mcp-google-multi 6.0.0-alpha.5 → 6.0.0-alpha.7

package/dist/doctor.d.ts

@@ -2,6 +2,7 @@ import type { ToolRegistry } from './registry.js';
 import { getAccountSet } from './accounts.js';
 import { type AccountHealth } from './tools/accounts-tool.js';
 import { peekMasterKeyProvenance } from './master-key.js';
+import { type HttpConfig } from './http-config.js';
 export type Verdict = 'ok' | 'warn' | 'fail' | 'unknown';
 export interface DiagnosticSection {
     id: number;
@@ -38,6 +39,17 @@ export interface DiagnosticsDeps {
     /** Optional live section-6 probe; when absent the section reports `unknown`
      * (spec: a section that cannot run is unknown, not FAIL). */
     probeApi?: (alias: string) => Promise<ApiProbeResult[]>;
+    /** Optional live section-7 endpoint probe (PRM/AS-metadata self-fetch);
+     * when absent, section 7 stays on its offline config checks. */
+    probeHttp?: (cfg: HttpConfig) => Promise<HttpProbeResult>;
+}
+/** Live §7 probe outcome. `unreachable` = connection-level failure (server not
+ * running), reported as `unknown` rather than FAIL; `problem` = a real
+ * metadata fault at a reachable server. */
+export interface HttpProbeResult {
+    ok: boolean;
+    unreachable?: boolean;
+    problem?: string;
 }
 /** Console deep-link to enable one API (section-6 hint, error taxonomy B10). */
 export declare function apiEnableLink(api: string): string;

