, closestBundle, resolveBundleAliases } from './scope-catalog.js';
 const envLoad = loadEnvFiles();
 const defaultTokenDir = path.join(configDir(), 'tokens');
@@ -40,7 +40,7 @@ function parseEnvAccounts(raw, adminAliases) {
         }
         // Restrict alias to a safe charset so it can't escape `tokenDir` via path traversal
         // (e.g. "../../etc/passwd:foo@bar.com" in .env).
-        if (!/^[a-zA-Z0-9_-]+$/.test(alias) || ['__proto__', 'constructor', 'prototype'].includes(alias)) {
+        if (!ALIAS_RE.test(alias) || isReservedAlias(alias)) {
             throw new Error(`Invalid alias "${alias}". Allowed characters: letters, digits, underscore, hyphen.`);
         }
         if (aliases.includes(alias)) {

package/dist/config-file.d.ts

@@ -2,6 +2,8 @@ export declare const CONFIG_VERSION = 1;
 export declare function configDir(env?: NodeJS.ProcessEnv): string;
 export declare function configFilePath(env?: NodeJS.ProcessEnv): string;
 export declare const ALIAS_RE: RegExp;
+export declare const RESERVED_ALIASES: string[];
+export declare function isReservedAlias(name: string): boolean;
 export interface ConfigFile {
     version: number;
     accounts?: Record<string, {

package/dist/config-file.js

@@ -22,7 +22,10 @@ const accountEntrySchema = z.strictObject({
 // masterKey, jwtKey, clientId) fails validation, structurally enforcing
 // secrets-env-only. scopeProfiles/defaultAccount/discovery/toolsets are part
 // of the frozen envelope; their consumers land in later slices.
-const RESERVED_ALIASES = ['__proto__', 'constructor', 'prototype'];
+export const RESERVED_ALIASES = ['__proto__', 'constructor', 'prototype'];
+export function isReservedAlias(name) {
+    return RESERVED_ALIASES.includes(name);
+}
 const configSchema = z.strictObject({
     version: z.number().int(),
     accounts: z.record(z.string().regex(ALIAS_RE), accountEntrySchema).optional(),

package/dist/master-key.js

@@ -38,17 +38,23 @@ let keychainFactory = systemKeychain;
 export function __setKeychainFactoryForTest(fn) {
     keychainFactory = fn ?? systemKeychain;
 }
-// Glob the token dir instead of iterating registered aliases: an orphan .enc
-// (alias removed from the registry, or a partial GOOGLE_ACCOUNTS override in
-// one client) must still stop a fresh key from being minted.
-function anyTokenFileExists() {
+function anyEncFileUnder(dir) {
     try {
-        return fs.readdirSync(getTokenDir()).some((f) => f.endsWith('.enc'));
+        return fs.readdirSync(dir, { recursive: true }).some((f) => String(f).endsWith('.enc'));
     }
     catch {
         return false;
     }
 }
+// Glob the token dir instead of iterating registered aliases: an orphan .enc
+// (alias removed from the registry, or a partial GOOGLE_ACCOUNTS override in
+// one client) must still stop a fresh key from being minted. The walk is
+// recursive and also covers configDir()/tenants (the tenant-namespaced token
+// root): a flat scan returns false the moment tokens nest, and minting a
+// fresh MASTER_KEY over existing .enc files bricks them irreversibly.
+function anyTokenFileExists() {
+    return anyEncFileUnder(getTokenDir()) || anyEncFileUnder(path.join(configDir(), 'tenants'));
+}
 function readKeyFile(filePath) {
     try {
         const raw = fs.readFileSync(filePath, 'utf8').trim();

