mcp-google-multi 6.0.0-alpha.56 → 6.0.0-alpha.57

package/dist/accounts.d.ts

@@ -56,6 +56,11 @@ export declare const accountAliasSchema: z.ZodType<string>;
  * permissive (same empty-safe rule as above); dispatch still resolves the
  * alias against the live registry. */
 export declare function accountArgLive(aliases: () => readonly string[]): z.ZodType<string>;
+/** The live membership check behind accountArgLive and the fan-out field;
+ * `selectors` also admits "*". An empty set stays permissive. */
+export declare function liveAccountCheck(aliases: () => readonly string[], selectors: boolean): z.core.$ZodCheck<string>;
+/** True for a field built on liveAccountCheck, optional or not. */
+export declare function isLiveAccountField(field: unknown): boolean;
 /**
  * BR-4: the stdio/http SERVER never boots with an empty registry — a fresh user
  * bootstraps via env / `migrate-config` / `account import` / `auth` first. The

package/dist/accounts.js

@@ -287,6 +287,8 @@ export const ACCOUNTS = current.aliases;
  * enum actually accepts, and naming a runtime-added alias as valid while
  * rejecting it would be a lie. */
 export function unknownAliasMessage(aliases, selectors = false) {
+    if (aliases.length === 0)
+        return 'No Google account is configured yet. Add one with account_add.';
     const all = selectors ? '; "*" for all accounts' : '';
     const csv = selectors && aliases.length > 1 ? `; or a CSV subset like "${aliases.slice(0, 2).join(',')}"` : '';
     return `Unknown account alias. Valid: ${aliases.join(', ')}${all}${csv}. Run account_list if accounts changed since this server started.`;
@@ -312,12 +314,29 @@ export const accountAliasSchema = accountAliasSchemaFor(ACCOUNTS);
  * permissive (same empty-safe rule as above); dispatch still resolves the
  * alias against the live registry. */
 export function accountArgLive(aliases) {
-    return z.string().superRefine((value, ctx) => {
+    return z.string().check(liveAccountCheck(aliases, false));
+}
+// The check instance survives the clones .describe() and .optional() make,
+// so it is what marks a field as an account selector for the registry.
+const LIVE_ACCOUNT_CHECKS = new WeakSet();
+/** The live membership check behind accountArgLive and the fan-out field;
+ * `selectors` also admits "*". An empty set stays permissive. */
+export function liveAccountCheck(aliases, selectors) {
+    const check = z.superRefine((value, ctx) => {
         const current = aliases();
-        if (current.length > 0 && !current.includes(value)) {
-            ctx.addIssue({ code: 'custom', message: unknownAliasMessage(current) });
-        }
+        if (current.length === 0 || current.includes(value) || (selectors && value === '*'))
+            return;
+        ctx.addIssue({ code: 'custom', message: unknownAliasMessage(current, selectors) });
     });
+    LIVE_ACCOUNT_CHECKS.add(check);
+    return check;
+}
+/** True for a field built on liveAccountCheck, optional or not. */
+export function isLiveAccountField(field) {
+    let def = field?._zod?.def;
+    if (def?.type === 'optional')
+        def = def.innerType?._zod?.def;
+    return def?.checks?.some((c) => LIVE_ACCOUNT_CHECKS.has(c)) ?? false;
 }
 /**
  * BR-4: the stdio/http SERVER never boots with an empty registry — a fresh user

package/dist/arg-normalize.js

@@ -1,4 +1,4 @@
-import { screenArguments, unknownArgEnvelope, } from './arg-strict.js';
+import { echoName, echoNames, screenArguments, unknownArgEnvelope, } from './arg-strict.js';
 import { sliceClean } from './trim.js';
 // The SDK synthesizes input-validation failures as isError RESULTS, skipping
 // the handler entirely: no handler of ours runs, so no envelope exists and the
@@ -116,7 +116,7 @@ export function screenMessage(msg, opts, log = (l) => process.stderr.write(`${l}
         return { action: 'forward', msg };
     const all = [...screened.unknown.map((u) => u.sent), ...screened.redundant];
     // Key names only; argument VALUES never reach the log.
-    log(`[args] ${tool}: undeclared ${all.join(', ')}${opts.mode === 'warn' ? ' (dropped)' : ' (rejected)'}`);
+    log(`[args] ${tool}: undeclared ${echoNames(all)}${opts.mode === 'warn' ? ' (dropped)' : ' (rejected)'}`);
     try {
         // Only ever a DECLARED key or the literal placeholder, so the metrics
         // closed-vocabulary rule holds: the caller's key is never persisted.
@@ -132,7 +132,7 @@ export function screenMessage(msg, opts, log = (l) => process.stderr.write(`${l}
     const siblings = screened.unknown.some((u) => u.suggestions.length > 0)
         ? []
         : (opts.siblingsFor?.(tool, screened.unknown.map((u) => u.sent)) ?? []);
-    const envelope = unknownArgEnvelope(tool, screened.unknown, declared, typeof account === 'string' ? account : undefined, siblings);
+    const envelope = unknownArgEnvelope(tool, screened.unknown, declared, typeof account === 'string' ? echoName(account) : undefined, siblings);
     return {
         action: 'reject',
         response: {

