mcp-google-multi 6.0.0-alpha.53 → 6.0.0-alpha.55

package/dist/accounts.d.ts

@@ -20,6 +20,7 @@ export interface AccountSet {
 }
 export declare function resolveAccounts(env?: NodeJS.ProcessEnv, filePath?: string, onInvalid?: 'exit' | 'throw', opts?: {
     tokenDir?: string;
+    emptyOk?: boolean;
 }): AccountSet;
 export declare function fileStamp(filePath: string, version: number): string;
 /** Live accessor: dispatch-time readers use this, never a captured snapshot. */

package/dist/accounts.js

@@ -74,7 +74,10 @@ function noAccountsMessage() {
  * empty behaves as unset, mirroring GOOGLE_ACCOUNTS semantics.
  */
 let warnedLegacy = false;
-export function resolveAccounts(env = process.env, filePath = configFilePath(), onInvalid = 'exit', opts = {}) {
+export function resolveAccounts(env = process.env, filePath = configFilePath(), onInvalid = 'exit', 
+// emptyOk: zero accounts is a valid set, not an error, even with 'throw'
+// (a context that has linked nothing yet). An invalid file still fails.
+opts = {}) {
     const dir = opts.tokenDir ?? tokenDir;
     const adminEnv = parseCsv(env.GOOGLE_ADMIN_ACCOUNTS);
     const rawEnv = env.GOOGLE_ACCOUNTS;
@@ -130,7 +133,7 @@ export function resolveAccounts(env = process.env, filePath = configFilePath(),
         // empty (BR-4), enforced by assertServerAccountsConfigured() in index.ts.
         // The dispatch-path reload ('throw') still throws so a mid-session emptied
         // config.json keeps the last-good registry (BR-7) instead of dropping tools.
-        if (onInvalid === 'throw') {
+        if (onInvalid === 'throw' && !opts.emptyOk) {
             throw new Error(`E_NO_ACCOUNTS_CONFIGURED: ${noAccountsMessage()}`);
         }
         return {

package/dist/api-probe.d.ts

@@ -1,3 +1,5 @@
+import { getClient } from './client.js';
+import { readToken } from './token-store.js';
 import type { ApiProbeResult } from './doctor.js';
 export interface ApiProbeSpec {
     service: string;
@@ -15,4 +17,7 @@ export interface ApiProbeDeps {
     grantedScopes: (alias: string) => string[];
     request: (alias: string, url: string) => Promise<void>;
 }
+/** Probe deps over one context's token reads and client; the module-level
+ * pair is the single owner's. */
+export declare function apiProbeDepsFor(readTokenFn: typeof readToken, getClientFn: typeof getClient): ApiProbeDeps;
 export declare function probeApiEnablement(alias: string, deps?: ApiProbeDeps): Promise<ApiProbeResult[]>;

package/dist/api-probe.js

@@ -24,21 +24,26 @@ export const API_PROBES = [
 export function planProbes(granted, probes = API_PROBES) {
     return probes.filter((p) => granted.some((s) => p.scopePrefixes.some((prefix) => s.startsWith(prefix))));
 }
-const DEFAULT_DEPS = {
-    grantedScopes: (alias) => {
-        try {
-            const scope = readToken(alias)?.scope;
-            return typeof scope === 'string' ? scope.split(' ').filter(Boolean) : [];
-        }
-        catch {
-            return [];
-        }
-    },
-    request: async (alias, url) => {
-        const auth = await getClient(alias);
-        await auth.request({ url, timeout: 10_000 });
-    },
-};
+/** Probe deps over one context's token reads and client; the module-level
+ * pair is the single owner's. */
+export function apiProbeDepsFor(readTokenFn, getClientFn) {
+    return {
+        grantedScopes: (alias) => {
+            try {
+                const scope = readTokenFn(alias)?.scope;
+                return typeof scope === 'string' ? scope.split(' ').filter(Boolean) : [];
+            }
+            catch {
+                return [];
+            }
+        },
+        request: async (alias, url) => {
+            const auth = await getClientFn(alias);
+            await auth.request({ url, timeout: 10_000 });
+        },
+    };
+}
+const DEFAULT_DEPS = apiProbeDepsFor(readToken, getClient);
 export async function probeApiEnablement(alias, deps = DEFAULT_DEPS) {
     const results = [];
     for (const spec of planProbes(deps.grantedScopes(alias))) {

package/dist/auth.d.ts

@@ -14,5 +14,5 @@ export declare function getAdminAccounts(set?: AccountSet): string[];
  * legacy env) changes its consent set and requires re-running auth. Evaluated
  * per account: `work` can carry admin + gmail_settings while `personal` is
  * never asked for them. */
-export declare function resolveScopesForAccount(alias: string): string[];
+export declare function resolveScopesForAccount(alias: string, set?: AccountSet): string[];
 export declare function runAuthFlow(args: string[]): Promise<void>;

package/dist/auth.js

@@ -95,15 +95,15 @@ export function getAdminAccounts(set = getAccountSet()) {
  * legacy env) changes its consent set and requires re-running auth. Evaluated
  * per account: `work` can carry admin + gmail_settings while `personal` is
  * never asked for them. */
-export function resolveScopesForAccount(alias) {
-    const profile = profileForAccount(alias);
+export function resolveScopesForAccount(alias, set = getAccountSet()) {
+    const profile = profileForAccount(alias, set);
     const scopes = profile.includesBase === false ? [] : [...BASE_SCOPES];
     for (const bundle of profile.bundles) {
         if (bundle === 'admin')
             continue;
         scopes.push(...BUNDLE_CATALOG[bundle].scopes);
     }
-    if (getAdminAccounts().includes(alias)) {
+    if (getAdminAccounts(set).includes(alias)) {
         scopes.push(...ADMIN_SCOPES);
     }
     return Array.from(new Set(scopes));

package/dist/client.d.ts

@@ -21,9 +21,13 @@ export declare function makeGetClient(contextKey: string, deps: GetClientDeps):
  * getClient below (today's behavior); a tenant context passes its own. */
 export interface CuratedToolDeps {
     getClientFn?: typeof getClient;
+    /** Whether tools may read or write the server host's disk (local uploads,
+     * downloads, attachments). Absent = true; the host belongs to its operator,
+     * so a non-owner context passes false. */
+    localFiles?: boolean;
 }
 /** The single-owner client, bound to the global registry + token store. The
  * operator surfaces that never carry a tenant (api-probe, executor and
- * escape-hatch `deps.getClientFn ?? getClient` defaults, stdio dispatch)
- * resolve through this. */
+ * escape-hatch `deps.getClientFn ?? getClient` defaults) resolve through
+ * this. */
 export declare const getClient: (account: Account) => Promise<OAuth2Client>;

package/dist/compose.d.ts

@@ -1,5 +1,11 @@
 import type { McpServer } from "@modelcontextprotocol/server";
+import type { ServerTarget } from './http-transport.js';
 import { ToolRegistry, type DiscoveryMode } from './registry.js';
-import type { IdentityContext } from './identity.js';
+import { type IdentityContext } from './identity.js';
 import type { Metrics } from './usage-metrics.js';
 export declare function buildRegistry(server: McpServer, ctx: IdentityContext, mode?: DiscoveryMode, metrics?: Metrics | null): ToolRegistry;
+/** The per-request hooks bound to one registry: argument shapes, unknown-
+ * argument screening and the account a validation envelope names. Both
+ * transports and every resolved server target build them here, so a mistyped
+ * argument behaves the same wherever it arrives. */
+export declare function requestHooksFor(registry: ToolRegistry, ctx: Pick<IdentityContext, 'accounts'>, metrics?: Metrics | null, env?: NodeJS.ProcessEnv): Omit<ServerTarget, 'server'>;

