mcp-google-multi 6.0.0-alpha.43 → 6.0.0-alpha.45

package/dist/doctor.d.ts

@@ -58,7 +58,9 @@ export declare function apiEnableLink(api: string): string;
 export declare function usageMetricsStatusLine(env: Record<string, string | undefined>): string;
 /** Roll section verdicts to an overall verdict. `unknown` never worsens it. */
 export declare function overallVerdict(sections: DiagnosticSection[]): Verdict;
-export declare function runDiagnostics(deps?: DiagnosticsDeps): Promise<DiagnosticsReport>;
+export declare function runDiagnostics(deps?: DiagnosticsDeps, opts?: {
+    scope?: 'operator' | 'tenant';
+}): Promise<DiagnosticsReport>;
 /** doctor CLI (brew-doctor style): glyph-coded human report. */
 export declare function renderDoctorText(report: DiagnosticsReport): string;
 /** Redacted, paste-ready bug report (BR8): verdicts + provenance labels + token
@@ -73,7 +75,9 @@ export declare function exitCodeFor(report: DiagnosticsReport, strict: boolean):
  * from already-registered services, and this runs after that), so it was
  * advertised only once something else expanded the surface. The README sends
  * people here when they are stuck, so it has to be findable. */
-export declare function registerDiagnoseTool(registry: ToolRegistry): void;
+export declare function registerDiagnoseTool(registry: ToolRegistry, ctx?: {
+    subject: string;
+}): void;
 export interface ResetOptions {
     account?: string;
     regenerateKey: boolean;

package/dist/doctor.js

@@ -300,21 +300,28 @@ export function overallVerdict(sections) {
     }
     return worst;
 }
-export async function runDiagnostics(deps = DEFAULT_DEPS) {
+export async function runDiagnostics(deps = DEFAULT_DEPS, opts = {}) {
+    // Tenant scope omits the OPERATOR sections: §3 (key provenance = box
+    // infrastructure) and §7 (its owner-gate lines print MCP_OWNER_EMAILS
+    // values — other people's addresses from a tenant's seat).
+    const tenantScope = opts.scope === 'tenant';
     const sections = [];
     sections.push(sectionRuntime(deps));
     const set = deps.accountSet();
     sections.push(sectionConfig(deps, set));
     const aliases = set?.aliases ?? [];
-    sections.push(sectionKeys(deps, aliases));
+    if (!tenantScope)
+        sections.push(sectionKeys(deps, aliases));
     if (aliases.length > 0) {
         const [tokens, scopes] = sectionsTokensAndScopes(deps, aliases);
         sections.push(tokens, scopes);
         sections.push(await sectionApiEnablement(deps, aliases));
     }
-    const http = await sectionHttp(deps, aliases);
-    if (http)
-        sections.push(http);
+    if (!tenantScope) {
+        const http = await sectionHttp(deps, aliases);
+        if (http)
+            sections.push(http);
+    }
     return { verdict: overallVerdict(sections), sections };
 }
 // --- skins -----------------------------------------------------------------
@@ -364,14 +371,17 @@ export function exitCodeFor(report, strict) {
  * from already-registered services, and this runs after that), so it was
  * advertised only once something else expanded the surface. The README sends
  * people here when they are stuck, so it has to be findable. */
-export function registerDiagnoseTool(registry) {
+export function registerDiagnoseTool(registry, ctx) {
+    // A non-owner context gets the tenant-scoped report; the free core's single
+    // 'owner' context keeps today's full operator report.
+    const scope = ctx && ctx.subject !== 'owner' ? 'tenant' : 'operator';
     registry.registerMeta('diagnose', {
         annotations: { readOnlyHint: true, openWorldHint: true },
         description: 'Health report for this server: runtime, config, keys, per-account token status, scope grants, and API enablement. Read-only; returns copy-pasteable fixes for anything wrong. Call this to diagnose auth/config failures.',
         inputSchema: {},
     }, async () => {
         try {
-            const result = await runDiagnostics();
+            const result = await runDiagnostics(undefined, { scope });
             return { content: [{ type: 'text', text: JSON.stringify(result, null, 2) }] };
         }
         catch (e) {

