mcp-google-multi 6.0.0-alpha.52 → 6.0.0-alpha.54

package/dist/api-probe.d.ts

@@ -1,3 +1,5 @@
+import { getClient } from './client.js';
+import { readToken } from './token-store.js';
 import type { ApiProbeResult } from './doctor.js';
 export interface ApiProbeSpec {
     service: string;
@@ -15,4 +17,7 @@ export interface ApiProbeDeps {
     grantedScopes: (alias: string) => string[];
     request: (alias: string, url: string) => Promise<void>;
 }
+/** Probe deps over one context's token reads and client; the module-level
+ * pair is the single owner's. */
+export declare function apiProbeDepsFor(readTokenFn: typeof readToken, getClientFn: typeof getClient): ApiProbeDeps;
 export declare function probeApiEnablement(alias: string, deps?: ApiProbeDeps): Promise<ApiProbeResult[]>;

package/dist/api-probe.js

@@ -24,21 +24,26 @@ export const API_PROBES = [
 export function planProbes(granted, probes = API_PROBES) {
     return probes.filter((p) => granted.some((s) => p.scopePrefixes.some((prefix) => s.startsWith(prefix))));
 }
-const DEFAULT_DEPS = {
-    grantedScopes: (alias) => {
-        try {
-            const scope = readToken(alias)?.scope;
-            return typeof scope === 'string' ? scope.split(' ').filter(Boolean) : [];
-        }
-        catch {
-            return [];
-        }
-    },
-    request: async (alias, url) => {
-        const auth = await getClient(alias);
-        await auth.request({ url, timeout: 10_000 });
-    },
-};
+/** Probe deps over one context's token reads and client; the module-level
+ * pair is the single owner's. */
+export function apiProbeDepsFor(readTokenFn, getClientFn) {
+    return {
+        grantedScopes: (alias) => {
+            try {
+                const scope = readTokenFn(alias)?.scope;
+                return typeof scope === 'string' ? scope.split(' ').filter(Boolean) : [];
+            }
+            catch {
+                return [];
+            }
+        },
+        request: async (alias, url) => {
+            const auth = await getClientFn(alias);
+            await auth.request({ url, timeout: 10_000 });
+        },
+    };
+}
+const DEFAULT_DEPS = apiProbeDepsFor(readToken, getClient);
 export async function probeApiEnablement(alias, deps = DEFAULT_DEPS) {
     const results = [];
     for (const spec of planProbes(deps.grantedScopes(alias))) {

package/dist/auth.d.ts

@@ -14,5 +14,5 @@ export declare function getAdminAccounts(set?: AccountSet): string[];
  * legacy env) changes its consent set and requires re-running auth. Evaluated
  * per account: `work` can carry admin + gmail_settings while `personal` is
  * never asked for them. */
-export declare function resolveScopesForAccount(alias: string): string[];
+export declare function resolveScopesForAccount(alias: string, set?: AccountSet): string[];
 export declare function runAuthFlow(args: string[]): Promise<void>;

package/dist/auth.js

@@ -95,15 +95,15 @@ export function getAdminAccounts(set = getAccountSet()) {
  * legacy env) changes its consent set and requires re-running auth. Evaluated
  * per account: `work` can carry admin + gmail_settings while `personal` is
  * never asked for them. */
-export function resolveScopesForAccount(alias) {
-    const profile = profileForAccount(alias);
+export function resolveScopesForAccount(alias, set = getAccountSet()) {
+    const profile = profileForAccount(alias, set);
     const scopes = profile.includesBase === false ? [] : [...BASE_SCOPES];
     for (const bundle of profile.bundles) {
         if (bundle === 'admin')
             continue;
         scopes.push(...BUNDLE_CATALOG[bundle].scopes);
     }
-    if (getAdminAccounts().includes(alias)) {
+    if (getAdminAccounts(set).includes(alias)) {
         scopes.push(...ADMIN_SCOPES);
     }
     return Array.from(new Set(scopes));

package/dist/client.d.ts

@@ -21,9 +21,13 @@ export declare function makeGetClient(contextKey: string, deps: GetClientDeps):
  * getClient below (today's behavior); a tenant context passes its own. */
 export interface CuratedToolDeps {
     getClientFn?: typeof getClient;
+    /** Whether tools may read or write the server host's disk (local uploads,
+     * downloads, attachments). Absent = true; the host belongs to its operator,
+     * so a non-owner context passes false. */
+    localFiles?: boolean;
 }
 /** The single-owner client, bound to the global registry + token store. The
  * operator surfaces that never carry a tenant (api-probe, executor and
- * escape-hatch `deps.getClientFn ?? getClient` defaults, stdio dispatch)
- * resolve through this. */
+ * escape-hatch `deps.getClientFn ?? getClient` defaults) resolve through
+ * this. */
 export declare const getClient: (account: Account) => Promise<OAuth2Client>;

package/dist/compose.d.ts

@@ -1,5 +1,5 @@
 import type { McpServer } from "@modelcontextprotocol/server";
 import { ToolRegistry, type DiscoveryMode } from './registry.js';
-import type { IdentityContext } from './identity.js';
+import { type IdentityContext } from './identity.js';
 import type { Metrics } from './usage-metrics.js';
 export declare function buildRegistry(server: McpServer, ctx: IdentityContext, mode?: DiscoveryMode, metrics?: Metrics | null): ToolRegistry;