package/dist/compose.js

@@ -4,20 +4,36 @@
 // parsing, no process.exit, no prints (accounts.js module-load resolution is
 // the one inherited, pre-existing exception on the import chain).
 import { GENERATED_SERVICES } from './tools/generated/index.js';
-import { GENERATED_GATES, SERVICES } from './services.js';
+import { GENERATED_GATES, SERVICES, unknownToolMessage } from './services.js';
+import { argNormalizationEnabled } from './arg-normalize.js';
+import { unknownArgMode } from './arg-strict.js';
 import { ToolRegistry } from './registry.js';
 import { registerDiscoverTools } from './discover.js';
 import { registerEscapeTools } from './tools/google-api.js';
-import { registerAccountTools } from './tools/accounts-tool.js';
+import { accountHealthDepsFor, registerAccountTools } from './tools/accounts-tool.js';
 import { registerDiagnoseTool } from './doctor.js';
 import { registerAccountWizardTools } from './tools/account-wizard.js';
 import { getToolsets, toolsetEnabled } from './toolsets.js';
+import { isOwnerContext } from './identity.js';
+import { resolveScopesForAccount } from './auth.js';
 export function buildRegistry(server, ctx, mode, metrics = null) {
     const policy = ctx.policy;
     // The registry's account view IS the context's: fan-out expansion,
     // selector validation and default-account injection all follow this
     // context, not the process global (identical for the free core's one ctx).
     const registry = new ToolRegistry(server, policy, mode, metrics, () => ctx.accounts);
+    // Every handler resolves its client, token reads and scope hints through
+    // this context; ctx.accounts is read per call, never snapshotted here, so
+    // the owner's live getter stays live.
+    const owner = isOwnerContext(ctx);
+    const clientDeps = { getClientFn: ctx.getClient, localFiles: owner };
+    const execDeps = {
+        getClientFn: ctx.getClient,
+        scopeDeps: {
+            readTokenFn: ctx.tokenStore.readToken,
+            profileFn: (alias) => resolveScopesForAccount(alias, ctx.accounts),
+        },
+    };
     const toolsets = getToolsets();
     if (toolsets !== 'all') {
         const known = new Set([...SERVICES.map((s) => s.name), ...GENERATED_SERVICES.map((s) => s.name)]);
@@ -37,7 +53,7 @@ export function buildRegistry(server, ctx, mode, metrics = null) {
             }
             continue;
         }
-        svc.register(registry);
+        svc.register(registry, clientDeps);
     }
     for (const gen of GENERATED_SERVICES) {
         if (!toolsetEnabled(toolsets, gen.name))
@@ -50,7 +66,7 @@ export function buildRegistry(server, ctx, mode, metrics = null) {
             }
             continue;
         }
-        gen.register(registry);
+        gen.register(registry, execDeps);
     }
     if (registry.services().length === 0) {
         const known = [...new Set([...SERVICES.map((s) => s.name), ...GENERATED_SERVICES.map((s) => s.name)])].sort();
@@ -59,9 +75,35 @@ export function buildRegistry(server, ctx, mode, metrics = null) {
             `Note: optional services need their bundle in an account's scope profile (or legacy GOOGLE_OPTIONAL_SCOPES); admin needs an admin account/profile.`);
     }
     registerDiscoverTools(registry, policy);
-    registerEscapeTools(registry, policy);
-    registerAccountTools(registry);
+    registerEscapeTools(registry, policy, execDeps);
+    registerAccountTools(registry, accountHealthDepsFor(ctx.tokenStore));
     registerDiagnoseTool(registry, ctx);
-    registerAccountWizardTools(registry, server);
+    // The wizard edits the owner's config.json and token store; any other
+    // context has neither.
+    if (owner)
+        registerAccountWizardTools(registry, server);
     return registry;
 }
+/** The per-request hooks bound to one registry: argument shapes, unknown-
+ * argument screening and the account a validation envelope names. Both
+ * transports and every resolved server target build them here, so a mistyped
+ * argument behaves the same wherever it arrives. */
+export function requestHooksFor(registry, ctx, metrics = null, env = process.env) {
+    const mode = unknownArgMode(env);
+    return {
+        argShapeFor: argNormalizationEnabled(env) ? (tool) => registry.argShape(tool) : undefined,
+        strictArgs: mode === 'off'
+            ? undefined
+            : {
+                mode,
+                declaredFor: (tool) => registry.declaredKeys(tool),
+                siblingsFor: (tool, keys) => registry.siblingSpellings(tool, keys),
+                unknownTool: (name) => unknownToolMessage(registry, name),
+                onDrop: metrics ? (tool, keys) => metrics.recordArgDrop(tool, keys) : undefined,
+            },
+        validationEnvelope: {
+            isKnownTool: (name) => registry.hasTool(name),
+            defaultAccount: () => ctx.accounts.defaultAccount,
+        },
+    };
+}

package/dist/config-file.js

@@ -14,9 +14,10 @@ export function tenantsDir(env = process.env) {
     return path.join(configDir(env), 'tenants');
 }
 // A tenant id becomes a filesystem path segment exactly like an account
-// alias, so it rides the same traversal guard.
+// alias, so it rides the same traversal guard. 'owner' is the single-owner
+// context's subject and client lane, so no tenant may take it.
 function assertTenantId(tenantId) {
-    if (!ALIAS_RE.test(tenantId) || isReservedAlias(tenantId)) {
+    if (!ALIAS_RE.test(tenantId) || isReservedAlias(tenantId) || tenantId === 'owner') {
         throw new Error(`E_TENANT_ID_INVALID: invalid tenant id "${tenantId}".`);
     }
 }

package/dist/doctor.d.ts

@@ -1,6 +1,7 @@
 import type { ToolRegistry } from './registry.js';
 import { getAccountSet } from './accounts.js';
 import { type AccountHealth } from './tools/accounts-tool.js';
+import { type IdentityContext } from './identity.js';
 import { peekMasterKeyProvenance } from './master-key.js';
 import { type HttpConfig } from './http-config.js';
 export type Verdict = 'ok' | 'warn' | 'fail' | 'unknown';
@@ -68,6 +69,7 @@ export declare function renderDoctorText(report: DiagnosticsReport): string;
 export declare function renderReport(report: DiagnosticsReport, version: string): string;
 /** Exit non-zero when any section FAILs; with strict, WARN counts too. */
 export declare function exitCodeFor(report: DiagnosticsReport, strict: boolean): number;
+export type DiagnoseContext = Pick<IdentityContext, 'subject' | 'accounts' | 'getClient' | 'tokenStore'>;
 /** Agent-callable structured health report (read-only). Mirrors `doctor`'s
  * engine. Registered as a META tool, like `account_list`: it introspects this
  * server rather than Google data, and as a normal tool it became a service of
@@ -75,9 +77,7 @@ export declare function exitCodeFor(report: DiagnosticsReport, strict: boolean):
  * from already-registered services, and this runs after that), so it was
  * advertised only once something else expanded the surface. The README sends
  * people here when they are stuck, so it has to be findable. */
-export declare function registerDiagnoseTool(registry: ToolRegistry, ctx?: {
-    subject: string;
-}): void;
+export declare function registerDiagnoseTool(registry: ToolRegistry, ctx?: DiagnoseContext): void;
 export interface ResetOptions {
     account?: string;
     regenerateKey: boolean;