package/dist/mcp-token.d.ts

@@ -9,6 +9,7 @@ export interface AccessTokenParams {
     secret: Uint8Array;
     ttlSec?: number;
     iat: number;
+    sub: string;
 }
 export declare function signAccessToken(p: AccessTokenParams): Promise<string>;
 export interface AccessClaims {
@@ -31,7 +32,7 @@ export interface CodePayload {
     redirect_uri: string;
     code_challenge: string;
     resource: string;
-    sub: 'owner';
+    sub: string;
 }
 export declare function signState(payload: StatePayload, base: string, secret: Uint8Array, iat: number, ttlSec?: number): Promise<string>;
 export declare function verifyState(token: string, base: string, secret: Uint8Array): Promise<StatePayload & {
@@ -57,7 +58,7 @@ export declare class ReplayGuard {
     private evictExpired;
 }
 export interface RefreshRecord {
-    sub: 'owner';
+    sub: string;
     issuedAt: number;
     family: string;
 }
@@ -74,8 +75,13 @@ export declare class RefreshStore {
     constructor(path: string, masterKey: string);
     private load;
     private save;
-    issue(nowMs: number, family?: string): string;
+    issue(nowMs: number, sub: string, family?: string): string;
     /** Rotate a presented refresh token; null if unknown OR if the presented
-     * token was already rotated away (reuse => the family is revoked). */
-    rotate(oldToken: string, nowMs: number): string | null;
+     * token was already rotated away (reuse => the family is revoked). The
+     * record's sub is copied forward and returned so the caller can mint the
+     * matching access token without trusting anything client-supplied. */
+    rotate(oldToken: string, nowMs: number): {
+        token: string;
+        sub: string;
+    } | null;
 }

package/dist/mcp-token.js

@@ -24,7 +24,7 @@ export async function signAccessToken(p) {
     return new SignJWT({ scope: 'mcp:use', purpose: 'mcp_access' })
         .setProtectedHeader({ alg: 'HS256', typ: 'JWT' })
         .setIssuer(p.base)
-        .setSubject('owner')
+        .setSubject(p.sub)
         .setAudience(`${p.base}/mcp`)
         .setIssuedAt(p.iat)
         .setExpirationTime(p.iat + ttl)
@@ -139,17 +139,19 @@ export class RefreshStore {
         }
         atomicWriteFileSync(this.path, encryptToken(data, this.masterKey), 0o600);
     }
-    issue(nowMs, family) {
+    issue(nowMs, sub, family) {
         return withFileLock(this.path, () => {
             const token = randomBytes(32).toString('base64url');
             const data = this.load();
-            data.active[token] = { sub: 'owner', issuedAt: nowMs, family: family ?? randomBytes(12).toString('hex') };
+            data.active[token] = { sub, issuedAt: nowMs, family: family ?? randomBytes(12).toString('hex') };
             this.save(data);
             return token;
         });
     }
     /** Rotate a presented refresh token; null if unknown OR if the presented
-     * token was already rotated away (reuse => the family is revoked). */
+     * token was already rotated away (reuse => the family is revoked). The
+     * record's sub is copied forward and returned so the caller can mint the
+     * matching access token without trusting anything client-supplied. */
     rotate(oldToken, nowMs) {
         return withFileLock(this.path, () => {
             const data = this.load();
@@ -168,9 +170,9 @@ export class RefreshStore {
             delete data.active[oldToken];
             data.spent[oldToken] = rec.family;
             const next = randomBytes(32).toString('base64url');
-            data.active[next] = { sub: 'owner', issuedAt: nowMs, family: rec.family };
+            data.active[next] = { sub: rec.sub, issuedAt: nowMs, family: rec.family };
             this.save(data);
-            return next;
+            return { token: next, sub: rec.sub };
         });
     }
 }