package/dist/arg-strict.d.ts

@@ -14,6 +14,13 @@ export declare const STRICT_EXEMPT_TOOLS: ReadonlySet<string>;
  * tools: no declared key starts with `_` or contains `/`, so neither rule can
  * shadow a real parameter. */
 export declare function isExemptKey(key: string): boolean;
+/** A call can carry thousands of unknown keys, or one of megabytes: only the
+ * first few earn a did-you-mean, and the log line and the envelope echo a
+ * bounded prefix of each name. The reject decision itself is never capped. */
+export declare const MAX_SUGGESTED_KEYS = 8;
+export declare function echoName(name: string): string;
+/** The first MAX_SUGGESTED_KEYS names, each capped, then "and N more". */
+export declare function echoNames(names: readonly string[], quote?: boolean): string;
 /**
  * Rank declared keys for an unknown key. Tiers, best non-empty tier wins:
  *   0 same key modulo case and separators

package/dist/arg-strict.js

@@ -9,7 +9,8 @@
 // and never touches a VALUE: it only decides that a key is undeclared, and
 // suggests what the caller probably meant. Rewriting would risk sending a real
 // value to Google on a guess, which is strictly worse than refusing.
-import { editDistance } from './scope-catalog.js';
+import { editDistance, SUGGEST_MAX_INPUT } from './scope-catalog.js';
+import { sliceClean } from './trim.js';
 /**
  * `GOOGLE_ARG_UNKNOWN`: reject | warn | off. A typo in the VALUE still falls
  * back to `warn`, not to the default: an operator who misspells the setting
@@ -59,6 +60,20 @@ export function isExemptKey(key) {
  * alone; they match far too much to be useful. */
 const GENERIC = new Set(['id', 'name', 'title', 'body', 'parent', 'text', 'content', 'type', 'value', 'key', 'data']);
 const flatten = (s) => s.toLowerCase().replace(/[^a-z0-9]/g, '');
+/** A call can carry thousands of unknown keys, or one of megabytes: only the
+ * first few earn a did-you-mean, and the log line and the envelope echo a
+ * bounded prefix of each name. The reject decision itself is never capped. */
+export const MAX_SUGGESTED_KEYS = 8;
+const MAX_ECHO_CHARS = 64;
+export function echoName(name) {
+    return name.length > MAX_ECHO_CHARS ? `${sliceClean(name, MAX_ECHO_CHARS)}...` : name;
+}
+/** The first MAX_SUGGESTED_KEYS names, each capped, then "and N more". */
+export function echoNames(names, quote = false) {
+    const shown = names.slice(0, MAX_SUGGESTED_KEYS).map((n) => (quote ? `"${echoName(n)}"` : echoName(n)));
+    const rest = names.length - shown.length;
+    return rest > 0 ? `${shown.join(', ')} and ${rest} more` : shown.join(', ');
+}
 function tokens(s) {
     return s
         .replace(/([a-z0-9])([A-Z])/g, '$1 $2')
@@ -76,6 +91,8 @@ function tokens(s) {
  * distance 6, well past any sane threshold, which is why tier 1 exists.
  */
 export function suggestKeys(unknown, declared, limit = 2) {
+    if (unknown.length > SUGGEST_MAX_INPUT)
+        return [];
     const uFlat = flatten(unknown);
     const uTok = tokens(unknown);
     const tiers = [[], [], [], []];
@@ -94,8 +111,12 @@ export function suggestKeys(unknown, declared, limit = 2) {
             tiers[2].push({ key, rank: Math.abs(kFlat.length - uFlat.length) });
             continue;
         }
+        const maxDist = Math.max(1, Math.floor(uFlat.length / 4));
+        // The distance is at least the length gap: skip the DP when that alone fails.
+        if (Math.abs(uFlat.length - kFlat.length) > maxDist)
+            continue;
         const d = editDistance(uFlat, kFlat);
-        if (d <= Math.max(1, Math.floor(uFlat.length / 4)))
+        if (d <= maxDist)
             tiers[3].push({ key, rank: d });
     }
     const tier = tiers.find((t) => t.length > 0);
@@ -117,10 +138,19 @@ export function screenArguments(tool, args, declared) {
     if (STRICT_EXEMPT_TOOLS.has(tool) || declared.length === 0)
         return out;
     const declaredSet = new Set(declared);
+    // Tier 0 (same key modulo case and separators) is a map lookup, so every key
+    // gets it and a redundant twin is recognised past the ranking budget too.
+    // A near-miss duplicate (a typo sent next to its declared key) is recognised
+    // only within the budget: a call needs 9 of them before one is refused.
+    const byFlat = new Map();
+    for (const k of declared)
+        byFlat.set(flatten(k), [...(byFlat.get(flatten(k)) ?? []), k]);
+    let ranked = 0;
     for (const key of Object.keys(args)) {
         if (declaredSet.has(key) || isExemptKey(key))
             continue;
-        const suggestions = suggestKeys(key, declared);
+        const twins = key.length <= SUGGEST_MAX_INPUT ? byFlat.get(flatten(key)) : undefined;
+        const suggestions = twins ? twins.slice(0, 2) : ranked++ < MAX_SUGGESTED_KEYS ? suggestKeys(key, declared) : [];
         // The caller sent both spellings, so the declared one already won and the
         // outcome is what it has always been. Never fail a call that works today.
         if (suggestions.some((s) => s in args)) {
@@ -133,7 +163,7 @@ export function screenArguments(tool, args, declared) {
 }
 /** The agent-facing envelope. Values are never included, only key names. */
 export function unknownArgEnvelope(tool, unknown, declared, account, siblings = []) {
-    const names = unknown.map((u) => `"${u.sent}"`).join(', ');
+    const names = echoNames(unknown.map((u) => u.sent), true);
     const accepts = `This tool accepts: ${declared.join(', ')}.`;
     const suggested = unknown.flatMap((u) => u.suggestions);
     let hint;