package/dist/doctor.js

@@ -2,14 +2,15 @@ import * as fs from 'node:fs';
 import * as path from 'node:path';
 import * as readline from 'node:readline';
 import { getAccountSet } from './accounts.js';
-import { deriveAccountHealth } from './tools/accounts-tool.js';
+import { accountHealthDepsFor, deriveAccountHealth } from './tools/accounts-tool.js';
+import { isOwnerContext } from './identity.js';
 import { peekMasterKeyProvenance, deleteMasterKeyMaterial } from './master-key.js';
 import { hasToken } from './token-store.js';
 import { configDir, loadConfigFile } from './config-file.js';
 import { envValueSource } from './env-load.js';
 import { reauthHint } from './reauth-hint.js';
 import { describeMetricsDir, resolveUsageMetrics, sourceLabel } from './usage-metrics.js';
-import { probeApiEnablement } from './api-probe.js';
+import { apiProbeDepsFor, probeApiEnablement } from './api-probe.js';
 import { safeMessage, stringifyEnvelope } from './tools/_errors.js';
 import { resolveHttpConfig, HttpConfigError } from './http-config.js';
 import { parseOwnerEmails } from './http-transport.js';
@@ -83,7 +84,7 @@ function sectionRuntime(deps) {
     }
     return { id: 1, title: 'Runtime', verdict: 'ok', lines: [`Node.js ${deps.nodeVersion} (>= ${MIN_NODE_MAJOR})`] };
 }
-function sectionConfig(deps, set) {
+function sectionConfig(deps, set, tenantScope = false) {
     const lines = [];
     let verdict = 'ok';
     let hint;
@@ -95,9 +96,14 @@ function sectionConfig(deps, set) {
             verdict: 'fail',
             slug: 'E_NO_ACCOUNTS_CONFIGURED',
             lines: ['No accounts configured.'],
-            hint: 'Add an account: run `npx mcp-google-multi migrate-config` or set GOOGLE_ACCOUNTS.',
+            ...(tenantScope ? {} : { hint: 'Add an account: run `npx mcp-google-multi migrate-config` or set GOOGLE_ACCOUNTS.' }),
         };
     }
+    // The config file, process env, working directory and metrics store below
+    // are the operator's host, not the context's: a tenant sees its own count.
+    if (tenantScope) {
+        return { id: 2, title: 'Config', verdict: 'ok', lines: [`${set.aliases.length} account(s) configured`] };
+    }
     const cfgPath = path.join(configDir(), 'config.json');
     lines.push(deps.fileExists(cfgPath) ? `config.json present (${set.aliases.length} account(s))` : `config.json absent — accounts sourced from env (${set.aliases.length})`);
     const legacyEnv = LEGACY_ENV_KEYS.filter((k) => deps.env[k]);
@@ -303,12 +309,13 @@ export function overallVerdict(sections) {
 export async function runDiagnostics(deps = DEFAULT_DEPS, opts = {}) {
     // Tenant scope omits the OPERATOR sections: §3 (key provenance = box
     // infrastructure) and §7 (its owner-gate lines print MCP_OWNER_EMAILS
-    // values — other people's addresses from a tenant's seat).
+    // values — other people's addresses from a tenant's seat), and trims §2 to
+    // the context's own account count.
     const tenantScope = opts.scope === 'tenant';
     const sections = [];
     sections.push(sectionRuntime(deps));
     const set = deps.accountSet();
-    sections.push(sectionConfig(deps, set));
+    sections.push(sectionConfig(deps, set, tenantScope));
     const aliases = set?.aliases ?? [];
     if (!tenantScope)
         sections.push(sectionKeys(deps, aliases));
@@ -390,6 +397,26 @@ export function exitCodeFor(report, strict) {
         return 1;
     return 0;
 }
+/** The engine's account, token and probe reads bound to one context, so a
+ * report never shows (or probes with) another context's accounts. */
+function diagnosticsDepsFor(ctx) {
+    const health = accountHealthDepsFor(ctx.tokenStore, () => ctx.accounts);
+    const probe = apiProbeDepsFor(ctx.tokenStore.readToken, ctx.getClient);
+    return {
+        ...DEFAULT_DEPS,
+        accountSet: () => {
+            try {
+                return ctx.accounts;
+            }
+            catch {
+                return null;
+            }
+        },
+        accountHealth: (alias) => deriveAccountHealth(alias, health),
+        anyTokensExist: (aliases) => aliases.some((a) => ctx.tokenStore.hasToken(a)),
+        probeApi: (alias) => probeApiEnablement(alias, probe),
+    };
+}
 /** Agent-callable structured health report (read-only). Mirrors `doctor`'s
  * engine. Registered as a META tool, like `account_list`: it introspects this
  * server rather than Google data, and as a normal tool it became a service of
@@ -398,16 +425,17 @@ export function exitCodeFor(report, strict) {
  * advertised only once something else expanded the surface. The README sends
  * people here when they are stuck, so it has to be findable. */
 export function registerDiagnoseTool(registry, ctx) {
-    // A non-owner context gets the tenant-scoped report; the free core's single
-    // 'owner' context keeps today's full operator report.
-    const scope = ctx && ctx.subject !== 'owner' ? 'tenant' : 'operator';
+    // A non-owner context gets the tenant-scoped report; only the owner context
+    // (or the context-free CLI surface) keeps the full operator report.
+    const scope = ctx && !isOwnerContext(ctx) ? 'tenant' : 'operator';
+    const deps = ctx ? diagnosticsDepsFor(ctx) : DEFAULT_DEPS;
     registry.registerMeta('diagnose', {
         annotations: { readOnlyHint: true, openWorldHint: true },
         description: 'Health report for this server: runtime, config, keys, per-account token status, scope grants, and API enablement. Read-only; returns copy-pasteable fixes for anything wrong. Call this to diagnose auth/config failures.',
         inputSchema: {},
     }, async () => {
         try {
-            const result = await runDiagnostics(undefined, { scope });
+            const result = await runDiagnostics(deps, { scope });
             return { content: [{ type: 'text', text: JSON.stringify(result, null, 2) }] };
         }
         catch (e) {

package/dist/executor.d.ts

@@ -1,4 +1,5 @@
 import { getClient } from './client.js';
+import { type ScopeSetDeps } from './scope-observability.js';
 export declare const MAX_RESPONSE_CHARS = 100000;
 export type QueryValue = string | number | boolean;
 export type QueryParams = Record<string, QueryValue | QueryValue[]>;
@@ -13,6 +14,8 @@ export interface ApiMethodRef {
 }
 export interface ExecuteDeps {
     getClientFn?: typeof getClient;
+    /** Token + profile view behind a 403 scope hint; absent = the single owner. */
+    scopeDeps?: ScopeSetDeps;
 }
 export interface ExecuteArgs {
     account: string;

