mcp-google-multi 6.0.0-alpha.63 → 6.0.0-alpha.65

package/dist/arg-normalize.js

@@ -1,5 +1,5 @@
 import { echoName, echoNames, screenArguments, unknownArgEnvelope, } from './arg-strict.js';
-import { sliceClean } from './trim.js';
+import { logSafe, sliceClean } from './trim.js';
 // The SDK synthesizes input-validation failures as isError RESULTS, skipping
 // the handler entirely: no handler of ours runs, so no envelope exists and the
 // client gets free text. The text is prose in both SDK eras (v1 prefixed it
@@ -115,8 +115,9 @@ export function screenMessage(msg, opts, log = (l) => process.stderr.write(`${l}
     if (screened.unknown.length === 0 && screened.redundant.length === 0)
         return { action: 'forward', msg };
     const all = [...screened.unknown.map((u) => u.sent), ...screened.redundant];
-    // Key names only; argument VALUES never reach the log.
-    log(`[args] ${tool}: undeclared ${echoNames(all)}${opts.mode === 'warn' ? ' (dropped)' : ' (rejected)'}`);
+    // Key names only; argument VALUES never reach the log. The names are the
+    // caller's, so they are escaped here and only here: the envelope is JSON.
+    log(`[args] ${tool}: undeclared ${logSafe(echoNames(all), 600)}${opts.mode === 'warn' ? ' (dropped)' : ' (rejected)'}`);
     try {
         // Only ever a DECLARED key or the literal placeholder, so the metrics
         // closed-vocabulary rule holds: the caller's key is never persisted.

package/dist/cimd-cache.d.ts

@@ -0,0 +1,38 @@
+export declare const CIMD_TTL_MS: number;
+/** The oldest validated document still served while the cap is full or the issuer cannot answer. */
+export declare const CIMD_MAX_STALE_MS: number;
+/** Fetches at once. A lookup can outlive the fetch that gave up on it, so ssrf-guard caps its own lookups apart. */
+export declare const CIMD_MAX_IN_FLIGHT = 4;
+export declare const CIMD_CACHE_MAX = 256;
+export type CimdDocument = Record<string, unknown>;
+type CimdError = {
+    error: 'E_CIMD_SSRF_BLOCKED' | 'E_CIMD_INVALID';
+};
+/** `fresh` is true only for the request whose fetch produced the document. */
+export type CimdResolution = {
+    doc: CimdDocument;
+    fresh: boolean;
+} | {
+    busy: true;
+} | CimdError;
+export interface CimdCacheDeps {
+    fetch: (clientId: string) => Promise<CimdDocument>;
+    now: () => number;
+    log: (line: string) => void;
+}
+export declare class CimdClientCache {
+    private readonly deps;
+    private readonly entries;
+    private readonly inFlight;
+    private busyLoggedAt;
+    private busySuppressed;
+    constructor(deps: CimdCacheDeps);
+    get size(): number;
+    /** `validate` runs once per fetch, in the request that started it, and every
+     * request waiting on that fetch gets the same answer. */
+    resolve(clientId: string, validate: (doc: CimdDocument) => boolean): Promise<CimdResolution>;
+    private fetchFor;
+    private store;
+    private noteBusy;
+}
+export {};

