mcp-google-multi 6.0.0-alpha.44 → 6.0.0-alpha.46

package/dist/compose.d.ts

@@ -0,0 +1,5 @@
+import type { McpServer } from "@modelcontextprotocol/server";
+import { ToolRegistry, type DiscoveryMode } from './registry.js';
+import type { IdentityContext } from './identity.js';
+import type { Metrics } from './usage-metrics.js';
+export declare function buildRegistry(server: McpServer, ctx: IdentityContext, mode?: DiscoveryMode, metrics?: Metrics | null): ToolRegistry;

package/dist/compose.js

@@ -0,0 +1,67 @@
+// S1.12: registry composition, extracted from index.ts so the tenancy module
+// (and tests) can build registries without touching the CLI entrypoint. This
+// module must stay free of import-time side effects of its own: no argv
+// parsing, no process.exit, no prints (accounts.js module-load resolution is
+// the one inherited, pre-existing exception on the import chain).
+import { GENERATED_SERVICES } from './tools/generated/index.js';
+import { GENERATED_GATES, SERVICES } from './services.js';
+import { ToolRegistry } from './registry.js';
+import { registerDiscoverTools } from './discover.js';
+import { registerEscapeTools } from './tools/google-api.js';
+import { registerAccountTools } from './tools/accounts-tool.js';
+import { registerDiagnoseTool } from './doctor.js';
+import { registerAccountWizardTools } from './tools/account-wizard.js';
+import { getToolsets, toolsetEnabled } from './toolsets.js';
+export function buildRegistry(server, ctx, mode, metrics = null) {
+    const policy = ctx.policy;
+    // The registry's account view IS the context's: fan-out expansion,
+    // selector validation and default-account injection all follow this
+    // context, not the process global (identical for the free core's one ctx).
+    const registry = new ToolRegistry(server, policy, mode, metrics, () => ctx.accounts);
+    const toolsets = getToolsets();
+    if (toolsets !== 'all') {
+        const known = new Set([...SERVICES.map((s) => s.name), ...GENERATED_SERVICES.map((s) => s.name)]);
+        for (const requested of toolsets) {
+            if (!known.has(requested)) {
+                process.stderr.write(`GOOGLE_TOOLSETS: unknown service "${requested}" ignored\n`);
+            }
+        }
+    }
+    for (const svc of SERVICES) {
+        if (!toolsetEnabled(toolsets, svc.name))
+            continue;
+        if (svc.enabled && !svc.enabled(ctx.accounts)) {
+            if (toolsets !== 'all') {
+                const hint = svc.name === 'admin' ? 'set admin on an account/profile (or GOOGLE_ADMIN_ACCOUNTS)' : `add "${svc.name}" to an account's scope profile (or legacy GOOGLE_OPTIONAL_SCOPES)`;
+                process.stderr.write(`GOOGLE_TOOLSETS: "${svc.name}" requested but not enabled — ${hint}\n`);
+            }
+            continue;
+        }
+        svc.register(registry);
+    }
+    for (const gen of GENERATED_SERVICES) {
+        if (!toolsetEnabled(toolsets, gen.name))
+            continue;
+        const curated = SERVICES.find((s) => s.name === gen.name);
+        const gate = curated?.enabled ?? GENERATED_GATES[gen.name]?.enabled;
+        if (gate && !gate(ctx.accounts)) {
+            if (!curated && toolsets !== 'all') {
+                process.stderr.write(`GOOGLE_TOOLSETS: "${gen.name}" requested but not enabled — ${GENERATED_GATES[gen.name].hint}\n`);
+            }
+            continue;
+        }
+        gen.register(registry);
+    }
+    if (registry.services().length === 0) {
+        const known = [...new Set([...SERVICES.map((s) => s.name), ...GENERATED_SERVICES.map((s) => s.name)])].sort();
+        throw new Error(`GOOGLE_TOOLSETS="${process.env.GOOGLE_TOOLSETS ?? ''}" selected no enabled services. ` +
+            `Known services: ${known.join(', ')}. ` +
+            `Note: optional services need their bundle in an account's scope profile (or legacy GOOGLE_OPTIONAL_SCOPES); admin needs an admin account/profile.`);
+    }
+    registerDiscoverTools(registry, policy);
+    registerEscapeTools(registry, policy);
+    registerAccountTools(registry);
+    registerDiagnoseTool(registry, ctx);
+    registerAccountWizardTools(registry, server);
+    return registry;
+}