package/dist/executor.js

@@ -103,6 +103,6 @@ export async function executeApiMethod(method, args, deps = {}) {
         return { content: [{ type: 'text', text }] };
     }
     catch (error) {
-        return handleGoogleApiError(error, args.account, undefined, () => method.scopes?.length ? scopeHintForMethod(method.scopes, args.account) : null);
+        return handleGoogleApiError(error, args.account, undefined, () => method.scopes?.length ? scopeHintForMethod(method.scopes, args.account, deps.scopeDeps) : null);
     }
 }

package/dist/http-transport.d.ts

@@ -15,6 +15,16 @@ export type AuthOutcome = {
 export type Authenticator = (req: IncomingMessage) => AuthOutcome | Promise<AuthOutcome>;
 /** A mounted extra route (the AS endpoints, B13). Return true if it wrote a response. */
 export type RouteHandler = (req: IncomingMessage, res: ServerResponse, url: URL) => boolean | Promise<boolean>;
+/** What a verified subject resolves to: ITS server plus the per-request hooks
+ * bound to that server's registry (tool shapes, declared keys, the default
+ * account a validation envelope names). The metrics observers (metricsTap,
+ * onArgRename) stay host-wide and must not be bound to any one registry. */
+export interface ServerTarget {
+    server: McpServer;
+    argShapeFor?: (tool: string) => ArgShape | undefined;
+    strictArgs?: StrictArgOptions;
+    validationEnvelope?: ValidationEnvelopeOptions;
+}
 export interface HttpHostOptions {
     /** The ONE McpServer + registry built at boot (P1 / BV gap #4: never per request). */
     server: McpServer;
@@ -25,14 +35,13 @@ export interface HttpHostOptions {
     /** Tenant-resolution seam: map the verified subject to ITS server. Absent
      * (free core) = every request dispatches to the one boot `server`. Return
      * null for an unknown subject -> 403 tenant_not_found. Each distinct
-     * resolved server gets its own serialize key. */
+     * resolved server gets its own dispatch lane. With a resolver, the
+     * per-request hooks come from the resolved target ONLY: the host-level
+     * argShapeFor / strictArgs / validationEnvelope describe the boot server's
+     * registry, never another subject's. */
     resolveServer?: (claims: {
         sub: string;
-    }) => Promise<{
-        server: McpServer;
-    } | null> | {
-        server: McpServer;
-    } | null;
+    }) => Promise<ServerTarget | null> | ServerTarget | null;
     /** Extra routes keyed by exact pathname (AS endpoints mount here in B13). */
     routes?: Record<string, RouteHandler>;
     log?: (line: string) => void;

package/dist/http-transport.js

@@ -43,12 +43,12 @@ export function jsonRpcMethod(body) {
 export class HttpTransportHost {
     opts;
     httpServer;
-    // Serialize the connect→dispatch critical section PER KEY: a McpServer
+    // Serialize the connect→dispatch critical section PER SERVER: a McpServer
     // captures its transport per request (protocol.js), but the gap between
     // connect() and the dispatch capturing it would still race under true
     // concurrency, so all traffic to ONE server runs under one mutex. The free
-    // core uses a single key (one boot server); with resolveServer each subject
-    // gets its own server and therefore its own independent lock lane.
+    // core has one lane (the boot server); with resolveServer each resolved
+    // server gets its own, however subjects map onto servers.
     locks = new Map();
     constructor(opts) {
         this.opts = opts;
@@ -56,7 +56,15 @@ export class HttpTransportHost {
     serializeFor(key, fn) {
         const prev = this.locks.get(key) ?? Promise.resolve();
         const run = prev.then(fn, fn);
-        this.locks.set(key, run.then(() => undefined, () => undefined));
+        const tail = run.then(() => undefined, () => undefined);
+        this.locks.set(key, tail);
+        // An idle lane drops out, so the map holds only in-flight subjects rather
+        // than every subject ever seen. A request that chained on this tail has
+        // already replaced it, so the identity check never frees a live lane.
+        void tail.then(() => {
+            if (this.locks.get(key) === tail)
+                this.locks.delete(key);
+        });
         return run;
     }
     log(line) {
@@ -154,7 +162,12 @@ export class HttpTransportHost {
         const sub = auth.sub ?? 'owner';
         // Tenant resolution (the seam EE fills): map the verified subject to ITS
         // server. Absent resolver = the one boot server for every subject.
-        let target = { server: this.opts.server };
+        let target = {
+            server: this.opts.server,
+            argShapeFor: this.opts.argShapeFor,
+            strictArgs: this.opts.strictArgs,
+            validationEnvelope: this.opts.validationEnvelope,
+        };
         if (this.opts.resolveServer) {
             try {
                 target = await this.opts.resolveServer({ sub });
@@ -204,12 +217,11 @@ export class HttpTransportHost {
         // releases. (A shared initialized-state persists across stateless requests;
         // benign for the single-owner design.)
         const deadlineMs = this.opts.dispatchTimeoutMs ?? DISPATCH_TIMEOUT_DEFAULT;
-        // The lock lane must match the SERVER identity, not the subject: without a
-        // resolver every subject shares the one boot server, so keying on sub
-        // would let two subjects race one server through the connect gap.
-        const serializeKey = this.opts.resolveServer ? sub : '__single__';
-        const mcpServer = target.server;
-        await this.serializeFor(serializeKey, async () => {
+        // The lock lane is the SERVER identity, never the subject: two subjects
+        // reaching one server (the boot server, or a resolver mapping several
+        // subjects to one) would otherwise race it through the connect gap.
+        const { server: mcpServer, argShapeFor, strictArgs, validationEnvelope } = target;
+        await this.serializeFor(mcpServer, async () => {
             const disconnected = new Promise((resolve) => res.once('close', () => resolve('closed')));
             let timer;
             const timedOut = new Promise((resolve) => {
@@ -218,10 +230,10 @@ export class HttpTransportHost {
             });
             // Same composition as the stdio leg: the envelope rewrite is innermost,
             // so the tap above it still classifies the original validation prose.
-            const enveloped = withValidationEnvelope(transport, this.opts.validationEnvelope ?? {});
+            const enveloped = withValidationEnvelope(transport, validationEnvelope ?? {});
             const tapped = this.opts.metricsTap ? this.opts.metricsTap(enveloped) : enveloped;
-            await mcpServer.connect(this.opts.argShapeFor || this.opts.strictArgs
-                ? withArgNormalization(tapped, this.opts.argShapeFor ?? (() => undefined), this.opts.log, this.opts.onArgRename, this.opts.strictArgs)
+            await mcpServer.connect(argShapeFor || strictArgs
+                ? withArgNormalization(tapped, argShapeFor ?? (() => undefined), this.opts.log, this.opts.onArgRename, strictArgs)
                 : tapped);
             // Reflect the dispatch into a non-rejecting arm: if the deadline wins the
             // race, an orphaned handler settling later must not surface as an unhandled

package/dist/identity.d.ts

@@ -21,6 +21,7 @@ export interface IdentityContext {
         hasToken: typeof hasToken;
     };
 }
+export declare function isOwnerContext(ctx: object | undefined): boolean;
 export declare function buildIdentityContext(env?: NodeJS.ProcessEnv, opts?: {
     transport?: Transport;
 }): IdentityContext;

