mcp-google-multi 6.0.0-alpha.57 → 6.0.0-alpha.59

package/dist/fs-atomic.d.ts

@@ -1,3 +1,14 @@
+/** Which process instance holds a lock: PID namespace id, start time in
+ * clock ticks since boot, and a boot id prefix. A part this process cannot
+ * read is `host` or `0` (all three without /proc). */
+interface LockIdentity {
+    ns: string;
+    start: string;
+    boot: string;
+}
+/** Test hook: act as a process with this identity (undefined restores the real one). */
+export declare function __setLockIdentityForTest(identity?: LockIdentity): void;
 export declare function withFileLock<T>(absPath: string, fn: () => T, label?: string): T;
 export declare function atomicWriteFileSync(absPath: string, contents: string, mode?: number): void;
 export declare function atomicWriteWithLock(absPath: string, contents: string, mode?: number): void;
+export {};

package/dist/fs-atomic.js

@@ -5,23 +5,216 @@ const LOCK_TIMEOUT_MS = 5_000;
 const LOCK_RETRY_MS = 10;
 const RENAME_ATTEMPTS = 5;
 const RENAME_RETRY_MS = 20;
+// A holder this process cannot identify (another PID namespace, another boot,
+// or no /proc) is dead only once its lock is this old.
+const LOCK_LEASE_MS = 60_000;
+// Breaking a lock takes microseconds, so an older breaker file was left by a crash.
+const BREAKER_STALE_MS = 2_000;
+const PROCESS_START_MS = performance.timeOrigin;
+const OWNER_NAME = /^(\d+)\.(\d+|host)\.(\d+)\.([0-9a-f]{8}|0)\.[0-9a-f]{12}\.owner$/;
+function startOf(pid) {
+    try {
+        const stat = fs.readFileSync(`/proc/${pid}/stat`, 'utf8');
+        const start = stat.slice(stat.lastIndexOf(')') + 2).split(' ')[19];
+        return /^\d+$/.test(start ?? '') ? start : undefined;
+    }
+    catch {
+        return undefined;
+    }
+}
+function selfIdentity() {
+    const identity = { ns: 'host', start: '0', boot: '0' };
+    try {
+        identity.ns = /^pid:\[(\d+)\]$/.exec(fs.readlinkSync('/proc/self/ns/pid'))?.[1] ?? 'host';
+    }
+    catch {
+        // no /proc
+    }
+    try {
+        const boot = fs.readFileSync('/proc/sys/kernel/random/boot_id', 'utf8').replace(/[^0-9a-f]/g, '').slice(0, 8);
+        if (boot.length === 8)
+            identity.boot = boot;
+    }
+    catch {
+        // no /proc
+    }
+    try {
+        // A /proc mounted for another PID namespace describes other processes,
+        // so no pid can be looked up in it.
+        if (fs.readlinkSync('/proc/self') === String(process.pid))
+            identity.start = startOf('self') ?? '0';
+    }
+    catch {
+        // no /proc
+    }
+    return identity;
+}
+let SELF = selfIdentity();
+/** Test hook: act as a process with this identity (undefined restores the real one). */
+export function __setLockIdentityForTest(identity) {
+    SELF = identity ?? selfIdentity();
+}
 function sleep(ms) {
     Atomics.wait(new Int32Array(new SharedArrayBuffer(4)), 0, 0, ms);
 }
+function sameFile(a, b) {
+    return a.ino === b.ino && a.dev === b.dev;
+}
+function isEnoent(error) {
+    return error.code === 'ENOENT';
+}
+// Undefined when the lock changed hands while it was being read.
+function readHolder(lock) {
+    const before = fs.lstatSync(lock, { bigint: true });
+    const body = before.isFile() ? fs.readFileSync(lock, 'utf8') : '';
+    let owner;
+    if (before.isFile()) {
+        const dir = path.dirname(lock);
+        const prefix = `${path.basename(lock)}.`;
+        for (const name of fs.readdirSync(dir)) {
+            if (!name.startsWith(prefix))
+                continue;
+            const m = OWNER_NAME.exec(name.slice(prefix.length));
+            if (!m || m[1] !== body)
+                continue;
+            const ownerPath = path.join(dir, name);
+            try {
+                if (sameFile(fs.lstatSync(ownerPath, { bigint: true }), before)) {
+                    owner = { path: ownerPath, ns: m[2], start: m[3], boot: m[4] };
+                    break;
+                }
+            }
+            catch (error) {
+                if (!isEnoent(error))
+                    throw error;
+            }
+        }
+    }
+    const after = fs.lstatSync(lock, { bigint: true });
+    if (!sameFile(before, after))
+        return undefined;
+    return { body, ino: after.ino, dev: after.dev, mtimeNs: after.mtimeNs, mtimeMs: Number(after.mtimeNs) / 1e6, owner };
+}
+// The owner file's random name tells two holders apart even when the second
+// lock reuses the first one's freed inode.
+function sameHolder(a, b) {
+    return sameFile(a, b) && a.body === b.body && a.mtimeNs === b.mtimeNs && a.owner?.path === b.owner?.path;
+}
+function probeDead(pid) {
+    try {
+        process.kill(pid, 0);
+        return false;
+    }
+    catch (error) {
+        const code = error.code;
+        // EPERM: PID exists but is not signalable (another user's process).
+        if (code === 'ESRCH')
+            return true;
+        if (code !== 'EPERM')
+            throw error;
+        return false;
+    }
+}
+function holderDead(holder, now) {
+    const pid = Number(holder.body);
+    if (!(Number.isSafeInteger(pid) && pid > 0))
+        return true;
+    const leaseOver = now - holder.mtimeMs >= LOCK_LEASE_MS;
+    const owner = holder.owner;
+    // No owner file: an older writer, whose namespace is unknown.
+    if (!owner)
+        return probeDead(pid) || leaseOver;
+    if (owner.ns !== SELF.ns || owner.boot !== SELF.boot)
+        return leaseOver;
+    // Two unreadable parts compare equal without naming the same namespace or
+    // boot, so only a fully known identity is looked up by start time.
+    if (SELF.ns !== 'host' && SELF.boot !== '0' && SELF.start !== '0' && owner.start !== '0') {
+        // A live namespace id is never shared, so the recorded pid is ours to
+        // look up: a restarted container reuses both the id and the pid, but not
+        // the start time.
+        const start = startOf(pid);
+        if (start !== undefined)
+            return start !== owner.start;
+        return probeDead(pid) || leaseOver;
+    }
+    if (pid === process.pid)
+        return holder.mtimeMs < PROCESS_START_MS;
+    return probeDead(pid) || leaseOver;
