mcp-google-multi 6.0.0-beta.2 → 6.0.0-beta.4

package/dist/oauth-consent.d.ts

@@ -1,4 +1,14 @@
 import { OAuth2Client } from 'googleapis-common';
+/** Google authorize-URL options for the owner's HTTP authorization server.
+ * alias_reauth asks for the alias's scopes plus openid/email, which /callback
+ * needs to bind the returned identity to the alias. It carries no login_hint:
+ * the link works without authentication, so a hint would hand the alias's
+ * address to anyone who opens it. Every other flow is identity-only. */
+export declare function ownerAuthUrlOptions(opts: {
+    flow: string;
+    alias?: string;
+    state: string;
+}, scopesFor: (alias: string) => string[]): Parameters<OAuth2Client['generateAuthUrl']>[0];
 /** GOOGLE_CLIENT_ID/SECRET absent — caller maps to E_CLIENT_CREDENTIALS_MISSING. */
 export declare class ClientCredentialsMissingError extends Error {
     constructor();

package/dist/oauth-consent.js

@@ -1,12 +1,24 @@
 import { OAuth2Client } from 'googleapis-common';
 import http from 'node:http';
 import { URL } from 'node:url';
-// Shared loopback OAuth consent (leg C of cc-auth), used by the account wizard
-// (B7) and the `auth --account` CLI. Live-server-safe: typed errors instead of
-// process.exit, and a timeout so a never-completed consent can't wedge a tool
-// call forever. The listener binds an EPHEMERAL loopback port (RFC 8252 §7.3;
-// Google Desktop clients accept any http://localhost:<port> redirect), so a
-// second local process on a fixed port can never break auth.
+// Shared loopback OAuth consent, used by the account wizard and `auth
+// --account`; a timeout keeps a never-completed consent from wedging a tool call forever.
+/** Google authorize-URL options for the owner's HTTP authorization server.
+ * alias_reauth asks for the alias's scopes plus openid/email, which /callback
+ * needs to bind the returned identity to the alias. It carries no login_hint:
+ * the link works without authentication, so a hint would hand the alias's
+ * address to anyone who opens it. Every other flow is identity-only. */
+export function ownerAuthUrlOptions(opts, scopesFor) {
+    if (opts.flow === 'alias_reauth' && opts.alias) {
+        return {
+            access_type: 'offline',
+            prompt: 'select_account consent',
+            scope: [...new Set([...scopesFor(opts.alias), 'openid', 'email'])],
+            state: opts.state,
+        };
+    }
+    return { scope: ['openid', 'email'], prompt: 'select_account', state: opts.state };
+}
 /** GOOGLE_CLIENT_ID/SECRET absent — caller maps to E_CLIENT_CREDENTIALS_MISSING. */
 export class ClientCredentialsMissingError extends Error {
     constructor() {
@@ -28,10 +40,8 @@ export class ConsentDeniedError extends Error {
         super(`E_CONSENT_DENIED: ${reason}`);
     }
 }
-// Surfaced after every successful consent: the expiry is invisible until the
-// token dies a week later as reauth_required, so the moment of success is the
-// one place the warning is guaranteed to be seen. Full walkthrough in
-// docs/google-cloud-setup.md.
+// Surfaced after every successful consent: the moment of success is the one
+// place this warning is guaranteed to be seen, before the token dies a week later as reauth_required.
 export const TESTING_MODE_WARNING = 'Heads-up: while your OAuth client\'s Publishing status is "Testing", Google expires refresh tokens after 7 days (weekly re-auth for every account). ' +
     'When your setup works, set it to "In production" at https://console.cloud.google.com/auth/audience. ' +
     'No verification review is needed for personal use; see docs/google-cloud-setup.md.';