package/dist/identity.js

@@ -2,12 +2,20 @@ import { getAccountSet, getTokenDir, refreshAccountSetIfStale } from './accounts
 import { makeGetClient } from './client.js';
 import { createTokenStore } from './token-store.js';
 import { resolvePolicy } from './write-control.js';
+// Only buildIdentityContext mints the owner brand. The subject string alone
+// never unlocks the owner-only surfaces (account wizard, host-file tools, the
+// operator diagnose report): a hand-built context claiming 'owner' stays a
+// non-owner context.
+const ownerContexts = new WeakSet();
+export function isOwnerContext(ctx) {
+    return ctx !== undefined && ownerContexts.has(ctx);
+}
 export function buildIdentityContext(env = process.env, opts = {}) {
     // Real closures over the single-owner state (the SAME factories EE
     // instantiates per tenant), bound here to the global registry + token dir —
     // behavior-identical to the module-level functions for the free core.
     const tokenStore = createTokenStore(getTokenDir());
-    return {
+    const ctx = {
         subject: 'owner',
         // Live getter: the seam must always see the current registry, never a
         // snapshot pinned from before a wizard mutation or cross-process reload.
@@ -25,4 +33,6 @@ export function buildIdentityContext(env = process.env, opts = {}) {
         }),
         tokenStore,
     };
+    ownerContexts.add(ctx);
+    return ctx;
 }

package/dist/index.js

@@ -1,42 +1,26 @@
 #!/usr/bin/env node
 // First import: triggers accounts.js module load (env files + registry) before
 // anything else. Named to also pull the server-only empty-registry guard (BR-4).
-import { assertServerAccountsConfigured, getAccountSet } from './accounts.js';
+import { assertServerAccountsConfigured } from './accounts.js';
 import { accountsAssertRequired, assertNoEnvAccountsMode, assertNoEnvOptionalScopesMode, isMultiTenantBoot, mtBootGates } from './boot-gates.js';
 import { readFileSync } from 'node:fs';
 import { fileURLToPath } from 'node:url';
 import path from 'node:path';
 import { StdioServerTransport } from "@modelcontextprotocol/server/stdio";
 import { McpServer } from "@modelcontextprotocol/server";
-import { unknownToolMessage } from './services.js';
 import { resolveDiscoveryMode } from './registry.js';
 import { isAllowed, describePolicy } from './write-control.js';
 import { buildIdentityContext } from './identity.js';
-import { buildRegistry } from './compose.js';
+import { buildRegistry, requestHooksFor } from './compose.js';
 import { registerSetupPrompt } from './setup-prompt.js';
 import { applyNetTuning } from './net-tuning.js';
-import { argNormalizationEnabled, withArgNormalization, withValidationEnvelope } from './arg-normalize.js';
-import { unknownArgMode } from './arg-strict.js';
+import { withArgNormalization, withValidationEnvelope } from './arg-normalize.js';
 import { envValueSource } from './env-load.js';
 import { loadConfigFile } from './config-file.js';
 import { initUsageMetrics, resolveUsageMetrics, sourceLabel } from './usage-metrics.js';
 applyNetTuning();
 const __dirname = path.dirname(fileURLToPath(import.meta.url));
 const pkg = JSON.parse(readFileSync(path.resolve(__dirname, '..', 'package.json'), 'utf-8'));
-/** Unknown-argument screening options, or undefined when the feature is off.
- * Shared by both transports so a mistyped argument behaves identically. */
-function strictArgOptions(registry, metrics) {
-    const mode = unknownArgMode();
-    if (mode === 'off')
-        return undefined;
-    return {
-        mode,
-        declaredFor: (tool) => registry.declaredKeys(tool),
-        siblingsFor: (tool, keys) => registry.siblingSpellings(tool, keys),
-        unknownTool: (name) => unknownToolMessage(registry, name),
-        onDrop: metrics ? (tool, keys) => metrics.recordArgDrop(tool, keys) : undefined,
-    };
-}
 async function main() {
     if (process.argv.includes('auth')) {
         const { runAuthFlow } = await import('./auth.js');
@@ -208,30 +192,28 @@ async function main() {
     if (wantStdio) {
         const server = new McpServer({ name: 'mcp-google-multi', version: pkg.version });
         const stdioMetrics = initMetricsFor('stdio', resolveDiscoveryMode());
-        const registry = buildRegistry(server, buildIdentityContext(process.env, { transport: 'stdio' }), undefined, stdioMetrics);
+        const stdioCtx = buildIdentityContext(process.env, { transport: 'stdio' });
+        const registry = buildRegistry(server, stdioCtx, undefined, stdioMetrics);
         registry.installListHandler();
         registerSetupPrompt(server);
+        const stdioHooks = requestHooksFor(registry, stdioCtx, stdioMetrics);
         // Outbound runs outermost-first, so the composition is deliberate: the
         // envelope rewrite is INNERMOST (last to touch the frame), the tap sits
         // above it (classifying the ORIGINAL validation prose), arg normalization
         // outermost. The tap only counts outbound JSON-RPC error frames (no
         // handler ran) plus id->tool names.
-        let transport = withValidationEnvelope(new StdioServerTransport(), {
-            isKnownTool: (n) => registry.hasTool(n),
-            defaultAccount: () => getAccountSet().defaultAccount,
-        });
+        let transport = withValidationEnvelope(new StdioServerTransport(), stdioHooks.validationEnvelope);
         if (stdioMetrics) {
             const { tapUsageMetrics } = await import('./metrics-tap.js');
             transport = tapUsageMetrics(transport, stdioMetrics, (n) => registry.hasTool(n));
         }
-        const strictStdio = strictArgOptions(registry, stdioMetrics);
-        await server.connect(argNormalizationEnabled() || strictStdio
+        await server.connect(stdioHooks.argShapeFor || stdioHooks.strictArgs
             ? withArgNormalization(transport, 
             // Gated exactly as the HTTP leg gates `argShapeFor`. Passing the
             // shape unconditionally made stdio rename keys while
             // GOOGLE_ARG_NORMALIZE=off, so the same call succeeded on stdio
             // and failed on HTTP once screening rejects.
-            argNormalizationEnabled() ? (n) => registry.argShape(n) : () => undefined, undefined, stdioMetrics ? (tool, n) => stdioMetrics.recordArgFix(tool, n) : undefined, strictStdio)
+            stdioHooks.argShapeFor ?? (() => undefined), undefined, stdioMetrics ? (tool, n) => stdioMetrics.recordArgFix(tool, n) : undefined, stdioHooks.strictArgs)
             : transport);
     }
     if (wantHttp) {
@@ -259,7 +241,8 @@ async function main() {
         }
         const httpServer = new McpServer({ name: 'mcp-google-multi', version: pkg.version });
         const httpMetrics = initMetricsFor('http', 'curated');
-        const registry = buildRegistry(httpServer, buildIdentityContext(process.env, { transport: 'http' }), 'curated', httpMetrics);
+        const httpCtx = buildIdentityContext(process.env, { transport: 'http' });
+        const registry = buildRegistry(httpServer, httpCtx, 'curated', httpMetrics);
         registry.installListHandler();
         registerSetupPrompt(httpServer);
         // B13: mount the OAuth 2.1 AS (legs A + B) + the Bearer authenticator.
@@ -345,14 +328,9 @@ async function main() {
             authenticate: authServer.authenticate,
             routes: authServer.routes,
             log: (l) => process.stderr.write(`[http] ${l}\n`),
-            argShapeFor: argNormalizationEnabled() ? (n) => registry.argShape(n) : undefined,
+            ...requestHooksFor(registry, httpCtx, httpMetrics),
             metricsTap: httpTap,
-            validationEnvelope: {
-                isKnownTool: (n) => registry.hasTool(n),
-                defaultAccount: () => getAccountSet().defaultAccount,
-            },
             onArgRename: httpMetrics ? (tool, n) => httpMetrics.recordArgFix(tool, n) : undefined,
-            strictArgs: strictArgOptions(registry, httpMetrics),
         });
         await host.start();
         process.stderr.write(`HTTP transport listening on http://${httpCfg.host}:${httpCfg.port} (public ${httpCfg.publicUrl})\n`);