package/dist/compose.js

@@ -8,16 +8,30 @@ import { GENERATED_GATES, SERVICES } from './services.js';
 import { ToolRegistry } from './registry.js';
 import { registerDiscoverTools } from './discover.js';
 import { registerEscapeTools } from './tools/google-api.js';
-import { registerAccountTools } from './tools/accounts-tool.js';
+import { accountHealthDepsFor, registerAccountTools } from './tools/accounts-tool.js';
 import { registerDiagnoseTool } from './doctor.js';
 import { registerAccountWizardTools } from './tools/account-wizard.js';
 import { getToolsets, toolsetEnabled } from './toolsets.js';
+import { isOwnerContext } from './identity.js';
+import { resolveScopesForAccount } from './auth.js';
 export function buildRegistry(server, ctx, mode, metrics = null) {
     const policy = ctx.policy;
     // The registry's account view IS the context's: fan-out expansion,
     // selector validation and default-account injection all follow this
     // context, not the process global (identical for the free core's one ctx).
     const registry = new ToolRegistry(server, policy, mode, metrics, () => ctx.accounts);
+    // Every handler resolves its client, token reads and scope hints through
+    // this context; ctx.accounts is read per call, never snapshotted here, so
+    // the owner's live getter stays live.
+    const owner = isOwnerContext(ctx);
+    const clientDeps = { getClientFn: ctx.getClient, localFiles: owner };
+    const execDeps = {
+        getClientFn: ctx.getClient,
+        scopeDeps: {
+            readTokenFn: ctx.tokenStore.readToken,
+            profileFn: (alias) => resolveScopesForAccount(alias, ctx.accounts),
+        },
+    };
     const toolsets = getToolsets();
     if (toolsets !== 'all') {
         const known = new Set([...SERVICES.map((s) => s.name), ...GENERATED_SERVICES.map((s) => s.name)]);
@@ -37,7 +51,7 @@ export function buildRegistry(server, ctx, mode, metrics = null) {
             }
             continue;
         }
-        svc.register(registry);
+        svc.register(registry, clientDeps);
     }
     for (const gen of GENERATED_SERVICES) {
         if (!toolsetEnabled(toolsets, gen.name))
@@ -50,7 +64,7 @@ export function buildRegistry(server, ctx, mode, metrics = null) {
             }
             continue;
         }
-        gen.register(registry);
+        gen.register(registry, execDeps);
     }
     if (registry.services().length === 0) {
         const known = [...new Set([...SERVICES.map((s) => s.name), ...GENERATED_SERVICES.map((s) => s.name)])].sort();
@@ -59,9 +73,12 @@ export function buildRegistry(server, ctx, mode, metrics = null) {
             `Note: optional services need their bundle in an account's scope profile (or legacy GOOGLE_OPTIONAL_SCOPES); admin needs an admin account/profile.`);
     }
     registerDiscoverTools(registry, policy);
-    registerEscapeTools(registry, policy);
-    registerAccountTools(registry);
+    registerEscapeTools(registry, policy, execDeps);
+    registerAccountTools(registry, accountHealthDepsFor(ctx.tokenStore));
     registerDiagnoseTool(registry, ctx);
-    registerAccountWizardTools(registry, server);
+    // The wizard edits the owner's config.json and token store; any other
+    // context has neither.
+    if (owner)
+        registerAccountWizardTools(registry, server);
     return registry;
 }

package/dist/config-file.js

@@ -14,9 +14,10 @@ export function tenantsDir(env = process.env) {
     return path.join(configDir(env), 'tenants');
 }
 // A tenant id becomes a filesystem path segment exactly like an account
-// alias, so it rides the same traversal guard.
+// alias, so it rides the same traversal guard. 'owner' is the single-owner
+// context's subject and client lane, so no tenant may take it.
 function assertTenantId(tenantId) {
-    if (!ALIAS_RE.test(tenantId) || isReservedAlias(tenantId)) {
+    if (!ALIAS_RE.test(tenantId) || isReservedAlias(tenantId) || tenantId === 'owner') {
         throw new Error(`E_TENANT_ID_INVALID: invalid tenant id "${tenantId}".`);
     }
 }

package/dist/doctor.d.ts

@@ -1,6 +1,7 @@
 import type { ToolRegistry } from './registry.js';
 import { getAccountSet } from './accounts.js';
 import { type AccountHealth } from './tools/accounts-tool.js';
+import { type IdentityContext } from './identity.js';
 import { peekMasterKeyProvenance } from './master-key.js';
 import { type HttpConfig } from './http-config.js';
 export type Verdict = 'ok' | 'warn' | 'fail' | 'unknown';
@@ -68,6 +69,7 @@ export declare function renderDoctorText(report: DiagnosticsReport): string;
 export declare function renderReport(report: DiagnosticsReport, version: string): string;
 /** Exit non-zero when any section FAILs; with strict, WARN counts too. */
 export declare function exitCodeFor(report: DiagnosticsReport, strict: boolean): number;
+export type DiagnoseContext = Pick<IdentityContext, 'subject' | 'accounts' | 'getClient' | 'tokenStore'>;
 /** Agent-callable structured health report (read-only). Mirrors `doctor`'s
  * engine. Registered as a META tool, like `account_list`: it introspects this
  * server rather than Google data, and as a normal tool it became a service of
@@ -75,9 +77,7 @@ export declare function exitCodeFor(report: DiagnosticsReport, strict: boolean):
  * from already-registered services, and this runs after that), so it was
  * advertised only once something else expanded the surface. The README sends
  * people here when they are stuck, so it has to be findable. */
-export declare function registerDiagnoseTool(registry: ToolRegistry, ctx?: {
-    subject: string;
-}): void;
+export declare function registerDiagnoseTool(registry: ToolRegistry, ctx?: DiagnoseContext): void;
 export interface ResetOptions {
     account?: string;
     regenerateKey: boolean;