package/dist/index.js

@@ -8,17 +8,11 @@ import { fileURLToPath } from 'node:url';
 import path from 'node:path';
 import { StdioServerTransport } from "@modelcontextprotocol/server/stdio";
 import { McpServer } from "@modelcontextprotocol/server";
-import { GENERATED_SERVICES } from './tools/generated/index.js';
-import { GENERATED_GATES, SERVICES, unknownToolMessage } from './services.js';
-import { ToolRegistry, resolveDiscoveryMode } from './registry.js';
-import { registerDiscoverTools } from './discover.js';
-import { registerEscapeTools } from './tools/google-api.js';
-import { registerAccountTools } from './tools/accounts-tool.js';
-import { registerDiagnoseTool } from './doctor.js';
-import { registerAccountWizardTools } from './tools/account-wizard.js';
-import { getToolsets, toolsetEnabled } from './toolsets.js';
+import { unknownToolMessage } from './services.js';
+import { resolveDiscoveryMode } from './registry.js';
 import { isAllowed, describePolicy } from './write-control.js';
 import { buildIdentityContext } from './identity.js';
+import { buildRegistry } from './compose.js';
 import { registerSetupPrompt } from './setup-prompt.js';
 import { applyNetTuning } from './net-tuning.js';
 import { argNormalizationEnabled, withArgNormalization, withValidationEnvelope } from './arg-normalize.js';
@@ -43,56 +37,6 @@ function strictArgOptions(registry, metrics) {
         onDrop: metrics ? (tool, keys) => metrics.recordArgDrop(tool, keys) : undefined,
     };
 }
-function buildRegistry(server, ctx, mode, metrics = null) {
-    const policy = ctx.policy;
-    const registry = new ToolRegistry(server, policy, mode, metrics);
-    const toolsets = getToolsets();
-    if (toolsets !== 'all') {
-        const known = new Set([...SERVICES.map((s) => s.name), ...GENERATED_SERVICES.map((s) => s.name)]);
-        for (const requested of toolsets) {
-            if (!known.has(requested)) {
-                process.stderr.write(`GOOGLE_TOOLSETS: unknown service "${requested}" ignored\n`);
-            }
-        }
-    }
-    for (const svc of SERVICES) {
-        if (!toolsetEnabled(toolsets, svc.name))
-            continue;
-        if (svc.enabled && !svc.enabled(ctx.accounts)) {
-            if (toolsets !== 'all') {
-                const hint = svc.name === 'admin' ? 'set admin on an account/profile (or GOOGLE_ADMIN_ACCOUNTS)' : `add "${svc.name}" to an account's scope profile (or legacy GOOGLE_OPTIONAL_SCOPES)`;
-                process.stderr.write(`GOOGLE_TOOLSETS: "${svc.name}" requested but not enabled — ${hint}\n`);
-            }
-            continue;
-        }
-        svc.register(registry);
-    }
-    for (const gen of GENERATED_SERVICES) {
-        if (!toolsetEnabled(toolsets, gen.name))
-            continue;
-        const curated = SERVICES.find((s) => s.name === gen.name);
-        const gate = curated?.enabled ?? GENERATED_GATES[gen.name]?.enabled;
-        if (gate && !gate(ctx.accounts)) {
-            if (!curated && toolsets !== 'all') {
-                process.stderr.write(`GOOGLE_TOOLSETS: "${gen.name}" requested but not enabled — ${GENERATED_GATES[gen.name].hint}\n`);
-            }
-            continue;
-        }
-        gen.register(registry);
-    }
-    if (registry.services().length === 0) {
-        const known = [...new Set([...SERVICES.map((s) => s.name), ...GENERATED_SERVICES.map((s) => s.name)])].sort();
-        throw new Error(`GOOGLE_TOOLSETS="${process.env.GOOGLE_TOOLSETS ?? ''}" selected no enabled services. ` +
-            `Known services: ${known.join(', ')}. ` +
-            `Note: optional services need their bundle in an account's scope profile (or legacy GOOGLE_OPTIONAL_SCOPES); admin needs an admin account/profile.`);
-    }
-    registerDiscoverTools(registry, policy);
-    registerEscapeTools(registry, policy);
-    registerAccountTools(registry);
-    registerDiagnoseTool(registry, ctx);
-    registerAccountWizardTools(registry, server);
-    return registry;
-}
 async function main() {
     if (process.argv.includes('auth')) {
         const { runAuthFlow } = await import('./auth.js');
@@ -381,6 +325,13 @@ async function main() {
         // re-auth link into the AS's alias_reauth flow instead of a stdio CLI hint.
         const { setHttpReauthBase } = await import('./reauth-hint.js');
         setHttpReauthBase(httpCfg.publicUrl);
+        // Wizard consent over HTTP: hand out the clientless AS link instead of
+        // binding a loopback listener (single-owner flow; a tenancy host installs
+        // its own signed-mint context here).
+        const { setWizardHttpConsent } = await import('./tools/account-wizard.js');
+        setWizardHttpConsent({
+            mintConsentUrl: (alias) => `${httpCfg.publicUrl}/authorize?flow=alias_reauth&alias=${encodeURIComponent(alias)}`,
+        });
         let httpTap;
         if (httpMetrics) {
             const { tapUsageMetrics } = await import('./metrics-tap.js');