package/dist/registry.d.ts

@@ -65,6 +65,9 @@ export declare class ToolRegistry {
     /** The registry's OWN alias list: registration-time schema builders (the
      * generated account enums) read this, never the process global. */
     accountAliases(): readonly string[];
+    /** The registry's OWN account set: handlers needing an account's email or
+     * profile read this, never the process global. */
+    accountSet(): AccountSet;
     /** Declared input-schema keys + scalar kinds for one tool (tools/call arg
      * normalization; the kind drives value coercion on renamed keys). */
     argShape(name: string): ArgShape | undefined;

package/dist/registry.js

@@ -225,7 +225,7 @@ export class ToolRegistry {
                     const v = a?.account;
                     if (typeof v !== 'string' || (v !== '*' && !v.includes(',')))
                         return 1;
-                    const sel = parseAccountSelector(v);
+                    const sel = parseAccountSelector(v, this.accounts().aliases);
                     return sel.ok ? sel.aliases.length : 1;
                 })
                 : finalHandler;
@@ -250,6 +250,11 @@ export class ToolRegistry {
     accountAliases() {
         return this.accounts().aliases;
     }
+    /** The registry's OWN account set: handlers needing an account's email or
+     * profile read this, never the process global. */
+    accountSet() {
+        return this.accounts();
+    }
     /** Declared input-schema keys + scalar kinds for one tool (tools/call arg
      * normalization; the kind drives value coercion on renamed keys). */
     argShape(name) {

package/dist/scope-observability.d.ts

@@ -1,4 +1,3 @@
-import { resolveScopesForAccount } from './auth.js';
 import { readToken } from './token-store.js';
 export type ScopeState = 'callable' | 'requestable_not_granted' | 'not_requestable';
 export type NotRequestableReason = 'add_bundle' | 'account_type' | 'unknown_scope';
@@ -35,12 +34,15 @@ export interface AccountScopeSets {
     granted: Set<string>;
     profile: Set<string>;
 }
+/** Where a scope hint reads the granted token and the configured profile;
+ * absent = the single-owner token store and global registry. */
+export interface ScopeSetDeps {
+    readTokenFn?: typeof readToken;
+    profileFn?: (alias: string) => string[];
+}
 /** Best-effort per-account sets; null when the token/profile is unreadable
  * (decrypt error, missing token) — callers fall back to generic hints. */
-export declare function accountScopeSets(alias: string, deps?: {
-    readTokenFn?: typeof readToken;
-    profileFn?: typeof resolveScopesForAccount;
-}): AccountScopeSets | null;
+export declare function accountScopeSets(alias: string, deps?: ScopeSetDeps): AccountScopeSets | null;
 /**
  * Runtime enrichment for a scope 403 on a method whose required scopes are
  * known (escape hatch: runtime Discovery; generated tools: baked). The
@@ -48,7 +50,7 @@ export declare function accountScopeSets(alias: string, deps?: {
  * profile means Google refuses it for this account type (personal Gmail),
  * so re-auth would loop — report the dead end instead.
  */
-export declare function scopeHintForMethod(required: readonly string[], alias: string, deps?: Parameters<typeof accountScopeSets>[1]): {
+export declare function scopeHintForMethod(required: readonly string[], alias: string, deps?: ScopeSetDeps): {
     hint: string;
     retriable: boolean;
 } | null;

package/dist/tools/_local-files.d.ts

@@ -1,3 +1,12 @@
 import * as fs from 'fs';
+/** Refusal for a host-file argument on a context that may not touch the
+ * server's disk: the host belongs to its operator, not to every caller. */
+export declare function hostFilesRefused(account: string | undefined, what: string): {
+    content: {
+        type: "text";
+        text: string;
+    }[];
+    isError: true;
+};
 export declare function prepareLocalDest(savePath: string, filename: string): string;
 export declare function openLocalReadStream(localPath: string): Promise<fs.ReadStream>;

package/dist/tools/_local-files.js

@@ -1,5 +1,23 @@
 import * as fs from 'fs';
 import * as path from 'path';
+import { stringifyEnvelope } from './_errors.js';
+/** Refusal for a host-file argument on a context that may not touch the
+ * server's disk: the host belongs to its operator, not to every caller. */
+export function hostFilesRefused(account, what) {
+    return {
+        content: [{
+                type: 'text',
+                text: stringifyEnvelope({
+                    error: 'forbidden',
+                    message: `${what}: this caller may not read files on the machine running the server.`,
+                    hint: 'Put the file in Drive first and work from its Drive id.',
+                    retriable: false,
+                    account,
+                }),
+            }],
+        isError: true,
+    };
+}
 // path.basename() is a traversal guard — a caller-supplied filename must never escape savePath.
 export function prepareLocalDest(savePath, filename) {
     const name = path.basename(filename);

package/dist/tools/accounts-tool.d.ts

@@ -1,5 +1,7 @@
 import type { ToolRegistry } from '../registry.js';
+import { type AccountSet } from '../accounts.js';
 import { type ScopesReport } from '../scope-observability.js';
+import { type TokenStore } from '../token-store.js';
 export interface AccountHealthDeps {
     hasToken: (alias: string) => boolean;
     readToken: (alias: string) => {
@@ -13,7 +15,12 @@ export interface AccountHealthDeps {
      * "registered but not requestable" view (B9). account_list stays compact:
      * its report universe is profile ∪ granted only. */
     registeredScopes?: () => string[];
+    /** Account view health is derived against; absent = the global registry. */
+    accounts?: () => AccountSet;
 }
+/** Health deps over one context's token store (and, optionally, its account
+ * view); the module-level functions are the single owner's store. */
+export declare function accountHealthDepsFor(store: Pick<TokenStore, 'hasToken' | 'readToken'>, accounts?: () => AccountSet): AccountHealthDeps;
 export type TokenStatus = 'ok' | 'expired_refreshable' | 'needs_reauth' | 'missing' | 'decrypt_error';
 export interface AccountHealth {
     alias: string;

