mcp-google-multi 6.0.0-alpha.64 → 6.0.0-alpha.66

package/dist/arg-normalize.js

@@ -1,5 +1,5 @@
 import { echoName, echoNames, screenArguments, unknownArgEnvelope, } from './arg-strict.js';
-import { sliceClean } from './trim.js';
+import { logSafe, sliceClean } from './trim.js';
 // The SDK synthesizes input-validation failures as isError RESULTS, skipping
 // the handler entirely: no handler of ours runs, so no envelope exists and the
 // client gets free text. The text is prose in both SDK eras (v1 prefixed it
@@ -115,8 +115,9 @@ export function screenMessage(msg, opts, log = (l) => process.stderr.write(`${l}
     if (screened.unknown.length === 0 && screened.redundant.length === 0)
         return { action: 'forward', msg };
     const all = [...screened.unknown.map((u) => u.sent), ...screened.redundant];
-    // Key names only; argument VALUES never reach the log.
-    log(`[args] ${tool}: undeclared ${echoNames(all)}${opts.mode === 'warn' ? ' (dropped)' : ' (rejected)'}`);
+    // Key names only; argument VALUES never reach the log. The names are the
+    // caller's, so they are escaped here and only here: the envelope is JSON.
+    log(`[args] ${tool}: undeclared ${logSafe(echoNames(all), 600)}${opts.mode === 'warn' ? ' (dropped)' : ' (rejected)'}`);
     try {
         // Only ever a DECLARED key or the literal placeholder, so the metrics
         // closed-vocabulary rule holds: the caller's key is never persisted.

package/dist/cimd-cache.d.ts

@@ -0,0 +1,38 @@
+export declare const CIMD_TTL_MS: number;
+/** The oldest validated document still served while the cap is full or the issuer cannot answer. */
+export declare const CIMD_MAX_STALE_MS: number;
+/** Fetches at once. A lookup can outlive the fetch that gave up on it, so ssrf-guard caps its own lookups apart. */
+export declare const CIMD_MAX_IN_FLIGHT = 4;
+export declare const CIMD_CACHE_MAX = 256;
+export type CimdDocument = Record<string, unknown>;
+type CimdError = {
+    error: 'E_CIMD_SSRF_BLOCKED' | 'E_CIMD_INVALID';
+};
+/** `fresh` is true only for the request whose fetch produced the document. */
+export type CimdResolution = {
+    doc: CimdDocument;
+    fresh: boolean;
+} | {
+    busy: true;
+} | CimdError;
+export interface CimdCacheDeps {
+    fetch: (clientId: string) => Promise<CimdDocument>;
+    now: () => number;
+    log: (line: string) => void;
+}
+export declare class CimdClientCache {
+    private readonly deps;
+    private readonly entries;
+    private readonly inFlight;
+    private busyLoggedAt;
+    private busySuppressed;
+    constructor(deps: CimdCacheDeps);
+    get size(): number;
+    /** `validate` runs once per fetch, in the request that started it, and every
+     * request waiting on that fetch gets the same answer. */
+    resolve(clientId: string, validate: (doc: CimdDocument) => boolean): Promise<CimdResolution>;
+    private fetchFor;
+    private store;
+    private noteBusy;
+}
+export {};

package/dist/cimd-cache.js

@@ -0,0 +1,117 @@
+// H4 F6: GET /authorize is unauthenticated, and a client_id on an allowlisted
+// issuer with a path never seen before forces an outbound fetch. So the
+// fetches running at once are capped, one client_id is fetched once however
+// many requests wait on it, and only a document that passed validation is
+// kept. Errors are never cached (CIMD section 5.2), and a negative cache would
+// not help anyway: the attack varies the path, so its key never repeats.
+import { CimdHttpError, isTransientFetchError, SsrfBlockedError } from './ssrf-guard.js';
+import { logSafe } from './trim.js';
+export const CIMD_TTL_MS = 5 * 60_000;
+/** The oldest validated document still served while the cap is full or the issuer cannot answer. */
+export const CIMD_MAX_STALE_MS = 24 * 60 * 60_000;
+/** Fetches at once. A lookup can outlive the fetch that gave up on it, so ssrf-guard caps its own lookups apart. */
+export const CIMD_MAX_IN_FLIGHT = 4;
+export const CIMD_CACHE_MAX = 256;
+const BUSY_LOG_EVERY_MS = 60_000;
+export class CimdClientCache {
+    deps;
+    entries = new Map();
+    // One entry per running fetch, so its size is the number of permits taken.
+    inFlight = new Map();
+    busyLoggedAt = -Infinity;
+    busySuppressed = 0;
+    constructor(deps) {
+        this.deps = deps;
+    }
+    get size() {
+        return this.entries.size;
+    }
+    /** `validate` runs once per fetch, in the request that started it, and every
+     * request waiting on that fetch gets the same answer. */
+    async resolve(clientId, validate) {
+        const entry = this.entries.get(clientId);
+        const age = entry ? this.deps.now() - entry.at : 0;
+        if (entry && age < CIMD_TTL_MS)
+            return { doc: entry.doc, fresh: false };
+        if (entry && age >= CIMD_MAX_STALE_MS)
+            this.entries.delete(clientId);
+        const running = this.inFlight.get(clientId);
+        if (running) {
+            const out = await running;
+            return 'doc' in out ? { doc: out.doc, fresh: false } : out;
+        }
+        if (this.inFlight.size >= CIMD_MAX_IN_FLIGHT) {
+            // A flood of fresh paths is exactly when the cap is full, and a client
+            // that signed in before must still be able to.
+            const stale = this.entries.get(clientId);
+            if (stale)
+                return { doc: stale.doc, fresh: false };
+            this.noteBusy();
+            return { busy: true };
+        }
+        return this.fetchFor(clientId, validate);
+    }
+    async fetchFor(clientId, validate) {
+        // Never rejects: neither core nor a host installs an unhandledRejection
+        // handler, and a waiter that stopped listening must not take the process down.
+        let settle;
+        this.inFlight.set(clientId, new Promise((r) => (settle = r)));
+        let out = { error: 'E_CIMD_INVALID' };
+        try {
+            const doc = await this.deps.fetch(clientId);
+            if (validate(doc)) {
+                this.store(clientId, doc);
+                out = { doc, fresh: true };
+            }
+            else {
+                this.entries.delete(clientId);
+            }
+        }
+        catch (e) {
+            out = { error: e instanceof SsrfBlockedError ? 'E_CIMD_SSRF_BLOCKED' : 'E_CIMD_INVALID' };
+            // A document that went bad is never served stale. An issuer that is down
+            // or overloaded says nothing about the document, so the last good one
+            // stays and answers this fetch's requests too (stale-if-error; the error
+            // itself is never stored).
+            const stale = this.entries.get(clientId);
+            if (!saysNothingAboutDocument(e))
+                this.entries.delete(clientId);
+            else if (stale && this.deps.now() - stale.at < CIMD_MAX_STALE_MS)
+                out = { doc: stale.doc, fresh: false };
+            // #13: the detail goes to the log only; the caller gets a generic answer.
+            this.deps.log(`CIMD fetch failed for ${logSafe(clientId, 128)}: ${logSafe(e instanceof Error ? e.message : 'non-Error rejection', 200)}`);
+        }
+        finally {
+            this.inFlight.delete(clientId);
+            settle(out);
+        }
+        return out;
+    }
+    store(clientId, doc) {
+        this.entries.delete(clientId);
+        while (this.entries.size >= CIMD_CACHE_MAX) {
+            const oldest = this.entries.keys().next().value;
+            if (oldest === undefined)
+                break;
+            this.entries.delete(oldest);
+        }
+        this.entries.set(clientId, { doc, at: this.deps.now() });
+    }
+    // Over-cap requests arrive at whatever rate the caller likes.
+    noteBusy() {
+        const now = this.deps.now();
+        if (now >= this.busyLoggedAt && now - this.busyLoggedAt < BUSY_LOG_EVERY_MS) {
+            this.busySuppressed++;
+            return;
+        }
+        const suppressed = this.busySuppressed;
+        this.busyLoggedAt = now;
+        this.busySuppressed = 0;
+        this.deps.log(`CIMD busy: in-flight cap reached${suppressed > 0 ? ` (n=${suppressed} suppressed)` : ''}`);
+    }
+}
+function saysNothingAboutDocument(e) {
+    if (isTransientFetchError(e))
+        return true;
+    return e instanceof CimdHttpError && (e.status === 408 || e.status === 429 || e.status >= 500);
+}