package/dist/outbound-allowlist.js

@@ -1,8 +1,6 @@
-// Opt-in outbound recipient allowlist for unattended deployments: a
-// prompt-injection blast-radius control (a hijacked agent cannot mail, invite
-// or share outside the operator's list), a safety feature first and an
-// enterprise checkbox second. FREE-core forever (ee-definition-v0 handoff).
-// Off by default: an unset/empty GOOGLE_OUTBOUND_ALLOWLIST gates nothing.
+// Opt-in outbound recipient allowlist: a prompt-injection blast-radius
+// control (a hijacked agent cannot mail/invite/share outside the operator's list). Off by default.
+import { hints } from './hint-provider.js';
 /** Parse GOOGLE_OUTBOUND_ALLOWLIST: comma-separated addresses and @domain
  * suffixes ("a@b.com, @company.com"). null = feature off (nothing gated). */
 export function resolveOutboundAllowlist(env = process.env) {
@@ -34,6 +32,7 @@ export function outboundViolations(emails, env = process.env) {
 /** The standard error envelope for a blocked outbound target. */
 export function outboundDeniedEnvelope(kind, blocked, account, env = process.env) {
     const list = resolveOutboundAllowlist(env);
+    const rendered = hints()?.render({ kind: 'outbound_denied', what: kind, blocked, entries: list?.entries ?? [] });
     return {
         content: [
             {
@@ -41,8 +40,9 @@ export function outboundDeniedEnvelope(kind, blocked, account, env = process.env
                 text: JSON.stringify({
                     error: 'recipient_not_allowed',
                     message: `${kind} blocked by the outbound allowlist: ${blocked.join(', ')}.`,
-                    hint: `GOOGLE_OUTBOUND_ALLOWLIST is active (${(list?.entries ?? []).join(', ')}). ` +
-                        'The operator must add the address (or its @domain) to the list, or unset the variable, to allow this target.',
+                    hint: rendered?.hint ??
+                        (`GOOGLE_OUTBOUND_ALLOWLIST is active (${(list?.entries ?? []).join(', ')}). ` +
+                            'The operator must add the address (or its @domain) to the list, or unset the variable, to allow this target.'),
                     retriable: false,
                     account,
                 }),
@@ -56,10 +56,8 @@ export function checkOutbound(kind, emails, account, env = process.env) {
     const blocked = outboundViolations(emails, env);
     return blocked.length > 0 ? outboundDeniedEnvelope(kind, blocked, account, env) : null;
 }
-// Escape-hatch / generated-tool enforcement. Structured bodies are inspected
-// for the known recipient fields; RAW compose methods cannot be inspected
-// (base64 RFC 822), so with the allowlist active they are refused outright in
-// favor of the curated tools that enforce it.
+// RAW compose methods can't be inspected (base64 RFC 822), so with the
+// allowlist active they're refused outright in favor of the curated tools that enforce it.
 const RAW_SEND_METHODS = new Set(['gmail.users.messages.send', 'gmail.users.drafts.send', 'gmail.users.drafts.create', 'gmail.users.messages.insert', 'gmail.users.messages.import']);
 export function collectBodyRecipients(body) {
     const out = [];

package/dist/reauth-hint.d.ts

@@ -1,2 +1,2 @@
-export declare function setHttpReauthBase(base: string | null): void;
+export declare function setHttpReauthLink(linker: ((alias: string) => string) | null): void;
 export declare function reauthHint(account: string): string;

package/dist/reauth-hint.js

@@ -1,15 +1,16 @@
-// B13 in-call re-auth (BV-1): a dead/missing per-account Google token is a
-// leg-C failure. Over stdio the fix is the `auth --account` CLI; over HTTP the
-// user cannot run a CLI, so the hint becomes a clickable link into the AS's
-// clientless alias_reauth flow (${BASE}/authorize?flow=alias_reauth&alias=…).
-// The HTTP bootstrap sets the base when the AS starts; stdio never does.
-let httpReauthBase = null;
-export function setHttpReauthBase(base) {
-    httpReauthBase = base;
+// Over stdio the fix is the `auth --account` CLI; over HTTP it's a clickable,
+// server-signed link instead, installed by the AS bootstrap. See docs/internals.md.
+import { hints } from './hint-provider.js';
+let httpReauthLink = null;
+export function setHttpReauthLink(linker) {
+    httpReauthLink = linker;
 }
 export function reauthHint(account) {
-    if (httpReauthBase) {
-        return `Re-authenticate "${account}" in your browser, then retry: ${httpReauthBase}/authorize?flow=alias_reauth&alias=${encodeURIComponent(account)}`;
+    const rendered = hints()?.render({ kind: 'reauth', account });
+    if (rendered)
+        return rendered.hint;
+    if (httpReauthLink) {
+        return `Re-authenticate "${account}" in your browser, then retry: ${httpReauthLink(account)}`;
     }
     return `Run: npx mcp-google-multi auth --account ${account}`;
 }

package/dist/registry-transfer.d.ts

@@ -1,3 +1,8 @@
+/** Refuse-only for v1: export/import operate on the FLAT single-owner
+ * store. A tenant-namespaced layout means the bundle would either miss every
+ * tenant's tokens or exfiltrate all of them in one file — refuse instead.
+ * Returns the offending dir, or null when the store is flat. */
+export declare function refuseIfMultiTenant(dir?: string): string | null;
 export interface TransferBundle {
     manifest: {
         v: 1;

