mcp-google-multi 6.0.0-alpha.46 → 6.0.0-alpha.48

package/dist/doctor.js

@@ -341,9 +341,35 @@ export function renderDoctorText(report) {
     out.push(`Overall: ${report.verdict.toUpperCase()}`);
     return out.join('\n');
 }
-/** Mask the local-part of an email so a report never carries a full address (BR8). */
+const EMAIL_LOCAL_CHAR = /[A-Za-z0-9._%+-]/;
+const EMAIL_DOMAIN_CHAR = /[A-Za-z0-9.-]/;
+/** Mask the local-part of an email so a report never carries a full address
+ * (BR8). A linear scan, not a regex: the `local* @domain` pattern backtracks
+ * polynomially on long local-charset runs without an @ (CodeQL
+ * js/polynomial-redos), and report text can embed arbitrary error strings. */
 function maskEmails(text) {
-    return text.replace(/([A-Za-z0-9._%+-])[A-Za-z0-9._%+-]*(@[A-Za-z0-9.-]+)/g, '$1***$2');
+    let out = '';
+    let i = 0;
+    while (i < text.length) {
+        if (text[i] === '@') {
+            let j = i + 1;
+            while (j < text.length && EMAIL_DOMAIN_CHAR.test(text[j]))
+                j += 1;
+            let k = out.length;
+            while (k > 0 && EMAIL_LOCAL_CHAR.test(out[k - 1]))
+                k -= 1;
+            if (j > i + 1 && k < out.length) {
+                // keep the first local char, mask the rest ('*' is outside the local
+                // charset, so a masked run can never be re-masked by a later @)
+                out = `${out.slice(0, k + 1)}***${text.slice(i, j)}`;
+                i = j;
+                continue;
+            }
+        }
+        out += text[i];
+        i += 1;
+    }
+    return out;
 }
 /** Redacted, paste-ready bug report (BR8): verdicts + provenance labels + token
  * statuses + slugs; NO token values, secrets, keys, or full email addresses. */

package/dist/registry.d.ts

@@ -62,6 +62,9 @@ export declare class ToolRegistry {
     constructor(server: McpServer, policy: Policy, mode?: DiscoveryMode, metrics?: Metrics | null, accounts?: () => AccountSet);
     registerMeta: McpServer['registerTool'];
     services(): string[];
+    /** The registry's OWN alias list: registration-time schema builders (the
+     * generated account enums) read this, never the process global. */
+    accountAliases(): readonly string[];
     /** Declared input-schema keys + scalar kinds for one tool (tools/call arg
      * normalization; the kind drives value coercion on renamed keys). */
     argShape(name: string): ArgShape | undefined;

package/dist/registry.js

@@ -245,6 +245,11 @@ export class ToolRegistry {
     services() {
         return [...new Set(this.tools.filter((t) => !t.meta).map((t) => t.service))];
     }
+    /** The registry's OWN alias list: registration-time schema builders (the
+     * generated account enums) read this, never the process global. */
+    accountAliases() {
+        return this.accounts().aliases;
+    }
     /** Declared input-schema keys + scalar kinds for one tool (tools/call arg
      * normalization; the kind drives value coercion on renamed keys). */
     argShape(name) {

package/dist/tools/generated/_shared.d.ts

@@ -21,5 +21,6 @@ export interface GeneratedToolDef {
     }>;
     shape: z.ZodRawShape;
 }
-export declare function accountField(): z.ZodOptional<z.ZodType<string, unknown, z.core.$ZodTypeInternals<string, unknown>>>;
+export declare function accountField(aliases?: readonly string[]): z.ZodOptional<z.ZodType<string, unknown, z.core.$ZodTypeInternals<string, unknown>>>;
+export type { ExecuteDeps } from '../../executor.js';
 export declare function registerGeneratedTool(registry: ToolRegistry, def: GeneratedToolDef, deps?: ExecuteDeps): void;

package/dist/tools/generated/_shared.js

@@ -1,7 +1,10 @@
-import { accountAliasSchema } from '../../accounts.js';
+import { accountAliasSchema, accountAliasSchemaFor } from '../../accounts.js';
 import { executeApiMethod } from '../../executor.js';
-export function accountField() {
-    return accountAliasSchema.optional().describe('Google account alias (omit for the default account)');
+export function accountField(aliases) {
+    // Per-registry enum when the caller supplies its alias list (regenerated
+    // code passes registry.accountAliases()); the no-arg form keeps the
+    // global-bound schema for compatibility.
+    return (aliases ? accountAliasSchemaFor(aliases) : accountAliasSchema).optional().describe('Google account alias (omit for the default account)');
 }
 export function registerGeneratedTool(registry, def, deps = {}) {
     // Widened locally: `cud` is a registry extension the SDK config type doesn't

package/dist/tools/generated/admin.d.ts

@@ -1,2 +1,3 @@
 import type { ToolRegistry } from '../../registry.js';
-export declare function registerAdminGeneratedTools(registry: ToolRegistry): void;
+import { type ExecuteDeps } from './_shared.js';
+export declare function registerAdminGeneratedTools(registry: ToolRegistry, deps?: ExecuteDeps): void;