package/dist/registry-transfer.js

@@ -7,7 +7,7 @@
 import { existsSync, readFileSync, readdirSync } from 'node:fs';
 import * as readline from 'node:readline';
 import path from 'node:path';
-import { encryptToken, decryptToken } from './token-store.js';
+import { createCipheriv, createDecipheriv, randomBytes, scryptSync } from 'node:crypto';
 import { atomicWriteFileSync, atomicWriteWithLock } from './fs-atomic.js';
 import { ALIAS_RE, configFilePath, CONFIG_VERSION, tenantsDir } from './config-file.js';
 import { getTokenDir } from './accounts.js';
@@ -61,15 +61,52 @@ export function buildTransferBundle(exportedAt, deps = {}) {
     }
     return { manifest: { v: 1, exportedAt, aliases: [...aliasSet].sort() }, config, tokens };
 }
+// Bundle envelope v2: a REAL passphrase KDF. The v1 envelope reused the
+// token store's deriveKey, whose passphrase branch is one unsalted sha256 —
+// an exported bundle could be brute-forced offline (CodeQL
+// js/insufficient-password-hash). scrypt with a per-bundle random salt fixes
+// that; v1 bundles (a prerelease-only format, never produced by any stable
+// release) are refused with a re-export hint rather than kept decryptable.
+const BUNDLE_VERSION = 2;
+const SCRYPT_PARAMS = { N: 1 << 15, r: 8, p: 1, maxmem: 64 * 1024 * 1024 };
+function bundleKey(passphrase, salt) {
+    return scryptSync(passphrase, salt, 32, SCRYPT_PARAMS);
+}
 export function encryptBundle(bundle, passphrase) {
-    return encryptToken(bundle, passphrase);
+    const salt = randomBytes(16);
+    const iv = randomBytes(12);
+    const cipher = createCipheriv('aes-256-gcm', bundleKey(passphrase, salt), iv);
+    const data = Buffer.concat([cipher.update(Buffer.from(JSON.stringify(bundle), 'utf8')), cipher.final()]);
+    const file = {
+        bv: BUNDLE_VERSION,
+        salt: salt.toString('base64'),
+        iv: iv.toString('base64'),
+        tag: cipher.getAuthTag().toString('base64'),
+        data: data.toString('base64'),
+    };
+    return JSON.stringify(file);
 }
 export class BundleDecryptError extends Error {
 }
 export function decryptBundle(contents, passphrase) {
+    let file;
+    try {
+        file = JSON.parse(contents);
+    }
+    catch {
+        throw new BundleDecryptError('The file is not a registry export bundle.');
+    }
+    if (file.v !== undefined && file.bv === undefined) {
+        throw new BundleDecryptError('This bundle uses the retired v1 prerelease format (weak passphrase derivation); re-export it from the source machine with the current version.');
+    }
+    if (file.bv !== BUNDLE_VERSION || !file.salt || !file.iv || !file.tag || !file.data) {
+        throw new BundleDecryptError('The file is not a valid registry export (bad envelope).');
+    }
     let obj;
     try {
-        obj = decryptToken(contents, passphrase);
+        const decipher = createDecipheriv('aes-256-gcm', bundleKey(passphrase, Buffer.from(file.salt, 'base64')), Buffer.from(file.iv, 'base64'));
+        decipher.setAuthTag(Buffer.from(file.tag, 'base64'));
+        obj = JSON.parse(Buffer.concat([decipher.update(Buffer.from(file.data, 'base64')), decipher.final()]).toString('utf8'));
     }
     catch {
         throw new BundleDecryptError('Could not decrypt the bundle — wrong passphrase or the file is corrupt.');