package/dist/cimd-cache.js

@@ -0,0 +1,117 @@
+// H4 F6: GET /authorize is unauthenticated, and a client_id on an allowlisted
+// issuer with a path never seen before forces an outbound fetch. So the
+// fetches running at once are capped, one client_id is fetched once however
+// many requests wait on it, and only a document that passed validation is
+// kept. Errors are never cached (CIMD section 5.2), and a negative cache would
+// not help anyway: the attack varies the path, so its key never repeats.
+import { CimdHttpError, isTransientFetchError, SsrfBlockedError } from './ssrf-guard.js';
+import { logSafe } from './trim.js';
+export const CIMD_TTL_MS = 5 * 60_000;
+/** The oldest validated document still served while the cap is full or the issuer cannot answer. */
+export const CIMD_MAX_STALE_MS = 24 * 60 * 60_000;
+/** Fetches at once. A lookup can outlive the fetch that gave up on it, so ssrf-guard caps its own lookups apart. */
+export const CIMD_MAX_IN_FLIGHT = 4;
+export const CIMD_CACHE_MAX = 256;
+const BUSY_LOG_EVERY_MS = 60_000;
+export class CimdClientCache {
+    deps;
+    entries = new Map();
+    // One entry per running fetch, so its size is the number of permits taken.
+    inFlight = new Map();
+    busyLoggedAt = -Infinity;
+    busySuppressed = 0;
+    constructor(deps) {
+        this.deps = deps;
+    }
+    get size() {
+        return this.entries.size;
+    }
+    /** `validate` runs once per fetch, in the request that started it, and every
+     * request waiting on that fetch gets the same answer. */
+    async resolve(clientId, validate) {
+        const entry = this.entries.get(clientId);
+        const age = entry ? this.deps.now() - entry.at : 0;
+        if (entry && age < CIMD_TTL_MS)
+            return { doc: entry.doc, fresh: false };
+        if (entry && age >= CIMD_MAX_STALE_MS)
+            this.entries.delete(clientId);
+        const running = this.inFlight.get(clientId);
+        if (running) {
+            const out = await running;
+            return 'doc' in out ? { doc: out.doc, fresh: false } : out;
+        }
+        if (this.inFlight.size >= CIMD_MAX_IN_FLIGHT) {
+            // A flood of fresh paths is exactly when the cap is full, and a client
+            // that signed in before must still be able to.
+            const stale = this.entries.get(clientId);
+            if (stale)
+                return { doc: stale.doc, fresh: false };
+            this.noteBusy();
+            return { busy: true };
+        }
+        return this.fetchFor(clientId, validate);
+    }
+    async fetchFor(clientId, validate) {
+        // Never rejects: neither core nor a host installs an unhandledRejection
+        // handler, and a waiter that stopped listening must not take the process down.
+        let settle;
+        this.inFlight.set(clientId, new Promise((r) => (settle = r)));
+        let out = { error: 'E_CIMD_INVALID' };
+        try {
+            const doc = await this.deps.fetch(clientId);
+            if (validate(doc)) {
+                this.store(clientId, doc);
+                out = { doc, fresh: true };
+            }
+            else {
+                this.entries.delete(clientId);
+            }
+        }
+        catch (e) {
+            out = { error: e instanceof SsrfBlockedError ? 'E_CIMD_SSRF_BLOCKED' : 'E_CIMD_INVALID' };
+            // A document that went bad is never served stale. An issuer that is down
+            // or overloaded says nothing about the document, so the last good one
+            // stays and answers this fetch's requests too (stale-if-error; the error
+            // itself is never stored).
+            const stale = this.entries.get(clientId);
+            if (!saysNothingAboutDocument(e))
+                this.entries.delete(clientId);
+            else if (stale && this.deps.now() - stale.at < CIMD_MAX_STALE_MS)
+                out = { doc: stale.doc, fresh: false };
+            // #13: the detail goes to the log only; the caller gets a generic answer.
+            this.deps.log(`CIMD fetch failed for ${logSafe(clientId, 128)}: ${logSafe(e instanceof Error ? e.message : 'non-Error rejection', 200)}`);
+        }
+        finally {
+            this.inFlight.delete(clientId);
+            settle(out);
+        }
+        return out;
+    }
+    store(clientId, doc) {
+        this.entries.delete(clientId);
+        while (this.entries.size >= CIMD_CACHE_MAX) {
+            const oldest = this.entries.keys().next().value;
+            if (oldest === undefined)
+                break;
+            this.entries.delete(oldest);
+        }
+        this.entries.set(clientId, { doc, at: this.deps.now() });
+    }
+    // Over-cap requests arrive at whatever rate the caller likes.
+    noteBusy() {
+        const now = this.deps.now();
+        if (now - this.busyLoggedAt < BUSY_LOG_EVERY_MS) {
+            this.busySuppressed++;
+            return;
+        }
+        const suppressed = this.busySuppressed;
+        this.busyLoggedAt = now;
+        this.busySuppressed = 0;
+        this.deps.log(`CIMD busy: in-flight cap reached${suppressed > 0 ? ` (n=${suppressed} suppressed)` : ''}`);
+    }
+}
+function saysNothingAboutDocument(e) {
+    if (isTransientFetchError(e))
+        return true;
+    return e instanceof CimdHttpError && (e.status === 408 || e.status === 429 || e.status >= 500);
+}