package/dist/oauth-as.js

@@ -385,8 +385,8 @@ export function buildAuthServer(config, deps = {}) {
             if (!form.code_verifier || pkceS256(form.code_verifier) !== code.code_challenge) {
                 return json(res, 400, { error: 'invalid_grant', message: 'PKCE verification failed' });
             }
-            const access = await signAccessToken({ base, secret, iat: nowSec(), ttlSec: accessTtl });
-            const refreshToken = refresh.issue(now());
+            const access = await signAccessToken({ base, secret, iat: nowSec(), ttlSec: accessTtl, sub: 'owner' });
+            const refreshToken = refresh.issue(now(), 'owner');
             log('token issued grant=authorization_code');
             return json(res, 200, { access_token: access, token_type: 'Bearer', expires_in: accessTtl, refresh_token: refreshToken, scope: 'mcp:use' });
         }
@@ -394,9 +394,9 @@ export function buildAuthServer(config, deps = {}) {
             const next = refresh.rotate(form.refresh_token ?? '', now());
             if (!next)
                 return json(res, 400, { error: 'invalid_grant', message: 'unknown or rotated refresh token' });
-            const access = await signAccessToken({ base, secret, iat: nowSec(), ttlSec: accessTtl });
+            const access = await signAccessToken({ base, secret, iat: nowSec(), ttlSec: accessTtl, sub: 'owner' });
             log('token issued grant=refresh_token');
-            return json(res, 200, { access_token: access, token_type: 'Bearer', expires_in: accessTtl, refresh_token: next, scope: 'mcp:use' });
+            return json(res, 200, { access_token: access, token_type: 'Bearer', expires_in: accessTtl, refresh_token: next.token, scope: 'mcp:use' });
         }
         return json(res, 400, { error: 'unsupported_grant_type', message: 'authorization_code or refresh_token only' });
     };

package/dist/registry-transfer.js

@@ -9,9 +9,8 @@ import * as readline from 'node:readline';
 import path from 'node:path';
 import { encryptToken, decryptToken } from './token-store.js';
 import { atomicWriteFileSync, atomicWriteWithLock } from './fs-atomic.js';
-import { configFilePath, CONFIG_VERSION } from './config-file.js';
+import { ALIAS_RE, configFilePath, CONFIG_VERSION } from './config-file.js';
 import { getTokenDir } from './accounts.js';
-const ALIAS_RE = /^[a-zA-Z0-9_-]+$/;
 function resolveDeps(deps) {
     return {
         configPath: deps.configPath ?? configFilePath(),

package/dist/registry.js

@@ -168,9 +168,9 @@ export class ToolRegistry {
             });
             const guarded = cud === 'read'
                 ? baseHandler
-                : (...args) => isAllowed({ name, service, cud }, policy)
+                : (...args) => isAllowed({ name, service, cud, scopes: config.requiredScopes }, policy)
                     ? baseHandler(...args)
-                    : writeDisabledResult({ name, service, cud }, policy, 
+                    : writeDisabledResult({ name, service, cud, scopes: config.requiredScopes }, policy, 
                     // Concrete by here: default-account injection wraps this.
                     args[0]?.account);
             // A2: the ONE default-account injection site — outside the CUD gate and

