mitsupi 1.4.0 → 1.6.0

package/skills/google-workspace/SKILL.md

@@ -9,15 +9,29 @@ Use this skill for Google Workspace tasks (Gmail, Drive, Calendar, Docs, Sheets,
 
 ## Files
 
-- `scripts/auth.js` — OAuth login/status/clear
+- `scripts/auth.js` — OAuth login/status/clear + account enumeration
 - `scripts/workspace.js` — JavaScript execution based API runner
 
+## Account model (multi-account)
+
+This skill is **profile-based by email address**.
+
+- There is **no default account**.
+- Every API call must specify `--email <account@example.com>`.
+- Tokens are stored per-email under `~/.pi/google-workspace/tokens/`.
+
+Before running API calls, discover available signed-in accounts:
+
+```bash
+node scripts/auth.js accounts
+```
+
 ## Usage
 
-Always use `exec`.
+Always use `exec` and always provide `--email`.
 
 ```bash
-node scripts/workspace.js exec <<'JS'
+node scripts/workspace.js exec --email user@example.com <<'JS'
 const me = await workspace.whoAmI();
 const files = await workspace.call('drive', 'files.list', {
   pageSize: 5,
@@ -31,6 +45,7 @@ Available inside exec scripts:
 
 - `auth` (authorized OAuth client)
 - `google` (`googleapis` root)
+- `workspace.accountEmail` (selected profile email)
 - `workspace.call(service, methodPath, params, {version})`
 - `workspace.service(service, {version})`
 - `workspace.whoAmI()`
@@ -47,12 +62,41 @@ Optional flags:
 2. Keep payloads small (`fields`, `maxResults`, minimal props).
 3. Use `Promise.all` for independent requests.
 4. Never print token contents.
-5. Use `scripts/auth.js` if you get auth errors.
+5. If the user did not specify an account, run `node scripts/auth.js accounts` and choose/confirm an explicit email.
+6. If auth fails, first run `node scripts/auth.js accounts` to see known profiles.
+7. If account mismatch is possible, run `workspace.whoAmI()` in the selected profile.
+8. On 401/403/unauthorized errors, switch account (`--email ...`) or re-login that specific profile.
+
+## Unauthorized/account-switch playbook
+
+If a request fails with unauthorized/forbidden/insufficient permissions:
+
+1. Enumerate profiles:
+
+```bash
+node scripts/auth.js accounts
+```
+
+2. Retry with the intended account:
+
+```bash
+node scripts/workspace.js exec --email correct-user@example.com <<'JS'
+return await workspace.whoAmI();
+JS
+```
+
+3. If token is stale or missing scopes, re-login that account:
+
+```bash
+node scripts/auth.js login --email correct-user@example.com
+```
+
+4. Retry the original request with the same `--email`.
 
 ## Short Gmail counting example
 
 ```bash
-node scripts/workspace.js exec <<'JS'
+node scripts/workspace.js exec --email user@example.com <<'JS'
 const gmail = google.gmail({ version: 'v1', auth });
 
 let trash = 0;
@@ -76,7 +120,7 @@ JS
 ## Setup + auth
 
 ```bash
-node scripts/auth.js login
+node scripts/auth.js login --email user@example.com
 ```
 
 Notes:
@@ -87,6 +131,7 @@ Notes:
 - Useful diagnostics:
 
 ```bash
-node scripts/auth.js status
-node scripts/auth.js clear
+node scripts/auth.js accounts
+node scripts/auth.js status --email user@example.com
+node scripts/auth.js clear --email user@example.com
 ```

package/skills/google-workspace/scripts/auth.js

@@ -2,29 +2,33 @@
 
 const {
   CREDENTIALS_PATH,
-  TOKEN_PATH,
+  TOKENS_DIR,
   DEFAULT_SCOPES,
   authorize,
   clearToken,
   credentialsExist,
   formatScopes,
   getWorkspaceClientConfig,
+  listAccounts,
   loadToken,
+  normalizeEmail,
   resolveAuthMode,
+  tokenPathForEmail,
 } = require('./common');
 
 function printHelp() {
   console.log(`Google Workspace auth helper
 
 Usage:
-  node scripts/auth.js login [--scopes scope1,scope2,...]
-  node scripts/auth.js status
-  node scripts/auth.js clear
+  node scripts/auth.js login --email user@example.com [--scopes scope1,scope2,...]
+  node scripts/auth.js status --email user@example.com
+  node scripts/auth.js clear --email user@example.com
+  node scripts/auth.js accounts
 