package/dist/index.js

@@ -89,7 +89,7 @@ function buildRegistry(server, ctx, mode, metrics = null) {
     registerDiscoverTools(registry, policy);
     registerEscapeTools(registry, policy);
     registerAccountTools(registry);
-    registerDiagnoseTool(registry);
+    registerDiagnoseTool(registry, ctx);
     registerAccountWizardTools(registry, server);
     return registry;
 }
@@ -381,6 +381,13 @@ async function main() {
         // re-auth link into the AS's alias_reauth flow instead of a stdio CLI hint.
         const { setHttpReauthBase } = await import('./reauth-hint.js');
         setHttpReauthBase(httpCfg.publicUrl);
+        // Wizard consent over HTTP: hand out the clientless AS link instead of
+        // binding a loopback listener (single-owner flow; a tenancy host installs
+        // its own signed-mint context here).
+        const { setWizardHttpConsent } = await import('./tools/account-wizard.js');
+        setWizardHttpConsent({
+            mintConsentUrl: (alias) => `${httpCfg.publicUrl}/authorize?flow=alias_reauth&alias=${encodeURIComponent(alias)}`,
+        });
         let httpTap;
         if (httpMetrics) {
             const { tapUsageMetrics } = await import('./metrics-tap.js');

package/dist/mcp-token.d.ts

@@ -89,4 +89,9 @@ export declare class RefreshStore {
         token: string;
         sub: string;
     } | null;
+    /** Drop every ACTIVE record minted under `sub` (linear scan under the store
+     * lock). Spent entries carry no sub and stay: with their families gone, a
+     * reuse finds nothing to revoke — inert by construction. Returns the number
+     * of active tokens dropped. */
+    purgeTenant(sub: string): number;
 }

package/dist/mcp-token.js

@@ -175,4 +175,23 @@ export class RefreshStore {
             return { token: next, sub: rec.sub };
         });
     }
+    /** Drop every ACTIVE record minted under `sub` (linear scan under the store
+     * lock). Spent entries carry no sub and stay: with their families gone, a
+     * reuse finds nothing to revoke — inert by construction. Returns the number
+     * of active tokens dropped. */
+    purgeTenant(sub) {
+        return withFileLock(this.path, () => {
+            const data = this.load();
+            let dropped = 0;
+            for (const [t, r] of Object.entries(data.active)) {
+                if (r.sub === sub) {
+                    delete data.active[t];
+                    dropped += 1;
+                }
+            }
+            if (dropped > 0)
+                this.save(data);
+            return dropped;
+        });
+    }
 }

package/dist/tenant-purge.d.ts

@@ -0,0 +1,26 @@
+import type { TokenData } from './types.js';
+/** Best-effort Google-side revocation (RFC 7009 endpoint). Returns whether
+ * Google acknowledged; NEVER throws — a network failure must not block the
+ * local purge (the local copy is the thing we control). */
+export declare function revokeGoogleToken(tokenData: {
+    refresh_token?: string;
+    access_token?: string;
+}, fetchFn?: typeof fetch): Promise<boolean>;
+export interface TenantTokenPurge {
+    /** Aliases whose .enc files were removed. */
+    removed: string[];
+    /** How many tokens Google acknowledged revoking (best-effort). */
+    revoked: number;
+}
+/** Remove every `.enc` under the tenant's token dir, optionally revoking each
+ * at Google first. Decrypt failures still purge the file — an unreadable
+ * token is exactly the thing to delete. Only THIS tenant's dir is touched. */
+export declare function purgeTenantTokens(tenantId: string, opts?: {
+    env?: NodeJS.ProcessEnv;
+    revoke?: (t: TokenData) => Promise<boolean>;
+    resolveKey?: () => string;
+}): Promise<TenantTokenPurge>;
+/** Remove the whole tenants/<id> directory (config + tokens). The id is
+ * validated by the path helper, so a traversal-shaped id throws before any
+ * filesystem access. */
+export declare function removeTenantDir(tenantId: string, env?: NodeJS.ProcessEnv): void;