+}
+// One waiter at a time breaks a dead lock: two breakers could otherwise both
+// see the dead holder, and the second would unlink the first one's new lock.
+// False when another waiter is breaking it.
+function breakLock(lock, holder) {
+    const breaker = `${lock}.break`;
+    // A token, not the inode: a breaker created after ours was removed can
+    // get our freed inode.
+    const token = `${process.pid}.${randomBytes(6).toString('hex')}`;
+    try {
+        fs.writeFileSync(breaker, token, { mode: 0o600, flag: 'wx' });
+    }
+    catch (error) {
+        if (error.code !== 'EEXIST')
+            throw error;
+        clearStaleBreaker(breaker);
+        return false;
+    }
+    try {
+        const current = readHolder(lock);
+        if (current && sameHolder(current, holder)) {
+            fs.rmSync(lock, { force: true });
+            if (holder.owner)
+                fs.rmSync(holder.owner.path, { force: true });
+        }
+    }
+    catch (error) {
+        if (!isEnoent(error))
+            throw error;
+    }
+    finally {
+        releaseBreaker(breaker, token);
+    }
+    return true;
+}
+// A symlink, or a breaker dated the other side of a clock step, would
+// otherwise block every break.
+function clearStaleBreaker(breaker) {
+    try {
+        const st = fs.lstatSync(breaker);
+        if (!st.isFile() || Math.abs(Date.now() - st.mtimeMs) >= BREAKER_STALE_MS)
+            fs.rmSync(breaker, { force: true });
+    }
+    catch (error) {
+        if (!isEnoent(error))
+            throw error;
+    }
+}
+function releaseBreaker(breaker, token) {
+    try {
+        if (fs.readFileSync(breaker, 'utf8') === token)
+            fs.rmSync(breaker, { force: true });
+    }
+    catch (error) {
+        if (!isEnoent(error))
+            throw error;
+    }
+}
 // Hardlink-based advisory lock, generalized path-keyed from the token store's
-// alias-keyed original (same mechanics: dead-owner recovery via signal-0 probe,
-// EPERM = alive, corrupt lock content recovered as dead, 5s timeout).
+// alias-keyed original. The lock body is the bare pid, as older readers expect;
+// the owner file stays linked while held and names the holder's process
+// instance. See docs/internals.md.
 export function withFileLock(absPath, fn, label = `lock: ${absPath}`) {
     const dir = path.dirname(absPath);
     const lock = path.join(dir, `.${path.basename(absPath)}.lock`);
-    const ownerFile = `${lock}.${process.pid}.${randomBytes(6).toString('hex')}.owner`;
+    const ownerFile = `${lock}.${process.pid}.${SELF.ns}.${SELF.start}.${SELF.boot}.${randomBytes(6).toString('hex')}.owner`;
     fs.mkdirSync(dir, { recursive: true, mode: 0o700 });
     fs.writeFileSync(ownerFile, String(process.pid), { mode: 0o600, flag: 'wx' });
     const deadline = Date.now() + LOCK_TIMEOUT_MS;
+    let linked = false;
     try {
         while (true) {
             try {
                 fs.linkSync(ownerFile, lock);
+                linked = true;
                 break;
             }
             catch (error) {
@@ -29,33 +222,13 @@ export function withFileLock(absPath, fn, label = `lock: ${absPath}`) {
                 if (err.code !== 'EEXIST')
                     throw error;
                 try {
-                    const observedOwner = fs.readFileSync(lock, 'utf8');
-                    const owner = Number(observedOwner);
-                    let ownerDead = !(Number.isSafeInteger(owner) && owner > 0);
-                    if (!ownerDead) {
-                        try {
-                            process.kill(owner, 0);
-                        }
-                        catch (ownerError) {
-                            const code = ownerError.code;
-                            // EPERM: PID exists but is not signalable (recycled by another
-                            // user); treat as alive, never break a lock we cannot verify.
-                            if (code === 'ESRCH')
-                                ownerDead = true;
-                            else if (code !== 'EPERM')
-                                throw ownerError;
-                        }
-                    }
-                    if (ownerDead) {
-                        if (fs.readFileSync(lock, 'utf8') === observedOwner)
-                            fs.rmSync(lock, { force: true });
+                    const holder = readHolder(lock);
+                    if (holder && holderDead(holder, Date.now()) && breakLock(lock, holder))
                         continue;
-                    }
                 }
                 catch (readError) {
-                    if (readError.code === 'ENOENT') {
+                    if (isEnoent(readError))
                         continue;
-                    }
                     throw readError;
                 }
                 if (Date.now() >= deadline) {
@@ -66,14 +239,32 @@ export function withFileLock(absPath, fn, label = `lock: ${absPath}`) {
         }
     }
     finally {
-        fs.rmSync(ownerFile, { force: true });
+        if (!linked)
+            fs.rmSync(ownerFile, { force: true });
     }
+    let bound = false;
     try {
+        // Some network and FUSE filesystems give each name of one file its own
+        // inode number; there the owner file cannot vouch for the lock.
+        bound = sameFile(fs.lstatSync(ownerFile, { bigint: true }), fs.lstatSync(lock, { bigint: true }));
         return fn();
     }
     finally {
-        fs.rmSync(lock, { force: true });
+        releaseLock(lock, ownerFile, bound);
+    }
+}
+// A holder whose lock was broken (its owner file removed with it) must not
+// remove its successor's lock.
+function releaseLock(lock, ownerFile, bound) {
+    try {
+        if (!bound || sameFile(fs.lstatSync(ownerFile, { bigint: true }), fs.lstatSync(lock, { bigint: true })))
+            fs.rmSync(lock, { force: true });
+    }
+    catch (error) {
+        if (!isEnoent(error))
+            throw error;
     }
+    fs.rmSync(ownerFile, { force: true });
 }
 export function atomicWriteFileSync(absPath, contents, mode = 0o600) {
     const dir = path.dirname(absPath);