package/dist/compose.js

@@ -4,7 +4,7 @@
 // parsing, no process.exit, no prints (accounts.js module-load resolution is
 // the one inherited, pre-existing exception on the import chain).
 import { GENERATED_SERVICES } from './tools/generated/index.js';
-import { GENERATED_GATES, SERVICES, unknownToolMessage } from './services.js';
+import { GENERATED_GATES, SERVICES, servicesAwaitingRestart, unknownToolMessage } from './services.js';
 import { argNormalizationEnabled } from './arg-normalize.js';
 import { unknownArgMode } from './arg-strict.js';
 import { ToolRegistry } from './registry.js';
@@ -81,7 +81,7 @@ export function buildRegistry(server, ctx, mode, metrics = null) {
     // The wizard edits the owner's config.json and token store; any other
     // context has neither.
     if (owner)
-        registerAccountWizardTools(registry, server);
+        registerAccountWizardTools(registry, server, () => servicesAwaitingRestart(registry));
     return registry;
 }
 /** The per-request hooks bound to one registry: argument shapes, unknown-

package/dist/discovery-client.d.ts

@@ -49,5 +49,8 @@ export declare function loadMethodIndex(api: string, deps?: DiscoveryDeps): Prom
 export declare function clearDiscoveryMemoryCache(): void;
 export declare function cudFromMethod(method: Pick<DiscoveryMethod, 'httpMethod' | 'id'>): 'read' | 'create' | 'update' | 'delete';
 export declare function expandPath(template: string, pathParams: Record<string, string>): string;
+/** Search keywords are a few words; the caps keep a caller-sized query from
+ * driving index-size x token-count substring scans on the event loop. */
+export declare const MAX_SEARCH_QUERY = 500;
 export declare function searchMethods(index: DiscoveryMethod[], query: string, limit?: number): DiscoveryMethod[];
 export {};

package/dist/discovery-client.js

@@ -263,8 +263,13 @@ export function expandPath(template, pathParams) {
         return segments.map(encodeURIComponent).join('/');
     });
 }
+/** Search keywords are a few words; the caps keep a caller-sized query from
+ * driving index-size x token-count substring scans on the event loop. */
+export const MAX_SEARCH_QUERY = 500;
+const MAX_SEARCH_TOKENS = 16;
 export function searchMethods(index, query, limit = 10) {
-    const tokens = query.toLowerCase().split(/\s+/).filter(Boolean);
+    const words = query.slice(0, MAX_SEARCH_QUERY).toLowerCase().split(/\s+/).filter(Boolean);
+    const tokens = [...new Set(words)].slice(0, MAX_SEARCH_TOKENS);
     if (tokens.length === 0)
         return index.slice(0, limit);
     const scored = index