package/dist/doctor.js

@@ -7,6 +7,8 @@ import { peekMasterKeyProvenance, deleteMasterKeyMaterial } from './master-key.j
 import { hasToken } from './token-store.js';
 import { configDir } from './config-file.js';
 import { probeApiEnablement } from './api-probe.js';
+import { resolveHttpConfig, HttpConfigError } from './http-config.js';
+import { parseOwnerEmails } from './http-transport.js';
 const MIN_NODE_MAJOR = 22;
 const DEFAULT_DEPS = {
     nodeVersion: process.versions.node,
@@ -25,17 +27,43 @@ const DEFAULT_DEPS = {
     anyTokensExist: (aliases) => aliases.some((a) => hasToken(a)),
     fileExists: fs.existsSync,
     probeApi: (alias) => probeApiEnablement(alias),
+    probeHttp: (cfg) => probeHttpEndpoints(cfg),
 };
+/** §7 live check: the advertised OAuth metadata must derive from MCP_PUBLIC_URL
+ * exactly — one mismatch between PRM `resource` / AS `issuer` and what clients
+ * compute from the public URL is the perpetual-401 interop bug (BR4). */
+async function probeHttpEndpoints(cfg) {
+    try {
+        const prmRes = await fetch(`${cfg.publicUrl}/.well-known/oauth-protected-resource`, {
+            signal: AbortSignal.timeout(2000),
+            redirect: 'manual',
+        });
+        if (!prmRes.ok)
+            return { ok: false, problem: `PRM endpoint returned HTTP ${prmRes.status}` };
+        const prm = (await prmRes.json());
+        if (prm.resource !== cfg.resourceUri) {
+            return { ok: false, problem: `PRM resource "${prm.resource}" does not match the expected "${cfg.resourceUri}"` };
+        }
+        const asRes = await fetch(`${cfg.publicUrl}/.well-known/oauth-authorization-server`, {
+            signal: AbortSignal.timeout(2000),
+            redirect: 'manual',
+        });
+        if (!asRes.ok)
+            return { ok: false, problem: `AS metadata endpoint returned HTTP ${asRes.status}` };
+        const as = (await asRes.json());
+        if (as.issuer !== cfg.publicUrl) {
+            return { ok: false, problem: `AS metadata issuer "${as.issuer}" does not match the public URL "${cfg.publicUrl}"` };
+        }
+        return { ok: true };
+    }
+    catch {
+        return { ok: false, unreachable: true };
+    }
+}
 /** Console deep-link to enable one API (section-6 hint, error taxonomy B10). */
 export function apiEnableLink(api) {
     return `https://console.cloud.google.com/apis/library/${api}.googleapis.com`;
 }
-function transportsFrom(env) {
-    return (env.MCP_TRANSPORT ?? 'stdio')
-        .split(',')
-        .map((s) => s.trim().toLowerCase())
-        .filter(Boolean);
-}
 const LEGACY_ENV_KEYS = ['GOOGLE_ACCOUNTS', 'GOOGLE_OPTIONAL_SCOPES', 'GOOGLE_ADMIN_ACCOUNTS'];
 function sectionRuntime(deps) {
     const major = Number.parseInt(deps.nodeVersion.split('.')[0] ?? '0', 10);
@@ -182,15 +210,65 @@ async function sectionApiEnablement(deps, aliases) {
     }
     return { id: 6, title: 'API enablement', verdict: 'ok', lines: lines.length ? lines : ['(probed account, all enabled)'] };
 }
-function sectionHttpDeferred(deps) {
-    if (!transportsFrom(deps.env).includes('http'))
+async function sectionHttp(deps, aliases) {
+    const raw = (deps.env.MCP_TRANSPORT ?? '').trim().toLowerCase();
+    if (raw === '' || raw === 'stdio')
         return null;
-    return {
-        id: 7,
-        title: 'HTTP',
-        verdict: 'unknown',
-        lines: ['HTTP diagnostics (MCP_PUBLIC_URL canonicalization, MCP_OWNER_EMAILS, PRM/AS-metadata self-fetch) land with the OAuth authorization server (not yet built).'],
-    };
+    let cfg;
+    try {
+        cfg = resolveHttpConfig(deps.env);
+    }
+    catch (err) {
+        return {
+            id: 7,
+            title: 'HTTP',
+            verdict: 'fail',
+            slug: err instanceof HttpConfigError ? err.slug : 'E_HTTP_CONFIG',
+            lines: [err.message],
+            hint: 'Fix the MCP_* variable above and re-run doctor.',
+        };
+    }
+    const lines = [`bind ${cfg.host}:${cfg.port}, public URL ${cfg.publicUrl} (resource ${cfg.resourceUri})`];
+    let verdict = 'ok';
+    let slug;
+    const hints = [];
+    const owners = parseOwnerEmails(deps.env);
+    if (owners.length === 0) {
+        verdict = 'fail';
+        slug = 'E_OWNER_EMAILS_REQUIRED';
+        lines.push('MCP_OWNER_EMAILS is empty — nobody can pass the owner gate.');
+        hints.push('Set MCP_OWNER_EMAILS to the Google email(s) allowed to authenticate.');
+    }
+    else {
+        const known = new Set(aliases.map((a) => deps.accountHealth(a).email.toLowerCase()));
+        const strangers = known.size > 0 ? owners.filter((o) => !known.has(o)) : [];
+        lines.push(`owner gate: ${owners.length} email(s)${strangers.length ? `, ${strangers.length} matching no configured account` : ''}`);
+        if (strangers.length > 0) {
+            verdict = 'warn';
+            slug = 'W_OWNER_EMAIL_UNKNOWN';
+            hints.push(`Owner entry ${strangers.join(', ')} is not a configured account email. ` +
+                'If that is a misspelling of your account email, sign-in will be refused — fix MCP_OWNER_EMAILS.');
+        }
+    }
+    if (verdict !== 'fail' && deps.probeHttp) {
+        const probe = await deps.probeHttp(cfg);
+        if (probe.ok) {
+            lines.push('live: PRM + AS metadata verified at the public URL');
+        }
+        else if (probe.unreachable) {
+            if (verdict === 'ok')
+                verdict = 'unknown';
+            lines.push(`live: ${cfg.publicUrl} not reachable (server not running?)`);
+            hints.push('Start the server (MCP_TRANSPORT=http) and re-run doctor for the live endpoint checks.');
+        }
+        else {
+            verdict = 'fail';
+            slug = 'E_HTTP_METADATA_MISMATCH';
+            lines.push(`live: ${probe.problem}`);
+            hints.push('The advertised OAuth metadata must derive from MCP_PUBLIC_URL exactly; restart the server after changing it.');
+        }
+    }
+    return { id: 7, title: 'HTTP', verdict, ...(slug ? { slug } : {}), lines, ...(hints.length ? { hint: hints.join('\n') } : {}) };
 }
 const RANK = { ok: 0, unknown: 0, warn: 1, fail: 2 };
 /** Roll section verdicts to an overall verdict. `unknown` never worsens it. */
@@ -214,7 +292,7 @@ export async function runDiagnostics(deps = DEFAULT_DEPS) {
         sections.push(tokens, scopes);
         sections.push(await sectionApiEnablement(deps, aliases));
     }
-    const http = sectionHttpDeferred(deps);
+    const http = await sectionHttp(deps, aliases);
     if (http)
         sections.push(http);
     return { verdict: overallVerdict(sections), sections };

package/dist/tools/drive.d.ts

@@ -1,5 +1,6 @@
 import type { ToolRegistry } from '../registry.js';
 export declare function isTextualMime(mimeType: string): boolean;
+export declare function resolveConvertTarget(convertTo: string | undefined): string | undefined;
 export declare const DRIVE_QUERY_HINT: string;
 export declare function normalizeDriveQuery(raw: string): string;
 export declare function isDriveInvalidQuery(error: any): boolean;

