mcp-google-multi 6.0.0-alpha.36 → 6.0.0-alpha.38

package/dist/accounts.js

@@ -2,7 +2,7 @@ import path from 'node:path';
 import fs from 'node:fs';
 import { z } from 'zod';
 import { loadEnvFiles } from './env-load.js';
-import { CONFIG_VERSION, configDir, configFilePath, failStartup, loadConfigFile, mutateConfigFile } from './config-file.js';
+import { ALIAS_RE, CONFIG_VERSION, configDir, configFilePath, failStartup, isReservedAlias, loadConfigFile, mutateConfigFile } from './config-file.js';
 import { BUNDLE_CATALOG, closestBundle, resolveBundleAliases } from './scope-catalog.js';
 const envLoad = loadEnvFiles();
 const defaultTokenDir = path.join(configDir(), 'tokens');
@@ -40,7 +40,7 @@ function parseEnvAccounts(raw, adminAliases) {
         }
         // Restrict alias to a safe charset so it can't escape `tokenDir` via path traversal
         // (e.g. "../../etc/passwd:foo@bar.com" in .env).
-        if (!/^[a-zA-Z0-9_-]+$/.test(alias) || ['__proto__', 'constructor', 'prototype'].includes(alias)) {
+        if (!ALIAS_RE.test(alias) || isReservedAlias(alias)) {
             throw new Error(`Invalid alias "${alias}". Allowed characters: letters, digits, underscore, hyphen.`);
         }
         if (aliases.includes(alias)) {

package/dist/config-file.d.ts

@@ -2,6 +2,8 @@ export declare const CONFIG_VERSION = 1;
 export declare function configDir(env?: NodeJS.ProcessEnv): string;
 export declare function configFilePath(env?: NodeJS.ProcessEnv): string;
 export declare const ALIAS_RE: RegExp;
+export declare const RESERVED_ALIASES: string[];
+export declare function isReservedAlias(name: string): boolean;
 export interface ConfigFile {
     version: number;
     accounts?: Record<string, {

package/dist/config-file.js

@@ -22,7 +22,10 @@ const accountEntrySchema = z.strictObject({
 // masterKey, jwtKey, clientId) fails validation, structurally enforcing
 // secrets-env-only. scopeProfiles/defaultAccount/discovery/toolsets are part
 // of the frozen envelope; their consumers land in later slices.
-const RESERVED_ALIASES = ['__proto__', 'constructor', 'prototype'];
+export const RESERVED_ALIASES = ['__proto__', 'constructor', 'prototype'];
+export function isReservedAlias(name) {
+    return RESERVED_ALIASES.includes(name);
+}
 const configSchema = z.strictObject({
     version: z.number().int(),
     accounts: z.record(z.string().regex(ALIAS_RE), accountEntrySchema).optional(),

package/dist/doctor.js

@@ -7,6 +7,7 @@ import { peekMasterKeyProvenance, deleteMasterKeyMaterial } from './master-key.j
 import { hasToken } from './token-store.js';
 import { configDir, loadConfigFile } from './config-file.js';
 import { envValueSource } from './env-load.js';
+import { reauthHint } from './reauth-hint.js';
 import { describeMetricsDir, resolveUsageMetrics, sourceLabel } from './usage-metrics.js';
 import { probeApiEnablement } from './api-probe.js';
 import { safeMessage, stringifyEnvelope } from './tools/_errors.js';
@@ -181,7 +182,7 @@ function sectionsTokensAndScopes(deps, aliases) {
             if (scopeVerdict === 'ok')
                 scopeVerdict = 'warn';
             scopeLines.push(`${alias}: ${r.callable.length} callable, ${r.requestable.length} requested-not-granted`);
-            scopeHint = `Re-auth to grant missing scopes: \`npx mcp-google-multi auth --account ${alias}\`.`;
+            scopeHint = `Re-auth to grant missing scopes. ${reauthHint(alias)}`;
         }
         else {
             scopeLines.push(`${alias}: ${r.callable.length} callable, all profile scopes granted`);

package/dist/http-transport.d.ts

@@ -4,6 +4,7 @@ import type { HttpConfig } from './http-config.js';
 import { type ArgShape, type StrictArgOptions, type ValidationEnvelopeOptions } from './arg-normalize.js';
 export type AuthOutcome = {
     ok: true;
+    sub?: string;
 } | {
     ok: false;
     status: number;