package/dist/doctor.js

@@ -2,14 +2,15 @@ import * as fs from 'node:fs';
 import * as path from 'node:path';
 import * as readline from 'node:readline';
 import { getAccountSet } from './accounts.js';
-import { deriveAccountHealth } from './tools/accounts-tool.js';
+import { accountHealthDepsFor, deriveAccountHealth } from './tools/accounts-tool.js';
+import { isOwnerContext } from './identity.js';
 import { peekMasterKeyProvenance, deleteMasterKeyMaterial } from './master-key.js';
 import { hasToken } from './token-store.js';
 import { configDir, loadConfigFile } from './config-file.js';
 import { envValueSource } from './env-load.js';
 import { reauthHint } from './reauth-hint.js';
 import { describeMetricsDir, resolveUsageMetrics, sourceLabel } from './usage-metrics.js';
-import { probeApiEnablement } from './api-probe.js';
+import { apiProbeDepsFor, probeApiEnablement } from './api-probe.js';
 import { safeMessage, stringifyEnvelope } from './tools/_errors.js';
 import { resolveHttpConfig, HttpConfigError } from './http-config.js';
 import { parseOwnerEmails } from './http-transport.js';
@@ -83,7 +84,7 @@ function sectionRuntime(deps) {
     }
     return { id: 1, title: 'Runtime', verdict: 'ok', lines: [`Node.js ${deps.nodeVersion} (>= ${MIN_NODE_MAJOR})`] };
 }
-function sectionConfig(deps, set) {
+function sectionConfig(deps, set, tenantScope = false) {
     const lines = [];
     let verdict = 'ok';
     let hint;
@@ -95,9 +96,14 @@ function sectionConfig(deps, set) {
             verdict: 'fail',
             slug: 'E_NO_ACCOUNTS_CONFIGURED',
             lines: ['No accounts configured.'],
-            hint: 'Add an account: run `npx mcp-google-multi migrate-config` or set GOOGLE_ACCOUNTS.',
+            ...(tenantScope ? {} : { hint: 'Add an account: run `npx mcp-google-multi migrate-config` or set GOOGLE_ACCOUNTS.' }),
         };
     }
+    // The config file, process env, working directory and metrics store below
+    // are the operator's host, not the context's: a tenant sees its own count.
+    if (tenantScope) {
+        return { id: 2, title: 'Config', verdict: 'ok', lines: [`${set.aliases.length} account(s) configured`] };
+    }
     const cfgPath = path.join(configDir(), 'config.json');
     lines.push(deps.fileExists(cfgPath) ? `config.json present (${set.aliases.length} account(s))` : `config.json absent — accounts sourced from env (${set.aliases.length})`);
     const legacyEnv = LEGACY_ENV_KEYS.filter((k) => deps.env[k]);
@@ -303,12 +309,13 @@ export function overallVerdict(sections) {
 export async function runDiagnostics(deps = DEFAULT_DEPS, opts = {}) {
     // Tenant scope omits the OPERATOR sections: §3 (key provenance = box
     // infrastructure) and §7 (its owner-gate lines print MCP_OWNER_EMAILS
-    // values — other people's addresses from a tenant's seat).
+    // values — other people's addresses from a tenant's seat), and trims §2 to
+    // the context's own account count.
     const tenantScope = opts.scope === 'tenant';
     const sections = [];
     sections.push(sectionRuntime(deps));
     const set = deps.accountSet();
-    sections.push(sectionConfig(deps, set));
+    sections.push(sectionConfig(deps, set, tenantScope));
     const aliases = set?.aliases ?? [];
     if (!tenantScope)
         sections.push(sectionKeys(deps, aliases));
@@ -390,6 +397,26 @@ export function exitCodeFor(report, strict) {
         return 1;
     return 0;
 }
+/** The engine's account, token and probe reads bound to one context, so a
+ * report never shows (or probes with) another context's accounts. */
+function diagnosticsDepsFor(ctx) {
+    const health = accountHealthDepsFor(ctx.tokenStore, () => ctx.accounts);
+    const probe = apiProbeDepsFor(ctx.tokenStore.readToken, ctx.getClient);
+    return {
+        ...DEFAULT_DEPS,
+        accountSet: () => {
+            try {
+                return ctx.accounts;
+            }
+            catch {
+                return null;
+            }
+        },
+        accountHealth: (alias) => deriveAccountHealth(alias, health),
+        anyTokensExist: (aliases) => aliases.some((a) => ctx.tokenStore.hasToken(a)),
+        probeApi: (alias) => probeApiEnablement(alias, probe),
+    };
+}
 /** Agent-callable structured health report (read-only). Mirrors `doctor`'s
  * engine. Registered as a META tool, like `account_list`: it introspects this
  * server rather than Google data, and as a normal tool it became a service of
@@ -398,16 +425,17 @@ export function exitCodeFor(report, strict) {
  * advertised only once something else expanded the surface. The README sends
  * people here when they are stuck, so it has to be findable. */
 export function registerDiagnoseTool(registry, ctx) {
-    // A non-owner context gets the tenant-scoped report; the free core's single
-    // 'owner' context keeps today's full operator report.
-    const scope = ctx && ctx.subject !== 'owner' ? 'tenant' : 'operator';
+    // A non-owner context gets the tenant-scoped report; only the owner context
+    // (or the context-free CLI surface) keeps the full operator report.
+    const scope = ctx && !isOwnerContext(ctx) ? 'tenant' : 'operator';
+    const deps = ctx ? diagnosticsDepsFor(ctx) : DEFAULT_DEPS;
     registry.registerMeta('diagnose', {
         annotations: { readOnlyHint: true, openWorldHint: true },
         description: 'Health report for this server: runtime, config, keys, per-account token status, scope grants, and API enablement. Read-only; returns copy-pasteable fixes for anything wrong. Call this to diagnose auth/config failures.',
         inputSchema: {},
     }, async () => {
         try {
-            const result = await runDiagnostics(undefined, { scope });
+            const result = await runDiagnostics(deps, { scope });
             return { content: [{ type: 'text', text: JSON.stringify(result, null, 2) }] };
         }
         catch (e) {