 Environment overrides:
   GOOGLE_WORKSPACE_CONFIG_DIR
   GOOGLE_WORKSPACE_CREDENTIALS
-  GOOGLE_WORKSPACE_TOKEN
+  GOOGLE_WORKSPACE_TOKENS_DIR
   GOOGLE_WORKSPACE_AUTH_MODE            (local|cloud)
   GOOGLE_WORKSPACE_CLIENT_ID            (cloud mode)
   GOOGLE_WORKSPACE_CLOUD_FUNCTION_URL   (cloud mode)
@@ -36,10 +40,12 @@ function parseScopes(args) {
   if (idx === -1) {
     return DEFAULT_SCOPES;
   }
+
   const raw = args[idx + 1];
   if (!raw) {
     throw new Error('--scopes requires a value');
   }
+
   const scopes = formatScopes(raw);
   if (scopes.length === 0) {
     throw new Error('--scopes produced an empty scope list');
@@ -47,22 +53,63 @@ function parseScopes(args) {
   return scopes;
 }
 
+function parseRequiredEmail(args) {
+  const idx = args.indexOf('--email');
+  if (idx === -1) {
+    throw new Error('Missing required --email <account@example.com>');
+  }
+
+  const raw = args[idx + 1];
+  if (!raw) {
+    throw new Error('--email requires a value');
+  }
+
+  return normalizeEmail(raw);
+}
+
 async function doLogin(args) {
+  const email = parseRequiredEmail(args);
   const scopes = parseScopes(args);
-  await authorize({ scopes, interactive: true });
+
+  await authorize({ email, scopes, interactive: true });
+
   console.log('✅ Login successful. Token stored at:');
-  console.log(`   ${TOKEN_PATH}`);
+  console.log(`   ${tokenPathForEmail(email)}`);
+}
+
+function printTokenDetails(token) {
+  const now = Date.now();
+  const expiry = token.expiry_date || null;
+  const expired = expiry ? expiry < now : null;
+  const scopeCount = formatScopes(token.scope).length;
+
+  console.log('Token details:');
+  console.log(`  access_token: ${token.access_token ? 'present' : 'missing'}`);
+  console.log(`  refresh_token: ${token.refresh_token ? 'present' : 'missing'}`);
+  console.log(`  scopes: ${scopeCount}`);
+
+  if (expiry) {
+    console.log(`  expiry_date: ${new Date(expiry).toISOString()}`);
+    console.log(`  expired: ${expired ? 'yes' : 'no'}`);
+  } else {
+    console.log('  expiry_date: n/a');
+  }
 }
 
-function doStatus() {
+function doStatus(args) {
+  const email = parseRequiredEmail(args);
+
   console.log('Credentials file:');
   console.log(`  ${CREDENTIALS_PATH}`);
   console.log(`  Exists: ${credentialsExist() ? 'yes' : 'no'}`);
 
-  const token = loadToken();
+  const token = loadToken(email);
   const mode = resolveAuthMode(token);
   const workspaceCfg = getWorkspaceClientConfig();
 
+  console.log('\nSelected account:');
+  console.log(`  ${email}`);
+
   console.log('\nAuth mode:');
   console.log(`  ${mode}`);
   if (mode === 'cloud') {
@@ -72,34 +119,60 @@ function doStatus() {
   }
 
   console.log('\nToken file:');
-  console.log(`  ${TOKEN_PATH}`);
+  console.log(`  ${tokenPathForEmail(email)}`);
   console.log(`  Exists: ${token ? 'yes' : 'no'}`);
 
   if (!token) {
+    console.log('\nTip: sign in with:');
+    console.log(`  node scripts/auth.js login --email ${email}`);
     return;
   }
 