package/dist/http-transport.js

@@ -149,6 +149,15 @@ export class HttpTransportHost {
             this.log(`${auth.status} auth_failed path=/mcp`);
             return;
         }
+        // Thread the verified subject to tool handlers: the Node transport forwards
+        // req.auth verbatim as ctx.http.authInfo. Token/clientId stay empty — the
+        // bearer value must not re-enter the dispatch path via handler context.
+        req.auth = {
+            token: '',
+            clientId: '',
+            scopes: ['mcp:use'],
+            extra: { sub: auth.sub ?? 'owner' },
+        };
         let body;
         try {
             body = await this.readJson(req);

package/dist/master-key.js

@@ -38,17 +38,23 @@ let keychainFactory = systemKeychain;
 export function __setKeychainFactoryForTest(fn) {
     keychainFactory = fn ?? systemKeychain;
 }
-// Glob the token dir instead of iterating registered aliases: an orphan .enc
-// (alias removed from the registry, or a partial GOOGLE_ACCOUNTS override in
-// one client) must still stop a fresh key from being minted.
-function anyTokenFileExists() {
+function anyEncFileUnder(dir) {
     try {
-        return fs.readdirSync(getTokenDir()).some((f) => f.endsWith('.enc'));
+        return fs.readdirSync(dir, { recursive: true }).some((f) => String(f).endsWith('.enc'));
     }
     catch {
         return false;
     }
 }
+// Glob the token dir instead of iterating registered aliases: an orphan .enc
+// (alias removed from the registry, or a partial GOOGLE_ACCOUNTS override in
+// one client) must still stop a fresh key from being minted. The walk is
+// recursive and also covers configDir()/tenants (the tenant-namespaced token
+// root): a flat scan returns false the moment tokens nest, and minting a
+// fresh MASTER_KEY over existing .enc files bricks them irreversibly.
+function anyTokenFileExists() {
+    return anyEncFileUnder(getTokenDir()) || anyEncFileUnder(path.join(configDir(), 'tenants'));
+}
 function readKeyFile(filePath) {
     try {
         const raw = fs.readFileSync(filePath, 'utf8').trim();

package/dist/mcp-token.d.ts

@@ -9,6 +9,7 @@ export interface AccessTokenParams {
     secret: Uint8Array;
     ttlSec?: number;
     iat: number;
+    sub: string;
 }
 export declare function signAccessToken(p: AccessTokenParams): Promise<string>;
 export interface AccessClaims {
@@ -31,7 +32,7 @@ export interface CodePayload {
     redirect_uri: string;
     code_challenge: string;
     resource: string;
-    sub: 'owner';
+    sub: string;
 }
 export declare function signState(payload: StatePayload, base: string, secret: Uint8Array, iat: number, ttlSec?: number): Promise<string>;
 export declare function verifyState(token: string, base: string, secret: Uint8Array): Promise<StatePayload & {
@@ -57,7 +58,7 @@ export declare class ReplayGuard {
     private evictExpired;
 }
 export interface RefreshRecord {
-    sub: 'owner';
+    sub: string;
     issuedAt: number;
     family: string;
 }
@@ -74,8 +75,13 @@ export declare class RefreshStore {
     constructor(path: string, masterKey: string);
     private load;
     private save;
-    issue(nowMs: number, family?: string): string;
+    issue(nowMs: number, sub: string, family?: string): string;
     /** Rotate a presented refresh token; null if unknown OR if the presented
-     * token was already rotated away (reuse => the family is revoked). */
-    rotate(oldToken: string, nowMs: number): string | null;
+     * token was already rotated away (reuse => the family is revoked). The
+     * record's sub is copied forward and returned so the caller can mint the
+     * matching access token without trusting anything client-supplied. */
+    rotate(oldToken: string, nowMs: number): {
+        token: string;
+        sub: string;
+    } | null;
 }