package/dist/http-transport.d.ts

@@ -2,6 +2,7 @@ import type { McpServer, Transport } from "@modelcontextprotocol/server";
 import { type IncomingMessage, type ServerResponse } from 'node:http';
 import type { HttpConfig } from './http-config.js';
 import { type ArgShape, type StrictArgOptions, type ValidationEnvelopeOptions } from './arg-normalize.js';
+export { logSafe } from './trim.js';
 export type AuthOutcome = {
     ok: true;
     sub?: string;
@@ -73,7 +74,9 @@ export declare function parseOwnerEmails(env?: NodeJS.ProcessEnv): string[];
  * connector calls /mcp server-to-server with no Origin, BV-4). */
 export declare function originAllowed(origin: string | undefined, allowed: string[]): boolean;
 export declare function hostAllowed(host: string | undefined, allowed: string[]): boolean;
-/** JSON-RPC method name(s) for an observability log line — no params, no PII. */
+/** JSON-RPC method name(s) for an observability log line: no params, no PII.
+ * The method is the caller's: anything not shaped like a method name, which
+ * includes a value whose String() throws, is logged as `<invalid>`. */
 export declare function jsonRpcMethod(body: unknown): string;
 export declare class HttpTransportHost {
     private readonly opts;

package/dist/http-transport.js

@@ -5,6 +5,9 @@ import { NodeStreamableHTTPServerTransport } from "@modelcontextprotocol/node";
 // loopback-owner authenticator so the local-HTTP model works before the AS lands.
 import { createServer } from 'node:http';
 import { withArgNormalization, withValidationEnvelope } from './arg-normalize.js';
+import { logSafe } from './trim.js';
+// A host wrapping the log callbacks it hands core needs this, and trim has no package export.
+export { logSafe } from './trim.js';
 // A hung handler that keeps the connection open would otherwise hold the global
 // serialize() lock forever. Generous by default so slow-but-valid calls (large
 // Drive exports, fan-out) still finish; the point is only to guarantee release.
@@ -37,12 +40,25 @@ export function hostAllowed(host, allowed) {
     const bare = host.replace(/:\d+$/, '');
     return allowed.includes(host) || allowed.includes(bare);
 }
-/** JSON-RPC method name(s) for an observability log line — no params, no PII. */
+const METHOD_NAME = /^[A-Za-z0-9_./$-]{1,64}$/;
+const BATCH_METHODS_SHOWN = 4;
+/** JSON-RPC method name(s) for an observability log line: no params, no PII.
+ * The method is the caller's: anything not shaped like a method name, which
+ * includes a value whose String() throws, is logged as `<invalid>`. */
 export function jsonRpcMethod(body) {
-    const one = (b) => b && typeof b === 'object' && 'method' in b ? String(b.method) : undefined;
-    if (Array.isArray(body))
-        return body.map(one).filter(Boolean).join(',') || 'batch';
-    return one(body) ?? 'unknown';
+    const one = (b) => {
+        if (!b || typeof b !== 'object' || !('method' in b))
+            return undefined;
+        const m = b.method;
+        return typeof m === 'string' && METHOD_NAME.test(m) ? m : '<invalid>';
+    };
+    if (!Array.isArray(body))
+        return one(body) ?? 'unknown';
+    const names = body.map(one).filter((n) => n !== undefined);
+    if (names.length === 0)
+        return 'batch';
+    const rest = names.length - BATCH_METHODS_SHOWN;
+    return rest > 0 ? `${names.slice(0, BATCH_METHODS_SHOWN).join(',')},+${rest}` : names.join(',');
 }
 /** setTimeout fires at once for a delay above this, so a longer grace would
  * cut every connection immediately. */
@@ -160,7 +176,7 @@ export class HttpTransportHost {
                 finally {
                     // A throwing log must not reach the destroy below: the answer is sent.
                     try {
-                        this.log(`500 internal_error path=${pathOf(req)}: ${e instanceof Error ? e.message : 'non-Error throw'}`);
+                        this.log(`500 internal_error path=${pathOf(req)}: ${e instanceof Error ? logSafe(e.message, 200) : 'non-Error throw'}`);
                     }
                     catch {
                         // nowhere left to report it
@@ -292,12 +308,12 @@ export class HttpTransportHost {
     frontGuard(req, res) {
         const { allowedHosts, allowedOrigins } = this.opts.config;
         if (!hostAllowed(req.headers.host, allowedHosts)) {
-            this.log(`403 host_rejected host=${req.headers.host ?? ''}`);
+            this.log(`403 host_rejected host=${logSafe(req.headers.host ?? '', 64)}`);
             this.fail(res, 403, 'host_rejected', 'Host not allowed (DNS-rebinding guard).');
             return false;
         }
         if (!originAllowed(req.headers.origin, allowedOrigins)) {
-            this.log(`403 origin_rejected origin=${req.headers.origin ?? ''}`);
+            this.log(`403 origin_rejected origin=${logSafe(req.headers.origin ?? '', 64)}`);
             this.fail(res, 403, 'origin_rejected', 'Origin not allowed.');
             return false;
         }

package/dist/mcp-token.d.ts

@@ -1,7 +1,7 @@
 export declare const ACCESS_TTL_DEFAULT = 600;
 export declare const STATE_TTL_DEFAULT = 600;
 export declare const CODE_TTL_DEFAULT = 60;
-export declare const REPLAY_CAP_DEFAULT = 10000;
+export declare const REPLAY_CAP_DEFAULT = 100000;
 /** Derive the HS256 secret (32 bytes) from the provisioned MCP_JWT_KEY string. */
 export declare function jwtSecretFrom(jwtKey: string): Uint8Array;
 export interface AccessTokenParams {
@@ -46,8 +46,9 @@ export interface CodePayload {
     sub: string;
 }
 export declare function signState(payload: StatePayload, base: string, secret: Uint8Array, iat: number, ttlSec?: number): Promise<string>;
-export declare function verifyState(token: string, base: string, secret: Uint8Array): Promise<StatePayload & {
+export declare function verifyState(token: string, base: string, secret: Uint8Array, nowSec?: number): Promise<StatePayload & {
     jti: string;
+    exp: number;
 }>;
 /** A re-auth link is handed out in a tool error, so it has to survive until
  * the user clicks it; an hour, not the 10-minute state TTL. */
@@ -64,21 +65,41 @@ export declare function verifyReauthLink(base: string, secret: Uint8Array, param
 /** A pending-authorization artifact for the DCR consent interstitial (same
  * shape as `state`, distinct purpose so the two can't be confused). */
 export declare function signPending(payload: StatePayload, base: string, secret: Uint8Array, iat: number, ttlSec?: number): Promise<string>;
-export declare function verifyPending(token: string, base: string, secret: Uint8Array): Promise<StatePayload & {
+export declare function verifyPending(token: string, base: string, secret: Uint8Array, nowSec?: number): Promise<StatePayload & {
     jti: string;
+    exp: number;
 }>;
 export declare function signAuthzCode(payload: CodePayload, base: string, secret: Uint8Array, iat: number, ttlSec?: number): Promise<string>;
-export declare function verifyAuthzCode(token: string, base: string, secret: Uint8Array): Promise<CodePayload & {
+export declare function verifyAuthzCode(token: string, base: string, secret: Uint8Array, nowSec?: number): Promise<CodePayload & {
     jti: string;
+    exp: number;
 }>;
+/** `full`: there is no room without forgetting a jti that is still live. */
+export type ReplaySpend = 'ok' | 'replay' | 'full';
 export declare class ReplayGuard {
     private readonly cap;
     private readonly seen;
+    private earliest;
+    private sweptAt;
     constructor(cap?: number);
-    /** Record a jti as spent. Returns false if it was already spent (replay). */
+    /** Hold a slot for an artifact about to be handed out, so its spend can
+     * never meet a full guard. The flood then lands where the artifact is
+     * minted, and refusing there loses nothing. */
+    reserve(jti: string, ttlMs: number, nowMs: number): 'ok' | 'full';
+    /** Record a jti as spent. A full guard refuses instead of evicting a live
+     * jti: a flood of spends would otherwise make a spent artifact usable again,
+     * such as a callback the browser binding refused (H4 F1). `artifactExpMs`
+     * keeps the record alive as long as the artifact itself, even when the clock
+     * stepped back between its signing and this spend. */
+    spend(jti: string, ttlMs: number, nowMs: number, artifactExpMs?: number): ReplaySpend;
+    /** Undo a spend whose next step could not go ahead. The slot stays held, so
+     * nothing is forgotten, and the artifact can be spent once more. */
+    unspend(jti: string): void;
+    /** `spend` as a boolean: false for a replay and for a full guard alike. */
     consume(jti: string, ttlMs: number, nowMs: number): boolean;
     get size(): number;
-    private evictExpired;
+    private record;
+    private room;
 }
 /** An earlier release's record, keyed by its live token. */
 export interface RefreshRecord {

