mcp-google-multi 6.0.0-alpha.58 → 6.0.0-alpha.59

package/dist/fs-atomic.d.ts

@@ -1,3 +1,14 @@
+/** Which process instance holds a lock: PID namespace id, start time in
+ * clock ticks since boot, and a boot id prefix. A part this process cannot
+ * read is `host` or `0` (all three without /proc). */
+interface LockIdentity {
+    ns: string;
+    start: string;
+    boot: string;
+}
+/** Test hook: act as a process with this identity (undefined restores the real one). */
+export declare function __setLockIdentityForTest(identity?: LockIdentity): void;
 export declare function withFileLock<T>(absPath: string, fn: () => T, label?: string): T;
 export declare function atomicWriteFileSync(absPath: string, contents: string, mode?: number): void;
 export declare function atomicWriteWithLock(absPath: string, contents: string, mode?: number): void;
+export {};

package/dist/fs-atomic.js

@@ -5,23 +5,216 @@ const LOCK_TIMEOUT_MS = 5_000;
 const LOCK_RETRY_MS = 10;
 const RENAME_ATTEMPTS = 5;
 const RENAME_RETRY_MS = 20;
+// A holder this process cannot identify (another PID namespace, another boot,
+// or no /proc) is dead only once its lock is this old.
+const LOCK_LEASE_MS = 60_000;
+// Breaking a lock takes microseconds, so an older breaker file was left by a crash.
+const BREAKER_STALE_MS = 2_000;
+const PROCESS_START_MS = performance.timeOrigin;
+const OWNER_NAME = /^(\d+)\.(\d+|host)\.(\d+)\.([0-9a-f]{8}|0)\.[0-9a-f]{12}\.owner$/;
+function startOf(pid) {
+    try {
+        const stat = fs.readFileSync(`/proc/${pid}/stat`, 'utf8');
+        const start = stat.slice(stat.lastIndexOf(')') + 2).split(' ')[19];
+        return /^\d+$/.test(start ?? '') ? start : undefined;
+    }
+    catch {
+        return undefined;
+    }
+}
+function selfIdentity() {
+    const identity = { ns: 'host', start: '0', boot: '0' };
+    try {
+        identity.ns = /^pid:\[(\d+)\]$/.exec(fs.readlinkSync('/proc/self/ns/pid'))?.[1] ?? 'host';
+    }
+    catch {
+        // no /proc
+    }
+    try {
+        const boot = fs.readFileSync('/proc/sys/kernel/random/boot_id', 'utf8').replace(/[^0-9a-f]/g, '').slice(0, 8);
+        if (boot.length === 8)
+            identity.boot = boot;
+    }
+    catch {
+        // no /proc
+    }
+    try {
+        // A /proc mounted for another PID namespace describes other processes,
+        // so no pid can be looked up in it.
+        if (fs.readlinkSync('/proc/self') === String(process.pid))
+            identity.start = startOf('self') ?? '0';
+    }
+    catch {
+        // no /proc
+    }
+    return identity;
+}
+let SELF = selfIdentity();
+/** Test hook: act as a process with this identity (undefined restores the real one). */
+export function __setLockIdentityForTest(identity) {
+    SELF = identity ?? selfIdentity();
+}
 function sleep(ms) {
     Atomics.wait(new Int32Array(new SharedArrayBuffer(4)), 0, 0, ms);
 }
+function sameFile(a, b) {
+    return a.ino === b.ino && a.dev === b.dev;
+}
+function isEnoent(error) {
+    return error.code === 'ENOENT';
+}
+// Undefined when the lock changed hands while it was being read.
+function readHolder(lock) {
+    const before = fs.lstatSync(lock, { bigint: true });
+    const body = before.isFile() ? fs.readFileSync(lock, 'utf8') : '';
+    let owner;
+    if (before.isFile()) {
+        const dir = path.dirname(lock);
+        const prefix = `${path.basename(lock)}.`;
+        for (const name of fs.readdirSync(dir)) {
+            if (!name.startsWith(prefix))
+                continue;
+            const m = OWNER_NAME.exec(name.slice(prefix.length));
+            if (!m || m[1] !== body)
+                continue;
+            const ownerPath = path.join(dir, name);
+            try {
+                if (sameFile(fs.lstatSync(ownerPath, { bigint: true }), before)) {
+                    owner = { path: ownerPath, ns: m[2], start: m[3], boot: m[4] };
+                    break;
+                }
+            }
+            catch (error) {
+                if (!isEnoent(error))
+                    throw error;
+            }
+        }
+    }
+    const after = fs.lstatSync(lock, { bigint: true });
+    if (!sameFile(before, after))
+        return undefined;
+    return { body, ino: after.ino, dev: after.dev, mtimeNs: after.mtimeNs, mtimeMs: Number(after.mtimeNs) / 1e6, owner };
+}
+// The owner file's random name tells two holders apart even when the second
+// lock reuses the first one's freed inode.
+function sameHolder(a, b) {
+    return sameFile(a, b) && a.body === b.body && a.mtimeNs === b.mtimeNs && a.owner?.path === b.owner?.path;
+}
+function probeDead(pid) {
+    try {
+        process.kill(pid, 0);
+        return false;
+    }
+    catch (error) {
+        const code = error.code;
+        // EPERM: PID exists but is not signalable (another user's process).
+        if (code === 'ESRCH')
+            return true;
+        if (code !== 'EPERM')
+            throw error;
+        return false;
+    }
+}
+function holderDead(holder, now) {
+    const pid = Number(holder.body);
+    if (!(Number.isSafeInteger(pid) && pid > 0))
+        return true;
+    const leaseOver = now - holder.mtimeMs >= LOCK_LEASE_MS;
+    const owner = holder.owner;
+    // No owner file: an older writer, whose namespace is unknown.
+    if (!owner)
+        return probeDead(pid) || leaseOver;
+    if (owner.ns !== SELF.ns || owner.boot !== SELF.boot)
+        return leaseOver;
+    // Two unreadable parts compare equal without naming the same namespace or
+    // boot, so only a fully known identity is looked up by start time.
+    if (SELF.ns !== 'host' && SELF.boot !== '0' && SELF.start !== '0' && owner.start !== '0') {
+        // A live namespace id is never shared, so the recorded pid is ours to
+        // look up: a restarted container reuses both the id and the pid, but not
+        // the start time.
+        const start = startOf(pid);
+        if (start !== undefined)
+            return start !== owner.start;
+        return probeDead(pid) || leaseOver;
+    }
+    if (pid === process.pid)
+        return holder.mtimeMs < PROCESS_START_MS;
+    return probeDead(pid) || leaseOver;