package/dist/tools/account-wizard.js

@@ -1,6 +1,6 @@
 import { z } from 'zod';
 import { getAccountSet, invalidateAccountSet } from '../accounts.js';
-import { mutateConfigFile } from '../config-file.js';
+import { ALIAS_RE, mutateConfigFile } from '../config-file.js';
 import { writeToken } from '../token-store.js';
 import { resolveScopesForAccount } from '../auth.js';
 import { BUNDLE_CATALOG, closestBundle, resolveBundleAliases } from '../scope-catalog.js';
@@ -9,13 +9,6 @@ import { coerceBoolean } from './_coerce.js';
 import { safeMessage, stringifyEnvelope } from './_errors.js';
 import { buildConsentClient, openLoopbackConsent, hasClientCredentials, TESTING_MODE_WARNING, } from '../oauth-consent.js';
 import { detectClients, buildServerEntry, renderInstruction, applyFileEntry, resolveMode, DEFAULT_SERVER_NAME, } from '../client-config.js';
-// B7: the elicitation-driven account_add / account_reauth wizard. It rebuilds
-// interactive account management on the mutable config.json registry so a
-// running server can add an account without the deployer editing env + running
-// a CLI. Google consent reuses the loopback flow (leg C); the HTTP-transport
-// consent path (${BASE}/authorize) is owned by the OAuth AS and lands with that
-// cluster — account_add over http is gated behind it.
-const ALIAS_RE = /^[a-zA-Z0-9_-]+$/;
 // The common optional bundles get their own checkbox (MCP elicitation has no
 // multi-select, so a boolean per bundle IS the checklist); the long tail stays
 // a comma-separated field for power users, and `allBundles` grants every one.
@@ -214,7 +207,7 @@ async function runConsent(server, alias) {
 function s4Text(alias, missing) {
     const outcome = missing.length === 0
         ? `✔ "${alias}" authenticated; all requested scopes granted. It is now usable without a restart.`
-        : `⚠ "${alias}" authenticated, but ${missing.length} requested scope(s) were NOT granted (E_SCOPE_NOT_GRANTED) — you may have unchecked some on the consent screen. Re-run account_reauth to grant them. The account is usable for the granted scopes.`;
+        : `⚠ "${alias}" authenticated, but ${missing.length} requested scope(s) were NOT granted (E_SCOPE_NOT_GRANTED). You may have unchecked some on the consent screen. Re-run account_reauth to grant them. The account is usable for the granted scopes.`;
     return `${outcome}\n${TESTING_MODE_WARNING}`;
 }
 const REQUIRES_INTERACTION = { 'anthropic/requiresUserInteraction': true };
@@ -226,7 +219,7 @@ export function registerAccountWizardTools(registry, server) {
     registerMeta('account_add', {
         _meta: REQUIRES_INTERACTION,
         annotations: { openWorldHint: true },
-        description: 'Add a new Google account: pass alias + email directly (plus optional bundles/allBundles/admin), or pass nothing for an interactive form where the client supports elicitation. Writes the registry and runs Google consent in the browser — no file editing or restart needed. Requires GOOGLE_CLIENT_ID/SECRET (run the `setup` prompt first if missing).',
+        description: 'Add a new Google account: pass alias + email directly (plus optional bundles/allBundles/admin), or pass nothing for an interactive form where the client supports elicitation. Writes the registry and runs Google consent in the browser. No file editing or restart needed. Requires GOOGLE_CLIENT_ID/SECRET (run the `setup` prompt first if missing).',
         inputSchema: {
             alias: z.string().optional().describe('Account alias (letters, digits, _ or -). Pass with email to add directly, skipping the form.'),
             account: z.string().optional().describe('Alias for the new account (same as `alias`; every other tool spells it `account`)'),
@@ -358,16 +351,16 @@ export function registerAccountWizardTools(registry, server) {
             for (const client of targets) {
                 const instr = renderInstruction(client, name, entry);
                 if (client.managed === 'cli') {
-                    blocks.push(`${client.label} — run:\n  ${instr.text}`);
+                    blocks.push(`${client.label}: run\n  ${instr.text}`);
                 }
                 else if (a.write) {
                     const res = applyFileEntry(client, name, entry);
                     blocks.push(res.ok
-                        ? `${client.label} — ${res.action} "${name}" in ${res.path}${res.backup ? ` (backup ${res.backup})` : ''}`
-                        : `${client.label} — ${res.message}\n${res.snippet ?? ''}`);
+                        ? `${client.label}: ${res.action} "${name}" in ${res.path}${res.backup ? ` (backup ${res.backup})` : ''}`
+                        : `${client.label}: ${res.message}\n${res.snippet ?? ''}`);
                 }
                 else {
-                    blocks.push(`${client.label} — add to ${instr.path}:\n${instr.text}`);
+                    blocks.push(`${client.label}: add to ${instr.path}\n${instr.text}`);
                 }
             }
             if (targets.length === 0) {