package/dist/executor.d.ts

@@ -1,4 +1,5 @@
 import { getClient } from './client.js';
+import { type ScopeSetDeps } from './scope-observability.js';
 export declare const MAX_RESPONSE_CHARS = 100000;
 export type QueryValue = string | number | boolean;
 export type QueryParams = Record<string, QueryValue | QueryValue[]>;
@@ -13,6 +14,8 @@ export interface ApiMethodRef {
 }
 export interface ExecuteDeps {
     getClientFn?: typeof getClient;
+    /** Token + profile view behind a 403 scope hint; absent = the single owner. */
+    scopeDeps?: ScopeSetDeps;
 }
 export interface ExecuteArgs {
     account: string;

package/dist/executor.js

@@ -103,6 +103,6 @@ export async function executeApiMethod(method, args, deps = {}) {
         return { content: [{ type: 'text', text }] };
     }
     catch (error) {
-        return handleGoogleApiError(error, args.account, undefined, () => method.scopes?.length ? scopeHintForMethod(method.scopes, args.account) : null);
+        return handleGoogleApiError(error, args.account, undefined, () => method.scopes?.length ? scopeHintForMethod(method.scopes, args.account, deps.scopeDeps) : null);
     }
 }

package/dist/identity.d.ts

@@ -21,6 +21,7 @@ export interface IdentityContext {
         hasToken: typeof hasToken;
     };
 }
+export declare function isOwnerContext(ctx: object | undefined): boolean;
 export declare function buildIdentityContext(env?: NodeJS.ProcessEnv, opts?: {
     transport?: Transport;
 }): IdentityContext;

package/dist/identity.js

@@ -2,12 +2,20 @@ import { getAccountSet, getTokenDir, refreshAccountSetIfStale } from './accounts
 import { makeGetClient } from './client.js';
 import { createTokenStore } from './token-store.js';
 import { resolvePolicy } from './write-control.js';
+// Only buildIdentityContext mints the owner brand. The subject string alone
+// never unlocks the owner-only surfaces (account wizard, host-file tools, the
+// operator diagnose report): a hand-built context claiming 'owner' stays a
+// non-owner context.
+const ownerContexts = new WeakSet();
+export function isOwnerContext(ctx) {
+    return ctx !== undefined && ownerContexts.has(ctx);
+}
 export function buildIdentityContext(env = process.env, opts = {}) {
     // Real closures over the single-owner state (the SAME factories EE
     // instantiates per tenant), bound here to the global registry + token dir —
     // behavior-identical to the module-level functions for the free core.
     const tokenStore = createTokenStore(getTokenDir());
-    return {
+    const ctx = {
         subject: 'owner',
         // Live getter: the seam must always see the current registry, never a
         // snapshot pinned from before a wizard mutation or cross-process reload.
@@ -25,4 +33,6 @@ export function buildIdentityContext(env = process.env, opts = {}) {
         }),
         tokenStore,
     };
+    ownerContexts.add(ctx);
+    return ctx;
 }

package/dist/master-key.js

@@ -48,12 +48,14 @@ function anyEncFileUnder(dir) {
 }
 // Glob the token dir instead of iterating registered aliases: an orphan .enc
 // (alias removed from the registry, or a partial GOOGLE_ACCOUNTS override in
-// one client) must still stop a fresh key from being minted. The walk is
-// recursive and also covers configDir()/tenants (the tenant-namespaced token
-// root): a flat scan returns false the moment tokens nest, and minting a
-// fresh MASTER_KEY over existing .enc files bricks them irreversibly.
+// one client) must still stop a fresh key from being minted. TOKEN_STORE_PATH
+// may relocate the token dir outside configDir(), so scan it directly; the
+// recursive configDir() walk then covers BOTH the tenant-namespaced token root
+// (tenants/<id>) AND any top-level master-key-encrypted registry beside it
+// (e.g. a downstream tenant map / invite store). Minting a fresh MASTER_KEY
+// over any existing .enc bricks it irreversibly, so the scan must see them all.
 function anyTokenFileExists() {
-    return anyEncFileUnder(getTokenDir()) || anyEncFileUnder(path.join(configDir(), 'tenants'));
+    return anyEncFileUnder(getTokenDir()) || anyEncFileUnder(configDir());
 }
 function readKeyFile(filePath) {
     try {