package/dist/tools/drive.js

@@ -48,6 +48,29 @@ export function isTextualMime(mimeType) {
     return TEXTUAL_EXACT.has(bare);
 }
 const BINARY_READ_HINT = 'Binary content cannot be inlined. Use drive_download to save the file to disk, or drive_export for Google Workspace files.';
+// Accepted alongside the full application/vnd.google-apps.* ids so the obvious
+// short spelling ("document") works; the enum advertises both.
+const CONVERT_SHORTHANDS = {
+    document: 'application/vnd.google-apps.document',
+    spreadsheet: 'application/vnd.google-apps.spreadsheet',
+    presentation: 'application/vnd.google-apps.presentation',
+    drawing: 'application/vnd.google-apps.drawing',
+};
+export function resolveConvertTarget(convertTo) {
+    if (!convertTo)
+        return undefined;
+    return CONVERT_SHORTHANDS[convertTo] ?? convertTo;
+}
+const CONVERT_TO_VALUES = [
+    'document',
+    'spreadsheet',
+    'presentation',
+    'drawing',
+    'application/vnd.google-apps.document',
+    'application/vnd.google-apps.spreadsheet',
+    'application/vnd.google-apps.presentation',
+    'application/vnd.google-apps.drawing',
+];
 // Comment/Reply fields list — Drive API requires explicit `fields` on every call.
 const COMMENT_BASE_FIELDS = 'id,kind,content,htmlContent,createdTime,modifiedTime,resolved,anchor,author,deleted,quotedFileContent';
 const REPLY_SUBFIELDS = 'id,content,action,createdTime,modifiedTime,author,deleted';
@@ -279,15 +302,10 @@ export function registerDriveTools(server) {
         description: 'Upload a local file to Google Drive. Pass `convertTo` to import it as a native, editable Google Doc/Sheet/Slides/Drawing instead of storing the raw bytes.',
         inputSchema: {
             account: accountEnum.describe('Google account alias'),
-            localPath: z.string().describe('Absolute path to file on disk'),
+            localPath: z.string().describe('Absolute path of the SOURCE file on disk to upload (on the machine running the server; this is not savePath)'),
             filename: z.string().describe('Name as it appears in Drive'),
             mimeType: z.string().optional().describe('Source MIME type of the local file (inferred from extension if omitted). With `convertTo`, this is the format Drive imports from.'),
-            convertTo: z.enum([
-                'application/vnd.google-apps.document',
-                'application/vnd.google-apps.spreadsheet',
-                'application/vnd.google-apps.presentation',
-                'application/vnd.google-apps.drawing',
-            ]).optional().describe('Convert the upload into this native Google Workspace type on import (e.g. upload .md/.html/.docx/.txt with convertTo=...google-apps.document to get a real Google Doc). Source must be an importable format. Omit to store the file as-is.'),
+            convertTo: z.enum(CONVERT_TO_VALUES).optional().describe('Convert the upload into this native Google Workspace type on import: "document" | "spreadsheet" | "presentation" | "drawing" (full application/vnd.google-apps.* ids also accepted). E.g. upload .md/.html/.docx/.txt with convertTo=document to get a real Google Doc. Source must be an importable format. Omit to store the file as-is.'),
             parentFolderId: z.string().optional().describe('Parent folder ID (defaults to My Drive root)'),
         },
     }, async ({ account, localPath, filename, mimeType: mimeTypeArg, convertTo, parentFolderId }) => {
@@ -301,7 +319,7 @@ export function registerDriveTools(server) {
                     name: filename,
                     parents: parentFolderId ? [parentFolderId] : undefined,
                     // Setting a google-apps target type makes Drive convert the media on import.
-                    ...(convertTo ? { mimeType: convertTo } : {}),
+                    ...(convertTo ? { mimeType: resolveConvertTarget(convertTo) } : {}),
                 },
                 media: {
                     mimeType: resolvedMime,
@@ -323,14 +341,17 @@ export function registerDriveTools(server) {
         inputSchema: {
             account: accountEnum.describe('Google account alias'),
             fileId: z.string().describe('Google Drive file ID'),
-            savePath: z.string().describe('Absolute directory path to save into'),
-            filename: z.string().describe('Filename to save as'),
+            savePath: z.string().describe('Absolute DIRECTORY path to save into (created if missing, on the machine running the server); the file name comes from `filename`'),
+            filename: z.string().optional().describe('Filename to save as (defaults to the file name in Drive)'),
         },
     }, async ({ account, fileId, savePath, filename }) => {
         try {
             const auth = await getClient(account);
             const drive = driveClient({ version: 'v3', auth });
-            const dest = prepareLocalDest(savePath, filename);
+            const name = filename
+                ?? (await drive.files.get({ fileId, fields: 'name', supportsAllDrives: true })).data.name
+                ?? fileId;
+            const dest = prepareLocalDest(savePath, name);
             const res = await drive.files.get({ fileId, alt: 'media', supportsAllDrives: true }, { responseType: 'stream' });