package/dist/tools/drive.js

@@ -255,6 +255,7 @@ export function registerDriveTools(server) {
                                 webViewLink,
                             }, null, 2),
                         }],
+                    isError: true,
                 };
             }
             const fileSize = parseInt(size ?? '0', 10);
@@ -274,6 +275,7 @@ export function registerDriveTools(server) {
                                 webViewLink,
                             }, null, 2),
                         }],
+                    isError: true,
                 };
             }
             if (mimeType && isTextualMime(mimeType)) {
@@ -295,6 +297,7 @@ export function registerDriveTools(server) {
                             webViewLink,
                         }, null, 2),
                     }],
+                isError: true,
             };
         }
         catch (error) {

package/dist/tools/google-api.js

@@ -191,7 +191,10 @@ export function registerEscapeTools(registry, policy, deps = {}) {
         const cud = cudFromMethod(method);
         const policyService = serviceForAlias(apiKey);
         const lastSegment = method.id.split('.').pop() ?? method.id;
-        const toolRef = { name: `${policyService}_${lastSegment}`, service: policyService, cud };
+        // The escape hatch self-gates, so it needs the same scope signal the
+        // registry wrapper gets; without it a privileged method would slip past
+        // safe-writes here while its generated twin is refused.
+        const toolRef = { name: `${policyService}_${lastSegment}`, service: policyService, cud, scopes: method.scopes };
         if (cud !== 'read' && !isAllowed(toolRef, policy)) {
             return writeDisabledResult(toolRef, policy, account);
         }

package/dist/usage-metrics.d.ts

@@ -86,6 +86,11 @@ export interface InitOptions {
     now?: () => number;
     monotonic?: () => number;
     log?: (line: string) => void;
+    /** Default true. The retry and bigram chains correlate CONSECUTIVE calls,
+     * which is only meaningful when one caller owns the whole process; a host
+     * serving several callers sets false so their sequences never cross-link.
+     * DayAgg shape is unchanged (retries/bigrams stay empty maps). */
+    sequencingEnabled?: boolean;
 }
 /** Deep-add b into a for the DayAgg shape (numbers add, maps union). */
 export declare function mergeDay(a: DayAgg, b: DayAgg): DayAgg;
@@ -108,6 +113,7 @@ export declare class Metrics {
     private dirty;
     private failures;
     private disabled;
+    private readonly sequencing;
     constructor(opts: InitOptions);
     private day;
     private initStorage;

package/dist/usage-metrics.js

@@ -221,7 +221,9 @@ export class Metrics {
     dirty = false;
     failures = 0;
     disabled = false;
+    sequencing;
     constructor(opts) {
+        this.sequencing = opts.sequencingEnabled !== false;
         this.dir = opts.dir ?? path.join(stateDir(opts.env), METRICS_DIR_NAME);
         this.aggDir = path.join(this.dir, 'agg');
         this.eventsFile = path.join(this.dir, 'events.jsonl');
@@ -357,22 +359,26 @@ export class Metrics {
             f.calls += 1;
             addInto(f, fan);
         }
-        // retry self-correction chain (spec section 1): in-memory only.
+        // retry self-correction chain (spec section 1): in-memory only. Both
+        // chains link consecutive calls, so they only run when one caller owns
+        // the process (sequencingEnabled).
         const nowM = this.mono();
-        const prev = this.lastError.get(entry.name);
-        if (prev && nowM - prev.at <= RETRY_WINDOW_MS) {
-            const rr = (this.deltas.retries[prev.slug] ??= { hintedOk: 0, hintedFail: 0, unhintedOk: 0, unhintedFail: 0 });
-            const key = `${prev.hinted ? 'hinted' : 'unhinted'}${ok ? 'Ok' : 'Fail'}`;
-            rr[key] += 1;
-            this.lastError.delete(entry.name);
-        }
-        if (!ok && slug)
-            this.lastError.set(entry.name, { slug, hinted: hinted === true, at: nowM });
-        // bigrams: ordered pairs within the process, 5-minute gap breaks the chain.
-        if (this.lastTool && nowM - this.lastTool.at <= BIGRAM_GAP_MS) {
-            addInto(this.deltas.bigrams, `${this.lastTool.name}>${entry.name}`);
+        if (this.sequencing) {
+            const prev = this.lastError.get(entry.name);
+            if (prev && nowM - prev.at <= RETRY_WINDOW_MS) {
+                const rr = (this.deltas.retries[prev.slug] ??= { hintedOk: 0, hintedFail: 0, unhintedOk: 0, unhintedFail: 0 });
+                const key = `${prev.hinted ? 'hinted' : 'unhinted'}${ok ? 'Ok' : 'Fail'}`;
+                rr[key] += 1;
+                this.lastError.delete(entry.name);
+            }
+            if (!ok && slug)
+                this.lastError.set(entry.name, { slug, hinted: hinted === true, at: nowM });
+            // bigrams: ordered pairs within the process, 5-minute gap breaks the chain.
+            if (this.lastTool && nowM - this.lastTool.at <= BIGRAM_GAP_MS) {
+                addInto(this.deltas.bigrams, `${this.lastTool.name}>${entry.name}`);
+            }
+            this.lastTool = { name: entry.name, at: nowM };
         }
-        this.lastTool = { name: entry.name, at: nowM };
         const event = {
             ts: new Date(this.now()).toISOString().slice(0, 16) + ':00Z',
             boot: this.bootId,