package/dist/mcp-token.js

@@ -12,7 +12,7 @@ import { atomicWriteFileSync, withFileLock } from './fs-atomic.js';
 export const ACCESS_TTL_DEFAULT = 600; // seconds
 export const STATE_TTL_DEFAULT = 600;
 export const CODE_TTL_DEFAULT = 60;
-export const REPLAY_CAP_DEFAULT = 10_000;
+export const REPLAY_CAP_DEFAULT = 100_000;
 /** Derive the HS256 secret (32 bytes) from the provisioned MCP_JWT_KEY string. */
 export function jwtSecretFrom(jwtKey) {
     return new Uint8Array(deriveKey(jwtKey));
@@ -52,17 +52,19 @@ async function signArtifact(claims, purpose, base, secret, iat, ttlSec) {
         .setJti(newJti())
         .sign(secret);
 }
-async function verifyArtifact(token, purpose, base, secret) {
-    const { payload } = await jwtVerify(token, secret, { issuer: base });
+// `nowSec`: the caller's clock, so expiry is judged by the same clock as the
+// replay guard that records the artifact's spend.
+async function verifyArtifact(token, purpose, base, secret, nowSec) {
+    const { payload } = await jwtVerify(token, secret, { issuer: base, ...(nowSec !== undefined ? { currentDate: new Date(nowSec * 1000) } : {}) });
     if (payload.purpose !== purpose)
         throw new Error(`wrong artifact purpose (${String(payload.purpose)})`);
-    return { ...payload, jti: String(payload.jti ?? '') };
+    return { ...payload, jti: String(payload.jti ?? ''), exp: Number(payload.exp ?? 0) };
 }
 export function signState(payload, base, secret, iat, ttlSec = STATE_TTL_DEFAULT) {
     return signArtifact(payload, 'mcp_state', base, secret, iat, ttlSec);
 }
-export async function verifyState(token, base, secret) {
-    return (await verifyArtifact(token, 'mcp_state', base, secret));
+export async function verifyState(token, base, secret, nowSec) {
+    return (await verifyArtifact(token, 'mcp_state', base, secret, nowSec));
 }
 // --- alias_reauth link -------------------------------------------------------
 /** A re-auth link is handed out in a tool error, so it has to survive until
@@ -93,44 +95,97 @@ export function verifyReauthLink(base, secret, params, nowSec) {
 export function signPending(payload, base, secret, iat, ttlSec = STATE_TTL_DEFAULT) {
     return signArtifact(payload, 'mcp_pending', base, secret, iat, ttlSec);
 }
-export async function verifyPending(token, base, secret) {
-    return (await verifyArtifact(token, 'mcp_pending', base, secret));
+export async function verifyPending(token, base, secret, nowSec) {
+    return (await verifyArtifact(token, 'mcp_pending', base, secret, nowSec));
 }
 export function signAuthzCode(payload, base, secret, iat, ttlSec = CODE_TTL_DEFAULT) {
     return signArtifact(payload, 'mcp_code', base, secret, iat, ttlSec);
 }
-export async function verifyAuthzCode(token, base, secret) {
-    return (await verifyArtifact(token, 'mcp_code', base, secret));
+export async function verifyAuthzCode(token, base, secret, nowSec) {
+    return (await verifyArtifact(token, 'mcp_code', base, secret, nowSec));
 }
-// --- Replay guard (C10/C17: single-use, capped, TTL-evicted) ----------------
+/** A full guard refuses rather than sweeping again sooner than this. */
+const FULL_SWEEP_EVERY_MS = 1000;
 export class ReplayGuard {
     cap;
-    seen = new Map(); // jti -> expiry (ms)
+    seen = new Map();
+    // A lower bound on every entry's expiry: below it nothing can have expired.
+    earliest = Infinity;
+    sweptAt = -Infinity;
     constructor(cap = REPLAY_CAP_DEFAULT) {
         this.cap = cap;
     }
-    /** Record a jti as spent. Returns false if it was already spent (replay). */
-    consume(jti, ttlMs, nowMs) {
-        this.evictExpired(nowMs);
-        if (this.seen.has(jti))
-            return false;
-        if (this.seen.size >= this.cap) {
-            // drop the oldest-inserted entry to bound memory (C17)
-            const oldest = this.seen.keys().next().value;
-            if (oldest !== undefined)
-                this.seen.delete(oldest);
+    /** Hold a slot for an artifact about to be handed out, so its spend can
+     * never meet a full guard. The flood then lands where the artifact is
+     * minted, and refusing there loses nothing. */
+    reserve(jti, ttlMs, nowMs) {
+        if (!this.room(nowMs))
+            return 'full';
+        this.record(jti, nowMs + ttlMs, false);
+        return 'ok';
+    }
+    /** Record a jti as spent. A full guard refuses instead of evicting a live
+     * jti: a flood of spends would otherwise make a spent artifact usable again,
+     * such as a callback the browser binding refused (H4 F1). `artifactExpMs`
+     * keeps the record alive as long as the artifact itself, even when the clock
+     * stepped back between its signing and this spend. */
+    spend(jti, ttlMs, nowMs, artifactExpMs = 0) {
+        const exp = Math.max(nowMs + ttlMs, artifactExpMs);
+        const held = this.seen.get(jti);
+        if (held && held.exp > nowMs) {
+            if (held.spent)
+                return 'replay';
+            held.spent = true;
+            held.exp = Math.max(held.exp, exp);
+            return 'ok';
         }
-        this.seen.set(jti, nowMs + ttlMs);
-        return true;
+        if (held)
+            this.seen.delete(jti);
+        if (!this.room(nowMs))
+            return 'full';
+        this.record(jti, exp, true);
+        return 'ok';
+    }
+    /** Undo a spend whose next step could not go ahead. The slot stays held, so
+     * nothing is forgotten, and the artifact can be spent once more. */
+    unspend(jti) {
+        const held = this.seen.get(jti);
+        if (held)
+            held.spent = false;
+    }
+    /** `spend` as a boolean: false for a replay and for a full guard alike. */
+    consume(jti, ttlMs, nowMs) {
+        return this.spend(jti, ttlMs, nowMs) === 'ok';
     }
     get size() {
         return this.seen.size;
     }
-    evictExpired(nowMs) {
-        for (const [jti, exp] of this.seen) {
-            if (exp <= nowMs)
+    record(jti, exp, spent) {
+        this.seen.set(jti, { exp, spent });
+        if (exp < this.earliest)
+            this.earliest = exp;
+    }
+    // Expired entries are dropped only here, when the map is at the cap: a refusal
+    // costs O(1), and a sweep runs only once something can have expired, at most
+    // once a second. Walking the map from its head on every call is not cheap: a
+    // Map iterator steps over every deleted slot until the table is rebuilt.
+    room(nowMs) {
+        if (this.seen.size < this.cap)
+            return true;
+        if (nowMs < this.earliest)
+            return false;
+        if (nowMs >= this.sweptAt && nowMs - this.sweptAt < FULL_SWEEP_EVERY_MS)
+            return false;
+        this.sweptAt = nowMs;
+        let earliest = Infinity;
+        for (const [jti, e] of this.seen) {
+            if (e.exp <= nowMs)
                 this.seen.delete(jti);
+            else if (e.exp < earliest)
+                earliest = e.exp;
         }
+        this.earliest = earliest;
+        return this.seen.size < this.cap;
     }
 }
 /** Store files this release writes; an absent `format` is an earlier release's. */

package/dist/oauth-as.d.ts

@@ -122,7 +122,9 @@ export interface AuthServer {
     /** Mint a signed, single-use, TTL-bound clientless flow URL
      * (`${base}/authorize?flow=...&state=<signed>`). The tenantId/bundles ride
      * INSIDE the signed state, so nothing at /authorize or /callback trusts a
-     * caller-supplied identity. Inert unless something calls it. */
+     * caller-supplied identity. The URL works only on this AuthServer, and only
+     * until its process restarts: sign-in artifacts are signed with a key each
+     * buildAuthServer call generates. Inert unless something calls it. */
     mintFlowState: (opts: {
         flow: 'alias_add';
         alias: string;