package/dist/http-transport.d.ts

@@ -2,6 +2,7 @@ import type { McpServer, Transport } from "@modelcontextprotocol/server";
 import { type IncomingMessage, type ServerResponse } from 'node:http';
 import type { HttpConfig } from './http-config.js';
 import { type ArgShape, type StrictArgOptions, type ValidationEnvelopeOptions } from './arg-normalize.js';
+export { logSafe } from './trim.js';
 export type AuthOutcome = {
     ok: true;
     sub?: string;
@@ -73,7 +74,9 @@ export declare function parseOwnerEmails(env?: NodeJS.ProcessEnv): string[];
  * connector calls /mcp server-to-server with no Origin, BV-4). */
 export declare function originAllowed(origin: string | undefined, allowed: string[]): boolean;
 export declare function hostAllowed(host: string | undefined, allowed: string[]): boolean;
-/** JSON-RPC method name(s) for an observability log line — no params, no PII. */
+/** JSON-RPC method name(s) for an observability log line: no params, no PII.
+ * The method is the caller's: anything not shaped like a method name, which
+ * includes a value whose String() throws, is logged as `<invalid>`. */
 export declare function jsonRpcMethod(body: unknown): string;
 export declare class HttpTransportHost {
     private readonly opts;

package/dist/http-transport.js

@@ -5,6 +5,9 @@ import { NodeStreamableHTTPServerTransport } from "@modelcontextprotocol/node";
 // loopback-owner authenticator so the local-HTTP model works before the AS lands.
 import { createServer } from 'node:http';
 import { withArgNormalization, withValidationEnvelope } from './arg-normalize.js';
+import { logSafe } from './trim.js';
+// A host wrapping the log callbacks it hands core needs this, and trim has no package export.
+export { logSafe } from './trim.js';
 // A hung handler that keeps the connection open would otherwise hold the global
 // serialize() lock forever. Generous by default so slow-but-valid calls (large
 // Drive exports, fan-out) still finish; the point is only to guarantee release.
@@ -37,12 +40,25 @@ export function hostAllowed(host, allowed) {
     const bare = host.replace(/:\d+$/, '');
     return allowed.includes(host) || allowed.includes(bare);
 }
-/** JSON-RPC method name(s) for an observability log line — no params, no PII. */
+const METHOD_NAME = /^[A-Za-z0-9_./$-]{1,64}$/;
+const BATCH_METHODS_SHOWN = 4;
+/** JSON-RPC method name(s) for an observability log line: no params, no PII.
+ * The method is the caller's: anything not shaped like a method name, which
+ * includes a value whose String() throws, is logged as `<invalid>`. */
 export function jsonRpcMethod(body) {
-    const one = (b) => b && typeof b === 'object' && 'method' in b ? String(b.method) : undefined;
-    if (Array.isArray(body))
-        return body.map(one).filter(Boolean).join(',') || 'batch';
-    return one(body) ?? 'unknown';
+    const one = (b) => {
+        if (!b || typeof b !== 'object' || !('method' in b))
+            return undefined;
+        const m = b.method;
+        return typeof m === 'string' && METHOD_NAME.test(m) ? m : '<invalid>';
+    };
+    if (!Array.isArray(body))
+        return one(body) ?? 'unknown';
+    const names = body.map(one).filter((n) => n !== undefined);
+    if (names.length === 0)
+        return 'batch';
+    const rest = names.length - BATCH_METHODS_SHOWN;
+    return rest > 0 ? `${names.slice(0, BATCH_METHODS_SHOWN).join(',')},+${rest}` : names.join(',');
 }
 /** setTimeout fires at once for a delay above this, so a longer grace would
  * cut every connection immediately. */
@@ -160,7 +176,7 @@ export class HttpTransportHost {
                 finally {
                     // A throwing log must not reach the destroy below: the answer is sent.
                     try {
-                        this.log(`500 internal_error path=${pathOf(req)}: ${e instanceof Error ? e.message : 'non-Error throw'}`);
+                        this.log(`500 internal_error path=${pathOf(req)}: ${e instanceof Error ? logSafe(e.message, 200) : 'non-Error throw'}`);
                     }
                     catch {
                         // nowhere left to report it
@@ -292,12 +308,12 @@ export class HttpTransportHost {
     frontGuard(req, res) {
         const { allowedHosts, allowedOrigins } = this.opts.config;
         if (!hostAllowed(req.headers.host, allowedHosts)) {
-            this.log(`403 host_rejected host=${req.headers.host ?? ''}`);
+            this.log(`403 host_rejected host=${logSafe(req.headers.host ?? '', 64)}`);
             this.fail(res, 403, 'host_rejected', 'Host not allowed (DNS-rebinding guard).');
             return false;
         }
         if (!originAllowed(req.headers.origin, allowedOrigins)) {
-            this.log(`403 origin_rejected origin=${req.headers.origin ?? ''}`);
+            this.log(`403 origin_rejected origin=${logSafe(req.headers.origin ?? '', 64)}`);
             this.fail(res, 403, 'origin_rejected', 'Origin not allowed.');
             return false;
         }