-  const now = Date.now();
-  const expiry = token.expiry_date || null;
-  const expired = expiry ? expiry < now : null;
-  const scopeCount = formatScopes(token.scope).length;
+  console.log('');
+  printTokenDetails(token);
+}
 
-  console.log('\nToken details:');
-  console.log(`  access_token: ${token.access_token ? 'present' : 'missing'}`);
-  console.log(`  refresh_token: ${token.refresh_token ? 'present' : 'missing'}`);
-  console.log(`  scopes: ${scopeCount}`);
+function doAccounts() {
+  const accounts = listAccounts();
 
-  if (expiry) {
-    console.log(`  expiry_date: ${new Date(expiry).toISOString()}`);
-    console.log(`  expired: ${expired ? 'yes' : 'no'}`);
-  } else {
-    console.log('  expiry_date: n/a');
+  console.log('Token store:');
+  console.log(`  ${TOKENS_DIR}`);
+
+  if (accounts.length === 0) {
+    console.log('\nNo signed-in accounts found.');
+    return;
+  }
+
+  console.log(`\nSigned-in accounts (${accounts.length}):`);
+
+  for (const account of accounts) {
+    console.log('');
+    console.log(`- email: ${account.email || '(unknown)'}`);
+    console.log(`  tokenFile: ${account.path}`);
+
+    if (account.error) {
+      console.log(`  error: ${account.error}`);
+      continue;
+    }
+
+    console.log(`  authMode: ${account.authMode || 'unknown'}`);
+    console.log(`  access_token: ${account.hasAccessToken ? 'present' : 'missing'}`);
+    console.log(`  refresh_token: ${account.hasRefreshToken ? 'present' : 'missing'}`);
+    console.log(`  scopes: ${account.scopes.length}`);
+
+    if (account.expiryDate) {
+      console.log(`  expiry_date: ${new Date(account.expiryDate).toISOString()}`);
+      console.log(`  expired: ${account.expired ? 'yes' : 'no'}`);
+    } else {
+      console.log('  expiry_date: n/a');
+    }
   }
 }
 
-function doClear() {
-  clearToken();
-  console.log('✅ Token cleared.');
+function doClear(args) {
+  const email = parseRequiredEmail(args);
+  clearToken(email);
+  console.log(`✅ Token cleared for ${email}.`);
 }
 
 async function main() {
@@ -116,12 +189,17 @@ async function main() {
   }
 
   if (command === 'status') {
-    doStatus();
+    doStatus(args);
+    return;
+  }
+
+  if (command === 'accounts') {
+    doAccounts();
     return;
   }
 
   if (command === 'clear') {
-    doClear();
+    doClear(args);
     return;
   }
 

package/skills/google-workspace/scripts/common.js

@@ -16,8 +16,8 @@ const CREDENTIALS_PATH =
   process.env.GOOGLE_WORKSPACE_CREDENTIALS ||
   path.join(CONFIG_DIR, 'credentials.json');
 
-const TOKEN_PATH =
-  process.env.GOOGLE_WORKSPACE_TOKEN || path.join(CONFIG_DIR, 'token.json');
+const TOKENS_DIR =
+  process.env.GOOGLE_WORKSPACE_TOKENS_DIR || path.join(CONFIG_DIR, 'tokens');
 
 const SKILL_ROOT = path.join(__dirname, '..');
 
@@ -26,6 +26,11 @@ const DEFAULT_CLIENT_ID =
 const DEFAULT_CLOUD_FUNCTION_URL =
   'https://google-workspace-extension.geminicli.com';
 