package/dist/fanout.d.ts

@@ -1,6 +1,14 @@
 import { z } from 'zod';
 export declare const CSV_RE: RegExp;
-export declare function fanoutAccountField(description: string, aliases: readonly string[]): z.ZodType;
+export declare function fanoutAccountField(description: string, aliases: () => readonly string[]): z.ZodType;
+/** '*' over an empty account set would fan out to nothing and report success. */
+export declare function noAccountsResult(): {
+    content: {
+        type: "text";
+        text: string;
+    }[];
+    isError: true;
+};
 export type AccountSelector = {
     ok: true;
     fanout: boolean;

package/dist/fanout.js

@@ -1,25 +1,47 @@
 import { z } from 'zod';
-import { getAccountSet, unknownAliasMessage } from './accounts.js';
+import { getAccountSet, liveAccountCheck, unknownAliasMessage } from './accounts.js';
+import { echoName, echoNames, MAX_SUGGESTED_KEYS } from './arg-strict.js';
 export const CSV_RE = /^[a-zA-Z0-9_-]+(\s*,\s*[a-zA-Z0-9_-]+)+$/;
 const FANOUT_CONCURRENCY = 5;
 // `aliases` is required (no global default): the field is baked into a
-// registry's inputSchema, so it must be built from THAT registry's account
-// set or a '*' would advertise and accept another registry's aliases.
+// registry's inputSchema, so it must read THAT registry's account set or a
+// '*' would advertise and accept another registry's aliases. It is a getter:
+// the set is read at parse time, so an alias added mid-session (account_add,
+// a tenant link) is valid on tools registered before it existed.
 export function fanoutAccountField(description, aliases) {
-    const csvExample = aliases.length > 1 ? `; or a CSV subset like "${aliases.slice(0, 2).join(',')}"` : '';
+    const boot = aliases();
+    const csvExample = boot.length > 1 ? `; or a CSV subset like "${boot.slice(0, 2).join(',')}"` : '';
     // The union's OWN error only fires when every branch aborts at the type
     // check (a non-string). For a string, zod surfaces the single non-aborted
     // branch verbatim, which is the CSV regex, so a mistyped alias used to read
     // as "Invalid string: must match pattern /^[a-zA-Z0-9_-]+(,...)/" and never
     // named an alias. Hence the same message on BOTH.
-    const bad = () => unknownAliasMessage(aliases, true);
+    const bad = () => unknownAliasMessage(aliases(), true);
     return z
-        // '*' first so the tuple is statically non-empty even when aliases is empty
-        // (a fresh install): z.enum requires [string, ...string[]].
-        .union([z.enum(['*', ...aliases]), z.string().regex(CSV_RE, { error: bad })], { error: bad })
+        // The selector branch stays first: tools/list injects the live
+        // '*' + alias enum into it (registry withLiveAccountEnum).
+        .union([z.string().check(liveAccountCheck(aliases, true)), z.string().regex(CSV_RE, { error: bad })], { error: bad })
         .optional()
         .describe(`${description}; "*" = all accounts${csvExample}; omit for the default account`);
 }
+/** '*' over an empty account set would fan out to nothing and report success. */
+export function noAccountsResult() {
+    return {
+        content: [
+            {
+                type: 'text',
+                text: JSON.stringify({
+                    error: 'validation_error',
+                    message: 'No Google account is configured, so "*" selects nothing.',
+                    hint: unknownAliasMessage([]),
+                    retriable: false,
+                    account: '*',
+                }),
+            },
+        ],
+        isError: true,
+    };
+}
 export function parseAccountSelector(value, accounts = getAccountSet().aliases) {
     if (value === '*')
         return { ok: true, fanout: true, aliases: [...accounts] };
@@ -56,10 +78,11 @@ export function invalidAccountsResult(invalid, accounts = getAccountSet().aliase
                 type: 'text',
                 text: JSON.stringify({
                     error: 'validation_error',
-                    message: `Unknown account alias(es): ${invalid.join(', ')}.`,
+                    // The caller's CSV can hold any number of tokens: echo a prefix.
+                    message: `Unknown account alias(es): ${echoNames(invalid)}.`,
                     hint: unknownAliasMessage(accounts, true),
                     retriable: false,
-                    account: invalid.join(','),
+                    account: invalid.slice(0, MAX_SUGGESTED_KEYS).map(echoName).join(','),
                 }),
             },
         ],