package/dist/registry.d.ts

@@ -65,6 +65,9 @@ export declare class ToolRegistry {
     /** The registry's OWN alias list: registration-time schema builders (the
      * generated account enums) read this, never the process global. */
     accountAliases(): readonly string[];
+    /** The registry's OWN account set: handlers needing an account's email or
+     * profile read this, never the process global. */
+    accountSet(): AccountSet;
     /** Declared input-schema keys + scalar kinds for one tool (tools/call arg
      * normalization; the kind drives value coercion on renamed keys). */
     argShape(name: string): ArgShape | undefined;

package/dist/registry.js

@@ -225,7 +225,7 @@ export class ToolRegistry {
                     const v = a?.account;
                     if (typeof v !== 'string' || (v !== '*' && !v.includes(',')))
                         return 1;
-                    const sel = parseAccountSelector(v);
+                    const sel = parseAccountSelector(v, this.accounts().aliases);
                     return sel.ok ? sel.aliases.length : 1;
                 })
                 : finalHandler;
@@ -250,6 +250,11 @@ export class ToolRegistry {
     accountAliases() {
         return this.accounts().aliases;
     }
+    /** The registry's OWN account set: handlers needing an account's email or
+     * profile read this, never the process global. */
+    accountSet() {
+        return this.accounts();
+    }
     /** Declared input-schema keys + scalar kinds for one tool (tools/call arg
      * normalization; the kind drives value coercion on renamed keys). */
     argShape(name) {

package/dist/scope-observability.d.ts

@@ -1,4 +1,3 @@
-import { resolveScopesForAccount } from './auth.js';
 import { readToken } from './token-store.js';
 export type ScopeState = 'callable' | 'requestable_not_granted' | 'not_requestable';
 export type NotRequestableReason = 'add_bundle' | 'account_type' | 'unknown_scope';
@@ -35,12 +34,15 @@ export interface AccountScopeSets {
     granted: Set<string>;
     profile: Set<string>;
 }
+/** Where a scope hint reads the granted token and the configured profile;
+ * absent = the single-owner token store and global registry. */
+export interface ScopeSetDeps {
+    readTokenFn?: typeof readToken;
+    profileFn?: (alias: string) => string[];
+}
 /** Best-effort per-account sets; null when the token/profile is unreadable
  * (decrypt error, missing token) — callers fall back to generic hints. */
-export declare function accountScopeSets(alias: string, deps?: {
-    readTokenFn?: typeof readToken;
-    profileFn?: typeof resolveScopesForAccount;
-}): AccountScopeSets | null;
+export declare function accountScopeSets(alias: string, deps?: ScopeSetDeps): AccountScopeSets | null;
 /**
  * Runtime enrichment for a scope 403 on a method whose required scopes are
  * known (escape hatch: runtime Discovery; generated tools: baked). The
@@ -48,7 +50,7 @@ export declare function accountScopeSets(alias: string, deps?: {
  * profile means Google refuses it for this account type (personal Gmail),
  * so re-auth would loop — report the dead end instead.
  */
-export declare function scopeHintForMethod(required: readonly string[], alias: string, deps?: Parameters<typeof accountScopeSets>[1]): {
+export declare function scopeHintForMethod(required: readonly string[], alias: string, deps?: ScopeSetDeps): {
     hint: string;
     retriable: boolean;
 } | null;

package/dist/tools/_local-files.d.ts

@@ -1,3 +1,12 @@
 import * as fs from 'fs';
+/** Refusal for a host-file argument on a context that may not touch the
+ * server's disk: the host belongs to its operator, not to every caller. */
+export declare function hostFilesRefused(account: string | undefined, what: string): {
+    content: {
+        type: "text";
+        text: string;
+    }[];
+    isError: true;
+};
 export declare function prepareLocalDest(savePath: string, filename: string): string;
 export declare function openLocalReadStream(localPath: string): Promise<fs.ReadStream>;

package/dist/tools/_local-files.js

@@ -1,5 +1,23 @@
 import * as fs from 'fs';
 import * as path from 'path';
+import { stringifyEnvelope } from './_errors.js';
+/** Refusal for a host-file argument on a context that may not touch the
+ * server's disk: the host belongs to its operator, not to every caller. */
+export function hostFilesRefused(account, what) {
+    return {
+        content: [{
+                type: 'text',
+                text: stringifyEnvelope({
+                    error: 'forbidden',
+                    message: `${what}: this caller may not read files on the machine running the server.`,
+                    hint: 'Put the file in Drive first and work from its Drive id.',
+                    retriable: false,
+                    account,
+                }),
+            }],
+        isError: true,
+    };
+}
 // path.basename() is a traversal guard — a caller-supplied filename must never escape savePath.
 export function prepareLocalDest(savePath, filename) {
     const name = path.basename(filename);