package/dist/index.js

@@ -250,9 +250,10 @@ async function main() {
         const { jwtSecretFrom } = await import('./mcp-token.js');
         const { resolveJwtKey, resolveMasterKeyForDispatch } = await import('./master-key.js');
         const { OAuth2Client } = await import('googleapis-common');
-        const { writeToken } = await import('./token-store.js');
+        const { readToken, writeToken } = await import('./token-store.js');
         const { resolveScopesForAccount } = await import('./auth.js');
         const { ownerAuthUrlOptions } = await import('./oauth-consent.js');
+        const { scopeGrantDiff, setWizardHttpConsent } = await import('./tools/account-wizard.js');
         const { configDir } = await import('./config-file.js');
         const { getAccountSet } = await import('./accounts.js');
         const googleClient = () => new OAuth2Client(process.env.GOOGLE_CLIENT_ID, process.env.GOOGLE_CLIENT_SECRET, `${httpCfg.publicUrl}/callback`);
@@ -275,19 +276,25 @@ async function main() {
                 return { tokens: flow === 'owner_gate' ? {} : tokens, email };
             },
             writeToken: (alias, tokens) => writeToken(alias, tokens),
+            missingScopes: (alias, granted) => scopeGrantDiff(resolveScopesForAccount(alias), granted),
+            hasToken: (alias) => {
+                try {
+                    return readToken(alias) != null;
+                }
+                catch {
+                    return false; // undecryptable: nothing usable to keep
+                }
+            },
             aliasEmail: (alias) => getAccountSet().configs[alias]?.email,
             log: (l) => process.stderr.write(`[as] ${l}\n`),
         });
-        // BV-1: over HTTP, a dead/missing per-account token surfaces a clickable
-        // re-auth link into the AS's alias_reauth flow instead of a stdio CLI hint.
-        const { setHttpReauthBase } = await import('./reauth-hint.js');
-        setHttpReauthBase(httpCfg.publicUrl);
-        // Wizard consent over HTTP: hand out the clientless AS link instead of
+        // BV-1: over HTTP, a dead/missing per-account token surfaces a clickable,
+        // signed re-auth link into the AS's alias_reauth flow instead of a CLI hint.
+        const { setHttpReauthLink } = await import('./reauth-hint.js');
+        setHttpReauthLink((alias) => authServer.reauthLink(alias));
+        // Wizard consent over HTTP: hand out the same signed link instead of
         // binding a loopback listener.
-        const { setWizardHttpConsent } = await import('./tools/account-wizard.js');
-        setWizardHttpConsent({
-            mintConsentUrl: (alias) => `${httpCfg.publicUrl}/authorize?flow=alias_reauth&alias=${encodeURIComponent(alias)}`,
-        });
+        setWizardHttpConsent({ mintConsentUrl: (alias) => authServer.reauthLink(alias) });
         let httpTap;
         if (httpMetrics) {
             const { tapUsageMetrics } = await import('./metrics-tap.js');

