mcp-google-multi 6.0.0-alpha.37 → 6.0.0-alpha.38

package/dist/doctor.js

@@ -7,6 +7,7 @@ import { peekMasterKeyProvenance, deleteMasterKeyMaterial } from './master-key.j
 import { hasToken } from './token-store.js';
 import { configDir, loadConfigFile } from './config-file.js';
 import { envValueSource } from './env-load.js';
+import { reauthHint } from './reauth-hint.js';
 import { describeMetricsDir, resolveUsageMetrics, sourceLabel } from './usage-metrics.js';
 import { probeApiEnablement } from './api-probe.js';
 import { safeMessage, stringifyEnvelope } from './tools/_errors.js';
@@ -181,7 +182,7 @@ function sectionsTokensAndScopes(deps, aliases) {
             if (scopeVerdict === 'ok')
                 scopeVerdict = 'warn';
             scopeLines.push(`${alias}: ${r.callable.length} callable, ${r.requestable.length} requested-not-granted`);
-            scopeHint = `Re-auth to grant missing scopes: \`npx mcp-google-multi auth --account ${alias}\`.`;
+            scopeHint = `Re-auth to grant missing scopes. ${reauthHint(alias)}`;
         }
         else {
             scopeLines.push(`${alias}: ${r.callable.length} callable, all profile scopes granted`);

package/dist/http-transport.d.ts

@@ -4,6 +4,7 @@ import type { HttpConfig } from './http-config.js';
 import { type ArgShape, type StrictArgOptions, type ValidationEnvelopeOptions } from './arg-normalize.js';
 export type AuthOutcome = {
     ok: true;
+    sub?: string;
 } | {
     ok: false;
     status: number;

package/dist/http-transport.js

@@ -149,6 +149,15 @@ export class HttpTransportHost {
             this.log(`${auth.status} auth_failed path=/mcp`);
             return;
         }
+        // Thread the verified subject to tool handlers: the Node transport forwards
+        // req.auth verbatim as ctx.http.authInfo. Token/clientId stay empty — the
+        // bearer value must not re-enter the dispatch path via handler context.
+        req.auth = {
+            token: '',
+            clientId: '',
+            scopes: ['mcp:use'],
+            extra: { sub: auth.sub ?? 'owner' },
+        };
         let body;
         try {
             body = await this.readJson(req);

package/dist/oauth-as.js

@@ -385,8 +385,8 @@ export function buildAuthServer(config, deps = {}) {
             if (!form.code_verifier || pkceS256(form.code_verifier) !== code.code_challenge) {
                 return json(res, 400, { error: 'invalid_grant', message: 'PKCE verification failed' });
             }
-            const access = await signAccessToken({ base, secret, iat: nowSec(), ttlSec: accessTtl, sub: 'owner' });
-            const refreshToken = refresh.issue(now(), 'owner');
+            const access = await signAccessToken({ base, secret, iat: nowSec(), ttlSec: accessTtl, sub: code.sub });
+            const refreshToken = refresh.issue(now(), code.sub);
             log('token issued grant=authorization_code');
             return json(res, 200, { access_token: access, token_type: 'Bearer', expires_in: accessTtl, refresh_token: refreshToken, scope: 'mcp:use' });
         }
@@ -394,7 +394,7 @@ export function buildAuthServer(config, deps = {}) {
             const next = refresh.rotate(form.refresh_token ?? '', now());
             if (!next)
                 return json(res, 400, { error: 'invalid_grant', message: 'unknown or rotated refresh token' });
-            const access = await signAccessToken({ base, secret, iat: nowSec(), ttlSec: accessTtl, sub: 'owner' });
+            const access = await signAccessToken({ base, secret, iat: nowSec(), ttlSec: accessTtl, sub: next.sub });
             log('token issued grant=refresh_token');
             return json(res, 200, { access_token: access, token_type: 'Bearer', expires_in: accessTtl, refresh_token: next.token, scope: 'mcp:use' });
         }
@@ -446,8 +446,8 @@ export function buildAuthServer(config, deps = {}) {
             return { ok: false, status: 401, headers: { 'WWW-Authenticate': wwwAuth }, body: JSON.stringify({ error: 'E_MCP_TOKEN_INVALID', message: 'missing bearer token' }) };
         }
         try {
-            await verifyAccessToken(header.slice(7), base, secret);
-            return { ok: true };
+            const claims = await verifyAccessToken(header.slice(7), base, secret);
+            return { ok: true, sub: claims.sub };
         }
         catch {
             return { ok: false, status: 401, headers: { 'WWW-Authenticate': wwwAuth }, body: JSON.stringify({ error: 'E_MCP_TOKEN_INVALID', message: 'invalid or expired token' }) };

package/dist/scope-observability.js

@@ -1,6 +1,7 @@
 import { ADMIN_SCOPES, BUNDLE_CATALOG } from './scope-catalog.js';
 import { BASE_SCOPES, resolveScopesForAccount } from './auth.js';
 import { readToken } from './token-store.js';
+import { reauthHint } from './reauth-hint.js';
 // Reverse index scope -> bundles offering it, narrowest bundle first (fewest
 // scopes) so the remediation names the smallest grant. BASE_SCOPES map to the
 // pseudo-bundle "base" (outside a profile only via includesBase:false).
@@ -74,7 +75,7 @@ export function scopeHint(scope, c, alias) {
         case 'requestable_not_granted':
             return {
                 hint: `Scope ${scope} is in ${alias}'s profile but not granted (you unchecked it at consent). ` +
-                    `Re-grant: npx mcp-google-multi auth --account ${alias}`,
+                    reauthHint(alias),
                 retriable: true,
             };
         case 'not_requestable':

package/dist/tools/accounts-tool.js

@@ -1,3 +1,4 @@
+import { reauthHint } from '../reauth-hint.js';
 import * as fs from 'node:fs';
 import { getAccountSet, refreshAccountSetIfStale } from '../accounts.js';
 import { buildScopesReport } from '../scope-observability.js';
@@ -35,7 +36,7 @@ export function deriveAccountHealth(alias, deps = DEFAULT_DEPS) {
                 status: 'missing',
                 hint: legacy
                     ? 'Plaintext token.json found — run: npx mcp-google-multi migrate-tokens'
-                    : `Run: npx mcp-google-multi auth --account ${alias}`,
+                    : reauthHint(alias),
             },
             scopes: noScopes,
         };
@@ -69,7 +70,7 @@ export function deriveAccountHealth(alias, deps = DEFAULT_DEPS) {
             status,
             expiryDate: expiry !== undefined ? new Date(expiry).toISOString() : undefined,
             hint: status === 'needs_reauth'
-                ? `Run: npx mcp-google-multi auth --account ${alias}`
+                ? reauthHint(alias)
                 : missing.length > 0
                     ? 'Re-auth to grant the missing scopes'
                     : undefined,

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "mcp-google-multi",
-  "version": "6.0.0-alpha.37",
+  "version": "6.0.0-alpha.38",
   "mcpName": "io.github.bakissation/mcp-google-multi",
   "description": "Local MCP server for Google Workspace (Gmail, Drive, Calendar, Sheets, Docs, Contacts, Tasks, Meet, Search Console, +Forms/Chat/Admin) across multiple accounts — OAuth-only, encrypted token storage, deny-by-default writes.",
   "type": "module",