package/dist/tools/accounts-tool.d.ts

@@ -1,5 +1,7 @@
 import type { ToolRegistry } from '../registry.js';
+import { type AccountSet } from '../accounts.js';
 import { type ScopesReport } from '../scope-observability.js';
+import { type TokenStore } from '../token-store.js';
 export interface AccountHealthDeps {
     hasToken: (alias: string) => boolean;
     readToken: (alias: string) => {
@@ -13,7 +15,12 @@ export interface AccountHealthDeps {
      * "registered but not requestable" view (B9). account_list stays compact:
      * its report universe is profile ∪ granted only. */
     registeredScopes?: () => string[];
+    /** Account view health is derived against; absent = the global registry. */
+    accounts?: () => AccountSet;
 }
+/** Health deps over one context's token store (and, optionally, its account
+ * view); the module-level functions are the single owner's store. */
+export declare function accountHealthDepsFor(store: Pick<TokenStore, 'hasToken' | 'readToken'>, accounts?: () => AccountSet): AccountHealthDeps;
 export type TokenStatus = 'ok' | 'expired_refreshable' | 'needs_reauth' | 'missing' | 'decrypt_error';
 export interface AccountHealth {
     alias: string;

package/dist/tools/accounts-tool.js

@@ -4,16 +4,23 @@ import { getAccountSet, refreshAccountSetIfStale } from '../accounts.js';
 import { buildScopesReport } from '../scope-observability.js';
 import { getAdminAccounts, resolveScopesForAccount } from '../auth.js';
 import { hasToken, readToken } from '../token-store.js';
-const DEFAULT_DEPS = {
-    hasToken,
-    readToken,
-    fileExists: fs.existsSync,
-    now: Date.now,
-};
+/** Health deps over one context's token store (and, optionally, its account
+ * view); the module-level functions are the single owner's store. */
+export function accountHealthDepsFor(store, accounts) {
+    return {
+        hasToken: store.hasToken,
+        readToken: store.readToken,
+        fileExists: fs.existsSync,
+        now: Date.now,
+        ...(accounts ? { accounts } : {}),
+    };
+}
+const DEFAULT_DEPS = accountHealthDepsFor({ hasToken, readToken });
 export function deriveAccountHealth(alias, deps = DEFAULT_DEPS) {
-    const config = getAccountSet().configs[alias];
-    const admin = getAdminAccounts().includes(alias);
-    const configured = resolveScopesForAccount(alias);
+    const set = (deps.accounts ?? getAccountSet)();
+    const config = set.configs[alias];
+    const admin = getAdminAccounts(set).includes(alias);
+    const configured = resolveScopesForAccount(alias, set);
     // BR-10: env-sourced accounts are not persisted in config.json, so the
     // account wizard cannot edit them — the deployer edits env instead.
     const base = {
@@ -88,14 +95,16 @@ export function registerAccountTools(registry, deps = DEFAULT_DEPS) {
         _meta: { 'anthropic/alwaysLoad': true },
     }, async () => {
         refreshAccountSetIfStale();
+        const set = registry.accountSet();
+        const health = { ...deps, accounts: () => set };
         return {
             content: [
                 {
                     type: 'text',
                     text: JSON.stringify({
-                        defaultAccount: getAccountSet().defaultAccount ?? null,
-                        defaultAccountSource: getAccountSet().defaultAccountSource ?? null,
-                        accounts: getAccountSet().aliases.map((alias) => deriveAccountHealth(alias, deps)),
+                        defaultAccount: set.defaultAccount ?? null,
+                        defaultAccountSource: set.defaultAccountSource ?? null,
+                        accounts: set.aliases.map((alias) => deriveAccountHealth(alias, health)),
                     }),
                 },
             ],