package/dist/http-transport.js

@@ -9,6 +9,10 @@ import { withArgNormalization, withValidationEnvelope } from './arg-normalize.js
 // serialize() lock forever. Generous by default so slow-but-valid calls (large
 // Drive exports, fan-out) still finish; the point is only to guarantee release.
 const DISPATCH_TIMEOUT_DEFAULT = 120_000;
+/** MCP 2025-06-18 dropped JSON-RPC batching, and the SDK screens every frame
+ * of a batch synchronously in one tick: without a cap one body multiplies the
+ * per-call work by however many frames fit in it. */
+const MAX_BATCH_FRAMES = 16;
 export function parseOwnerEmails(env = process.env) {
     return (env.MCP_OWNER_EMAILS ?? '')
         .split(',')
@@ -198,6 +202,9 @@ export class HttpTransportHost {
         catch (e) {
             return this.fail(res, 400, 'invalid_body', e.message);
         }
+        if (Array.isArray(body) && body.length > MAX_BATCH_FRAMES) {
+            return this.fail(res, 400, 'batch_too_large', `a JSON-RPC batch may hold at most ${MAX_BATCH_FRAMES} messages`);
+        }
         // Host/Origin are enforced by the front guard above (uniformly for /mcp and
         // the mounted AS routes), so the SDK's own DNS-rebind guard is disabled: its
         // exact-Host match is stricter than the front guard and would 403 valid

package/dist/index.js

@@ -252,6 +252,7 @@ async function main() {
         const { OAuth2Client } = await import('googleapis-common');
         const { writeToken } = await import('./token-store.js');
         const { resolveScopesForAccount } = await import('./auth.js');
+        const { ownerAuthUrlOptions } = await import('./oauth-consent.js');
         const { configDir } = await import('./config-file.js');
         const { getAccountSet } = await import('./accounts.js');
         const googleClient = () => new OAuth2Client(process.env.GOOGLE_CLIENT_ID, process.env.GOOGLE_CLIENT_SECRET, `${httpCfg.publicUrl}/callback`);
@@ -265,20 +266,7 @@ async function main() {
             masterKey: resolveMasterKeyForDispatch().key,
             refreshStorePath: path.join(configDir(), 'mcp-tokens.enc'),
         }, {
-            buildGoogleAuthUrl: ({ flow, alias, state }) => {
-                if (flow === 'alias_reauth' && alias) {
-                    const cfg = getAccountSet().configs[alias];
-                    // openid+email so /callback can bind the returned identity to the alias.
-                    return googleClient().generateAuthUrl({
-                        access_type: 'offline',
-                        prompt: 'consent',
-                        scope: [...new Set([...resolveScopesForAccount(alias), 'openid', 'email'])],
-                        login_hint: cfg?.email,
-                        state,
-                    });
-                }
-                return googleClient().generateAuthUrl({ scope: ['openid', 'email'], prompt: 'select_account', state });
-            },
+            buildGoogleAuthUrl: ({ flow, alias, state }) => googleClient().generateAuthUrl(ownerAuthUrlOptions({ flow, alias, state }, (a) => resolveScopesForAccount(a))),
             exchangeCode: async (code, flow) => {
                 const { tokens } = await googleClient().getToken(code);
                 const email = verifiedEmailFromIdToken(tokens.id_token ?? undefined);

package/dist/oauth-as.d.ts

@@ -48,9 +48,9 @@ export interface AuthServerDeps {
     /** Exchange a Google auth code at `${base}/callback` for tokens (+ owner email). */
     exchangeCode?: (code: string, flow: StatePayload['flow']) => Promise<GoogleExchangeResult>;
     /** Build the Google authorization URL (redirect back to `${base}/callback`).
-     *  The impl chooses scope/prompt/login_hint from the flow: owner_gate =
-     *  `openid email` + select_account; alias_reauth = the alias's resource scopes
-     *  + consent. */
+     *  The impl chooses scope/prompt from the flow: owner_gate = `openid email`
+     *  + select_account; alias_reauth = the alias's resource scopes + select_account
+     *  consent, and no login_hint (the link needs no authentication). */
     buildGoogleAuthUrl?: (opts: {
         flow: StatePayload['flow'];
         alias?: string;