package/dist/write-control.d.ts

@@ -22,6 +22,10 @@ interface ToolRef {
     name: string;
     service: string;
     cud: Cud;
+    /** The method's required OAuth scopes, when the caller knows them. Absent
+     * means "unknown", which is treated as not privileged: a missing scope list
+     * must not silently widen the gate OR silently break an ordinary write. */
+    scopes?: readonly string[];
 }
 /** The irreversible set (frozen, cc-write-control): real sends leave the
  * user's (or org's) identity unrecallably; permanent deletes bypass Trash.
@@ -35,12 +39,21 @@ export declare const IRREVERSIBLE_TOOLS: Set<string>;
 export declare function resolvePolicy(env?: NodeJS.ProcessEnv, opts?: {
     transport?: Transport;
 }): Policy;
+export type PrivilegeKind = 'push_registration' | 'privileged_scope';
+/** Why this write counts as privileged, or undefined if it does not.
+ * Derived, not a hand-kept name list: the tool surface is regenerated from
+ * Discovery, and a list of names would drift out of date silently. */
+export declare function privilegeOf(tool: ToolRef): PrivilegeKind | undefined;
 export declare function isAllowed(tool: ToolRef, policy: Policy): boolean;
 export type DenyReason = {
     rule: 'read_only';
 } | {
     rule: 'deny_glob';
     pattern: string;
+} | {
+    rule: 'privileged';
+    profile: Profile;
+    kind: PrivilegeKind;
 } | {
     rule: 'profile';
     profile: Profile;