package/dist/mcp-token.d.ts

@@ -46,6 +46,18 @@ export declare function signState(payload: StatePayload, base: string, secret: U
 export declare function verifyState(token: string, base: string, secret: Uint8Array): Promise<StatePayload & {
     jti: string;
 }>;
+/** A re-auth link is handed out in a tool error, so it has to survive until
+ * the user clicks it; an hour, not the 10-minute state TTL. */
+export declare const REAUTH_LINK_TTL_SEC = 3600;
+/** Query string of a server-issued alias_reauth link: the alias, an expiry and
+ * an HMAC over both. Synchronous, so the error hints that carry it stay so. */
+export declare function signReauthLink(base: string, secret: Uint8Array, alias: string, nowSec: number): string;
+/** The alias a link was issued for, or null when it is missing, forged or expired. */
+export declare function verifyReauthLink(base: string, secret: Uint8Array, params: {
+    alias: string;
+    exp: string;
+    sig: string;
+}, nowSec: number): string | null;
 /** A pending-authorization artifact for the DCR consent interstitial (same
  * shape as `state`, distinct purpose so the two can't be confused). */
 export declare function signPending(payload: StatePayload, base: string, secret: Uint8Array, iat: number, ttlSec?: number): Promise<string>;

package/dist/mcp-token.js

@@ -3,7 +3,7 @@
 // `state` and authorization code, the in-memory single-use replay guard, and
 // the opaque rotated refresh-token store. Keyed by the provisioned MCP_JWT_KEY
 // (B5), so tokens survive a restart as long as the key persists.
-import { randomBytes } from 'node:crypto';
+import { createHmac, randomBytes, timingSafeEqual } from 'node:crypto';
 import { existsSync, readFileSync } from 'node:fs';
 import { SignJWT, jwtVerify } from 'jose';
 import { deriveKey, encryptToken, decryptToken } from './token-store.js';
@@ -59,6 +59,30 @@ export function signState(payload, base, secret, iat, ttlSec = STATE_TTL_DEFAULT
 export async function verifyState(token, base, secret) {
     return (await verifyArtifact(token, 'mcp_state', base, secret));
 }
+// --- alias_reauth link -------------------------------------------------------
+/** A re-auth link is handed out in a tool error, so it has to survive until
+ * the user clicks it; an hour, not the 10-minute state TTL. */
+export const REAUTH_LINK_TTL_SEC = 3600;
+function reauthMac(base, secret, alias, exp) {
+    // The newline-separated input can never be a JWT signing input (two
+    // base64url segments and one dot), so the shared key stays unambiguous.
+    return createHmac('sha256', secret).update(`alias_reauth\n${base}\n${alias}\n${exp}`).digest();
+}
+/** Query string of a server-issued alias_reauth link: the alias, an expiry and
+ * an HMAC over both. Synchronous, so the error hints that carry it stay so. */
+export function signReauthLink(base, secret, alias, nowSec) {
+    const exp = nowSec + REAUTH_LINK_TTL_SEC;
+    return `alias=${encodeURIComponent(alias)}&exp=${exp}&sig=${reauthMac(base, secret, alias, exp).toString('base64url')}`;
+}
+/** The alias a link was issued for, or null when it is missing, forged or expired. */
+export function verifyReauthLink(base, secret, params, nowSec) {
+    const exp = Number(params.exp);
+    if (!params.alias || !/^\d+$/.test(params.exp) || exp < nowSec)
+        return null;
+    const want = reauthMac(base, secret, params.alias, exp);
+    const got = Buffer.from(params.sig, 'base64url');
+    return got.length === want.length && timingSafeEqual(got, want) ? params.alias : null;
+}
 /** A pending-authorization artifact for the DCR consent interstitial (same
  * shape as `state`, distinct purpose so the two can't be confused). */
 export function signPending(payload, base, secret, iat, ttlSec = STATE_TTL_DEFAULT) {