package/dist/oauth-as.js

@@ -407,6 +407,14 @@ export function buildAuthServer(config, deps = {}) {
                 log(`alias_reauth identity mismatch for "${st.alias}" (got ${gotEmail || 'none'})`);
                 return errorPage(res, 403, 'access_denied', 'the Google account you signed in with is not the one configured for this alias');
             }
+            // A completion without a refresh token (a Google URL built without
+            // offline access, say) would replace a working credential with one that
+            // dies within the hour. Keep the stored token instead.
+            const refreshToken = exchanged.tokens.refresh_token;
+            if (typeof refreshToken !== 'string' || refreshToken === '') {
+                log(`alias_reauth for "${st.alias}" returned no refresh token; stored token kept`);
+                return errorPage(res, 400, 'E_REAUTH_INCOMPLETE', 'Google did not return a long-lived token, so the stored one was kept. Open the re-auth link again and approve access.');
+            }
             deps.writeToken?.(st.alias, exchanged.tokens);
             log(`callback ok flow=alias_reauth alias=${st.alias}`);
             res.writeHead(200, { 'Content-Type': 'text/html' });

package/dist/oauth-consent.d.ts

@@ -1,4 +1,14 @@
 import { OAuth2Client } from 'googleapis-common';
+/** Google authorize-URL options for the owner's HTTP authorization server.
+ * alias_reauth asks for the alias's scopes plus openid/email, which /callback
+ * needs to bind the returned identity to the alias. It carries no login_hint:
+ * the link works without authentication, so a hint would hand the alias's
+ * address to anyone who opens it. Every other flow is identity-only. */
+export declare function ownerAuthUrlOptions(opts: {
+    flow: string;
+    alias?: string;
+    state: string;
+}, scopesFor: (alias: string) => string[]): Parameters<OAuth2Client['generateAuthUrl']>[0];
 /** GOOGLE_CLIENT_ID/SECRET absent — caller maps to E_CLIENT_CREDENTIALS_MISSING. */
 export declare class ClientCredentialsMissingError extends Error {
     constructor();

package/dist/oauth-consent.js

@@ -7,6 +7,22 @@ import { URL } from 'node:url';
 // call forever. The listener binds an EPHEMERAL loopback port (RFC 8252 §7.3;
 // Google Desktop clients accept any http://localhost:<port> redirect), so a
 // second local process on a fixed port can never break auth.
+/** Google authorize-URL options for the owner's HTTP authorization server.
+ * alias_reauth asks for the alias's scopes plus openid/email, which /callback
+ * needs to bind the returned identity to the alias. It carries no login_hint:
+ * the link works without authentication, so a hint would hand the alias's
+ * address to anyone who opens it. Every other flow is identity-only. */
+export function ownerAuthUrlOptions(opts, scopesFor) {
+    if (opts.flow === 'alias_reauth' && opts.alias) {
+        return {
+            access_type: 'offline',
+            prompt: 'select_account consent',
+            scope: [...new Set([...scopesFor(opts.alias), 'openid', 'email'])],
+            state: opts.state,
+        };
+    }
+    return { scope: ['openid', 'email'], prompt: 'select_account', state: opts.state };
+}
 /** GOOGLE_CLIENT_ID/SECRET absent — caller maps to E_CLIENT_CREDENTIALS_MISSING. */
 export class ClientCredentialsMissingError extends Error {
     constructor() {

package/dist/registry.d.ts

@@ -38,6 +38,8 @@ export interface CatalogOperation {
      * real scope error rather than a bare "not found". */
     unreachable?: true;
 }
+/** The service a tool name belongs to: its prefix, unless overridden. */
+export declare function serviceOf(name: string): string;
 export declare function inferCud(name: string): Cud;
 export declare class ToolRegistry {
     private readonly server;