package/dist/registry-transfer.js

@@ -1,17 +1,26 @@
-// B19: encrypted registry export / import (account-registry.md). Moves a whole
-// setup to another machine. The bundle is encrypted under a user PASSPHRASE
-// (portable across machines with different MASTER_KEYs) via the token-store AES
-// primitives; the bundled <alias>.enc token files stay encrypted under the
-// SOURCE MASTER_KEY (double-locked), so the target needs the same MASTER_KEY to
-// use them. Secrets (MASTER_KEY / client secret) are never in the bundle.
+// Encrypted registry export/import: the bundle is passphrase-encrypted, but
+// the bundled <alias>.enc files stay double-locked under the SOURCE MASTER_KEY.
 import { existsSync, readFileSync, readdirSync } from 'node:fs';
 import * as readline from 'node:readline';
 import path from 'node:path';
-import { encryptToken, decryptToken } from './token-store.js';
+import { createCipheriv, createDecipheriv, randomBytes, scryptSync } from 'node:crypto';
 import { atomicWriteFileSync, atomicWriteWithLock } from './fs-atomic.js';
-import { configFilePath, CONFIG_VERSION } from './config-file.js';
+import { ALIAS_RE, configFilePath, CONFIG_VERSION, tenantsDir } from './config-file.js';
 import { getTokenDir } from './accounts.js';
-const ALIAS_RE = /^[a-zA-Z0-9_-]+$/;
+/** Refuse-only for v1: export/import operate on the FLAT single-owner
+ * store. A tenant-namespaced layout means the bundle would either miss every
+ * tenant's tokens or exfiltrate all of them in one file — refuse instead.
+ * Returns the offending dir, or null when the store is flat. */
+export function refuseIfMultiTenant(dir = tenantsDir()) {
+    try {
+        if (readdirSync(dir).length > 0)
+            return dir;
+    }
+    catch {
+        // absent or unreadable tenants/ = flat store
+    }
+    return null;
+}
 function resolveDeps(deps) {
     return {
         configPath: deps.configPath ?? configFilePath(),
@@ -48,15 +57,48 @@ export function buildTransferBundle(exportedAt, deps = {}) {
     }
     return { manifest: { v: 1, exportedAt, aliases: [...aliasSet].sort() }, config, tokens };
 }
+// v2: a REAL passphrase KDF (scrypt, per-bundle salt). v1 reused the token
+// store's unsalted-sha256 passphrase branch (CodeQL js/insufficient-password-hash) and is refused outright.
+const BUNDLE_VERSION = 2;
+const SCRYPT_PARAMS = { N: 1 << 15, r: 8, p: 1, maxmem: 64 * 1024 * 1024 };
+function bundleKey(passphrase, salt) {
+    return scryptSync(passphrase, salt, 32, SCRYPT_PARAMS);
+}
 export function encryptBundle(bundle, passphrase) {
-    return encryptToken(bundle, passphrase);
+    const salt = randomBytes(16);
+    const iv = randomBytes(12);
+    const cipher = createCipheriv('aes-256-gcm', bundleKey(passphrase, salt), iv);
+    const data = Buffer.concat([cipher.update(Buffer.from(JSON.stringify(bundle), 'utf8')), cipher.final()]);
+    const file = {
+        bv: BUNDLE_VERSION,
+        salt: salt.toString('base64'),
+        iv: iv.toString('base64'),
+        tag: cipher.getAuthTag().toString('base64'),
+        data: data.toString('base64'),
+    };
+    return JSON.stringify(file);
 }
 export class BundleDecryptError extends Error {
 }
 export function decryptBundle(contents, passphrase) {
+    let file;
+    try {
+        file = JSON.parse(contents);
+    }
+    catch {
+        throw new BundleDecryptError('The file is not a registry export bundle.');
+    }
+    if (file.v !== undefined && file.bv === undefined) {
+        throw new BundleDecryptError('This bundle uses the retired v1 prerelease format (weak passphrase derivation); re-export it from the source machine with the current version.');
+    }
+    if (file.bv !== BUNDLE_VERSION || !file.salt || !file.iv || !file.tag || !file.data) {
+        throw new BundleDecryptError('The file is not a valid registry export (bad envelope).');
+    }
     let obj;
     try {
-        obj = decryptToken(contents, passphrase);
+        const decipher = createDecipheriv('aes-256-gcm', bundleKey(passphrase, Buffer.from(file.salt, 'base64')), Buffer.from(file.iv, 'base64'));
+        decipher.setAuthTag(Buffer.from(file.tag, 'base64'));
+        obj = JSON.parse(Buffer.concat([decipher.update(Buffer.from(file.data, 'base64')), decipher.final()]).toString('utf8'));
     }
     catch {
         throw new BundleDecryptError('Could not decrypt the bundle — wrong passphrase or the file is corrupt.');
@@ -153,6 +195,11 @@ async function resolvePassphrase(prompt) {
     }
 }
 export async function runExportCli(argv) {
+    const mtDir = refuseIfMultiTenant();
+    if (mtDir) {
+        console.error(`E_MULTI_TENANT_EXPORT_REFUSED: tenant-namespaced token stores exist under ${mtDir}; account export only operates on a flat single-owner store.`);
+        return 2;
+    }
     const out = argFlag(argv, '--out');
     if (!out) {
         console.error('Usage: mcp-google-multi account export --out <bundle.enc>');
@@ -170,6 +217,11 @@ export async function runExportCli(argv) {
     return 0;
 }
 export async function runImportCli(argv) {
+    const mtDir = refuseIfMultiTenant();
+    if (mtDir) {
+        console.error(`E_MULTI_TENANT_EXPORT_REFUSED: tenant-namespaced token stores exist under ${mtDir}; account import only operates on a flat single-owner store.`);
+        return 2;
+    }
     const file = argv[argv.indexOf('import') + 1];
     if (!file || file.startsWith('--')) {
         console.error('Usage: mcp-google-multi account import <bundle.enc> [--replace]');