package/dist/tools/drive.js

@@ -1,10 +1,10 @@
 import { z } from 'zod';
 import { coerceArray, coerceBoolean, coerceNumber } from './_coerce.js';
 import { drive as driveClient } from '@googleapis/drive';
-import { accountArgLive, getAccountSet } from '../accounts.js';
+import { accountArgLive } from '../accounts.js';
 import { getClient } from '../client.js';
 import { handleGoogleApiError, invalidParams, safeMessage, stringifyEnvelope } from './_errors.js';
-import { openLocalReadStream, prepareLocalDest } from './_local-files.js';
+import { hostFilesRefused, openLocalReadStream, prepareLocalDest } from './_local-files.js';
 import { checkOutbound, outboundDeniedEnvelope, resolveOutboundAllowlist } from '../outbound-allowlist.js';
 import { isAllowed, writeDisabledResult } from '../write-control.js';
 import { capText, listResult } from '../trim.js';
@@ -128,6 +128,8 @@ export function registerDriveTools(server, deps = {}) {
     const accountEnum = accountArgLive(() => server.accountAliases()).optional();
     const requiredAccountEnum = accountArgLive(() => server.accountAliases());
     const getClientFn = deps.getClientFn ?? getClient;
+    const localFiles = deps.localFiles ?? true;
+    const registerHostFileTool = localFiles ? server.registerTool : (() => undefined);
     // ─── Read / search / list ──────────────────────────────────────────────
     server.registerTool('drive_search', {
         description: 'Search files in a Google Drive account. A plain keyword is treated as a full-text search; pass Drive query syntax for a structured search.',
@@ -343,7 +345,7 @@ export function registerDriveTools(server, deps = {}) {
         }
     });
     // ─── Write / upload / download ─────────────────────────────────────────
-    server.registerTool('drive_upload', {
+    registerHostFileTool('drive_upload', {
         description: 'Upload a local file to Google Drive. Pass `convertTo` to import it as a native, editable Google Doc/Sheet/Slides/Drawing instead of storing the raw bytes.',
         inputSchema: {
             account: accountEnum.describe('Google account alias'),
@@ -381,7 +383,7 @@ export function registerDriveTools(server, deps = {}) {
             return handleDriveError(error, account);
         }
     });
-    server.registerTool('drive_download', {
+    registerHostFileTool('drive_download', {
         description: 'Download a binary file from Drive to local disk. For Google Workspace formats (Docs, Sheets, Slides), use drive_export instead.',
         inputSchema: {
             account: accountEnum.describe('Google account alias'),
@@ -409,7 +411,7 @@ export function registerDriveTools(server, deps = {}) {
             return handleDriveError(error, account);
         }
     });
-    server.registerTool('drive_export', {
+    registerHostFileTool('drive_export', {
         description: 'Export a Google Workspace document (Doc, Sheet, Slide) to a standard format and save to disk. Supported: PDF, DOCX, XLSX, PPTX, TXT, CSV, Markdown (text/markdown for Docs).',
         inputSchema: {
             account: accountEnum.describe('Google account alias'),
@@ -476,11 +478,20 @@ export function registerDriveTools(server, deps = {}) {
             fileId: z.string().min(1).describe('Google Drive file ID'),
             newName: z.string().optional().describe('New filename'),
             newParentFolderId: z.string().optional().describe('Move to this folder, named newParentFolderId here, not parentFolderId'),
-            localPath: z.string().optional().describe('Replace file content with this local file (path on the machine running the server)'),
-            mimeType: z.string().optional().describe('MIME type of the replacement file (required if localPath is provided)'),
-            convertTo: z.enum(CONVERT_TO_VALUES).optional().describe('When replacing content via localPath, convert the new content into this native Google Workspace type on import: "document" | "spreadsheet" | "presentation" | "drawing" (full application/vnd.google-apps.* ids also accepted).'),
+            ...(localFiles
+                ? {
+                    localPath: z.string().optional().describe('Replace file content with this local file (path on the machine running the server)'),
+                    mimeType: z.string().optional().describe('MIME type of the replacement file (required if localPath is provided)'),
+                    convertTo: z.enum(CONVERT_TO_VALUES).optional().describe('When replacing content via localPath, convert the new content into this native Google Workspace type on import: "document" | "spreadsheet" | "presentation" | "drawing" (full application/vnd.google-apps.* ids also accepted).'),
+                }
+                : {}),
         },
-    }, async ({ account, fileId, newName, newParentFolderId, localPath: localPathArg, mimeType: mimeTypeArg, convertTo }) => {
+    }, async (args) => {
+        const { account, fileId, newName, newParentFolderId } = args;
+        // Declared only when the context may read host files (see the shape).
+        const { localPath: localPathArg, mimeType: mimeTypeArg, convertTo } = args;
+        if (localPathArg && !localFiles)
+            return hostFilesRefused(account, 'localPath');
         try {
             const auth = await getClientFn(account);
             const drive = driveClient({ version: 'v3', auth });
@@ -1309,7 +1320,7 @@ export function registerDriveTools(server, deps = {}) {
                 };
             }
             const intendedName = newName ?? meta.data.name ?? 'transferred-file';
-            const targetEmail = getAccountSet().configs[toAccount].email;
+            const targetEmail = server.accountSet().configs[toAccount].email;
             const finish = async (data, strategy, flags) => {
                 let moveFailed = false;
                 let moveSkipped = false;

package/dist/tools/generated/index.d.ts

@@ -1,5 +1,6 @@
 import type { ToolRegistry } from '../../registry.js';
+import type { ExecuteDeps } from './_shared.js';
 export declare const GENERATED_SERVICES: Array<{
     name: string;
-    register: (registry: ToolRegistry) => void;
+    register: (registry: ToolRegistry, deps?: ExecuteDeps) => void;
 }>;