package/dist/oauth-as.d.ts

@@ -6,6 +6,10 @@ export declare const DCR_MAX_REDIRECT_URIS = 10;
 export interface GoogleExchangeResult {
     tokens: Record<string, unknown>;
     email?: string;
+    /** Google's stable account id; unlike the address it is never reassigned. */
+    sub?: string;
+    /** Google Workspace hosted domain; absent for a consumer account. */
+    hd?: string;
 }
 export interface AuthServerConfig {
     base: string;
@@ -16,10 +20,10 @@ export interface AuthServerConfig {
     accessTtlSec?: number;
     masterKey: string;
     refreshStorePath: string;
-    /** Default true. The clientless alias-only `flow=alias_reauth` link carries
+    /** Default true. The clientless `flow=alias_reauth` link names an alias with
      * no tenant binding, so a multi-tenant deployment sets false: with several
      * tenants an alias name alone is ambiguous and the branch becomes a
-     * cross-tenant re-auth vector. Server-minted signed flows are unaffected. */
+     * cross-tenant re-auth vector. Server-minted alias_add flows are unaffected. */
     legacyAliasReauth?: boolean;
 }
 /** What /callback hands the alias_add binder once Google returned a verified
@@ -31,6 +35,7 @@ export interface TenantAliasBind {
     bundles?: string[];
     nonce?: string;
     tokens: Record<string, unknown>;
+    sub?: string;
 }
 /** A binder's deliberate refusal (policy, not failure): /callback answers 403
  * with this slug and message. The message reaches an unauthenticated browser. */
@@ -40,8 +45,15 @@ export interface AliasBindRefusal {
         message: string;
     };
 }
-/** Only trust the id_token email when Google marks it verified (#8). The token
- * comes straight from Google's token endpoint, so its claims are read unsigned. */
+export interface GoogleIdentity {
+    email?: string;
+    sub?: string;
+    hd?: string;
+}
+/** Only trust the id_token identity when Google marks the email verified (#8).
+ * The token comes straight from Google's token endpoint, so its claims are
+ * read unsigned. A malformed sub or hd is dropped, never passed on. */
+export declare function verifiedIdentityFromIdToken(idToken?: string | null): GoogleIdentity | undefined;
 export declare function verifiedEmailFromIdToken(idToken?: string | null): string | undefined;
 export interface AuthServerDeps {
     fetchCimd?: (clientId: string) => Promise<Record<string, unknown>>;
@@ -58,6 +70,12 @@ export interface AuthServerDeps {
         bundles?: string[];
     }) => string;
     writeToken?: (alias: string, tokens: Record<string, unknown>) => void;
+    /** Scopes the alias asked for that `grantedScope` lacks, so the alias_reauth
+     * completion page can say what Google's granular consent left out. */
+    missingScopes?: (alias: string, grantedScope: string | undefined) => string[];
+    /** Whether a readable token is stored for the alias; a narrower re-auth
+     * grant keeps it rather than replace it. */
+    hasToken?: (alias: string) => boolean;
     registeredClients?: Map<string, {
         redirect_uris: string[];
     }>;
@@ -70,8 +88,14 @@ export interface AuthServerDeps {
     aliasEmail?: (alias: string) => string | undefined;
     /** Map a verified sign-in email to the subject its tokens are minted under.
      * Default = the MCP_OWNER_EMAILS allowlist -> {sub:'owner'}; null = denied.
-     * The tenant resolver (invite claim / email->tenant lookup) plugs in here. */
-    resolveSubject?: (email: string) => {
+     * The tenant resolver (invite claim / email->tenant lookup) plugs in here.
+     * `identity` carries Google's `sub` and `hd` when the exchange returned
+     * them, so a resolver can key on the stable account id rather than an
+     * address that can be reassigned. */
+    resolveSubject?: (email: string, identity?: {
+        sub?: string;
+        hd?: string;
+    }) => {
         sub: string;
     } | null;
     /** alias_add completion: persist the new alias's config row and tokens under
@@ -88,12 +112,17 @@ export interface AuthServer {
      * INSIDE the signed state, so nothing at /authorize or /callback trusts a
      * caller-supplied identity. Inert unless something calls it. */
     mintFlowState: (opts: {
-        flow: 'alias_add' | 'alias_reauth';
+        flow: 'alias_add';
         alias: string;
         tenantId?: string;
         bundles?: string[];
         nonce?: string;
     }) => Promise<string>;
+    /** The owner's re-auth link for `alias`: HMAC-signed, expiring, not single
+     * use (a chat client may prefetch it). /authorize refuses any alias_reauth
+     * request without a valid one, so an unauthenticated caller can neither
+     * start a re-auth nor learn which aliases exist or what they hold. */
+    reauthLink: (alias: string) => string;
 }
 /** C6: exact redirect_uri match, with RFC 8252 §7.3 port-agnostic loopback and
  *  the fixed claude.ai callback. */