+}
+// One waiter at a time breaks a dead lock: two breakers could otherwise both
+// see the dead holder, and the second would unlink the first one's new lock.
+// False when another waiter is breaking it.
+function breakLock(lock, holder) {
+    const breaker = `${lock}.break`;
+    // A token, not the inode: a breaker created after ours was removed can
+    // get our freed inode.
+    const token = `${process.pid}.${randomBytes(6).toString('hex')}`;
+    try {
+        fs.writeFileSync(breaker, token, { mode: 0o600, flag: 'wx' });
+    }
+    catch (error) {
+        if (error.code !== 'EEXIST')
+            throw error;
+        clearStaleBreaker(breaker);
+        return false;
+    }
+    try {
+        const current = readHolder(lock);
+        if (current && sameHolder(current, holder)) {
+            fs.rmSync(lock, { force: true });
+            if (holder.owner)
+                fs.rmSync(holder.owner.path, { force: true });
+        }
+    }
+    catch (error) {
+        if (!isEnoent(error))
+            throw error;
+    }
+    finally {
+        releaseBreaker(breaker, token);
+    }
+    return true;
+}
+// A symlink, or a breaker dated the other side of a clock step, would
+// otherwise block every break.
+function clearStaleBreaker(breaker) {
+    try {
+        const st = fs.lstatSync(breaker);
+        if (!st.isFile() || Math.abs(Date.now() - st.mtimeMs) >= BREAKER_STALE_MS)
+            fs.rmSync(breaker, { force: true });
+    }
+    catch (error) {
+        if (!isEnoent(error))
+            throw error;
+    }
+}
+function releaseBreaker(breaker, token) {
+    try {
+        if (fs.readFileSync(breaker, 'utf8') === token)
+            fs.rmSync(breaker, { force: true });
+    }
+    catch (error) {
+        if (!isEnoent(error))
+            throw error;
+    }
+}
 // Hardlink-based advisory lock, generalized path-keyed from the token store's
-// alias-keyed original (same mechanics: dead-owner recovery via signal-0 probe,
-// EPERM = alive, corrupt lock content recovered as dead, 5s timeout).
+// alias-keyed original. The lock body is the bare pid, as older readers expect;
+// the owner file stays linked while held and names the holder's process
+// instance. See docs/internals.md.
 export function withFileLock(absPath, fn, label = `lock: ${absPath}`) {
     const dir = path.dirname(absPath);
     const lock = path.join(dir, `.${path.basename(absPath)}.lock`);
-    const ownerFile = `${lock}.${process.pid}.${randomBytes(6).toString('hex')}.owner`;
+    const ownerFile = `${lock}.${process.pid}.${SELF.ns}.${SELF.start}.${SELF.boot}.${randomBytes(6).toString('hex')}.owner`;
     fs.mkdirSync(dir, { recursive: true, mode: 0o700 });
     fs.writeFileSync(ownerFile, String(process.pid), { mode: 0o600, flag: 'wx' });
     const deadline = Date.now() + LOCK_TIMEOUT_MS;
+    let linked = false;
     try {
         while (true) {
             try {
                 fs.linkSync(ownerFile, lock);
+                linked = true;
                 break;
             }
             catch (error) {
@@ -29,33 +222,13 @@ export function withFileLock(absPath, fn, label = `lock: ${absPath}`) {
                 if (err.code !== 'EEXIST')
                     throw error;
                 try {
-                    const observedOwner = fs.readFileSync(lock, 'utf8');
-                    const owner = Number(observedOwner);
-                    let ownerDead = !(Number.isSafeInteger(owner) && owner > 0);
-                    if (!ownerDead) {
-                        try {
-                            process.kill(owner, 0);
-                        }
-                        catch (ownerError) {
-                            const code = ownerError.code;
-                            // EPERM: PID exists but is not signalable (recycled by another
-                            // user); treat as alive, never break a lock we cannot verify.
-                            if (code === 'ESRCH')
-                                ownerDead = true;
-                            else if (code !== 'EPERM')
-                                throw ownerError;
-                        }
-                    }
-                    if (ownerDead) {
-                        if (fs.readFileSync(lock, 'utf8') === observedOwner)
-                            fs.rmSync(lock, { force: true });
+                    const holder = readHolder(lock);
+                    if (holder && holderDead(holder, Date.now()) && breakLock(lock, holder))
                         continue;
-                    }
                 }
                 catch (readError) {
-                    if (readError.code === 'ENOENT') {
+                    if (isEnoent(readError))
                         continue;
-                    }
                     throw readError;
                 }
                 if (Date.now() >= deadline) {
@@ -66,14 +239,32 @@ export function withFileLock(absPath, fn, label = `lock: ${absPath}`) {
         }
     }
     finally {
-        fs.rmSync(ownerFile, { force: true });
+        if (!linked)
+            fs.rmSync(ownerFile, { force: true });
     }
+    let bound = false;
     try {
+        // Some network and FUSE filesystems give each name of one file its own
+        // inode number; there the owner file cannot vouch for the lock.
+        bound = sameFile(fs.lstatSync(ownerFile, { bigint: true }), fs.lstatSync(lock, { bigint: true }));
         return fn();
     }
     finally {
-        fs.rmSync(lock, { force: true });
+        releaseLock(lock, ownerFile, bound);
+    }
+}
+// A holder whose lock was broken (its owner file removed with it) must not
+// remove its successor's lock.
+function releaseLock(lock, ownerFile, bound) {
+    try {
+        if (!bound || sameFile(fs.lstatSync(ownerFile, { bigint: true }), fs.lstatSync(lock, { bigint: true })))
+            fs.rmSync(lock, { force: true });
+    }
+    catch (error) {
+        if (!isEnoent(error))
+            throw error;
     }
+    fs.rmSync(ownerFile, { force: true });
 }
 export function atomicWriteFileSync(absPath, contents, mode = 0o600) {
     const dir = path.dirname(absPath);