package/dist/mcp-token.js

@@ -24,7 +24,7 @@ export async function signAccessToken(p) {
     return new SignJWT({ scope: 'mcp:use', purpose: 'mcp_access' })
         .setProtectedHeader({ alg: 'HS256', typ: 'JWT' })
         .setIssuer(p.base)
-        .setSubject('owner')
+        .setSubject(p.sub)
         .setAudience(`${p.base}/mcp`)
         .setIssuedAt(p.iat)
         .setExpirationTime(p.iat + ttl)
@@ -139,17 +139,19 @@ export class RefreshStore {
         }
         atomicWriteFileSync(this.path, encryptToken(data, this.masterKey), 0o600);
     }
-    issue(nowMs, family) {
+    issue(nowMs, sub, family) {
         return withFileLock(this.path, () => {
             const token = randomBytes(32).toString('base64url');
             const data = this.load();
-            data.active[token] = { sub: 'owner', issuedAt: nowMs, family: family ?? randomBytes(12).toString('hex') };
+            data.active[token] = { sub, issuedAt: nowMs, family: family ?? randomBytes(12).toString('hex') };
             this.save(data);
             return token;
         });
     }
     /** Rotate a presented refresh token; null if unknown OR if the presented
-     * token was already rotated away (reuse => the family is revoked). */
+     * token was already rotated away (reuse => the family is revoked). The
+     * record's sub is copied forward and returned so the caller can mint the
+     * matching access token without trusting anything client-supplied. */
     rotate(oldToken, nowMs) {
         return withFileLock(this.path, () => {
             const data = this.load();
@@ -168,9 +170,9 @@ export class RefreshStore {
             delete data.active[oldToken];
             data.spent[oldToken] = rec.family;
             const next = randomBytes(32).toString('base64url');
-            data.active[next] = { sub: 'owner', issuedAt: nowMs, family: rec.family };
+            data.active[next] = { sub: rec.sub, issuedAt: nowMs, family: rec.family };
             this.save(data);
-            return next;
+            return { token: next, sub: rec.sub };
         });
     }
 }

package/dist/oauth-as.js

@@ -385,8 +385,8 @@ export function buildAuthServer(config, deps = {}) {
             if (!form.code_verifier || pkceS256(form.code_verifier) !== code.code_challenge) {
                 return json(res, 400, { error: 'invalid_grant', message: 'PKCE verification failed' });
             }
-            const access = await signAccessToken({ base, secret, iat: nowSec(), ttlSec: accessTtl });
-            const refreshToken = refresh.issue(now());
+            const access = await signAccessToken({ base, secret, iat: nowSec(), ttlSec: accessTtl, sub: code.sub });
+            const refreshToken = refresh.issue(now(), code.sub);
             log('token issued grant=authorization_code');
             return json(res, 200, { access_token: access, token_type: 'Bearer', expires_in: accessTtl, refresh_token: refreshToken, scope: 'mcp:use' });
         }
@@ -394,9 +394,9 @@ export function buildAuthServer(config, deps = {}) {
             const next = refresh.rotate(form.refresh_token ?? '', now());
             if (!next)
                 return json(res, 400, { error: 'invalid_grant', message: 'unknown or rotated refresh token' });
-            const access = await signAccessToken({ base, secret, iat: nowSec(), ttlSec: accessTtl });
+            const access = await signAccessToken({ base, secret, iat: nowSec(), ttlSec: accessTtl, sub: next.sub });
             log('token issued grant=refresh_token');
-            return json(res, 200, { access_token: access, token_type: 'Bearer', expires_in: accessTtl, refresh_token: next, scope: 'mcp:use' });
+            return json(res, 200, { access_token: access, token_type: 'Bearer', expires_in: accessTtl, refresh_token: next.token, scope: 'mcp:use' });
         }
         return json(res, 400, { error: 'unsupported_grant_type', message: 'authorization_code or refresh_token only' });
     };
@@ -446,8 +446,8 @@ export function buildAuthServer(config, deps = {}) {
             return { ok: false, status: 401, headers: { 'WWW-Authenticate': wwwAuth }, body: JSON.stringify({ error: 'E_MCP_TOKEN_INVALID', message: 'missing bearer token' }) };
         }
         try {
-            await verifyAccessToken(header.slice(7), base, secret);
-            return { ok: true };
+            const claims = await verifyAccessToken(header.slice(7), base, secret);
+            return { ok: true, sub: claims.sub };
         }
         catch {
             return { ok: false, status: 401, headers: { 'WWW-Authenticate': wwwAuth }, body: JSON.stringify({ error: 'E_MCP_TOKEN_INVALID', message: 'invalid or expired token' }) };