package/dist/write-control.js

@@ -63,11 +63,33 @@ function firstMatch(tool, globs) {
 function matchesAny(tool, globs) {
     return firstMatch(tool, globs) !== undefined;
 }
-function profileAllows(profile, cud) {
+/** Scopes that authorize acting on the whole organization, on legal holds, on
+ * billing, or on deployed code. A write behind one of these is not a "safe"
+ * write in any useful sense of the word, whatever its HTTP verb. */
+const PRIVILEGED_SCOPE_RE = /\/auth\/(admin\.directory|admin\.datatransfer|cloud-identity|apps\.licensing|apps\.order|apps\.groups\.settings|apps\.groups\.migration|ediscovery|script\.projects|script\.deployments)/;
+/** Registering a push channel hands this account's activity to an external URL.
+ * It is shaped like a create and behaves like an export, so the verb hides it. */
+const PUSH_REGISTRATION_RE = /(_watch|_subscriptions_create|_subscriptions_reactivate)$/;
+/** Why this write counts as privileged, or undefined if it does not.
+ * Derived, not a hand-kept name list: the tool surface is regenerated from
+ * Discovery, and a list of names would drift out of date silently. */
+export function privilegeOf(tool) {
+    if (PUSH_REGISTRATION_RE.test(tool.name))
+        return 'push_registration';
+    // `some`, not `every`: the scope list is an any-of, so a tool that CAN be
+    // authorized by a privileged scope is treated as privileged.
+    if (tool.scopes?.some((sc) => PRIVILEGED_SCOPE_RE.test(sc)))
+        return 'privileged_scope';
+    return undefined;
+}
+function profileAllows(profile, tool) {
     if (profile === 'full-writes')
         return true;
-    if (profile === 'safe-writes')
-        return cud === 'create' || cud === 'update';
+    if (profile === 'safe-writes') {
+        if (privilegeOf(tool) !== undefined)
+            return false;
+        return tool.cud === 'create' || tool.cud === 'update';
+    }
     return false;
 }
 export function isAllowed(tool, policy) {
@@ -79,11 +101,11 @@ export function isAllowed(tool, policy) {
         return false;
     if (matchesAny(tool, policy.allow))
         return true;
-    return profileAllows(policy.profile, tool.cud);
+    return profileAllows(policy.profile, tool);
 }
-/** Which profiles would permit this cud at all. */
-function profilesAllowing(cud) {
-    return PROFILES.filter((p) => profileAllows(p, cud));
+/** Which profiles would permit this tool at all. */
+function profilesAllowing(tool) {
+    return PROFILES.filter((p) => profileAllows(p, tool));
 }
 /** WHICH rule refused the call. `isAllowed` has a precedence order, so exactly
  * one rule decides; naming the others sends the caller to a setting that
@@ -98,8 +120,14 @@ export function denyReason(tool, policy) {
         return { rule: 'deny_glob', pattern };
     if (matchesAny(tool, policy.allow))
         return undefined;
-    if (profileAllows(policy.profile, tool.cud))
+    if (profileAllows(policy.profile, tool))
         return undefined;
+    const kind = privilegeOf(tool);
+    // Distinguished from a plain profile refusal: "delete is not a safe write"
+    // and "this is an org-wide operation" need different answers.
+    if (kind !== undefined && policy.profile === 'safe-writes') {
+        return { rule: 'privileged', profile: policy.profile, kind };
+    }
     return { rule: 'profile', profile: policy.profile };
 }
 function denyHint(tool, reason) {
@@ -109,7 +137,13 @@ function denyHint(tool, reason) {
     if (reason.rule === 'deny_glob') {
         return `GOOGLE_WRITE_DENY pattern "${reason.pattern}" matches this tool, and deny is checked before the allow-list and the profile, so neither can override it. Remove or narrow that pattern.`;
     }
-    const usable = profilesAllowing(tool.cud).filter((p) => p !== reason.profile);
+    if (reason.rule === 'privileged') {
+        const what = reason.kind === 'push_registration'
+            ? 'registers a push channel, which sends this account\'s activity to an external URL'
+            : 'needs a scope that acts on the whole organization, on legal holds, on billing, or on deployed code';
+        return `"${tool.name}" ${what}, so "${reason.profile}" refuses it whatever its verb. Use GOOGLE_PROFILE=full-writes, or allow just this one with GOOGLE_WRITE_ALLOW="${tool.service}:${opOf(tool)}".`;
+    }
+    const usable = profilesAllowing(tool).filter((p) => p !== reason.profile);
     const profiles = usable.length > 0
         ? `Use GOOGLE_PROFILE=${usable.join(' or ')}`
         : 'No profile permits this operation';

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "mcp-google-multi",
-  "version": "6.0.0-alpha.35",
+  "version": "6.0.0-alpha.37",
   "mcpName": "io.github.bakissation/mcp-google-multi",
   "description": "Local MCP server for Google Workspace (Gmail, Drive, Calendar, Sheets, Docs, Contacts, Tasks, Meet, Search Console, +Forms/Chat/Admin) across multiple accounts — OAuth-only, encrypted token storage, deny-by-default writes.",
   "type": "module",