+const REQUIRED_IDENTITY_SCOPES = [
+  'https://www.googleapis.com/auth/userinfo.email',
+  'https://www.googleapis.com/auth/userinfo.profile',
+];
+
 const DEFAULT_SCOPES = [
   'https://www.googleapis.com/auth/documents',
   'https://www.googleapis.com/auth/drive',
@@ -33,7 +38,7 @@ const DEFAULT_SCOPES = [
   'https://www.googleapis.com/auth/chat.spaces',
   'https://www.googleapis.com/auth/chat.messages',
   'https://www.googleapis.com/auth/chat.memberships',
-  'https://www.googleapis.com/auth/userinfo.profile',
+  ...REQUIRED_IDENTITY_SCOPES,
   'https://www.googleapis.com/auth/gmail.modify',
   'https://www.googleapis.com/auth/directory.readonly',
   'https://www.googleapis.com/auth/presentations.readonly',
@@ -57,6 +62,10 @@ function ensureConfigDir() {
   fs.mkdirSync(CONFIG_DIR, { recursive: true });
 }
 
+function ensureTokensDir() {
+  fs.mkdirSync(TOKENS_DIR, { recursive: true });
+}
+
 function readJson(filePath) {
   return JSON.parse(fs.readFileSync(filePath, 'utf8'));
 }
@@ -122,8 +131,29 @@ function credentialsExist() {
   return fs.existsSync(CREDENTIALS_PATH);
 }
 
-function tokenExists() {
-  return fs.existsSync(TOKEN_PATH);
+function normalizeEmail(email) {
+  const normalized = String(email || '').trim().toLowerCase();
+  if (!normalized) {
+    throw new Error('Email is required. Pass --email <account@example.com>.');
+  }
+
+  if (!/^[^@\s]+@[^@\s]+$/.test(normalized)) {
+    throw new Error(`Invalid email address: ${email}`);
+  }
+
+  return normalized;
+}
+
+function tokenFilenameForEmail(email) {
+  return `${encodeURIComponent(normalizeEmail(email))}.json`;
+}
+
+function tokenPathForEmail(email) {
+  return path.join(TOKENS_DIR, tokenFilenameForEmail(email));
+}
+
+function tokenExists(email) {
+  return fs.existsSync(tokenPathForEmail(email));
 }
 
 function loadCredentialsFile() {
@@ -136,11 +166,84 @@ function loadCredentialsFile() {
   return readJson(CREDENTIALS_PATH);
 }
 
-function loadToken() {
-  if (!tokenExists()) {
+function loadToken(email) {
+  const tokenPath = tokenPathForEmail(email);
+  if (!fs.existsSync(tokenPath)) {
+    return null;
+  }
+  return readJson(tokenPath);
+}
+
+function decodeEmailFromTokenFilename(filename) {
+  if (!filename.endsWith('.json')) {
+    return null;
+  }
+
+  try {
+    return normalizeEmail(decodeURIComponent(filename.slice(0, -5)));
+  } catch {
     return null;
   }
-  return readJson(TOKEN_PATH);
+}
+
+function listAccounts() {
+  if (!fs.existsSync(TOKENS_DIR)) {
+    return [];
+  }
+
+  const results = [];
+  const entries = fs.readdirSync(TOKENS_DIR, { withFileTypes: true });
+
+  for (const entry of entries) {
+    if (!entry.isFile() || !entry.name.endsWith('.json')) {
+      continue;
+    }
+
+    const tokenPath = path.join(TOKENS_DIR, entry.name);
+    const emailFromFilename = decodeEmailFromTokenFilename(entry.name);
+
+    let token;
+    try {
+      token = readJson(tokenPath);
+    } catch (error) {
+      results.push({
+        email: emailFromFilename,
+        path: tokenPath,
+        error: `Failed to read token JSON: ${error.message}`,
+      });
+      continue;
+    }
+
+    let email = emailFromFilename;
+    if (token && token.__email) {
+      try {
+        email = normalizeEmail(token.__email);
+      } catch {
+        // Ignore malformed __email metadata and keep filename-derived email.
+      }
+    }
+
+    const expiryDate = token.expiry_date || null;
+
+    results.push({
+      email,
+      path: tokenPath,
+      authMode: token.__authMode === 'local' || token.__authMode === 'cloud'
+        ? token.__authMode
+        : null,
+      hasAccessToken: Boolean(token.access_token),
+      hasRefreshToken: Boolean(token.refresh_token),
+      scopes: formatScopes(token.scope),
+      expiryDate,
+      expired: expiryDate ? expiryDate < Date.now() : null,
+    });
+  }
+
+  return results.sort((a, b) => {
+    const left = a.email || '';
+    const right = b.email || '';
+    return left.localeCompare(right);
+  });
 }
 
 function createOAuthClientFromCredentials(credentialsJson) {
@@ -192,23 +295,31 @@ function resolveAuthMode(token) {
   return 'cloud';
 }
 