package/dist/registry-transfer.js

@@ -9,9 +9,8 @@ import * as readline from 'node:readline';
 import path from 'node:path';
 import { encryptToken, decryptToken } from './token-store.js';
 import { atomicWriteFileSync, atomicWriteWithLock } from './fs-atomic.js';
-import { configFilePath, CONFIG_VERSION } from './config-file.js';
+import { ALIAS_RE, configFilePath, CONFIG_VERSION } from './config-file.js';
 import { getTokenDir } from './accounts.js';
-const ALIAS_RE = /^[a-zA-Z0-9_-]+$/;
 function resolveDeps(deps) {
     return {
         configPath: deps.configPath ?? configFilePath(),

package/dist/scope-observability.js

@@ -1,6 +1,7 @@
 import { ADMIN_SCOPES, BUNDLE_CATALOG } from './scope-catalog.js';
 import { BASE_SCOPES, resolveScopesForAccount } from './auth.js';
 import { readToken } from './token-store.js';
+import { reauthHint } from './reauth-hint.js';
 // Reverse index scope -> bundles offering it, narrowest bundle first (fewest
 // scopes) so the remediation names the smallest grant. BASE_SCOPES map to the
 // pseudo-bundle "base" (outside a profile only via includesBase:false).
@@ -74,7 +75,7 @@ export function scopeHint(scope, c, alias) {
         case 'requestable_not_granted':
             return {
                 hint: `Scope ${scope} is in ${alias}'s profile but not granted (you unchecked it at consent). ` +
-                    `Re-grant: npx mcp-google-multi auth --account ${alias}`,
+                    reauthHint(alias),
                 retriable: true,
             };
         case 'not_requestable':

package/dist/tools/account-wizard.js

@@ -1,6 +1,6 @@
 import { z } from 'zod';
 import { getAccountSet, invalidateAccountSet } from '../accounts.js';
-import { mutateConfigFile } from '../config-file.js';
+import { ALIAS_RE, mutateConfigFile } from '../config-file.js';
 import { writeToken } from '../token-store.js';
 import { resolveScopesForAccount } from '../auth.js';
 import { BUNDLE_CATALOG, closestBundle, resolveBundleAliases } from '../scope-catalog.js';
@@ -9,13 +9,6 @@ import { coerceBoolean } from './_coerce.js';
 import { safeMessage, stringifyEnvelope } from './_errors.js';
 import { buildConsentClient, openLoopbackConsent, hasClientCredentials, TESTING_MODE_WARNING, } from '../oauth-consent.js';
 import { detectClients, buildServerEntry, renderInstruction, applyFileEntry, resolveMode, DEFAULT_SERVER_NAME, } from '../client-config.js';
-// B7: the elicitation-driven account_add / account_reauth wizard. It rebuilds
-// interactive account management on the mutable config.json registry so a
-// running server can add an account without the deployer editing env + running
-// a CLI. Google consent reuses the loopback flow (leg C); the HTTP-transport
-// consent path (${BASE}/authorize) is owned by the OAuth AS and lands with that
-// cluster. account_add over http is gated behind it.
-const ALIAS_RE = /^[a-zA-Z0-9_-]+$/;
 // The common optional bundles get their own checkbox (MCP elicitation has no
 // multi-select, so a boolean per bundle IS the checklist); the long tail stays
 // a comma-separated field for power users, and `allBundles` grants every one.

package/dist/tools/accounts-tool.js

@@ -1,3 +1,4 @@
+import { reauthHint } from '../reauth-hint.js';
 import * as fs from 'node:fs';
 import { getAccountSet, refreshAccountSetIfStale } from '../accounts.js';
 import { buildScopesReport } from '../scope-observability.js';
@@ -35,7 +36,7 @@ export function deriveAccountHealth(alias, deps = DEFAULT_DEPS) {
                 status: 'missing',
                 hint: legacy
                     ? 'Plaintext token.json found — run: npx mcp-google-multi migrate-tokens'
-                    : `Run: npx mcp-google-multi auth --account ${alias}`,
+                    : reauthHint(alias),
             },
             scopes: noScopes,
         };
@@ -69,7 +70,7 @@ export function deriveAccountHealth(alias, deps = DEFAULT_DEPS) {
             status,
             expiryDate: expiry !== undefined ? new Date(expiry).toISOString() : undefined,
             hint: status === 'needs_reauth'
-                ? `Run: npx mcp-google-multi auth --account ${alias}`
+                ? reauthHint(alias)
                 : missing.length > 0
                     ? 'Re-auth to grant the missing scopes'
                     : undefined,

