mmggws 0.1.0 → 0.1.1

package/README.md

@@ -5,7 +5,7 @@ Zero-config launcher for the `abom` Google Workspace MCP server.
 ## Claude Code
 
 ```bash
-claude mcp add abom -e ABOM_TOOLSETS=core -- npx -y mmggws
+claude mcp add google-workspace -e ABOM_TOOLSETS=core -- npx -y mmggws
 ```
 
 Running `abom` with no arguments starts the MCP server over stdio. If no Google token exists yet, ask Claude to call `auth_login`; it opens browser consent and stores OAuth tokens outside the package at `~/.config/gwmcp/token.json`.

package/bin/abom.js

@@ -4,13 +4,7 @@ const { spawn } = require("node:child_process");
 const { existsSync } = require("node:fs");
 const { join } = require("node:path");
 
-const targets = {
-  "darwin-arm64": "abom-darwin-arm64",
-  "darwin-x64": "abom-darwin-amd64",
-  "linux-arm64": "abom-linux-arm64",
-  "linux-x64": "abom-linux-amd64",
-  "win32-x64": "abom-windows-amd64.exe"
-};
+const { targets } = require("./targets");
 
 const target = `${process.platform}-${process.arch}`;
 const executable = targets[target];

package/bin/check-package.js

@@ -1,27 +1,12 @@
 #!/usr/bin/env node
 
-const { existsSync, statSync } = require("node:fs");
+const { existsSync, statSync, readFileSync } = require("node:fs");
 const { join } = require("node:path");
 const { spawnSync } = require("node:child_process");
+const { createHash } = require("node:crypto");
 
 const packageJson = require("../package.json");
-
-const targets = {
-  "darwin-arm64": "abom-darwin-arm64",
-  "darwin-x64": "abom-darwin-amd64",
-  "linux-arm64": "abom-linux-arm64",
-  "linux-x64": "abom-linux-amd64",
-  "win32-x64": "abom-windows-amd64.exe"
-};
-
-const required = [
-  "abom-darwin-arm64",
-  "abom-darwin-amd64",
-  "abom-linux-arm64",
-  "abom-linux-amd64",
-  "abom-windows-amd64.exe",
-  "SHA256SUMS"
-];
+const { targets, requiredArtifacts: required } = require("./targets");
 
 const vendorDir = join(__dirname, "..", "vendor");
 const missing = required.filter((name) => {
@@ -35,6 +20,36 @@ if (missing.length > 0) {
   process.exit(1);
 }
 
+// Verify each vendored binary against the bundled SHA256SUMS manifest so a
+// corrupted or swapped binary is caught before publish rather than by users.
+const expectedSums = new Map(
+  readFileSync(join(vendorDir, "SHA256SUMS"), "utf8")
+    .split("\n")
+    .map((line) => line.trim())
+    .filter(Boolean)
+    .map((line) => {
+      const [hash, name] = line.split(/\s+/);
+      return [name, hash];
+    })
+);
+
+const mismatched = required
+  .filter((name) => name !== "SHA256SUMS")
+  .flatMap((name) => {
+    const want = expectedSums.get(name);
+    if (!want) {
+      return [`${name} (no SHA256SUMS entry)`];
+    }
+    const got = createHash("sha256").update(readFileSync(join(vendorDir, name))).digest("hex");
+    return got === want ? [] : [`${name} (expected ${want}, got ${got})`];
+  });
+
+if (mismatched.length > 0) {
+  console.error(`abom: vendored binaries do not match SHA256SUMS: ${mismatched.join("; ")}`);
+  console.error("Re-run scripts/build-release.sh <version> and scripts/prepare-npm-package.sh <version>.");
+  process.exit(1);
+}
+
 const currentTarget = targets[`${process.platform}-${process.arch}`];
 if (currentTarget) {
   const binaryPath = join(vendorDir, currentTarget);

package/bin/targets.js

@@ -0,0 +1,16 @@
+// Single source of truth for the platform -> bundled-binary mapping shared by
+// the launcher (abom.js) and the prepublish guard (check-package.js). Keep this
+// list in step with the GOOS/GOARCH matrix in scripts/build-release.sh.
+const targets = {
+  "darwin-arm64": "abom-darwin-arm64",
+  "darwin-x64": "abom-darwin-amd64",
+  "linux-arm64": "abom-linux-arm64",
+  "linux-x64": "abom-linux-amd64",
+  "win32-x64": "abom-windows-amd64.exe"
+};
+
+// The artifacts a complete package must vendor: every mapped binary plus the
+// checksum manifest used to verify them.
+const requiredArtifacts = [...new Set(Object.values(targets)), "SHA256SUMS"];
+
+module.exports = { targets, requiredArtifacts };

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "mmggws",
-  "version": "0.1.0",
+  "version": "0.1.1",
   "description": "Zero-config launcher for the abom Google Workspace MCP server",
   "bin": {
     "abom": "bin/abom.js"

package/vendor/SHA256SUMS

@@ -1,5 +1,5 @@
-90a250ef598a6fd0dfdc9ae46dfb865d1717f22257f47cac030a752252d5e370  abom-darwin-amd64
-5ff18fff07b704630306e35d44681d1bb12ed95534f7547e3357999bdd1ee110  abom-darwin-arm64
-0ba872da21e67980e8e9433765988e42e45df7c3b1fc7363b407adcca4c1a009  abom-linux-amd64
-65422427a98159ec72ca9164c83bb60cf9add9135c4b16fa839cea0efca70d47  abom-linux-arm64
-0e71309cf63f1d613ca598e50cc59429b2768347d36492879d3f382bd7808318  abom-windows-amd64.exe
+7b90185547a359742750a76e4258a60cb9c4dc134c7b0f984a7bb0211aa16029  abom-darwin-amd64
+70e30f8a7227c60ad0e8dd6dce7692096249754e261172d9af2d2afac07c4f0e  abom-darwin-arm64
+dc92b66c9e62da8216988342e7be5dbcf4b7c8dcdedda82ba0da0e99e4a8c568  abom-linux-amd64
+bc93dd4076c92b98ef0669b1c7b66bbd1454d489955af71aa655748252cbff25  abom-linux-arm64
+b3fb4a5a8217d4273ee3e0a52889461afbaa489fbe6766c4765e9791f1865a2f  abom-windows-amd64.exe