package/dist/oauth-as.js

@@ -7,7 +7,7 @@
 // whole surface is exercised by an offline harness.
 import { createHash, randomBytes } from 'node:crypto';
 import { isIPv4 } from 'node:net';
-import { signAccessToken, verifyAccessToken, signState, verifyState, signAuthzCode, verifyAuthzCode, signPending, verifyPending, ReplayGuard, RefreshStore, STATE_TTL_DEFAULT, CODE_TTL_DEFAULT, ACCESS_TTL_DEFAULT, } from './mcp-token.js';
+import { signAccessToken, verifyAccessToken, signState, verifyState, signAuthzCode, verifyAuthzCode, signReauthLink, verifyReauthLink, signPending, verifyPending, ReplayGuard, RefreshStore, STATE_TTL_DEFAULT, CODE_TTL_DEFAULT, ACCESS_TTL_DEFAULT, } from './mcp-token.js';
 import { fetchCimdDocument, SsrfBlockedError } from './ssrf-guard.js';
 const CLAUDE_AI_FIXED_CALLBACK = 'https://claude.ai/api/mcp/auth_callback';
 // DCR (/register) is public + unauthenticated, so its in-memory store must be
@@ -17,21 +17,34 @@ const CLAUDE_AI_FIXED_CALLBACK = 'https://claude.ai/api/mcp/auth_callback';
 export const DCR_MAX_CLIENTS = 1000;
 export const DCR_MAX_REDIRECT_URIS = 10;
 const DCR_MAX_URI_LEN = 2048;
-/** Only trust the id_token email when Google marks it verified (#8). The token
- * comes straight from Google's token endpoint, so its claims are read unsigned. */
-export function verifiedEmailFromIdToken(idToken) {
+const OIDC_SUB = /^[\x21-\x7e]{1,255}$/;
+const HOSTED_DOMAIN = /^[a-z0-9-]+(\.[a-z0-9-]+)+$/i;
+/** Only trust the id_token identity when Google marks the email verified (#8).
+ * The token comes straight from Google's token endpoint, so its claims are
+ * read unsigned. A malformed sub or hd is dropped, never passed on. */
+export function verifiedIdentityFromIdToken(idToken) {
     if (!idToken)
         return undefined;
     try {
         const [, payload] = idToken.split('.');
         const claims = JSON.parse(Buffer.from(payload, 'base64url').toString('utf-8'));
         const verified = claims.email_verified === true || claims.email_verified === 'true';
-        return verified ? claims.email : undefined;
+        if (!verified)
+            return undefined;
+        const identity = { email: claims.email };
+        if (typeof claims.sub === 'string' && OIDC_SUB.test(claims.sub))
+            identity.sub = claims.sub;
+        if (typeof claims.hd === 'string' && claims.hd.length <= 253 && HOSTED_DOMAIN.test(claims.hd))
+            identity.hd = claims.hd;
+        return identity;
     }
     catch {
         return undefined;
     }
 }
+export function verifiedEmailFromIdToken(idToken) {
+    return verifiedIdentityFromIdToken(idToken)?.email;
+}
 // --- helpers ----------------------------------------------------------------
 function json(res, status, body, extraHeaders = {}) {
     res.writeHead(status, { 'Content-Type': 'application/json', ...extraHeaders });
@@ -240,6 +253,11 @@ export function buildAuthServer(config, deps = {}) {
             catch {
                 return errorPage(res, 400, 'E_STATE_INVALID', 'the approval is invalid or expired');
             }
+            // Only the client leg signs pendings, and it is always the owner sign-in;
+            // a pending signed before that rule (flow=alias_reauth) is refused here.
+            if (pending.flow !== 'owner_gate') {
+                return errorPage(res, 400, 'E_STATE_INVALID', 'the approval is invalid or expired');
+            }
             if (!replay.consume(pending.jti, STATE_TTL_DEFAULT * 1000, now())) {
                 return errorPage(res, 400, 'E_STATE_INVALID', 'this approval was already used');
             }
@@ -280,17 +298,20 @@ export function buildAuthServer(config, deps = {}) {
         // In-call re-auth (BV-1): a user-clicked `flow=alias_reauth` link has NO
         // client leg — no code is delivered to any client, the refreshed token is
         // written server-side for the alias — so it skips the client_id/redirect/
-        // PKCE requirements. Safe because /callback binds the completing Google
-        // identity to the alias's configured email before writing anything.
-        if (q.get('flow') === 'alias_reauth' && aliasParam && !clientId) {
+        // PKCE requirements. The link must be one this server signed (reauthLink),
+        // and /callback still binds the completing identity to the alias's email.
+        if (q.get('flow') === 'alias_reauth' && !clientId) {
             if (config.legacyAliasReauth === false) {
                 // Alias-only, tenant-ambiguous: disabled on multi-tenant deployments.
                 return errorPage(res, 403, 'E_LEGACY_REAUTH_DISABLED', 'alias re-auth links are disabled on this deployment; ask the server for a fresh account link');
             }
-            if (!deps.aliasEmail?.(aliasParam)) {
-                return errorPage(res, 400, 'invalid_request', `unknown account "${aliasParam}"`);
+            const alias = verifyReauthLink(base, secret, { alias: aliasParam ?? '', exp: q.get('exp') ?? '', sig: q.get('sig') ?? '' }, nowSec());
+            // One answer for an unsigned, forged, expired or stale link, so a
+            // request the server did not issue learns nothing about its aliases.
+            if (!alias || !deps.aliasEmail?.(alias)) {
+                return errorPage(res, 400, 'E_STATE_INVALID', 'this re-auth link is invalid or expired; ask the server for a fresh one');
             }
-            return toGoogle(res, { flow: 'alias_reauth', client_id: '', redirect_uri: '', code_challenge: '', resource, alias: aliasParam });
+            return toGoogle(res, { flow: 'alias_reauth', client_id: '', redirect_uri: '', code_challenge: '', resource, alias });
         }
         if (!clientId)
             return json(res, 400, { error: 'invalid_request', message: 'client_id required', iss: base }, issHeader);