package/dist/oauth-as.d.ts

@@ -6,6 +6,10 @@ export declare const DCR_MAX_REDIRECT_URIS = 10;
 export interface GoogleExchangeResult {
     tokens: Record<string, unknown>;
     email?: string;
+    /** Google's stable account id; unlike the address it is never reassigned. */
+    sub?: string;
+    /** Google Workspace hosted domain; absent for a consumer account. */
+    hd?: string;
 }
 export interface AuthServerConfig {
     base: string;
@@ -31,6 +35,7 @@ export interface TenantAliasBind {
     bundles?: string[];
     nonce?: string;
     tokens: Record<string, unknown>;
+    sub?: string;
 }
 /** A binder's deliberate refusal (policy, not failure): /callback answers 403
  * with this slug and message. The message reaches an unauthenticated browser. */
@@ -40,8 +45,15 @@ export interface AliasBindRefusal {
         message: string;
     };
 }
-/** Only trust the id_token email when Google marks it verified (#8). The token
- * comes straight from Google's token endpoint, so its claims are read unsigned. */
+export interface GoogleIdentity {
+    email?: string;
+    sub?: string;
+    hd?: string;
+}
+/** Only trust the id_token identity when Google marks the email verified (#8).
+ * The token comes straight from Google's token endpoint, so its claims are
+ * read unsigned. A malformed sub or hd is dropped, never passed on. */
+export declare function verifiedIdentityFromIdToken(idToken?: string | null): GoogleIdentity | undefined;
 export declare function verifiedEmailFromIdToken(idToken?: string | null): string | undefined;
 export interface AuthServerDeps {
     fetchCimd?: (clientId: string) => Promise<Record<string, unknown>>;
@@ -76,8 +88,14 @@ export interface AuthServerDeps {
     aliasEmail?: (alias: string) => string | undefined;
     /** Map a verified sign-in email to the subject its tokens are minted under.
      * Default = the MCP_OWNER_EMAILS allowlist -> {sub:'owner'}; null = denied.
-     * The tenant resolver (invite claim / email->tenant lookup) plugs in here. */
-    resolveSubject?: (email: string) => {
+     * The tenant resolver (invite claim / email->tenant lookup) plugs in here.
+     * `identity` carries Google's `sub` and `hd` when the exchange returned
+     * them, so a resolver can key on the stable account id rather than an
+     * address that can be reassigned. */
+    resolveSubject?: (email: string, identity?: {
+        sub?: string;
+        hd?: string;
+    }) => {
         sub: string;
     } | null;
     /** alias_add completion: persist the new alias's config row and tokens under