package/dist/oauth-as.js

@@ -7,8 +7,11 @@
 // whole surface is exercised by an offline harness.
 import { createHash, randomBytes, timingSafeEqual } from 'node:crypto';
 import { isIPv4 } from 'node:net';
+import { decodeJwt } from 'jose';
 import { signAccessToken, verifyAccessToken, signState, verifyState, signAuthzCode, verifyAuthzCode, signReauthLink, verifyReauthLink, signPending, verifyPending, ReplayGuard, RefreshStore, STATE_TTL_DEFAULT, CODE_TTL_DEFAULT, ACCESS_TTL_DEFAULT, } from './mcp-token.js';
-import { fetchCimdDocument, SsrfBlockedError } from './ssrf-guard.js';
+import { fetchCimdDocument } from './ssrf-guard.js';
+import { CimdClientCache } from './cimd-cache.js';
+import { logSafe } from './trim.js';
 const CLAUDE_AI_FIXED_CALLBACK = 'https://claude.ai/api/mcp/auth_callback';
 // DCR (/register) is public + unauthenticated, so its in-memory store must be
 // bounded like every sibling store (the ReplayGuard cap) or a request loop
@@ -51,8 +54,8 @@ function json(res, status, body, extraHeaders = {}) {
     res.end(JSON.stringify(body));
     return true;
 }
-function errorPage(res, status, slug, message) {
-    res.writeHead(status, { 'Content-Type': 'text/plain' });
+function errorPage(res, status, slug, message, extraHeaders = {}) {
+    res.writeHead(status, { 'Content-Type': 'text/plain', ...extraHeaders });
     res.end(`${slug}: ${message}`);
     return true;
 }
@@ -61,6 +64,14 @@ class SubjectCheckUnavailable extends Error {
 function subjectUnavailable(res) {
     return json(res, 503, { error: 'temporarily_unavailable', message: 'the sign-in could not be checked right now; retry shortly' }, { 'Retry-After': '5' });
 }
+// Not invalid_client: clients and people read that as a permanent misconfiguration.
+function clientUnavailable(res) {
+    return json(res, 503, { error: 'temporarily_unavailable', message: 'the client could not be checked right now; retry shortly' }, { 'Retry-After': '5' });
+}
+// The replay guard is full: every slot holds a jti that is still live.
+function signInBusy(res) {
+    return errorPage(res, 503, 'E_SIGNIN_BUSY', 'sign-in is busy right now; retry in a minute', { 'Retry-After': '60' });
+}
 function redirect(res, location, extraHeaders = {}) {
     res.writeHead(302, { Location: location, ...extraHeaders });
     res.end();
@@ -177,6 +188,11 @@ export function buildAuthServer(config, deps = {}) {
     const base = config.base;
     const resource = config.resourceUri;
     const secret = config.secret;
+    // States, approvals and codes live minutes, and their single use rests on an
+    // in-memory replay guard that a restart empties. So they are signed with a
+    // key only this AuthServer holds: a restart invalidates every one in flight,
+    // instead of letting a spent or unreserved one pass the new, empty guard.
+    const flowSecret = new Uint8Array(randomBytes(32));
     const accessTtl = config.accessTtlSec ?? ACCESS_TTL_DEFAULT;
     const cimd = deps.fetchCimd ?? ((clientId) => fetchCimdDocument(clientId));
     const replay = deps.replayGuard ?? new ReplayGuard();
@@ -189,6 +205,26 @@ export function buildAuthServer(config, deps = {}) {
     }
     const refresh = deps.refreshStore ?? new RefreshStore(config.refreshStorePath, config.masterKey, { maxAgeSec: config.refreshMaxAgeSec, idleSec: config.refreshIdleSec, log });
     const nowSec = () => Math.floor(now() / 1000);
+    // A full guard is refused at whatever rate the caller likes, so its line is
+    // written at most once a minute (or at once after the clock stepped back).
+    let fullLoggedAt = -Infinity;
+    let fullSuppressed = 0;
+    const noteFull = (at) => {
+        if (at >= fullLoggedAt && at - fullLoggedAt < 60_000) {
+            fullSuppressed++;
+            return;
+        }
+        log(`replay guard full: sign-in refused${fullSuppressed > 0 ? ` (n=${fullSuppressed} suppressed)` : ''}`);
+        fullLoggedAt = at;
+        fullSuppressed = 0;
+    };
+    const spend = (artifact, ttlSec) => {
+        const at = now();
+        const r = replay.spend(artifact.jti, ttlSec * 1000, at, artifact.exp * 1000);
+        if (r === 'full')
+            noteFull(at);
+        return r;
+    };
     const resolveSubject = deps.resolveSubject ?? ((email) => (config.ownerEmails.includes(email) ? { sub: 'owner' } : null));
     const issHeader = { 'Cache-Control': 'no-store' };
     const prm = {
@@ -210,8 +246,7 @@ export function buildAuthServer(config, deps = {}) {
         authorization_response_iss_parameter_supported: true,
         scopes_supported: ['mcp:use'],
     };
-    const cimdCache = new Map();
-    const CIMD_CACHE_TTL_MS = 5 * 60_000;
+    const cimdClients = new CimdClientCache({ fetch: cimd, now, log });
     async function validateClient(clientId) {
         const reg = registered.get(clientId);
         if (reg)
@@ -229,47 +264,36 @@ export function buildAuthServer(config, deps = {}) {
             return { error: 'E_CIMD_INVALID', message: 'invalid client' };
         }
         if (scheme !== 'https:' || !config.cimdIssuers.includes(issuerHost)) {
-            log(`CIMD rejected: client_id ${clientId} issuer not allowlisted`);
+            // The issuer and a length, never the path: an attacker picks the path freely.
+            log(`CIMD rejected: issuer=${logSafe(`${scheme}//${issuerHost}`, 80)} not allowlisted client_id_len=${clientId.length}`);
             return { error: 'E_CIMD_INVALID', message: 'invalid client' };
         }
-        let doc;
-        const cached = cimdCache.get(clientId);
-        if (cached && cached.exp > now()) {
-            doc = cached.doc;
-        }
-        else {
-            try {
-                doc = await cimd(clientId);
-            }
-            catch (e) {
-                // #13: never echo internal fetch details to the caller (blind-SSRF
-                // oracle); log server-side, return a generic message.
-                log(`CIMD fetch failed for ${clientId}: ${e.message}`);
-                const slug = e instanceof SsrfBlockedError ? 'E_CIMD_SSRF_BLOCKED' : 'E_CIMD_INVALID';
-                return { error: slug, message: 'invalid client' };
-            }
-            cimdCache.set(clientId, { doc, exp: now() + CIMD_CACHE_TTL_MS }); // #15
-        }
-        if (doc.client_id !== clientId)
-            return { error: 'E_CIMD_INVALID', message: 'invalid client' };
-        const uris = Array.isArray(doc.redirect_uris) ? doc.redirect_uris : [];
-        if (uris.length === 0)
-            return { error: 'E_CIMD_INVALID', message: 'invalid client' };
-        // C6 #14: warn on a localhost-only redirect set (loopback impersonation).
-        if (uris.every((u) => { try {
+        // #15: cached only once it validates; the cache logs a failed fetch.
+        const got = await cimdClients.resolve(clientId, (doc) => doc.client_id === clientId && Array.isArray(doc.redirect_uris) && doc.redirect_uris.length > 0);
+        if ('busy' in got)
+            return got;
+        // #13: never echo internal fetch details to the caller (blind-SSRF oracle).
+        if ('error' in got)
+            return { error: got.error, message: 'invalid client' };
+        const uris = got.doc.redirect_uris;
+        // C6 #14: warn on a localhost-only redirect set (loopback impersonation),
+        // once per fetch rather than on every sign-in the cache serves.
+        if (got.fresh && uris.every((u) => { try {
             return isLoopbackHostname(new URL(u).hostname);
         }
         catch {
             return false;
         } })) {
-            log(`client ${clientId} advertises only loopback redirect_uris`);
+            log(`client ${logSafe(clientId, 128)} advertises only loopback redirect_uris`);
         }
         return { redirect_uris: uris, dcr: false };
     }
     function escapeHtml(s) {
         return s.replace(/[&<>"']/g, (c) => ({ '&': '&amp;', '<': '&lt;', '>': '&gt;', '"': '&quot;', "'": '&#39;' })[c]);
     }
-    async function toGoogle(res, sp) {
+    /** `incoming`: the artifact spent to get here. If no slot is left for the
+     * new state it is unspent, so retrying it works once a slot frees. */
+    async function toGoogle(res, sp, incoming) {
         // H4 F1: without this, a Google URL minted here and forwarded to someone
         // else signs THEM in and hands their subject to the starting client.
         const headers = {};
@@ -279,7 +303,16 @@ export function buildAuthServer(config, deps = {}) {
             sp = { ...sp, bind };
             headers['Set-Cookie'] = `${bindCookieName(base, bind)}=${value}; ${bindCookieAttrs(base, STATE_TTL_DEFAULT)}`;
         }