-function saveToken(token, mode) {
+function saveToken(email, token, mode) {
   ensureConfigDir();
+  ensureTokensDir();
+
+  const normalizedEmail = normalizeEmail(email);
+  const tokenPath = tokenPathForEmail(normalizedEmail);
+
   const payload = {
     ...token,
     __authMode: mode,
+    __email: normalizedEmail,
   };
-  fs.writeFileSync(TOKEN_PATH, JSON.stringify(payload, null, 2));
+
+  fs.writeFileSync(tokenPath, JSON.stringify(payload, null, 2));
   try {
-    fs.chmodSync(TOKEN_PATH, 0o600);
+    fs.chmodSync(tokenPath, 0o600);
   } catch {
     // Non-POSIX file systems can fail chmod. Ignore.
   }
 }
 
-function clearToken() {
-  if (tokenExists()) {
-    fs.rmSync(TOKEN_PATH);
+function clearToken(email) {
+  const tokenPath = tokenPathForEmail(email);
+  if (fs.existsSync(tokenPath)) {
+    fs.rmSync(tokenPath);
   }
 }
 
@@ -274,24 +385,57 @@ async function refreshViaCloudFunction(refreshToken) {
   return response.json();
 }
 
-async function interactiveLoginLocal(scopes) {
+function mergeWithIdentityScopes(scopes) {
+  return Array.from(new Set([...formatScopes(scopes), ...REQUIRED_IDENTITY_SCOPES]));
+}
+
+async function fetchAuthenticatedEmail(authClient) {
+  const google = getGoogleApis();
+  const oauth2 = google.oauth2({ version: 'v2', auth: authClient });
+  const response = await oauth2.userinfo.get();
+  const email = response?.data?.email;
+  if (!email) {
+    throw new Error(
+      'Authentication succeeded, but Google did not return an email address. ' +
+        'Ensure userinfo.email scope is granted.',
+    );
+  }
+  return normalizeEmail(email);
+}
+
+async function ensureExpectedEmail(authClient, expectedEmail) {
+  const normalizedExpectedEmail = normalizeEmail(expectedEmail);
+  const authenticatedEmail = await fetchAuthenticatedEmail(authClient);
+
+  if (authenticatedEmail !== normalizedExpectedEmail) {
+    throw new Error(
+      `Authenticated as ${authenticatedEmail}, but expected ${normalizedExpectedEmail}. ` +
+        'Sign in with the requested account and retry.',
+    );
+  }
+
+  return authenticatedEmail;
+}
+
+async function interactiveLoginLocal(scopes, email) {
   const { authenticate } = loadRuntimeDeps();
   console.error('ℹ️  Opening browser for Google OAuth login (local credentials)...');
 
   const authClient = await authenticate({
     keyfilePath: CREDENTIALS_PATH,
-    scopes,
+    scopes: mergeWithIdentityScopes(scopes),
   });
 
   if (!authClient.credentials || !authClient.credentials.access_token) {
     throw new Error('Authentication failed: no access token returned.');
   }
 
-  saveToken(authClient.credentials, 'local');
+  const normalizedEmail = await ensureExpectedEmail(authClient, email);
+  saveToken(normalizedEmail, authClient.credentials, 'local');
   return authClient;
 }
 
-async function interactiveLoginCloud(scopes) {
+async function interactiveLoginCloud(scopes, email) {
   const client = createCloudOAuthClient();
   const { cloudFunctionUrl } = getWorkspaceClientConfig();
 