package/dist/usage-metrics.d.ts

@@ -86,6 +86,11 @@ export interface InitOptions {
     now?: () => number;
     monotonic?: () => number;
     log?: (line: string) => void;
+    /** Default true. The retry and bigram chains correlate CONSECUTIVE calls,
+     * which is only meaningful when one caller owns the whole process; a host
+     * serving several callers sets false so their sequences never cross-link.
+     * DayAgg shape is unchanged (retries/bigrams stay empty maps). */
+    sequencingEnabled?: boolean;
 }
 /** Deep-add b into a for the DayAgg shape (numbers add, maps union). */
 export declare function mergeDay(a: DayAgg, b: DayAgg): DayAgg;
@@ -108,6 +113,7 @@ export declare class Metrics {
     private dirty;
     private failures;
     private disabled;
+    private readonly sequencing;
     constructor(opts: InitOptions);
     private day;
     private initStorage;

package/dist/usage-metrics.js

@@ -221,7 +221,9 @@ export class Metrics {
     dirty = false;
     failures = 0;
     disabled = false;
+    sequencing;
     constructor(opts) {
+        this.sequencing = opts.sequencingEnabled !== false;
         this.dir = opts.dir ?? path.join(stateDir(opts.env), METRICS_DIR_NAME);
         this.aggDir = path.join(this.dir, 'agg');
         this.eventsFile = path.join(this.dir, 'events.jsonl');
@@ -357,22 +359,26 @@ export class Metrics {
             f.calls += 1;
             addInto(f, fan);
         }
-        // retry self-correction chain (spec section 1): in-memory only.
+        // retry self-correction chain (spec section 1): in-memory only. Both
+        // chains link consecutive calls, so they only run when one caller owns
+        // the process (sequencingEnabled).
         const nowM = this.mono();
-        const prev = this.lastError.get(entry.name);
-        if (prev && nowM - prev.at <= RETRY_WINDOW_MS) {
-            const rr = (this.deltas.retries[prev.slug] ??= { hintedOk: 0, hintedFail: 0, unhintedOk: 0, unhintedFail: 0 });
-            const key = `${prev.hinted ? 'hinted' : 'unhinted'}${ok ? 'Ok' : 'Fail'}`;
-            rr[key] += 1;
-            this.lastError.delete(entry.name);
-        }
-        if (!ok && slug)
-            this.lastError.set(entry.name, { slug, hinted: hinted === true, at: nowM });
-        // bigrams: ordered pairs within the process, 5-minute gap breaks the chain.
-        if (this.lastTool && nowM - this.lastTool.at <= BIGRAM_GAP_MS) {
-            addInto(this.deltas.bigrams, `${this.lastTool.name}>${entry.name}`);
+        if (this.sequencing) {
+            const prev = this.lastError.get(entry.name);
+            if (prev && nowM - prev.at <= RETRY_WINDOW_MS) {
+                const rr = (this.deltas.retries[prev.slug] ??= { hintedOk: 0, hintedFail: 0, unhintedOk: 0, unhintedFail: 0 });
+                const key = `${prev.hinted ? 'hinted' : 'unhinted'}${ok ? 'Ok' : 'Fail'}`;
+                rr[key] += 1;
+                this.lastError.delete(entry.name);
+            }
+            if (!ok && slug)
+                this.lastError.set(entry.name, { slug, hinted: hinted === true, at: nowM });
+            // bigrams: ordered pairs within the process, 5-minute gap breaks the chain.
+            if (this.lastTool && nowM - this.lastTool.at <= BIGRAM_GAP_MS) {
+                addInto(this.deltas.bigrams, `${this.lastTool.name}>${entry.name}`);
+            }
+            this.lastTool = { name: entry.name, at: nowM };
         }
-        this.lastTool = { name: entry.name, at: nowM };
         const event = {
             ts: new Date(this.now()).toISOString().slice(0, 16) + ':00Z',
             boot: this.bootId,

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "mcp-google-multi",
-  "version": "6.0.0-alpha.36",
+  "version": "6.0.0-alpha.38",
   "mcpName": "io.github.bakissation/mcp-google-multi",
   "description": "Local MCP server for Google Workspace (Gmail, Drive, Calendar, Sheets, Docs, Contacts, Tasks, Meet, Search Console, +Forms/Chat/Admin) across multiple accounts — OAuth-only, encrypted token storage, deny-by-default writes.",
   "type": "module",