             // pipeline destroys both streams on source/sink error; raw .pipe leaks the partial file.
             await pipeline(res.data, fs.createWriteStream(dest, { mode: 0o600 }));
@@ -349,14 +370,20 @@ export function registerDriveTools(server) {
             account: accountEnum.describe('Google account alias'),
             fileId: z.string().describe('Google Drive file ID'),
             mimeType: z.string().describe('Target export MIME type (e.g. "application/pdf", "text/markdown", "application/vnd.openxmlformats-officedocument.wordprocessingml.document")'),
-            savePath: z.string().describe('Absolute directory path to save into'),
-            filename: z.string().describe('Filename to save as'),
+            savePath: z.string().describe('Absolute DIRECTORY path to save into (created if missing, on the machine running the server); the file name comes from `filename`'),
+            filename: z.string().optional().describe('Filename to save as (defaults to the Drive name plus the extension implied by mimeType)'),
         },
     }, async ({ account, fileId, mimeType: exportMime, savePath, filename }) => {
         try {
             const auth = await getClient(account);
             const drive = driveClient({ version: 'v3', auth });
-            const dest = prepareLocalDest(savePath, filename);
+            let name = filename;
+            if (!name) {
+                const meta = await drive.files.get({ fileId, fields: 'name', supportsAllDrives: true });
+                const ext = mime.extension(exportMime);
+                name = `${meta.data.name ?? fileId}${ext ? `.${ext}` : ''}`;
+            }
+            const dest = prepareLocalDest(savePath, name);
             const res = await drive.files.export({ fileId, mimeType: exportMime }, { responseType: 'stream' });
             // pipeline destroys both streams on source/sink error; raw .pipe leaks the partial file.
             await pipeline(res.data, fs.createWriteStream(dest, { mode: 0o600 }));
@@ -404,14 +431,9 @@ export function registerDriveTools(server) {
             fileId: z.string().describe('Google Drive file ID'),
             newName: z.string().optional().describe('New filename'),
             newParentFolderId: z.string().optional().describe('Move to this folder'),
-            localPath: z.string().optional().describe('Replace file content with this local file'),
+            localPath: z.string().optional().describe('Replace file content with this local file (path on the machine running the server)'),
             mimeType: z.string().optional().describe('MIME type of the replacement file (required if localPath is provided)'),
-            convertTo: z.enum([
-                'application/vnd.google-apps.document',
-                'application/vnd.google-apps.spreadsheet',
-                'application/vnd.google-apps.presentation',
-                'application/vnd.google-apps.drawing',
-            ]).optional().describe('When replacing content via localPath, convert the new content into this native Google Workspace type on import (e.g. replace a Google Doc body from a local .docx). Source must be an importable format.'),
+            convertTo: z.enum(CONVERT_TO_VALUES).optional().describe('When replacing content via localPath, convert the new content into this native Google Workspace type on import: "document" | "spreadsheet" | "presentation" | "drawing" (full application/vnd.google-apps.* ids also accepted).'),
         },
     }, async ({ account, fileId, newName, newParentFolderId, localPath: localPathArg, mimeType: mimeTypeArg, convertTo }) => {
         try {
@@ -437,7 +459,7 @@ export function registerDriveTools(server) {
                     body: await openLocalReadStream(localPathArg),
                 };
                 if (convertTo)
-                    requestBody.mimeType = convertTo;
+                    requestBody.mimeType = resolveConvertTarget(convertTo);
             }
             const res = await drive.files.update(params);
             return {

package/dist/tools/gmail.js

@@ -665,7 +665,7 @@ export function registerGmailTools(server) {
             messageId: z.string().describe('The Gmail message ID'),
             attachmentId: z.string().describe('The attachment ID from gmail_read response'),
             filename: z.string().describe('Filename to save as (e.g. report.xlsx)'),
-            savePath: z.string().describe('Absolute directory path to save into, e.g. /home/user/Downloads'),
+            savePath: z.string().describe('Absolute DIRECTORY path to save into (created if missing, on the machine running the server), e.g. /home/user/Downloads; the file name comes from `filename`'),
         },
     }, async ({ account, messageId, attachmentId, filename, savePath }) => {
         try {

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "mcp-google-multi",
-  "version": "6.0.0-alpha.5",
+  "version": "6.0.0-alpha.7",
   "description": "Local MCP server for Google Workspace (Gmail, Drive, Calendar, Sheets, Docs, Contacts, Tasks, Meet, Search Console, +Forms/Chat/Admin) across multiple accounts — OAuth-only, encrypted token storage, deny-by-default writes.",
   "type": "module",
   "license": "MIT",