@@ -312,7 +456,7 @@ async function interactiveLoginCloud(scopes) {
   const authUrl = client.generateAuthUrl({
     redirect_uri: cloudFunctionUrl,
     access_type: 'offline',
-    scope: scopes,
+    scope: mergeWithIdentityScopes(scopes),
     state,
     prompt: 'consent',
   });
@@ -436,15 +580,16 @@ async function interactiveLoginCloud(scopes) {
   });
 
   client.setCredentials(credentials);
-  saveToken(credentials, 'cloud');
+  const normalizedEmail = await ensureExpectedEmail(client, email);
+  saveToken(normalizedEmail, credentials, 'cloud');
   return client;
 }
 
-async function interactiveLogin(scopes, mode) {
+async function interactiveLogin(scopes, mode, email) {
   if (mode === 'local') {
-    return interactiveLoginLocal(scopes);
+    return interactiveLoginLocal(scopes, email);
   }
-  return interactiveLoginCloud(scopes);
+  return interactiveLoginCloud(scopes, email);
 }
 
 function stripInternalTokenFields(token) {
@@ -453,17 +598,20 @@ function stripInternalTokenFields(token) {
   }
   const clone = { ...token };
   delete clone.__authMode;
+  delete clone.__email;
   return clone;
 }
 
 async function authorize(options = {}) {
-  const scopes = options.scopes || DEFAULT_SCOPES;
+  const email = normalizeEmail(options.email);
+  const scopes = mergeWithIdentityScopes(options.scopes || DEFAULT_SCOPES);
   const interactive = options.interactive !== false;
 
   ensureConfigDir();
+  ensureTokensDir();
   loadRuntimeDeps();
 
-  const token = loadToken();
+  const token = loadToken(email);
   const mode = resolveAuthMode(token);
 
   const client =
@@ -473,9 +621,22 @@ async function authorize(options = {}) {
 
   if (!token) {
     if (!interactive) {
-      throw new Error(`No token found at ${TOKEN_PATH}. Run: node scripts/auth.js login`);
+      throw new Error(
+        `No token found for ${email} at ${tokenPathForEmail(email)}. ` +
+          `Run: node scripts/auth.js login --email ${email}`,
+      );
+    }
+    return interactiveLogin(scopes, mode, email);
+  }
+
+  if (token.__email) {
+    const tokenEmail = normalizeEmail(token.__email);
+    if (tokenEmail !== email) {
+      throw new Error(
+        `Token metadata mismatch. Requested ${email} but token is tagged as ${tokenEmail}. ` +
+          `Delete it and sign in again: node scripts/auth.js clear --email ${email}`,
+      );
     }
-    return interactiveLogin(scopes, mode);
   }
 
   client.setCredentials(stripInternalTokenFields(token));
@@ -493,7 +654,7 @@ async function authorize(options = {}) {
           refreshed.credentials.refresh_token || client.credentials.refresh_token,
       };
       client.setCredentials(merged);
-      saveToken(merged, 'local');
+      saveToken(email, merged, 'local');
       return client;
     }
 
@@ -505,15 +666,18 @@ async function authorize(options = {}) {
       refresh_token: client.credentials.refresh_token,
     };
     client.setCredentials(merged);
-    saveToken(merged, 'cloud');
+    saveToken(email, merged, 'cloud');
     return client;
   }
 
   if (!interactive) {
-    throw new Error('Token is expired and no refresh token is available. Run login again.');
+    throw new Error(
+      `Token for ${email} is expired and no refresh token is available. ` +
+        `Run: node scripts/auth.js login --email ${email}`,
+    );
   }
 
-  return interactiveLogin(scopes, mode);
+  return interactiveLogin(scopes, mode, email);
 }
 
 function formatScopes(value) {
@@ -532,15 +696,20 @@ function formatScopes(value) {
 module.exports = {
   CONFIG_DIR,
   CREDENTIALS_PATH,
-  TOKEN_PATH,
+  TOKENS_DIR,
   DEFAULT_SCOPES,
   DEFAULT_VERSIONS,
+  REQUIRED_IDENTITY_SCOPES,
   authorize,
   clearToken,
   credentialsExist,
   formatScopes,
   getGoogleApis,
   getWorkspaceClientConfig,
+  listAccounts,
   loadToken,
+  normalizeEmail,
   resolveAuthMode,
+  tokenExists,
+  tokenPathForEmail,
 };