@@ -310,14 +331,16 @@ export function buildAuthServer(config, deps = {}) {
             return json(res, 400, { error: 'invalid_request', message: `resource must be ${resource}`, iss: base }, issHeader);
         }
         // (5) only after full validation do we build the request artifact.
+        // A client leg is always the owner sign-in. Re-auth has its own signed
+        // link: accepting flow=alias_reauth here let any client (a self-registered
+        // one, or a public CIMD client_id) start it and read the alias's scopes.
         const statePayload = {
-            flow: q.get('flow') === 'alias_reauth' ? 'alias_reauth' : 'owner_gate',
+            flow: 'owner_gate',
             client_id: clientId,
             redirect_uri: redirectUri,
             code_challenge: codeChallenge,
             client_state: clientState,
             resource,
-            alias: q.get('alias') ?? undefined,
         };
         // Confused-deputy defense (#3): a self-registered DCR client can pick an
         // arbitrary redirect_uri, so before we send the owner to Google (whose
@@ -373,7 +396,7 @@ export function buildAuthServer(config, deps = {}) {
                 return errorPage(res, 403, 'access_denied', 'Google did not return an email for the signed-in account');
             let refusal;
             try {
-                const out = await deps.bindTenantAlias({ tenantId: st.tenantId, alias: st.alias, email: boundEmail, bundles: st.bundles, nonce: st.nonce, tokens: exchanged.tokens });
+                const out = await deps.bindTenantAlias({ tenantId: st.tenantId, alias: st.alias, email: boundEmail, bundles: st.bundles, nonce: st.nonce, tokens: exchanged.tokens, sub: exchanged.sub });
                 refusal = out?.refused;
             }
             catch (e) {
@@ -415,10 +438,26 @@ export function buildAuthServer(config, deps = {}) {
                 log(`alias_reauth for "${st.alias}" returned no refresh token; stored token kept`);
                 return errorPage(res, 400, 'E_REAUTH_INCOMPLETE', 'Google did not return a long-lived token, so the stored one was kept. Open the re-auth link again and approve access.');
             }
+            const granted = typeof exchanged.tokens.scope === 'string' ? exchanged.tokens.scope : undefined;
+            const missing = deps.missingScopes?.(st.alias, granted) ?? [];
+            const listed = missing.map((m) => `<code>${escapeHtml(m)}</code>`).join(', ');
+            // A narrower grant replaces nothing that works. The link can be reused
+            // for an hour and the Google URL's scope is not signed, so a narrower
+            // grant is not necessarily the account holder's choice.
+            if (missing.length > 0 && deps.hasToken?.(st.alias)) {
+                log(`alias_reauth for "${st.alias}" granted ${missing.length} fewer scope(s); stored token kept`);
+                res.writeHead(400, { 'Content-Type': 'text/html' });
+                res.end(`<!doctype html><meta charset=utf-8><p>E_SCOPE_NOT_GRANTED: Google did not grant ${missing.length} requested scope(s): ${listed}, so the stored access for "${escapeHtml(st.alias)}" was kept. Ask for a fresh re-auth link and leave every box ticked.</p>`);
+                return true;
+            }
             deps.writeToken?.(st.alias, exchanged.tokens);
             log(`callback ok flow=alias_reauth alias=${st.alias}`);
+            // With no stored token a partial grant still beats none; say what is missing.
+            const gap = missing.length
+                ? `<p>Google did not grant ${missing.length} requested scope(s): ${listed}. Ask for a fresh re-auth link and leave every box ticked to restore them.</p>`
+                : '';
             res.writeHead(200, { 'Content-Type': 'text/html' });
-            res.end(`<!doctype html><meta charset=utf-8><p>Re-authenticated "${escapeHtml(st.alias)}". You can close this window.</p>`);
+            res.end(`<!doctype html><meta charset=utf-8><p>Re-authenticated "${escapeHtml(st.alias)}". You can close this window.</p>${gap}`);
             return true;
         }
         // owner_gate: resolve the verified email to its subject (default = the
@@ -426,7 +465,7 @@ export function buildAuthServer(config, deps = {}) {
         // signed into the authz code and flows into every token minted from it.
         const email = (exchanged.email ?? '').toLowerCase();
         const iss = encodeURIComponent(base);
-        const subject = email ? resolveSubject(email) : null;
+        const subject = email ? resolveSubject(email, { sub: exchanged.sub, hd: exchanged.hd }) : null;
         if (!subject) {
             const sep = st.redirect_uri.includes('?') ? '&' : '?';
             const s = st.client_state ? `&state=${encodeURIComponent(st.client_state)}` : '';
@@ -537,8 +576,13 @@ export function buildAuthServer(config, deps = {}) {
         }
     };
     const mintFlowState = async ({ flow, alias, tenantId, bundles, nonce }) => {
+        // /authorize has a signed branch for alias_add only; anything else minted
+        // here would be a state no route verifies the way its flow needs.
+        if (flow !== 'alias_add')
+            throw new Error(`mintFlowState supports alias_add only, not ${String(flow)}`);
         const state = await signState({ flow, client_id: '', redirect_uri: '', code_challenge: '', resource, alias, tenantId, bundles, nonce }, base, secret, nowSec());
         return `${base}/authorize?flow=${flow}&state=${encodeURIComponent(state)}`;
     };
-    return { routes, authenticate, mintFlowState };
+    const reauthLink = (alias) => `${base}/authorize?flow=alias_reauth&${signReauthLink(base, secret, alias, nowSec())}`;
+    return { routes, authenticate, mintFlowState, reauthLink };
 }