package/dist/tools/account-wizard.d.ts

@@ -53,4 +53,13 @@ export declare function argsToAddForm(a: {
 /** Scopes requested by the profile but NOT granted at consent (granular
  * consent / unchecked bundles). Pure. */
 export declare function scopeGrantDiff(requested: string[], grantedScope: string | undefined): string[];
+/** HTTP-transport consent context (S1.20): set by the HTTP bootstrap. When
+ * present, runConsent NEVER binds a server-side loopback listener — the
+ * user's browser cannot reach the daemon's loopback — and instead hands out
+ * a clientless AS consent URL. The injector decides the flow (single-owner =
+ * the legacy alias_reauth link; a tenancy host mints a signed alias_add URL). */
+export interface WizardHttpConsent {
+    mintConsentUrl: (alias: string) => Promise<string> | string;
+}
+export declare function setWizardHttpConsent(ctx: WizardHttpConsent | null): void;
 export declare function registerAccountWizardTools(registry: ToolRegistry, server: McpServer): void;

package/dist/tools/account-wizard.js

@@ -136,6 +136,15 @@ function errorResult(slug, message, hint, account) {
         isError: true,
     };
 }
+let httpConsent = null;
+export function setWizardHttpConsent(ctx) {
+    httpConsent = ctx;
+}
+function pendingText(alias, url) {
+    return (`Account "${alias}" is ready to authorize. Open this link in a browser (it belongs to whoever owns the Google account):\n${url}\n` +
+        `On completion the token is stored server-side and the account is usable immediately — no restart. ` +
+        `If the link expires, run account_reauth for a fresh one.\n${TESTING_MODE_WARNING}`);
+}
 /** Run Google consent for `alias` and persist the token. Opens the browser via
  * URL-mode elicitation when the client supports it, else server-side + prints
  * the URL. Returns the granted-scope diff for the S4 report. */
@@ -150,6 +159,29 @@ async function runConsent(server, alias) {
             hint: 'Accounts sourced from GOOGLE_ACCOUNTS are not editable here. Run `mcp-google-multi migrate-config` to move them into config.json.',
         };
     }
+    // HTTP transport: consent completes OUT OF BAND at the AS /callback. Never
+    // bind a loopback listener here; try URL-mode elicitation as a convenience
+    // but surface the URL UP FRONT either way (not only on failure).
+    const http = httpConsent;
+    if (http) {
+        let url;
+        try {
+            url = await http.mintConsentUrl(alias);
+        }
+        catch (e) {
+            return { ok: false, slug: 'internal', message: safeMessage(e) };
+        }
+        const caps = server.server.getClientCapabilities?.();
+        if (caps?.elicitation?.url !== undefined) {
+            try {
+                await server.server.elicitInput(urlElicitationParams(alias, url, randomBytes(16).toString('hex')));
+            }
+            catch {
+                // the URL in the pending text is the recovery
+            }
+        }
+        return { ok: 'pending', url };
+    }
     // Bind the ephemeral loopback listener BEFORE building the auth URL: the
     // redirect URI needs the assigned port, and listening first means the
     // callback can't race the browser.
@@ -267,6 +299,8 @@ export function registerAccountWizardTools(registry, server) {