-        const state = await signState(sp, base, secret, nowSec());
+        const state = await signState(sp, base, flowSecret, nowSec());
+        // Its /callback must find a slot even while a flood fills the guard, or a
+        // refusal there (the browser binding) could not be recorded.
+        const at = now();
+        if (replay.reserve(String(decodeJwt(state).jti), STATE_TTL_DEFAULT * 1000, at) === 'full') {
+            if (incoming)
+                replay.unspend(incoming);
+            noteFull(at);
+            return signInBusy(res);
+        }
         const authUrl = deps.buildGoogleAuthUrl
             ? deps.buildGoogleAuthUrl({ flow: sp.flow, alias: sp.alias, state, bundles: sp.bundles })
             : `https://accounts.google.com/o/oauth2/v2/auth?state=${encodeURIComponent(state)}`;
@@ -298,22 +331,25 @@ export function buildAuthServer(config, deps = {}) {
             }
             let pending;
             try {
-                pending = await verifyPending(form.pending ?? '', base, secret);
+                pending = await verifyPending(form.pending ?? '', base, flowSecret, nowSec());
             }
             catch {
                 return errorPage(res, 400, 'E_STATE_INVALID', 'the approval is invalid or expired');
             }
-            // Only the client leg signs pendings, and it is always the owner sign-in;
-            // a pending signed before that rule (flow=alias_reauth) is refused here.
+            // Only the client leg signs pendings, and it is always the owner sign-in.
+            // Defence in depth: a pending from an earlier release, which could carry
+            // flow=alias_reauth, was signed with MCP_JWT_KEY and no longer verifies.
             if (pending.flow !== 'owner_gate') {
                 return errorPage(res, 400, 'E_STATE_INVALID', 'the approval is invalid or expired');
             }
-            if (!replay.consume(pending.jti, STATE_TTL_DEFAULT * 1000, now())) {
+            const spent = spend(pending, STATE_TTL_DEFAULT);
+            if (spent === 'full')
+                return signInBusy(res);
+            if (spent === 'replay')
                 return errorPage(res, 400, 'E_STATE_INVALID', 'this approval was already used');
-            }
             const { jti: _drop, ...sp } = pending;
             void _drop;
-            return toGoogle(res, sp);
+            return toGoogle(res, sp, pending.jti);
         }
         const q = url.searchParams;
         const clientId = q.get('client_id') ?? '';
@@ -330,7 +366,7 @@ export function buildAuthServer(config, deps = {}) {
         if (q.get('flow') === 'alias_add' && !clientId) {
             let minted;
             try {
-                minted = await verifyState(q.get('state') ?? '', base, secret);
+                minted = await verifyState(q.get('state') ?? '', base, flowSecret, nowSec());
             }
             catch {
                 return errorPage(res, 400, 'E_STATE_INVALID', 'the add-account link is invalid, expired, or tampered');
@@ -338,12 +374,14 @@ export function buildAuthServer(config, deps = {}) {
             if (minted.flow !== 'alias_add' || !minted.alias || !minted.tenantId) {
                 return errorPage(res, 400, 'E_STATE_INVALID', 'the add-account link is malformed');
             }
-            if (!replay.consume(minted.jti, STATE_TTL_DEFAULT * 1000, now())) {
+            const spent = spend(minted, STATE_TTL_DEFAULT);
+            if (spent === 'full')
+                return signInBusy(res);
+            if (spent === 'replay')
                 return errorPage(res, 400, 'E_STATE_INVALID', 'this add-account link was already used');
-            }
             const { jti: _spent, ...sp } = minted;
             void _spent;
-            return toGoogle(res, sp);
+            return toGoogle(res, sp, minted.jti);
         }
         // In-call re-auth (BV-1): a user-clicked `flow=alias_reauth` link has NO
         // client leg — no code is delivered to any client, the refreshed token is
@@ -366,6 +404,8 @@ export function buildAuthServer(config, deps = {}) {
         if (!clientId)
             return json(res, 400, { error: 'invalid_request', message: 'client_id required', iss: base }, issHeader);
         const client = await validateClient(clientId);
+        if ('busy' in client)
+            return clientUnavailable(res);
         if ('error' in client)
             return json(res, 400, { error: 'invalid_client', message: client.message, iss: base }, issHeader);
         // (2) exact redirect_uri match BEFORE minting anything (open-redirect defense)
@@ -399,7 +439,7 @@ export function buildAuthServer(config, deps = {}) {
         // it — their redirect_uris come from an issuer-allowlisted document a rogue
         // cannot forge, so there is nothing to spoof.
         if (client.dcr) {
-            const pendingToken = await signPending(statePayload, base, secret, nowSec());
+            const pendingToken = await signPending(statePayload, base, flowSecret, nowSec());
             res.writeHead(200, { 'Content-Type': 'text/html; charset=utf-8', 'Cache-Control': 'no-store', 'Content-Security-Policy': "frame-ancestors 'none'", 'X-Frame-Options': 'DENY' });
             res.end(`<!doctype html><meta charset=utf-8><title>Authorize access</title>` +
                 `<body style="font-family:system-ui,sans-serif;max-width:36em;margin:3em auto;line-height:1.5">` +
@@ -419,14 +459,16 @@ export function buildAuthServer(config, deps = {}) {
         const stateToken = url.searchParams.get('state') ?? '';
         let st;
         try {
-            st = await verifyState(stateToken, base, secret);
+            st = await verifyState(stateToken, base, flowSecret, nowSec());
         }
         catch {
             return errorPage(res, 400, 'E_STATE_INVALID', 'state is invalid, expired, or tampered');
         }
-        if (!replay.consume(st.jti, STATE_TTL_DEFAULT * 1000, now())) {
+        const spent = spend(st, STATE_TTL_DEFAULT);
+        if (spent === 'full')
+            return signInBusy(res);
+        if (spent === 'replay')
             return errorPage(res, 400, 'E_STATE_INVALID', 'state has already been used (replay)');
-        }
         // After the spend, so a refused callback URL cannot be replayed from the
         // browser that holds the cookie; before the exchange and resolveSubject.
         if (st.flow === 'owner_gate') {
@@ -446,7 +488,7 @@ export function buildAuthServer(config, deps = {}) {
         catch (e) {
             // The detail can name proxies and hosts; it goes to the log, not the browser.
             const detail = e instanceof Error ? e.message : typeof e === 'string' ? e : 'non-Error rejection';
-            log(`callback exchange failed flow=${st.flow}: ${detail.replace(/[\r\n]+/g, ' ')}`);
+            log(`callback exchange failed flow=${st.flow}: ${logSafe(detail, 300)}`);
             return errorPage(res, 400, 'invalid_grant', 'Google could not complete the sign-in; start again from your app');
         }
         if (st.flow === 'alias_add') {
@@ -464,17 +506,17 @@ export function buildAuthServer(config, deps = {}) {
             }
             catch (e) {
                 // Any rejection reason, even none, must still reach this answer.
-                log(`alias_add bind failed for "${st.alias}": ${e instanceof Error ? e.message : typeof e === 'string' ? e : 'non-Error rejection'}`);
+                log(`alias_add bind failed for "${logSafe(st.alias, 64)}": ${logSafe(e instanceof Error ? e.message : typeof e === 'string' ? e : 'non-Error rejection', 200)}`);
                 return errorPage(res, 500, 'E_ALIAS_ADD_FAILED', 'the account could not be saved; try the link again or ask for a fresh one');
             }
             if (refusal) {
                 // The slug lands in a text/plain body; keep it a bare identifier.
                 const slug = typeof refusal.slug === 'string' && /^[A-Za-z0-9_]+$/.test(refusal.slug) ? refusal.slug : 'access_denied';
                 const message = typeof refusal.message === 'string' && refusal.message ? refusal.message : 'the account could not be linked';
-                log(`alias_add refused for "${st.alias}": ${slug}`);
+                log(`alias_add refused for "${logSafe(st.alias, 64)}": ${logSafe(slug, 64)}`);
                 return errorPage(res, 403, slug, message);
             }
-            log(`callback ok flow=alias_add alias=${st.alias}`);
+            log(`callback ok flow=alias_add alias=${logSafe(st.alias, 64)}`);
             res.writeHead(200, { 'Content-Type': 'text/html' });