package/dist/reauth-hint.d.ts

@@ -1,2 +1,2 @@
-export declare function setHttpReauthBase(base: string | null): void;
+export declare function setHttpReauthLink(linker: ((alias: string) => string) | null): void;
 export declare function reauthHint(account: string): string;

package/dist/reauth-hint.js

@@ -1,15 +1,15 @@
 // B13 in-call re-auth (BV-1): a dead/missing per-account Google token is a
 // leg-C failure. Over stdio the fix is the `auth --account` CLI; over HTTP the
-// user cannot run a CLI, so the hint becomes a clickable link into the AS's
-// clientless alias_reauth flow (${BASE}/authorize?flow=alias_reauth&alias=…).
-// The HTTP bootstrap sets the base when the AS starts; stdio never does.
-let httpReauthBase = null;
-export function setHttpReauthBase(base) {
-    httpReauthBase = base;
+// user cannot run a CLI, so the hint becomes a clickable, server-signed link
+// into the AS's clientless alias_reauth flow (AuthServer.reauthLink). The HTTP
+// bootstrap installs the linker when the AS starts; stdio never does.
+let httpReauthLink = null;
+export function setHttpReauthLink(linker) {
+    httpReauthLink = linker;
 }
 export function reauthHint(account) {
-    if (httpReauthBase) {
-        return `Re-authenticate "${account}" in your browser, then retry: ${httpReauthBase}/authorize?flow=alias_reauth&alias=${encodeURIComponent(account)}`;
+    if (httpReauthLink) {
+        return `Re-authenticate "${account}" in your browser, then retry: ${httpReauthLink(account)}`;
     }
     return `Run: npx mcp-google-multi auth --account ${account}`;
 }

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "mcp-google-multi",
-  "version": "6.0.0-alpha.57",
+  "version": "6.0.0-alpha.59",
   "mcpName": "io.github.bakissation/mcp-google-multi",
   "description": "Local MCP server for Google Workspace (Gmail, Drive, Calendar, Sheets, Docs, Contacts, Tasks, Meet, Search Console, +Forms/Chat/Admin) across multiple accounts — OAuth-only, encrypted token storage, deny-by-default writes.",
   "type": "module",