package/dist/registry.d.ts

@@ -1,6 +1,7 @@
 import type { McpServer } from "@modelcontextprotocol/server";
 import { z } from 'zod';
 import { type Policy } from './write-control.js';
+import { type AccountSet } from './accounts.js';
 import type { ArgShape } from './arg-normalize.js';
 import type { Metrics } from './usage-metrics.js';
 export type Cud = 'read' | 'create' | 'update' | 'delete';
@@ -37,18 +38,19 @@ export interface CatalogOperation {
      * real scope error rather than a bare "not found". */
     unreachable?: true;
 }
+/** The service a tool name belongs to: its prefix, unless overridden. */
+export declare function serviceOf(name: string): string;
 export declare function inferCud(name: string): Cud;
 export declare class ToolRegistry {
     private readonly server;
     private readonly metrics;
+    private readonly accounts;
     readonly tools: ToolEntry[];
     readonly policy: Policy;
     readonly registerTool: McpServer['registerTool'];
     private readonly revealed;
     private readonly jsonSchemaCache;
     private readonly argShapeCache;
-    /** Memoized isUngrantable verdict per tool: the answer depends on the frozen
-     * bundle catalog only, so it never changes within a process. */
     private readonly ungrantable;
     private readonly compactOutput;
     private registeringMeta;
@@ -57,9 +59,15 @@ export declare class ToolRegistry {
     /** Agent-toggled runtime overlay (discover_all / discover_reset): lifts a
      * lazy surface to curated without touching the configured mode. */
     private expanded;
-    constructor(server: McpServer, policy: Policy, mode?: DiscoveryMode, metrics?: Metrics | null);
+    constructor(server: McpServer, policy: Policy, mode?: DiscoveryMode, metrics?: Metrics | null, accounts?: () => AccountSet);
     registerMeta: McpServer['registerTool'];
     services(): string[];
+    /** The registry's OWN alias list: registration-time schema builders (the
+     * generated account enums) read this, never the process global. */
+    accountAliases(): readonly string[];
+    /** The registry's OWN account set: handlers needing an account's email or
+     * profile read this, never the process global. */
+    accountSet(): AccountSet;
     /** Declared input-schema keys + scalar kinds for one tool (tools/call arg
      * normalization; the kind drives value coercion on renamed keys). */
     argShape(name: string): ArgShape | undefined;
@@ -96,7 +104,7 @@ export declare class ToolRegistry {
     /** discover_all: advertise the full curated set at once. Idempotent. */
     expand(): boolean;
     /** discover_reset: back to the lean meta-only surface. Clears reveals too.
-     * BV-8: if a client mishandles a SHRINKING tools/list, this degrades to a
+     * If a client mishandles a SHRINKING tools/list, this degrades to a
      * no-op for that session — tools stay callable regardless (graceful
      * dispatch), zero correctness impact. */
     collapse(): boolean;
@@ -118,4 +126,5 @@ export declare class ToolRegistry {
     };
     installListHandler(): void;
     private toToolJson;
+    private withLiveAccountEnum;
 }