             res.end(`<!doctype html><meta charset=utf-8><p>Connected "${escapeHtml(st.alias)}". You can close this window and retry your request.</p>`);
             return true;
@@ -490,7 +532,7 @@ export function buildAuthServer(config, deps = {}) {
             const gotEmail = (exchanged.email ?? '').toLowerCase();
             const expected = (deps.aliasEmail?.(st.alias) ?? '').toLowerCase();
             if (!expected || !gotEmail || gotEmail !== expected) {
-                log(`alias_reauth identity mismatch for "${st.alias}" (got ${gotEmail || 'none'})`);
+                log(`alias_reauth identity mismatch for "${logSafe(st.alias, 64)}" (got ${logSafe(gotEmail || 'none', 254)})`);
                 return errorPage(res, 403, 'access_denied', 'the Google account you signed in with is not the one configured for this alias');
             }
             // A completion without a refresh token (a Google URL built without
@@ -498,7 +540,7 @@ export function buildAuthServer(config, deps = {}) {
             // dies within the hour. Keep the stored token instead.
             const refreshToken = exchanged.tokens.refresh_token;
             if (typeof refreshToken !== 'string' || refreshToken === '') {
-                log(`alias_reauth for "${st.alias}" returned no refresh token; stored token kept`);
+                log(`alias_reauth for "${logSafe(st.alias, 64)}" returned no refresh token; stored token kept`);
                 return errorPage(res, 400, 'E_REAUTH_INCOMPLETE', 'Google did not return a long-lived token, so the stored one was kept. Open the re-auth link again and approve access.');
             }
             const granted = typeof exchanged.tokens.scope === 'string' ? exchanged.tokens.scope : undefined;
@@ -508,13 +550,13 @@ export function buildAuthServer(config, deps = {}) {
             // for an hour and the Google URL's scope is not signed, so a narrower
             // grant is not necessarily the account holder's choice.
             if (missing.length > 0 && deps.hasToken?.(st.alias)) {
-                log(`alias_reauth for "${st.alias}" granted ${missing.length} fewer scope(s); stored token kept`);
+                log(`alias_reauth for "${logSafe(st.alias, 64)}" granted ${missing.length} fewer scope(s); stored token kept`);
                 res.writeHead(400, { 'Content-Type': 'text/html' });
                 res.end(`<!doctype html><meta charset=utf-8><p>E_SCOPE_NOT_GRANTED: Google did not grant ${missing.length} requested scope(s): ${listed}, so the stored access for "${escapeHtml(st.alias)}" was kept. Ask for a fresh re-auth link and leave every box ticked.</p>`);
                 return true;
             }
             deps.writeToken?.(st.alias, exchanged.tokens);
-            log(`callback ok flow=alias_reauth alias=${st.alias}`);
+            log(`callback ok flow=alias_reauth alias=${logSafe(st.alias, 64)}`);
             // With no stored token a partial grant still beats none; say what is missing.
             const gap = missing.length
                 ? `<p>Google did not grant ${missing.length} requested scope(s): ${listed}. Ask for a fresh re-auth link and leave every box ticked to restore them.</p>`
@@ -534,7 +576,7 @@ export function buildAuthServer(config, deps = {}) {
             const s = st.client_state ? `&state=${encodeURIComponent(st.client_state)}` : '';
             return redirect(res, `${st.redirect_uri}${sep}error=access_denied${s}&iss=${iss}`);
         }
-        const authzCode = await signAuthzCode({ redirect_uri: st.redirect_uri, code_challenge: st.code_challenge, resource: st.resource, sub: subject.sub }, base, secret, nowSec());
+        const authzCode = await signAuthzCode({ redirect_uri: st.redirect_uri, code_challenge: st.code_challenge, resource: st.resource, sub: subject.sub }, base, flowSecret, nowSec());
         log('callback ok flow=owner_gate');
         const sep = st.redirect_uri.includes('?') ? '&' : '?';
         const s = st.client_state ? `&state=${encodeURIComponent(st.client_state)}` : '';
@@ -553,14 +595,16 @@ export function buildAuthServer(config, deps = {}) {
         if (grant === 'authorization_code') {
             let code;
             try {
-                code = await verifyAuthzCode(form.code ?? '', base, secret);
+                code = await verifyAuthzCode(form.code ?? '', base, flowSecret, nowSec());
             }
             catch {
                 return json(res, 400, { error: 'invalid_grant', message: 'authorization code invalid or expired' });
             }
-            if (!replay.consume(code.jti, CODE_TTL_DEFAULT * 1000, now())) {
+            const spent = spend(code, CODE_TTL_DEFAULT);
+            if (spent === 'full')
+                return subjectUnavailable(res);
+            if (spent === 'replay')
                 return json(res, 400, { error: 'invalid_grant', message: 'authorization code already redeemed' });
-            }
             if (form.redirect_uri !== code.redirect_uri) {
                 return json(res, 400, { error: 'invalid_grant', message: 'redirect_uri mismatch' });
             }
@@ -577,7 +621,9 @@ export function buildAuthServer(config, deps = {}) {
                     active = deps.subjectActive(code.sub);
                 }
                 catch (e) {
-                    log(`token deferred grant=authorization_code: subject check failed: ${e instanceof Error ? e.message : 'non-Error throw'}`);
+                    log(`token deferred grant=authorization_code: subject check failed: ${e instanceof Error ? logSafe(e.message, 200) : 'non-Error throw'}`);
+                    // Nothing was issued and PKCE passed, so the retry the 503 asks for may redeem it.
+                    replay.unspend(code.jti);
                     return subjectUnavailable(res);
                 }
                 if (!active) {
@@ -612,7 +658,7 @@ export function buildAuthServer(config, deps = {}) {
             catch (e) {
                 if (!(e instanceof SubjectCheckUnavailable))
                     throw e;
-                log(`token deferred grant=refresh_token: subject check failed: ${e.cause instanceof Error ? e.cause.message : 'non-Error throw'}`);
+                log(`token deferred grant=refresh_token: subject check failed: ${e.cause instanceof Error ? logSafe(e.cause.message, 200) : 'non-Error throw'}`);
                 return subjectUnavailable(res);
             }
             if (!next)
@@ -633,9 +679,18 @@ export function buildAuthServer(config, deps = {}) {
         catch {
             return json(res, 400, { error: 'invalid_client_metadata', message: 'a JSON body with redirect_uris is required' });
         }
-        const redirectUris = Array.isArray(parsed.redirect_uris) ? parsed.redirect_uris.map(String) : [];
+        // Shape first: a throw here is an unauthenticated 500 per request, and a
+        // `null` body has no properties while String() throws on {"toString":1}.
+        if (!parsed || typeof parsed !== 'object' || Array.isArray(parsed)) {
+            return json(res, 400, { error: 'invalid_client_metadata', message: 'a JSON body with redirect_uris is required' });
+        }
+        const raw = parsed.redirect_uris;
+        const redirectUris = Array.isArray(raw) ? raw : [];
         if (redirectUris.length === 0)
             return json(res, 400, { error: 'invalid_client_metadata', message: 'redirect_uris required' });
+        if (!redirectUris.every((u) => typeof u === 'string')) {
+            return json(res, 400, { error: 'invalid_client_metadata', message: 'every redirect_uri must be a string' });
+        }
         if (redirectUris.length > DCR_MAX_REDIRECT_URIS || redirectUris.some((u) => u.length > DCR_MAX_URI_LEN)) {
             return json(res, 400, { error: 'invalid_client_metadata', message: 'too many or oversized redirect_uris' });
         }
@@ -681,7 +736,7 @@ export function buildAuthServer(config, deps = {}) {
         // here would be a state no route verifies the way its flow needs.
         if (flow !== 'alias_add')
             throw new Error(`mintFlowState supports alias_add only, not ${String(flow)}`);
-        const state = await signState({ flow, client_id: '', redirect_uri: '', code_challenge: '', resource, alias, tenantId, bundles, nonce }, base, secret, nowSec());
+        const state = await signState({ flow, client_id: '', redirect_uri: '', code_challenge: '', resource, alias, tenantId, bundles, nonce }, base, flowSecret, nowSec());
         return `${base}/authorize?flow=${flow}&state=${encodeURIComponent(state)}`;
     };
     const reauthLink = (alias) => `${base}/authorize?flow=alias_reauth&${signReauthLink(base, secret, alias, nowSec())}`;