package/dist/registry.js

@@ -1,10 +1,10 @@
 import { z } from 'zod';
 import { isAllowed, writeDisabledResult, IRREVERSIBLE_TOOLS } from './write-control.js';
-import { getAccountSet, refreshAccountSetIfStale } from './accounts.js';
+import { getAccountSet, isLiveAccountField, refreshAccountSetIfStale } from './accounts.js';
 import { compactResult, trimEnabled } from './trim.js';
-import { fanoutAccountField, invalidAccountsResult, parseAccountSelector, runFanout } from './fanout.js';
+import { fanoutAccountField, invalidAccountsResult, noAccountsResult, parseAccountSelector, runFanout } from './fanout.js';
 import { MAX_RESPONSE_CHARS } from './executor.js';
-import { suggestKeys } from './arg-strict.js';
+import { MAX_SUGGESTED_KEYS, suggestKeys } from './arg-strict.js';
 import { classifyScope } from './scope-observability.js';
 /** Nothing granted, no profile: asks the BUNDLE CATALOG whether a scope is
  * reachable at all, independently of any account. */
@@ -40,6 +40,10 @@ const CUD_OVERRIDES = {
 const SERVICE_OVERRIDES = {
     reports_activities_list: 'admin',
 };
+/** The service a tool name belongs to: its prefix, unless overridden. */
+export function serviceOf(name) {
+    return Object.hasOwn(SERVICE_OVERRIDES, name) ? SERVICE_OVERRIDES[name] : name.includes('_') ? name.slice(0, name.indexOf('_')) : name;
+}
 // read tools that write local files — same savePath fanned across accounts would clobber
 const FANOUT_EXCLUDE = new Set(['gmail_download_attachment', 'drive_download', 'drive_export']);
 /** Account-management tools: the `account` they take is the SUBJECT of the
@@ -64,7 +68,11 @@ function scalarKindOf(field) {
     }
     return 'other';
 }
-function isAccountEnum(field) {
+/** A field naming one of the registry's accounts: a baked enum or a live
+ * account check (curated tools and generated tools both validate live). */
+function isAccountSelector(field) {
+    if (isLiveAccountField(field))
+        return true;
     const def = field?._zod?.def;
     if (!def)
         return false;
@@ -119,7 +127,7 @@ export class ToolRegistry {
         this.policy = policy;
         this.mode = mode;
         this.registerTool = ((name, config, handler) => {
-            const service = SERVICE_OVERRIDES[name] ?? (name.includes('_') ? name.slice(0, name.indexOf('_')) : name);
+            const service = serviceOf(name);
             const cud = config.cud ?? inferCud(name);
             // destructiveHint=false claims "additive only" (MCP spec) — updates overwrite, so they stay true.
             // idempotent: reads trivially, deletes (already-gone = same), updates
@@ -146,14 +154,16 @@ export class ToolRegistry {
             let inputShape = config.inputSchema ?? {};
             let baseHandler = handler;
             const hasAccountField = 'account' in inputShape && !DEFAULT_ACCOUNT_EXCLUDE.has(name);
-            if (cud === 'read' && !this.registeringMeta && !FANOUT_EXCLUDE.has(name) && isAccountEnum(inputShape.account)) {
+            if (cud === 'read' && !this.registeringMeta && !FANOUT_EXCLUDE.has(name) && isAccountSelector(inputShape.account)) {
                 const description = inputShape.account.description ?? 'Google account alias';
-                inputShape = { ...inputShape, account: fanoutAccountField(description, this.accounts().aliases) };
+                inputShape = { ...inputShape, account: fanoutAccountField(description, () => this.accounts().aliases) };
                 baseHandler = async (...args) => {
                     const first = args[0];
                     const parsed = parseAccountSelector(typeof first?.account === 'string' ? first.account : '', this.accounts().aliases);
                     if (!parsed.ok)
                         return invalidAccountsResult(parsed.invalid, this.accounts().aliases);
+                    if (parsed.aliases.length === 0)
+                        return noAccountsResult();
                     if (!parsed.fanout)
                         return handler({ ...first, account: parsed.aliases[0] }, ...args.slice(1));
                     return runFanout(handler, args, parsed.aliases);
@@ -309,7 +319,7 @@ export class ToolRegistry {
         // case (parentId against parentFolderId) fails containment and edit
         // distance alike, which is the whole reason that matcher exists.
         const keys = candidates.map(([key]) => key);
-        const hits = new Set(unknownKeys.flatMap((k) => suggestKeys(k, keys)));
+        const hits = new Set(unknownKeys.slice(0, MAX_SUGGESTED_KEYS).flatMap((k) => suggestKeys(k, keys)));
         return candidates
             .filter(([key]) => hits.has(key))
             .slice(0, 2)
@@ -478,11 +488,12 @@ export class ToolRegistry {
         if (aliases.length === 0)
             return schema;
         if (Array.isArray(account.anyOf)) {
-            // fan-out union: refresh the enum branch ('*' + aliases), keep the CSV branch
-            const hasEnumBranch = account.anyOf.some((b) => Array.isArray(b.enum));
-            if (!hasEnumBranch)
+            // fan-out union: advertise '*' + the live aliases on the selector branch
+            // (the one without the CSV pattern), keep the CSV branch as is
+            const isSelector = (b) => b.pattern === undefined;
+            if (!account.anyOf.some(isSelector))
                 return schema;
-            const anyOf = account.anyOf.map((b) => (Array.isArray(b.enum) ? { ...b, enum: ['*', ...aliases] } : b));
+            const anyOf = account.anyOf.map((b) => (isSelector(b) ? { ...b, enum: ['*', ...aliases] } : b));
             return { ...s, properties: { ...s.properties, account: { ...account, anyOf } } };
         }
         return { ...s, properties: { ...s.properties, account: { ...account, enum: [...aliases] } } };