package/dist/oauth-as.js

@@ -17,21 +17,34 @@ const CLAUDE_AI_FIXED_CALLBACK = 'https://claude.ai/api/mcp/auth_callback';
 export const DCR_MAX_CLIENTS = 1000;
 export const DCR_MAX_REDIRECT_URIS = 10;
 const DCR_MAX_URI_LEN = 2048;
-/** Only trust the id_token email when Google marks it verified (#8). The token
- * comes straight from Google's token endpoint, so its claims are read unsigned. */
-export function verifiedEmailFromIdToken(idToken) {
+const OIDC_SUB = /^[\x21-\x7e]{1,255}$/;
+const HOSTED_DOMAIN = /^[a-z0-9-]+(\.[a-z0-9-]+)+$/i;
+/** Only trust the id_token identity when Google marks the email verified (#8).
+ * The token comes straight from Google's token endpoint, so its claims are
+ * read unsigned. A malformed sub or hd is dropped, never passed on. */
+export function verifiedIdentityFromIdToken(idToken) {
     if (!idToken)
         return undefined;
     try {
         const [, payload] = idToken.split('.');
         const claims = JSON.parse(Buffer.from(payload, 'base64url').toString('utf-8'));
         const verified = claims.email_verified === true || claims.email_verified === 'true';
-        return verified ? claims.email : undefined;
+        if (!verified)
+            return undefined;
+        const identity = { email: claims.email };
+        if (typeof claims.sub === 'string' && OIDC_SUB.test(claims.sub))
+            identity.sub = claims.sub;
+        if (typeof claims.hd === 'string' && claims.hd.length <= 253 && HOSTED_DOMAIN.test(claims.hd))
+            identity.hd = claims.hd;
+        return identity;
     }
     catch {
         return undefined;
     }
 }
+export function verifiedEmailFromIdToken(idToken) {
+    return verifiedIdentityFromIdToken(idToken)?.email;
+}
 // --- helpers ----------------------------------------------------------------
 function json(res, status, body, extraHeaders = {}) {
     res.writeHead(status, { 'Content-Type': 'application/json', ...extraHeaders });
@@ -383,7 +396,7 @@ export function buildAuthServer(config, deps = {}) {
                 return errorPage(res, 403, 'access_denied', 'Google did not return an email for the signed-in account');
             let refusal;
             try {
-                const out = await deps.bindTenantAlias({ tenantId: st.tenantId, alias: st.alias, email: boundEmail, bundles: st.bundles, nonce: st.nonce, tokens: exchanged.tokens });
+                const out = await deps.bindTenantAlias({ tenantId: st.tenantId, alias: st.alias, email: boundEmail, bundles: st.bundles, nonce: st.nonce, tokens: exchanged.tokens, sub: exchanged.sub });
                 refusal = out?.refused;
             }
             catch (e) {
@@ -452,7 +465,7 @@ export function buildAuthServer(config, deps = {}) {
         // signed into the authz code and flows into every token minted from it.
         const email = (exchanged.email ?? '').toLowerCase();
         const iss = encodeURIComponent(base);
-        const subject = email ? resolveSubject(email) : null;
+        const subject = email ? resolveSubject(email, { sub: exchanged.sub, hd: exchanged.hd }) : null;
         if (!subject) {
             const sep = st.redirect_uri.includes('?') ? '&' : '?';
             const s = st.client_state ? `&state=${encodeURIComponent(st.client_state)}` : '';

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "mcp-google-multi",
-  "version": "6.0.0-alpha.58",
+  "version": "6.0.0-alpha.59",
   "mcpName": "io.github.bakissation/mcp-google-multi",
   "description": "Local MCP server for Google Workspace (Gmail, Drive, Calendar, Sheets, Docs, Contacts, Tasks, Meet, Search Console, +Forms/Chat/Admin) across multiple accounts — OAuth-only, encrypted token storage, deny-by-default writes.",
   "type": "module",