package/dist/ssrf-guard.d.ts

@@ -1,6 +1,12 @@
 export declare class SsrfBlockedError extends Error {
     constructor(message: string);
 }
+/** A non-2xx answer, kept apart so the cache can tell an issuer that is
+ * overloaded for now from one that says the document is gone. */
+export declare class CimdHttpError extends SsrfBlockedError {
+    readonly status: number;
+    constructor(status: number);
+}
 /** True if an IPv4 literal is in a blocked (private/link-local/loopback/etc) range. */
 export declare function isBlockedIPv4(ip: string): boolean;
 /** True if an IPv6 literal is blocked. */
@@ -10,28 +16,35 @@ export interface SsrfDeps {
     /** Injectable resolver (defaults to dns.lookup all-addresses) for tests. */
     resolveAll?: (host: string) => Promise<string[]>;
 }
+/** The most lookups started here that may be unsettled at once, abandoned ones included; process-wide, as the libuv threadpool is. */
+export declare const MAX_UNSETTLED_LOOKUPS = 4;
 /**
  * Assert a URL is safe to fetch server-side: HTTPS scheme, and every address
- * the host resolves to is public. Throws SsrfBlockedError otherwise, and
- * returns the resolved IPs.
+ * the host resolves to is public. Throws SsrfBlockedError otherwise, except
+ * that a resolver error with a transient code (a lookup that could not answer
+ * this time) is rethrown as is. Returns the resolved IPs.
  *
  * NOTE: this checks the host's addresses but does NOT pin them — the caller
  * fetches by hostname, so undici re-resolves at connect time (a check-time vs
  * connect-time TOCTOU / short-TTL rebind window). We deliberately do not pin
  * (CDN IPs rotate). The real anti-SSRF control is the caller-side issuer
  * allowlist (oauth-as validateClient rejects any non-allowlisted host BEFORE
- * fetching), so an attacker can't steer the fetch at an arbitrary hostname;
- * this public-range check is defense-in-depth on top of that.
+ * fetching, and fetchCimdDocument follows no redirect, so no hop leaves it),
+ * so an attacker can't steer the fetch at an arbitrary hostname; this
+ * public-range check is defense-in-depth on top of that.
  */
 export declare function assertPublicHttpsUrl(rawUrl: string, deps?: SsrfDeps): Promise<{
     url: URL;
     addresses: string[];
 }>;
 export interface CimdFetchOptions {
+    /** Default 5120: CIMD section 8.7 recommends at most 5 KB. */
     maxBytes?: number;
+    /** One attempt's cap, never past what is left of deadlineMs (default 5000). */
     timeoutMs?: number;
-    maxRedirects?: number;
-    /** Transient-network-error retries per hop (default 2 → up to 3 attempts). */
+    /** One budget for every attempt, DNS lookups and backoff included (default 8000). */
+    deadlineMs?: number;
+    /** Transient-network-error retries (default 1, so at most 2 attempts). */
     retries?: number;
     /** Base backoff between retries in ms; grows linearly per attempt (default 200). */
     retryBackoffMs?: number;
@@ -40,9 +53,10 @@ export interface CimdFetchOptions {
     sleepImpl?: (ms: number) => Promise<void>;
     ssrf?: SsrfDeps;
 }
+export declare function isTransientFetchError(e: unknown): boolean;
 /**
- * SSRF-guarded fetch of a CIMD client-metadata document (JSON). Every hop
- * (including redirects) is HTTPS + public-IP checked; response is size- and
- * time-capped. Returns the parsed JSON object.
+ * SSRF-guarded fetch of a CIMD client-metadata document (JSON): HTTPS and
+ * public-IP checked, no redirect followed, size-capped, and every attempt
+ * inside one deadline. Returns the parsed JSON object.
  */
 export declare function fetchCimdDocument(rawUrl: string, opts?: CimdFetchOptions): Promise<Record<string, unknown>>;

package/dist/ssrf-guard.js

@@ -1,8 +1,9 @@
 // B13 / C11: SSRF guard for every server-side fetch (the CIMD client_id doc).
 // D4 decision (dependencies-and-bv §2.2): a small AUDITED private-range check,
 // no dependency — HTTPS-only, resolve-then-check ALL addresses (anti-rebind),
-// and cap redirects / size / time. Blocks 10/8, 172.16/12, 192.168/16, 127/8,
-// 169.254/16, 0/8, multicast, ::1, fc00::/7, fe80::/10, and v4-mapped forms.
+// no redirects followed, and capped size and time. Blocks 10/8, 172.16/12,
+// 192.168/16, 127/8, 169.254/16, 0/8, multicast, ::1, fc00::/7, fe80::/10, and
+// v4-mapped forms.
 import { lookup } from 'node:dns/promises';
 import { isIPv4, isIPv6, BlockList } from 'node:net';
 export class SsrfBlockedError extends Error {
@@ -11,6 +12,16 @@ export class SsrfBlockedError extends Error {
         this.name = 'SsrfBlockedError';
     }
 }
+/** A non-2xx answer, kept apart so the cache can tell an issuer that is
+ * overloaded for now from one that says the document is gone. */
+export class CimdHttpError extends SsrfBlockedError {
+    status;
+    constructor(status) {
+        super(`CIMD fetch failed: HTTP ${status}`);
+        this.name = 'CimdHttpError';
+        this.status = status;
+    }
+}
 /** True if an IPv4 literal is in a blocked (private/link-local/loopback/etc) range. */
 export function isBlockedIPv4(ip) {
     const parts = ip.split('.').map(Number);
@@ -61,25 +72,45 @@ export function isBlockedIp(ip) {
         return isBlockedIPv6(ip);
     return true; // unparseable → block
 }
+/** The most lookups started here that may be unsettled at once, abandoned ones included; process-wide, as the libuv threadpool is. */
+export const MAX_UNSETTLED_LOOKUPS = 4;
+let unsettledLookups = 0;
+/** The lookup cap refused to start one: transient for the cache, but never retried, since the hung lookups it waits on outlast any backoff. */
+class LookupBusyError extends Error {
+    code = 'EAI_AGAIN';
+}
 async function defaultResolveAll(host) {
     // A bare IP literal needs no DNS; check it directly.
     if (isIPv4(host) || isIPv6(host))
         return [host];
-    const results = await lookup(host, { all: true });
-    return results.map((r) => r.address);
+    // getaddrinfo keeps its thread until it returns, even once no attempt waits
+    // on it, so a new lookup past the cap would only queue behind the hung ones.
+    if (unsettledLookups >= MAX_UNSETTLED_LOOKUPS) {
+        throw new LookupBusyError(`DNS lookup for ${host} not started: ${MAX_UNSETTLED_LOOKUPS} earlier lookups have not returned`);
+    }
+    unsettledLookups++;
+    try {
+        const results = await lookup(host, { all: true });
+        return results.map((r) => r.address);
+    }
+    finally {
+        unsettledLookups--;
+    }
 }
 /**
  * Assert a URL is safe to fetch server-side: HTTPS scheme, and every address
- * the host resolves to is public. Throws SsrfBlockedError otherwise, and
- * returns the resolved IPs.
+ * the host resolves to is public. Throws SsrfBlockedError otherwise, except
+ * that a resolver error with a transient code (a lookup that could not answer
+ * this time) is rethrown as is. Returns the resolved IPs.
  *
  * NOTE: this checks the host's addresses but does NOT pin them — the caller
  * fetches by hostname, so undici re-resolves at connect time (a check-time vs
  * connect-time TOCTOU / short-TTL rebind window). We deliberately do not pin
  * (CDN IPs rotate). The real anti-SSRF control is the caller-side issuer
  * allowlist (oauth-as validateClient rejects any non-allowlisted host BEFORE
- * fetching), so an attacker can't steer the fetch at an arbitrary hostname;
- * this public-range check is defense-in-depth on top of that.
+ * fetching, and fetchCimdDocument follows no redirect, so no hop leaves it),
+ * so an attacker can't steer the fetch at an arbitrary hostname; this
+ * public-range check is defense-in-depth on top of that.
  */
 export async function assertPublicHttpsUrl(rawUrl, deps = {}) {
     let url;
@@ -98,6 +129,11 @@ export async function assertPublicHttpsUrl(rawUrl, deps = {}) {
         addresses = await resolveAll(url.hostname);
     }
     catch (e) {
+        // A resolver that could not answer this time says nothing about the host,
+        // so the fetch may retry it; a name that does not exist stays a block.
+        const code = e?.code;
+        if (typeof code === 'string' && TRANSIENT_CODES.has(code))
+            throw e;
         throw new SsrfBlockedError(`DNS resolution failed for ${url.hostname}: ${e.message}`);
     }
     if (addresses.length === 0)
@@ -124,7 +160,7 @@ const TRANSIENT_CODES = new Set([
     'UND_ERR_CONNECT_TIMEOUT',
     'UND_ERR_SOCKET',
 ]);
-function isTransientFetchError(e) {
+export function isTransientFetchError(e) {
     if (e instanceof SsrfBlockedError)
         return false; // deterministic security/shape reject
     const name = e?.name;
@@ -140,73 +176,76 @@ function isTransientFetchError(e) {
         return true;
     return false;
 }
+// dns.lookup cannot be cancelled, so an attempt stops waiting on it instead.
+function untilAborted(work, signal) {
+    return new Promise((resolve, reject) => {
+        const onAbort = () => reject(signal.reason);
+        signal.addEventListener('abort', onAbort, { once: true });
+        void work.then(resolve, reject).finally(() => signal.removeEventListener('abort', onAbort));
+    });
+}
 /**
- * SSRF-guarded fetch of a CIMD client-metadata document (JSON). Every hop
- * (including redirects) is HTTPS + public-IP checked; response is size- and
- * time-capped. Returns the parsed JSON object.
+ * SSRF-guarded fetch of a CIMD client-metadata document (JSON): HTTPS and
+ * public-IP checked, no redirect followed, size-capped, and every attempt
+ * inside one deadline. Returns the parsed JSON object.
  */
 export async function fetchCimdDocument(rawUrl, opts = {}) {
-    const maxBytes = opts.maxBytes ?? 64 * 1024;
+    const maxBytes = opts.maxBytes ?? 5120;
     const timeoutMs = opts.timeoutMs ?? 5000;
-    const maxRedirects = opts.maxRedirects ?? 3;
-    const retries = opts.retries ?? 2;
+    const deadline = Date.now() + (opts.deadlineMs ?? 8000);
+    const retries = opts.retries ?? 1;
     const backoffMs = opts.retryBackoffMs ?? 200;
     const doFetch = opts.fetchImpl ?? fetch;
     const sleep = opts.sleepImpl ?? ((ms) => new Promise((r) => setTimeout(r, ms)));
-    let current = rawUrl;
-    for (let hop = 0; hop <= maxRedirects; hop++) {
-        let redirectTo = null;
-        let doc = null;
-        // Retry transient connection failures IN PLACE. Each attempt re-runs the
-        // resolve-then-check so a retry can never skip the anti-rebind guard, and
-        // the timer is per-attempt (armed across the body read, #10).
-        for (let attempt = 0;; attempt++) {
-            await assertPublicHttpsUrl(current, opts.ssrf);
-            const controller = new AbortController();
-            const timer = setTimeout(() => controller.abort(), timeoutMs);
+    // Retry fast transient failures IN PLACE. Each attempt re-runs the
+    // resolve-then-check so a retry can never skip the anti-rebind guard, and
+    // the timer is per-attempt (armed across the lookup and the body read, #10).
+    for (let attempt = 0;; attempt++) {
+        const controller = new AbortController();
+        let timedOut = false;
+        const timer = setTimeout(() => {
+            timedOut = true;
+            controller.abort();
+        }, Math.max(0, Math.min(timeoutMs, deadline - Date.now())));
+        try {
+            await untilAborted(assertPublicHttpsUrl(rawUrl, opts.ssrf), controller.signal);
+            const res = await doFetch(rawUrl, { redirect: 'manual', signal: controller.signal, headers: { accept: 'application/json' } });
+            // CIMD section 5: a redirect is never followed. Only this URL passed the
+            // issuer allowlist, and a document behind a redirect could claim its client_id.
+            if (res.status >= 300 && res.status < 400)
+                throw new SsrfBlockedError('CIMD redirect refused');
+            if (!res.ok)
+                throw new CimdHttpError(res.status);
+            const text = await readCapped(res, maxBytes, controller);
+            let parsed;
             try {
-                const res = await doFetch(current, { redirect: 'manual', signal: controller.signal, headers: { accept: 'application/json' } });
-                if (res.status >= 300 && res.status < 400) {
-                    const loc = res.headers.get('location');
-                    if (!loc)
-                        throw new SsrfBlockedError('redirect without a Location header');
-                    redirectTo = loc;
-                    break;
-                }
-                if (!res.ok)
-                    throw new SsrfBlockedError(`CIMD fetch failed: HTTP ${res.status}`);
-                const text = await readCapped(res, maxBytes, controller);
-                let parsed;
-                try {
-                    parsed = JSON.parse(text);
-                }
-                catch {
-                    throw new SsrfBlockedError('CIMD document is not valid JSON');
-                }
-                if (typeof parsed !== 'object' || parsed === null || Array.isArray(parsed)) {
-                    throw new SsrfBlockedError('CIMD document is not a JSON object');
-                }
-                doc = parsed;
-                break;
+                parsed = JSON.parse(text);
             }
-            catch (e) {
-                if (attempt < retries && isTransientFetchError(e)) {
-                    await sleep(backoffMs * (attempt + 1));
-                    continue;
-                }
-                throw e;
+            catch {
+                throw new SsrfBlockedError('CIMD document is not valid JSON');
             }
-            finally {
-                clearTimeout(timer);
+            if (typeof parsed !== 'object' || parsed === null || Array.isArray(parsed)) {
+                throw new SsrfBlockedError('CIMD document is not a JSON object');
+            }
+            return parsed;
+        }
+        catch (e) {
+            // A refused status throws with the body unread, and only an abort hands
+            // that connection back; the controller is this attempt's alone.
+            controller.abort();
+            const wait = backoffMs * (attempt + 1);
+            // A timed-out attempt may leave a lookup hung on the threadpool, ours or
+            // fetch's own at connect time, and a retry would start another beside it.
+            if (!timedOut && !(e instanceof LookupBusyError) && attempt < retries && isTransientFetchError(e) && deadline - Date.now() > wait) {
+                await sleep(wait);
+                continue;
             }
+            throw e;
         }
-        if (redirectTo !== null) {
-            current = new URL(redirectTo, current).toString();
-            continue;
+        finally {
+            clearTimeout(timer);
         }
-        return doc;
     }
-    throw new SsrfBlockedError(`too many redirects (> ${maxRedirects})`);
 }
 /** Read a response body, aborting the moment it exceeds maxBytes (never buffers
  * an oversized body). Falls back to a capped arrayBuffer when there is no