package/dist/scope-catalog.d.ts

@@ -20,4 +20,12 @@ export declare function isKnownBundle(name: string): boolean;
 export declare function resolveBundleAliases(bundles: string[]): string[];
 /** Closest catalog key for E_UNKNOWN_BUNDLE remediation (edit distance <= 2). */
 export declare function closestBundle(name: string): string | undefined;
+/** Longest input any did-you-mean compares. Every name it suggests (tool,
+ * argument key, bundle, Discovery method id) is far shorter, and the inputs
+ * are caller-controlled: an unbounded comparison let one oversized name block
+ * the event loop for minutes. */
+export declare const SUGGEST_MAX_INPUT = 128;
+/** Levenshtein distance. Past SUGGEST_MAX_INPUT it returns the longer length
+ * without comparing: an upper bound on the true distance, and above every
+ * caller's accept threshold, so a capped pair is never suggested. */
 export declare function editDistance(a: string, b: string): number;

package/dist/scope-catalog.js

@@ -182,6 +182,8 @@ export function closestBundle(name) {
     let best;
     let bestDist = 3;
     for (const key of Object.keys(BUNDLE_CATALOG)) {
+        if (Math.abs(name.length - key.length) >= bestDist)
+            continue;
         const d = editDistance(name.toLowerCase(), key);
         if (d < bestDist) {
             bestDist = d;
@@ -190,14 +192,24 @@ export function closestBundle(name) {
     }
     return best;
 }
+/** Longest input any did-you-mean compares. Every name it suggests (tool,
+ * argument key, bundle, Discovery method id) is far shorter, and the inputs
+ * are caller-controlled: an unbounded comparison let one oversized name block
+ * the event loop for minutes. */
+export const SUGGEST_MAX_INPUT = 128;
+/** Levenshtein distance. Past SUGGEST_MAX_INPUT it returns the longer length
+ * without comparing: an upper bound on the true distance, and above every
+ * caller's accept threshold, so a capped pair is never suggested. */
 export function editDistance(a, b) {
-    const dp = Array.from({ length: a.length + 1 }, (_, i) => [i, ...Array(b.length).fill(0)]);
-    for (let j = 1; j <= b.length; j++)
-        dp[0][j] = j;
+    if (a.length > SUGGEST_MAX_INPUT || b.length > SUGGEST_MAX_INPUT)
+        return Math.max(a.length, b.length);
+    let prev = Array.from({ length: b.length + 1 }, (_, j) => j);
     for (let i = 1; i <= a.length; i++) {
+        const row = [i];
         for (let j = 1; j <= b.length; j++) {
-            dp[i][j] = Math.min(dp[i - 1][j] + 1, dp[i][j - 1] + 1, dp[i - 1][j - 1] + (a[i - 1] === b[j - 1] ? 0 : 1));
+            row[j] = Math.min(prev[j] + 1, row[j - 1] + 1, prev[j - 1] + (a[i - 1] === b[j - 1] ? 0 : 1));
         }
+        prev = row;
     }
-    return dp[a.length][b.length];
+    return prev[b.length];
 }

package/dist/services.d.ts

@@ -1,6 +1,6 @@
 import type { AccountSet } from './accounts.js';
 import type { CuratedToolDeps } from './client.js';
-import type { ToolRegistry } from './registry.js';
+import { type ToolRegistry } from './registry.js';
 export interface ServiceEntry {
     name: string;
     register: (registry: ToolRegistry, deps?: CuratedToolDeps) => void;
@@ -14,11 +14,11 @@ export declare const GENERATED_GATES: Record<string, {
     enabled: (set?: AccountSet) => boolean;
     hint: string;
 }>;
+export declare function unknownToolMessage(registry: ToolRegistry, rawName: string): string;
 /**
- * Message for a `tools/call` naming a tool that is not registered. The SDK's
- * own answer is a bare "Tool X not found", which reads identically for a typo,
- * for a service gated behind a scope bundle, and for an API this server has
- * never heard of. Those need different next steps, and the server knows which
- * is which: it composed the enabled-service list at boot.
+ * Gated services the registry's CURRENT accounts enable but that registered
+ * nothing: an account added mid-session unlocked them after buildRegistry
+ * decided the gates. Mirrors compose.ts gate for gate, so an ungated or
+ * toolset-excluded service is never reported.
  */
-export declare function unknownToolMessage(registry: ToolRegistry, name: string): string;
+export declare function servicesAwaitingRestart(registry: ToolRegistry): string[];