package/dist/mcp-token.d.ts

@@ -80,40 +80,78 @@ export declare class ReplayGuard {
     get size(): number;
     private evictExpired;
 }
+/** An earlier release's record, keyed by its live token. */
 export interface RefreshRecord {
     sub: string;
     issuedAt: number;
     family: string;
 }
 /**
- * Persisted (encrypted under MASTER_KEY) opaque refresh-token store. Rotates on
- * every use (a stolen token is usable at most once), and detects REUSE of a
- * rotated-away token as theft: the whole token family is revoked (#7 / C14).
- * All read-modify-write goes through a file lock so concurrent stdio+HTTP
- * processes can't lost-update or double-spend (#12).
+ * The family tag of a refresh token this `masterKey`'s store minted, or null
+ * for anything else. Derives the key once; the returned function does no I/O,
+ * so a host can key a pre-auth rate limit on it.
+ */
+export declare function refreshFamilyTagger(masterKey: string): (token: string) => string | null;
+/** Boot check for a refresh store file: returns when it is absent or this
+ * release can read it; throws when it does not decrypt under `masterKey`
+ * (E_REFRESH_STORE_UNREADABLE) or a newer release wrote it
+ * (E_REFRESH_STORE_FORMAT). */
+export declare function assertRefreshStoreReadable(file: string, masterKey: string): void;
+export interface RefreshStoreOptions {
+    /** Absolute family lifetime in seconds, counted from the sign-in. Unset: unlimited. */
+    maxAgeSec?: number;
+    /** Idle lifetime in seconds, counted from the last issue or rotation. Unset: unlimited. */
+    idleSec?: number;
+    /** Server-side log for a revoked, dropped or expired family. Never given a token or a subject. */
+    log?: (line: string) => void;
+}
+/**
+ * Persisted (encrypted under MASTER_KEY) refresh-token store. Rotates on every
+ * use, and a token carries its family and generation under a MAC, so
+ * presenting any generation the family has rotated past is REUSE: the family
+ * is revoked for the rest of its life (#7 / C14, H4 F2). The store keeps one
+ * record per family, whatever its rotation count. Every read-modify-write goes
+ * through a file lock so concurrent stdio+HTTP processes can't lost-update or
+ * double-spend (#12). See docs/internals.md.
  */
 export declare class RefreshStore {
     private readonly path;
     private readonly masterKey;
-    constructor(path: string, masterKey: string);
+    private readonly log;
+    private readonly maxAgeMs;
+    private readonly idleMs;
+    private macKey;
+    private legacyEmpty;
+    constructor(path: string, masterKey: string, options?: RefreshStoreOptions);
+    private get timed();
+    private live;
+    /** Drop expired sessions in both formats; the count of those dropped. */
+    private prune;
+    /** A session written while the clock ran ahead would otherwise outlive its
+     * limit by the size of the jump. */
+    private clamp;
+    private key;
+    /** With `nowMs` (every issue and rotation), also clamps and prunes. */
     private load;
     private save;
-    issue(nowMs: number, sub: string, family?: string): string;
-    /** Rotate a presented refresh token; null if unknown OR if the presented
-     * token was already rotated away (reuse => the family is revoked). The
-     * record's sub is copied forward and returned so the caller can mint the
-     * matching access token without trusting anything client-supplied.
+    private emit;
+    private newFamilyId;
+    issue(nowMs: number, sub: string): string;
+    /** Rotate a presented refresh token; null if it is unknown, malformed, or
+     * rotated away (reuse => the family is revoked). The record's sub is copied
+     * forward and returned so the caller can mint the matching access token
+     * without trusting anything client-supplied.
      *
      * `accept` (optional) is called inside the store lock, before any mutation,
-     * with the record's sub. false: every active record of that sub is dropped
-     * and null returned. A throw: nothing is mutated and the error propagates,
-     * so the presented token stays valid. Absent: unchanged. */
+     * with the record's sub. false: every session of that sub is dropped and
+     * null returned. A throw: nothing is written and the error propagates, so
+     * the presented token stays valid. Absent: unchanged. */
     rotate(oldToken: string, nowMs: number, accept?: (sub: string) => boolean): {
         token: string;
         sub: string;
     } | null;
-    /** Drop every ACTIVE record minted under `sub` (linear scan under the store
-     * lock); the save then drops the spent entries of every family left with no
-     * active token. Returns the number of active tokens dropped. */
+    /** Drop every session minted under `sub`, in both formats (linear scan under
+     * the store lock); the save then drops the earlier-release spent entries of
+     * the families that died with them. Returns the number of sessions dropped. */
     purgeTenant(sub: string): number;
 }