package/dist/trim.d.ts

@@ -6,6 +6,11 @@ export interface CappedText {
 }
 export declare function capText(text: string, maxChars: number, offset?: number): CappedText;
 export declare function sliceClean(text: string, max: number): string;
+/** An untrusted value made fit for one log line: never throws, at most `max`
+ * characters of it (then `...(len=N)`), each unsafe character as a literal
+ * `\uXXXX`. Backslash stays as is, so a value already through here comes back
+ * unchanged and a clean short value keeps its exact text. */
+export declare function logSafe(value: unknown, max: number): string;
 /** Largest prefix whose JSON encoding (the wrapping quotes included) fits
  * `maxEncoded`. Slicing raw characters overshoots whenever the text contains
  * quotes or backslashes, which JSON.stringify doubles: the escape hatch's

package/dist/trim.js

@@ -11,6 +11,26 @@ export function sliceClean(text, max) {
     const sliced = text.slice(0, max);
     return /[\uD800-\uDBFF]$/.test(sliced) ? sliced.slice(0, -1) : sliced;
 }
+// C0, DEL and C1 (NEL, 8-bit CSI and OSC) can end a line or drive a terminal;
+// the line and paragraph separators end a line for many readers; the bidi and
+// invisible format controls make a line read differently from its bytes.
+const LOG_UNSAFE = /[\p{Cc}\u061c\u200e\u200f\u202a-\u202e\u2028\u2029\u2066-\u2069]/gu;
+/** An untrusted value made fit for one log line: never throws, at most `max`
+ * characters of it (then `...(len=N)`), each unsafe character as a literal
+ * `\uXXXX`. Backslash stays as is, so a value already through here comes back
+ * unchanged and a clean short value keeps its exact text. */
+export function logSafe(value, max) {
+    let text;
+    try {
+        text = String(value);
+    }
+    catch {
+        return '<unprintable>';
+    }
+    const cut = text.length > max ? sliceClean(text, max) : text;
+    const escaped = cut.replace(LOG_UNSAFE, (c) => `\\u${c.charCodeAt(0).toString(16).padStart(4, '0')}`);
+    return cut === text ? escaped : `${escaped}...(len=${text.length})`;
+}
 /** Largest prefix whose JSON encoding (the wrapping quotes included) fits
  * `maxEncoded`. Slicing raw characters overshoots whenever the text contains
  * quotes or backslashes, which JSON.stringify doubles: the escape hatch's

package/dist/usage-metrics.js

@@ -36,7 +36,7 @@ const ARG_KEY_RE = /^[A-Za-z][A-Za-z0-9_.]{0,63}$/;
 /** Union of every `error:` slug literal emitted anywhere in src/ (kept honest
  * by a set-equality grep test). Anything outside buckets to `other`. */
 export const KNOWN_ERROR_SLUGS = new Set([
-    'E_ALIAS_EXISTS', 'E_CIMD_INVALID', 'E_ENV_ACCOUNTS_MODE', 'E_MCP_TOKEN_INVALID',
+    'E_ALIAS_EXISTS', 'E_CIMD_INVALID', 'E_CIMD_SSRF_BLOCKED', 'E_ENV_ACCOUNTS_MODE', 'E_MCP_TOKEN_INVALID',
     'E_NO_DEFAULT_ACCOUNT', 'E_UNKNOWN_BUNDLE', 'E_VALIDATION', 'ambiguous',
     'api_not_enabled', 'auth_required', 'bad_request', 'binary', 'binary_unsupported',
     'confirmation_declined', 'diagnose_failed', 'discovery_unavailable', 'dispatch_timeout',

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "mcp-google-multi",
-  "version": "6.0.0-alpha.64",
+  "version": "6.0.0-alpha.66",
   "mcpName": "io.github.bakissation/mcp-google-multi",
   "description": "Local MCP server for Google Workspace (Gmail, Drive, Calendar, Sheets, Docs, Contacts, Tasks, Meet, Search Console, +Forms/Chat/Admin) across multiple accounts — OAuth-only, encrypted token storage, deny-by-default writes.",
   "type": "module",