package/dist/tools/accounts-tool.js

@@ -4,16 +4,23 @@ import { getAccountSet, refreshAccountSetIfStale } from '../accounts.js';
 import { buildScopesReport } from '../scope-observability.js';
 import { getAdminAccounts, resolveScopesForAccount } from '../auth.js';
 import { hasToken, readToken } from '../token-store.js';
-const DEFAULT_DEPS = {
-    hasToken,
-    readToken,
-    fileExists: fs.existsSync,
-    now: Date.now,
-};
+/** Health deps over one context's token store (and, optionally, its account
+ * view); the module-level functions are the single owner's store. */
+export function accountHealthDepsFor(store, accounts) {
+    return {
+        hasToken: store.hasToken,
+        readToken: store.readToken,
+        fileExists: fs.existsSync,
+        now: Date.now,
+        ...(accounts ? { accounts } : {}),
+    };
+}
+const DEFAULT_DEPS = accountHealthDepsFor({ hasToken, readToken });
 export function deriveAccountHealth(alias, deps = DEFAULT_DEPS) {
-    const config = getAccountSet().configs[alias];
-    const admin = getAdminAccounts().includes(alias);
-    const configured = resolveScopesForAccount(alias);
+    const set = (deps.accounts ?? getAccountSet)();
+    const config = set.configs[alias];
+    const admin = getAdminAccounts(set).includes(alias);
+    const configured = resolveScopesForAccount(alias, set);
     // BR-10: env-sourced accounts are not persisted in config.json, so the
     // account wizard cannot edit them — the deployer edits env instead.
     const base = {
@@ -88,14 +95,16 @@ export function registerAccountTools(registry, deps = DEFAULT_DEPS) {
         _meta: { 'anthropic/alwaysLoad': true },
     }, async () => {
         refreshAccountSetIfStale();
+        const set = registry.accountSet();
+        const health = { ...deps, accounts: () => set };
         return {
             content: [
                 {
                     type: 'text',
                     text: JSON.stringify({
-                        defaultAccount: getAccountSet().defaultAccount ?? null,
-                        defaultAccountSource: getAccountSet().defaultAccountSource ?? null,
-                        accounts: getAccountSet().aliases.map((alias) => deriveAccountHealth(alias, deps)),
+                        defaultAccount: set.defaultAccount ?? null,
+                        defaultAccountSource: set.defaultAccountSource ?? null,
+                        accounts: set.aliases.map((alias) => deriveAccountHealth(alias, health)),
                     }),
                 },
             ],

package/dist/tools/drive.js

@@ -1,10 +1,10 @@
 import { z } from 'zod';
 import { coerceArray, coerceBoolean, coerceNumber } from './_coerce.js';
 import { drive as driveClient } from '@googleapis/drive';
-import { accountArgLive, getAccountSet } from '../accounts.js';
+import { accountArgLive } from '../accounts.js';
 import { getClient } from '../client.js';
 import { handleGoogleApiError, invalidParams, safeMessage, stringifyEnvelope } from './_errors.js';
-import { openLocalReadStream, prepareLocalDest } from './_local-files.js';
+import { hostFilesRefused, openLocalReadStream, prepareLocalDest } from './_local-files.js';
 import { checkOutbound, outboundDeniedEnvelope, resolveOutboundAllowlist } from '../outbound-allowlist.js';
 import { isAllowed, writeDisabledResult } from '../write-control.js';
 import { capText, listResult } from '../trim.js';
@@ -128,6 +128,8 @@ export function registerDriveTools(server, deps = {}) {
     const accountEnum = accountArgLive(() => server.accountAliases()).optional();
     const requiredAccountEnum = accountArgLive(() => server.accountAliases());
     const getClientFn = deps.getClientFn ?? getClient;
+    const localFiles = deps.localFiles ?? true;
+    const registerHostFileTool = localFiles ? server.registerTool : (() => undefined);
     // ─── Read / search / list ──────────────────────────────────────────────
     server.registerTool('drive_search', {
         description: 'Search files in a Google Drive account. A plain keyword is treated as a full-text search; pass Drive query syntax for a structured search.',
@@ -343,7 +345,7 @@ export function registerDriveTools(server, deps = {}) {
         }
     });
     // ─── Write / upload / download ─────────────────────────────────────────
-    server.registerTool('drive_upload', {
+    registerHostFileTool('drive_upload', {
         description: 'Upload a local file to Google Drive. Pass `convertTo` to import it as a native, editable Google Doc/Sheet/Slides/Drawing instead of storing the raw bytes.',
         inputSchema: {
             account: accountEnum.describe('Google account alias'),
@@ -381,7 +383,7 @@ export function registerDriveTools(server, deps = {}) {
             return handleDriveError(error, account);
         }
     });
-    server.registerTool('drive_download', {
+    registerHostFileTool('drive_download', {
         description: 'Download a binary file from Drive to local disk. For Google Workspace formats (Docs, Sheets, Slides), use drive_export instead.',
         inputSchema: {
             account: accountEnum.describe('Google account alias'),
@@ -409,7 +411,7 @@ export function registerDriveTools(server, deps = {}) {
             return handleDriveError(error, account);
         }
     });
-    server.registerTool('drive_export', {
+    registerHostFileTool('drive_export', {
         description: 'Export a Google Workspace document (Doc, Sheet, Slide) to a standard format and save to disk. Supported: PDF, DOCX, XLSX, PPTX, TXT, CSV, Markdown (text/markdown for Docs).',
         inputSchema: {
             account: accountEnum.describe('Google account alias'),
@@ -476,11 +478,20 @@ export function registerDriveTools(server, deps = {}) {
             fileId: z.string().min(1).describe('Google Drive file ID'),
             newName: z.string().optional().describe('New filename'),
             newParentFolderId: z.string().optional().describe('Move to this folder, named newParentFolderId here, not parentFolderId'),
-            localPath: z.string().optional().describe('Replace file content with this local file (path on the machine running the server)'),
-            mimeType: z.string().optional().describe('MIME type of the replacement file (required if localPath is provided)'),
-            convertTo: z.enum(CONVERT_TO_VALUES).optional().describe('When replacing content via localPath, convert the new content into this native Google Workspace type on import: "document" | "spreadsheet" | "presentation" | "drawing" (full application/vnd.google-apps.* ids also accepted).'),
+            ...(localFiles
+                ? {
+                    localPath: z.string().optional().describe('Replace file content with this local file (path on the machine running the server)'),
+                    mimeType: z.string().optional().describe('MIME type of the replacement file (required if localPath is provided)'),
+                    convertTo: z.enum(CONVERT_TO_VALUES).optional().describe('When replacing content via localPath, convert the new content into this native Google Workspace type on import: "document" | "spreadsheet" | "presentation" | "drawing" (full application/vnd.google-apps.* ids also accepted).'),
+                }
+                : {}),
         },
-    }, async ({ account, fileId, newName, newParentFolderId, localPath: localPathArg, mimeType: mimeTypeArg, convertTo }) => {
+    }, async (args) => {
+        const { account, fileId, newName, newParentFolderId } = args;
+        // Declared only when the context may read host files (see the shape).
+        const { localPath: localPathArg, mimeType: mimeTypeArg, convertTo } = args;
+        if (localPathArg && !localFiles)
+            return hostFilesRefused(account, 'localPath');
         try {
             const auth = await getClientFn(account);
             const drive = driveClient({ version: 'v3', auth });
@@ -1309,7 +1320,7 @@ export function registerDriveTools(server, deps = {}) {
                 };
             }
             const intendedName = newName ?? meta.data.name ?? 'transferred-file';
-            const targetEmail = getAccountSet().configs[toAccount].email;
+            const targetEmail = server.accountSet().configs[toAccount].email;
             const finish = async (data, strategy, flags) => {
                 let moveFailed = false;
                 let moveSkipped = false;