package/dist/tools/gmail.js

@@ -5,7 +5,7 @@ import { accountArgLive } from '../accounts.js';
 import { getClient } from '../client.js';
 import { handleGoogleApiError, invalidParams, mapGoogleError } from './_errors.js';
 import { buildReplyHeaders, composeRaw, renderMarkdown, htmlToMarkdown, HeaderInjectionError } from './gmail-mime.js';
-import { prepareLocalDest } from './_local-files.js';
+import { hostFilesRefused, prepareLocalDest } from './_local-files.js';
 import { checkOutbound } from '../outbound-allowlist.js';
 import addressparser from 'nodemailer/lib/addressparser/index.js';
 import { lookup as lookupMime } from 'mime-types';
@@ -106,9 +106,11 @@ export function deriveReplySubject(sourceSubject) {
 // The account's own-address set (primary + Gmail send-as aliases) used to
 // exclude the caller from reply-all. Send-as rarely changes, so memoize per
 // process; a stale miss only costs one extra self-copy, never a wrong send.
+// Keyed by alias AND mailbox: two contexts can share an alias name.
 const ownAddressCache = new Map();
 function getOwnAddresses(gmail, account, primaryEmail) {
-    let cached = ownAddressCache.get(account);
+    const key = `${account} ${normAddr(primaryEmail)}`;
+    let cached = ownAddressCache.get(key);
     if (!cached) {
         cached = (async () => {
             const set = new Set([normAddr(primaryEmail)]);
@@ -124,7 +126,7 @@ function getOwnAddresses(gmail, account, primaryEmail) {
             }
             return set;
         })();
-        ownAddressCache.set(account, cached);
+        ownAddressCache.set(key, cached);
     }
     return cached;
 }
@@ -441,6 +443,8 @@ export function registerGmailTools(server, deps = {}) {
     // custody path is the context's, not the process global.
     const accountEnum = accountArgLive(() => server.accountAliases()).optional();
     const getClientFn = deps.getClientFn ?? getClient;
+    const localFiles = deps.localFiles ?? true;
+    const registerHostFileTool = localFiles ? server.registerTool : (() => undefined);
     server.registerTool('gmail_search', {
         description: 'Search messages in a Gmail account. Returns compact rows (id, from, subject, date, snippet); ' +
             'pass full=true for threadId, to, labelIds and the untruncated snippet.',
@@ -626,13 +630,15 @@ export function registerGmailTools(server, deps = {}) {
                 .describe('With replyToMessageId: include the source To+Cc (minus your own addresses) in cc. Default false (reply to sender only).'),
             replyToThreadId: z.string().optional()
                 .describe('Thread ID to send the message in'),
-            attachments: coerceJson(attachmentSchema),
+            ...(localFiles ? { attachments: coerceJson(attachmentSchema) } : {}),
         },
     }, async ({ account, to, subject, body, htmlBody, allowRawHtml, cc, replyToMessageId, replyAll, replyToThreadId, attachments }) => {
+        if (!localFiles && attachments?.length)
+            return hostFilesRefused(account, 'attachments');
         try {
             const auth = await getClientFn(account);
             const gmail = gmailClient({ version: 'v1', auth });
-            const config = (await import('../accounts.js')).getAccountSet().configs[account];
+            const config = server.accountSet().configs[account];
             if (htmlBody !== undefined) {
                 throw new GmailComposeError('E_HTMLBODY_REMOVED', 'htmlBody was removed in v6: author Markdown in `body`; for literal HTML pass `allowRawHtml: true`.');
             }
@@ -690,7 +696,7 @@ export function registerGmailTools(server, deps = {}) {
             return mapped ?? handleGmailError(error, account);
         }
     });
-    server.registerTool('gmail_download_attachment', {
+    registerHostFileTool('gmail_download_attachment', {
         description: 'Download an email attachment to local disk. Use gmail_read first to get the attachmentId.',
         inputSchema: {
             account: accountEnum.describe('Google account alias'),
@@ -741,13 +747,15 @@ export function registerGmailTools(server, deps = {}) {
                 .describe('With replyToMessageId: include the source To+Cc (minus your own addresses) in cc. Default false (reply to sender only).'),
             replyToThreadId: z.string().optional()
                 .describe('Thread ID to associate the draft with'),
-            attachments: coerceJson(attachmentSchema),
+            ...(localFiles ? { attachments: coerceJson(attachmentSchema) } : {}),
         },
     }, async ({ account, to, subject, body, htmlBody, allowRawHtml, cc, replyToMessageId, replyAll, replyToThreadId, attachments }) => {
+        if (!localFiles && attachments?.length)
+            return hostFilesRefused(account, 'attachments');
         try {
             const auth = await getClientFn(account);
             const gmail = gmailClient({ version: 'v1', auth });
-            const config = (await import('../accounts.js')).getAccountSet().configs[account];
+            const config = server.accountSet().configs[account];
             if (htmlBody !== undefined) {
                 throw new GmailComposeError('E_HTMLBODY_REMOVED', 'htmlBody was removed in v6: author Markdown in `body`; for literal HTML pass `allowRawHtml: true`.');
             }

package/dist/tools/google-api.d.ts

@@ -1,10 +1,9 @@
 import type { ToolRegistry } from '../registry.js';
 import { type Policy } from '../write-control.js';
-import { getClient } from '../client.js';
 import { type Toolsets } from '../toolsets.js';
+import { type ExecuteDeps } from '../executor.js';
 import { type DiscoveryDeps, type DiscoveryMethod } from '../discovery-client.js';
-export interface EscapeDeps extends DiscoveryDeps {
-    getClientFn?: typeof getClient;
+export interface EscapeDeps extends DiscoveryDeps, ExecuteDeps {
     toolsets?: Toolsets;
 }
 /** Up to three closest known ids for the unknown_method did-you-mean hint;

package/dist/tools/google-api.js

@@ -204,6 +204,6 @@ export function registerEscapeTools(registry, policy, deps = {}) {
             pathParams: pathParams,
             queryParams: queryParams,
             body,
-        }, { getClientFn });
+        }, { getClientFn, scopeDeps: deps.scopeDeps });
     });
 }

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "mcp-google-multi",
-  "version": "6.0.0-alpha.52",
+  "version": "6.0.0-alpha.54",
   "mcpName": "io.github.bakissation/mcp-google-multi",
   "description": "Local MCP server for Google Workspace (Gmail, Drive, Calendar, Sheets, Docs, Contacts, Tasks, Meet, Search Console, +Forms/Chat/Admin) across multiple accounts — OAuth-only, encrypted token storage, deny-by-default writes.",
   "type": "module",
@@ -27,6 +27,7 @@
     "./boot-gates": "./dist/boot-gates.js",
     "./tenant-purge": "./dist/tenant-purge.js",
     "./doctor": "./dist/doctor.js",
+    "./write-control": "./dist/write-control.js",
     "./package.json": "./package.json"
   },
   "files": [