package/dist/tenant-purge.js

@@ -0,0 +1,67 @@
+// S1.21: tenant offboarding primitives. Core owns the reusable token-purge
+// legs (generically useful, tenant-id-agnostic); the tenant_delete
+// ORCHESTRATION (what to purge, in what order, from which admin surface)
+// lives with the tenancy module that calls these.
+import fs from 'node:fs';
+import path from 'node:path';
+import { tenantConfigFilePath, tenantTokenDir } from './config-file.js';
+import { createTokenStore } from './token-store.js';
+/** Best-effort Google-side revocation (RFC 7009 endpoint). Returns whether
+ * Google acknowledged; NEVER throws — a network failure must not block the
+ * local purge (the local copy is the thing we control). */
+export async function revokeGoogleToken(tokenData, fetchFn = fetch) {
+    const token = tokenData.refresh_token ?? tokenData.access_token;
+    if (!token)
+        return false;
+    try {
+        const res = await fetchFn('https://oauth2.googleapis.com/revoke', {
+            method: 'POST',
+            headers: { 'Content-Type': 'application/x-www-form-urlencoded' },
+            body: new URLSearchParams({ token }).toString(),
+        });
+        return res.ok;
+    }
+    catch {
+        return false;
+    }
+}
+/** Remove every `.enc` under the tenant's token dir, optionally revoking each
+ * at Google first. Decrypt failures still purge the file — an unreadable
+ * token is exactly the thing to delete. Only THIS tenant's dir is touched. */
+export async function purgeTenantTokens(tenantId, opts = {}) {
+    const dir = tenantTokenDir(tenantId, opts.env);
+    const store = createTokenStore(dir, { tenantId, resolveKey: opts.resolveKey });
+    const removed = [];
+    let revoked = 0;
+    let names;
+    try {
+        names = fs.readdirSync(dir);
+    }
+    catch {
+        return { removed, revoked }; // no token dir = nothing to purge
+    }
+    for (const name of names) {
+        if (!name.endsWith('.enc'))
+            continue;
+        const alias = name.slice(0, -'.enc'.length);
+        if (opts.revoke) {
+            try {
+                const token = store.readToken(alias);
+                if (token && (await opts.revoke(token)))
+                    revoked += 1;
+            }
+            catch {
+                // undecryptable or invalid-alias filename: still remove the file
+            }
+        }
+        fs.rmSync(path.join(dir, name), { force: true });
+        removed.push(alias);
+    }
+    return { removed, revoked };
+}
+/** Remove the whole tenants/<id> directory (config + tokens). The id is
+ * validated by the path helper, so a traversal-shaped id throws before any
+ * filesystem access. */
+export function removeTenantDir(tenantId, env) {
+    fs.rmSync(path.dirname(tenantConfigFilePath(tenantId, env)), { recursive: true, force: true });
+}

package/dist/tools/account-wizard.d.ts

@@ -53,4 +53,13 @@ export declare function argsToAddForm(a: {
 /** Scopes requested by the profile but NOT granted at consent (granular
  * consent / unchecked bundles). Pure. */
 export declare function scopeGrantDiff(requested: string[], grantedScope: string | undefined): string[];
+/** HTTP-transport consent context (S1.20): set by the HTTP bootstrap. When
+ * present, runConsent NEVER binds a server-side loopback listener — the
+ * user's browser cannot reach the daemon's loopback — and instead hands out
+ * a clientless AS consent URL. The injector decides the flow (single-owner =
+ * the legacy alias_reauth link; a tenancy host mints a signed alias_add URL). */
+export interface WizardHttpConsent {
+    mintConsentUrl: (alias: string) => Promise<string> | string;
+}
+export declare function setWizardHttpConsent(ctx: WizardHttpConsent | null): void;
 export declare function registerAccountWizardTools(registry: ToolRegistry, server: McpServer): void;