             invalidateAccountSet();
             // S3 + S4: consent + validate.
             const consent = await runConsent(server, validated.alias);
+            if (consent.ok === 'pending')
+                return textResult(pendingText(validated.alias, consent.url));
             if (!consent.ok)
                 return errorResult(consent.slug, consent.message, consent.hint, validated.alias);
             // B15: offer to register the server with another MCP client.
@@ -303,6 +337,8 @@ export function registerAccountWizardTools(registry, server) {
                 return errorResult('validation_error', `Unknown account "${alias}".`, `Pass one of the configured aliases: ${getAccountSet().aliases.join(', ')}. Use account_add to create a new one.`, alias);
             }
             const consent = await runConsent(server, alias);
+            if (consent.ok === 'pending')
+                return textResult(pendingText(alias, consent.url));
             if (!consent.ok)
                 return errorResult(consent.slug, consent.message, consent.hint, alias);
             return textResult(s4Text(alias, consent.missing));
@@ -353,6 +389,12 @@ export function registerAccountWizardTools(registry, server) {
                 if (client.managed === 'cli') {
                     blocks.push(`${client.label}: run\n  ${instr.text}`);
                 }
+                else if (a.write && mode === 'http') {
+                    // Over HTTP this tool runs on the DAEMON, whose homedir is not the
+                    // caller's machine: write:true would edit the operator's own client
+                    // configs (a cross-tenant hazard under tenancy). Snippet only.
+                    blocks.push(`${client.label}: write:true is ignored over HTTP — this tool runs on the server, not your machine. Add to ${instr.path}\n${instr.text}`);
+                }
                 else if (a.write) {
                     const res = applyFileEntry(client, name, entry);
                     blocks.push(res.ok

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "mcp-google-multi",
-  "version": "6.0.0-alpha.44",
+  "version": "6.0.0-alpha.46",
   "mcpName": "io.github.bakissation/mcp-google-multi",
   "description": "Local MCP server for Google Workspace (Gmail, Drive, Calendar, Sheets, Docs, Contacts, Tasks, Meet, Search Console, +Forms/Chat/Admin) across multiple accounts — OAuth-only, encrypted token storage, deny-by-default writes.",
   "type": "module",
@@ -9,6 +9,24 @@
     "mcp-google-multi": "dist/index.js"
   },
   "main": "dist/index.js",
+  "exports": {
+    ".": "./dist/index.js",
+    "./identity": "./dist/identity.js",
+    "./compose": "./dist/compose.js",
+    "./registry": "./dist/registry.js",
+    "./oauth-as": "./dist/oauth-as.js",
+    "./accounts": "./dist/accounts.js",
+    "./token-store": "./dist/token-store.js",
+    "./http-transport": "./dist/http-transport.js",
+    "./http-config": "./dist/http-config.js",
+    "./client": "./dist/client.js",
+    "./config-file": "./dist/config-file.js",
+    "./mcp-token": "./dist/mcp-token.js",
+    "./boot-gates": "./dist/boot-gates.js",
+    "./tenant-purge": "./dist/tenant-purge.js",
+    "./doctor": "./dist/doctor.js",
+    "./package.json": "./package.json"
+  },
   "files": [
     "dist"
   ],