package/dist/tools/generated/index.d.ts

@@ -1,5 +1,6 @@
 import type { ToolRegistry } from '../../registry.js';
+import type { ExecuteDeps } from './_shared.js';
 export declare const GENERATED_SERVICES: Array<{
     name: string;
-    register: (registry: ToolRegistry) => void;
+    register: (registry: ToolRegistry, deps?: ExecuteDeps) => void;
 }>;

package/dist/tools/gmail.js

@@ -5,7 +5,7 @@ import { accountArgLive } from '../accounts.js';
 import { getClient } from '../client.js';
 import { handleGoogleApiError, invalidParams, mapGoogleError } from './_errors.js';
 import { buildReplyHeaders, composeRaw, renderMarkdown, htmlToMarkdown, HeaderInjectionError } from './gmail-mime.js';
-import { prepareLocalDest } from './_local-files.js';
+import { hostFilesRefused, prepareLocalDest } from './_local-files.js';
 import { checkOutbound } from '../outbound-allowlist.js';
 import addressparser from 'nodemailer/lib/addressparser/index.js';
 import { lookup as lookupMime } from 'mime-types';
@@ -106,9 +106,11 @@ export function deriveReplySubject(sourceSubject) {
 // The account's own-address set (primary + Gmail send-as aliases) used to
 // exclude the caller from reply-all. Send-as rarely changes, so memoize per
 // process; a stale miss only costs one extra self-copy, never a wrong send.
+// Keyed by alias AND mailbox: two contexts can share an alias name.
 const ownAddressCache = new Map();
 function getOwnAddresses(gmail, account, primaryEmail) {
-    let cached = ownAddressCache.get(account);
+    const key = `${account} ${normAddr(primaryEmail)}`;
+    let cached = ownAddressCache.get(key);
     if (!cached) {
         cached = (async () => {
             const set = new Set([normAddr(primaryEmail)]);
@@ -124,7 +126,7 @@ function getOwnAddresses(gmail, account, primaryEmail) {
             }
             return set;
         })();
-        ownAddressCache.set(account, cached);
+        ownAddressCache.set(key, cached);
     }
     return cached;
 }
@@ -441,6 +443,8 @@ export function registerGmailTools(server, deps = {}) {
     // custody path is the context's, not the process global.
     const accountEnum = accountArgLive(() => server.accountAliases()).optional();
     const getClientFn = deps.getClientFn ?? getClient;
+    const localFiles = deps.localFiles ?? true;
+    const registerHostFileTool = localFiles ? server.registerTool : (() => undefined);
     server.registerTool('gmail_search', {
         description: 'Search messages in a Gmail account. Returns compact rows (id, from, subject, date, snippet); ' +
             'pass full=true for threadId, to, labelIds and the untruncated snippet.',
@@ -626,13 +630,15 @@ export function registerGmailTools(server, deps = {}) {
                 .describe('With replyToMessageId: include the source To+Cc (minus your own addresses) in cc. Default false (reply to sender only).'),
             replyToThreadId: z.string().optional()
                 .describe('Thread ID to send the message in'),
-            attachments: coerceJson(attachmentSchema),
+            ...(localFiles ? { attachments: coerceJson(attachmentSchema) } : {}),
         },
     }, async ({ account, to, subject, body, htmlBody, allowRawHtml, cc, replyToMessageId, replyAll, replyToThreadId, attachments }) => {
+        if (!localFiles && attachments?.length)
+            return hostFilesRefused(account, 'attachments');
         try {
             const auth = await getClientFn(account);
             const gmail = gmailClient({ version: 'v1', auth });
-            const config = (await import('../accounts.js')).getAccountSet().configs[account];
+            const config = server.accountSet().configs[account];
             if (htmlBody !== undefined) {
                 throw new GmailComposeError('E_HTMLBODY_REMOVED', 'htmlBody was removed in v6: author Markdown in `body`; for literal HTML pass `allowRawHtml: true`.');
             }
@@ -690,7 +696,7 @@ export function registerGmailTools(server, deps = {}) {
             return mapped ?? handleGmailError(error, account);
         }
     });
-    server.registerTool('gmail_download_attachment', {
+    registerHostFileTool('gmail_download_attachment', {
         description: 'Download an email attachment to local disk. Use gmail_read first to get the attachmentId.',
         inputSchema: {
             account: accountEnum.describe('Google account alias'),
@@ -741,13 +747,15 @@ export function registerGmailTools(server, deps = {}) {
                 .describe('With replyToMessageId: include the source To+Cc (minus your own addresses) in cc. Default false (reply to sender only).'),
             replyToThreadId: z.string().optional()
                 .describe('Thread ID to associate the draft with'),
-            attachments: coerceJson(attachmentSchema),
+            ...(localFiles ? { attachments: coerceJson(attachmentSchema) } : {}),
         },
     }, async ({ account, to, subject, body, htmlBody, allowRawHtml, cc, replyToMessageId, replyAll, replyToThreadId, attachments }) => {
+        if (!localFiles && attachments?.length)
+            return hostFilesRefused(account, 'attachments');
         try {
             const auth = await getClientFn(account);
             const gmail = gmailClient({ version: 'v1', auth });
-            const config = (await import('../accounts.js')).getAccountSet().configs[account];
+            const config = server.accountSet().configs[account];
             if (htmlBody !== undefined) {
                 throw new GmailComposeError('E_HTMLBODY_REMOVED', 'htmlBody was removed in v6: author Markdown in `body`; for literal HTML pass `allowRawHtml: true`.');
             }

package/dist/tools/google-api.d.ts

@@ -1,10 +1,9 @@
 import type { ToolRegistry } from '../registry.js';
 import { type Policy } from '../write-control.js';
-import { getClient } from '../client.js';
 import { type Toolsets } from '../toolsets.js';
+import { type ExecuteDeps } from '../executor.js';
 import { type DiscoveryDeps, type DiscoveryMethod } from '../discovery-client.js';
-export interface EscapeDeps extends DiscoveryDeps {
-    getClientFn?: typeof getClient;
+export interface EscapeDeps extends DiscoveryDeps, ExecuteDeps {
     toolsets?: Toolsets;
 }
 /** Up to three closest known ids for the unknown_method did-you-mean hint;

package/dist/tools/google-api.js

@@ -204,6 +204,6 @@ export function registerEscapeTools(registry, policy, deps = {}) {
             pathParams: pathParams,
             queryParams: queryParams,
             body,
-        }, { getClientFn });
+        }, { getClientFn, scopeDeps: deps.scopeDeps });
     });
 }

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "mcp-google-multi",
-  "version": "6.0.0-alpha.53",
+  "version": "6.0.0-alpha.55",
   "mcpName": "io.github.bakissation/mcp-google-multi",
   "description": "Local MCP server for Google Workspace (Gmail, Drive, Calendar, Sheets, Docs, Contacts, Tasks, Meet, Search Console, +Forms/Chat/Admin) across multiple accounts — OAuth-only, encrypted token storage, deny-by-default writes.",
   "type": "module",
@@ -27,6 +27,7 @@
     "./boot-gates": "./dist/boot-gates.js",
     "./tenant-purge": "./dist/tenant-purge.js",
     "./doctor": "./dist/doctor.js",
+    "./write-control": "./dist/write-control.js",
     "./package.json": "./package.json"
   },
   "files": [