package/dist/tools/account-wizard.js

@@ -136,6 +136,15 @@ function errorResult(slug, message, hint, account) {
         isError: true,
     };
 }
+let httpConsent = null;
+export function setWizardHttpConsent(ctx) {
+    httpConsent = ctx;
+}
+function pendingText(alias, url) {
+    return (`Account "${alias}" is ready to authorize. Open this link in a browser (it belongs to whoever owns the Google account):\n${url}\n` +
+        `On completion the token is stored server-side and the account is usable immediately — no restart. ` +
+        `If the link expires, run account_reauth for a fresh one.\n${TESTING_MODE_WARNING}`);
+}
 /** Run Google consent for `alias` and persist the token. Opens the browser via
  * URL-mode elicitation when the client supports it, else server-side + prints
  * the URL. Returns the granted-scope diff for the S4 report. */
@@ -150,6 +159,29 @@ async function runConsent(server, alias) {
             hint: 'Accounts sourced from GOOGLE_ACCOUNTS are not editable here. Run `mcp-google-multi migrate-config` to move them into config.json.',
         };
     }
+    // HTTP transport: consent completes OUT OF BAND at the AS /callback. Never
+    // bind a loopback listener here; try URL-mode elicitation as a convenience
+    // but surface the URL UP FRONT either way (not only on failure).
+    const http = httpConsent;
+    if (http) {
+        let url;
+        try {
+            url = await http.mintConsentUrl(alias);
+        }
+        catch (e) {
+            return { ok: false, slug: 'internal', message: safeMessage(e) };
+        }
+        const caps = server.server.getClientCapabilities?.();
+        if (caps?.elicitation?.url !== undefined) {
+            try {
+                await server.server.elicitInput(urlElicitationParams(alias, url, randomBytes(16).toString('hex')));
+            }
+            catch {
+                // the URL in the pending text is the recovery
+            }
+        }
+        return { ok: 'pending', url };
+    }
     // Bind the ephemeral loopback listener BEFORE building the auth URL: the
     // redirect URI needs the assigned port, and listening first means the
     // callback can't race the browser.
@@ -267,6 +299,8 @@ export function registerAccountWizardTools(registry, server) {
             invalidateAccountSet();
             // S3 + S4: consent + validate.
             const consent = await runConsent(server, validated.alias);
+            if (consent.ok === 'pending')
+                return textResult(pendingText(validated.alias, consent.url));
             if (!consent.ok)
                 return errorResult(consent.slug, consent.message, consent.hint, validated.alias);
             // B15: offer to register the server with another MCP client.
@@ -303,6 +337,8 @@ export function registerAccountWizardTools(registry, server) {
                 return errorResult('validation_error', `Unknown account "${alias}".`, `Pass one of the configured aliases: ${getAccountSet().aliases.join(', ')}. Use account_add to create a new one.`, alias);
             }
             const consent = await runConsent(server, alias);
+            if (consent.ok === 'pending')
+                return textResult(pendingText(alias, consent.url));
             if (!consent.ok)
                 return errorResult(consent.slug, consent.message, consent.hint, alias);
             return textResult(s4Text(alias, consent.missing));
@@ -353,6 +389,12 @@ export function registerAccountWizardTools(registry, server) {
                 if (client.managed === 'cli') {
                     blocks.push(`${client.label}: run\n  ${instr.text}`);
                 }
+                else if (a.write && mode === 'http') {
+                    // Over HTTP this tool runs on the DAEMON, whose homedir is not the
+                    // caller's machine: write:true would edit the operator's own client
+                    // configs (a cross-tenant hazard under tenancy). Snippet only.
+                    blocks.push(`${client.label}: write:true is ignored over HTTP — this tool runs on the server, not your machine. Add to ${instr.path}\n${instr.text}`);
+                }
                 else if (a.write) {
                     const res = applyFileEntry(client, name, entry);
                     blocks.push(res.ok

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "mcp-google-multi",
-  "version": "6.0.0-alpha.43",
+  "version": "6.0.0-alpha.45",
   "mcpName": "io.github.bakissation/mcp-google-multi",
   "description": "Local MCP server for Google Workspace (Gmail, Drive, Calendar, Sheets, Docs, Contacts, Tasks, Meet, Search Console, +Forms/Chat/Admin) across multiple accounts — OAuth-only, encrypted token storage, deny-by-default writes.",
   "type": "module",