mmggws 0.1.0 → 0.1.2

package/README.md

@@ -2,10 +2,18 @@
 
 Zero-config launcher for the `abom` Google Workspace MCP server.
 
-## Claude Code
+## One command (Claude Code + Claude Desktop)
 
 ```bash
-claude mcp add abom -e ABOM_TOOLSETS=core -- npx -y mmggws
+npx mmggws install
+```
+
+Registers `abom` with both Claude Code and Claude Desktop on macOS, Linux, and Windows, each set to launch `npx -y mmggws`. Restart Claude Desktop afterward. Flags: `--clients`, `--scope`, `--name`, `--toolsets`, `--disclosure`, `--dry-run`.
+
+## Claude Code (manual, single client)
+
+```bash
+claude mcp add google-workspace -e ABOM_TOOLSETS=core -- npx -y mmggws
 ```
 
 Running `abom` with no arguments starts the MCP server over stdio. If no Google token exists yet, ask Claude to call `auth_login`; it opens browser consent and stores OAuth tokens outside the package at `~/.config/gwmcp/token.json`.

package/bin/abom.js

@@ -4,13 +4,7 @@ const { spawn } = require("node:child_process");
 const { existsSync } = require("node:fs");
 const { join } = require("node:path");
 
-const targets = {
-  "darwin-arm64": "abom-darwin-arm64",
-  "darwin-x64": "abom-darwin-amd64",
-  "linux-arm64": "abom-linux-arm64",
-  "linux-x64": "abom-linux-amd64",
-  "win32-x64": "abom-windows-amd64.exe"
-};
+const { targets } = require("./targets");
 
 const target = `${process.platform}-${process.arch}`;
 const executable = targets[target];

package/bin/check-package.js

@@ -1,27 +1,12 @@
 #!/usr/bin/env node
 
-const { existsSync, statSync } = require("node:fs");
+const { existsSync, statSync, readFileSync } = require("node:fs");
 const { join } = require("node:path");
 const { spawnSync } = require("node:child_process");
+const { createHash } = require("node:crypto");
 
 const packageJson = require("../package.json");
-
-const targets = {
-  "darwin-arm64": "abom-darwin-arm64",
-  "darwin-x64": "abom-darwin-amd64",
-  "linux-arm64": "abom-linux-arm64",
-  "linux-x64": "abom-linux-amd64",
-  "win32-x64": "abom-windows-amd64.exe"
-};
-
-const required = [
-  "abom-darwin-arm64",
-  "abom-darwin-amd64",
-  "abom-linux-arm64",
-  "abom-linux-amd64",
-  "abom-windows-amd64.exe",
-  "SHA256SUMS"
-];
+const { targets, requiredArtifacts: required } = require("./targets");
 
 const vendorDir = join(__dirname, "..", "vendor");
 const missing = required.filter((name) => {
@@ -35,6 +20,36 @@ if (missing.length > 0) {
   process.exit(1);
 }
 
+// Verify each vendored binary against the bundled SHA256SUMS manifest so a
+// corrupted or swapped binary is caught before publish rather than by users.
+const expectedSums = new Map(
+  readFileSync(join(vendorDir, "SHA256SUMS"), "utf8")
+    .split("\n")
+    .map((line) => line.trim())
+    .filter(Boolean)
+    .map((line) => {
+      const [hash, name] = line.split(/\s+/);
+      return [name, hash];
+    })
+);
+
+const mismatched = required
+  .filter((name) => name !== "SHA256SUMS")
+  .flatMap((name) => {
+    const want = expectedSums.get(name);
+    if (!want) {
+      return [`${name} (no SHA256SUMS entry)`];
+    }
+    const got = createHash("sha256").update(readFileSync(join(vendorDir, name))).digest("hex");
+    return got === want ? [] : [`${name} (expected ${want}, got ${got})`];
+  });
+
+if (mismatched.length > 0) {
+  console.error(`abom: vendored binaries do not match SHA256SUMS: ${mismatched.join("; ")}`);
+  console.error("Re-run scripts/build-release.sh <version> and scripts/prepare-npm-package.sh <version>.");
+  process.exit(1);
+}
+
 const currentTarget = targets[`${process.platform}-${process.arch}`];
 if (currentTarget) {
   const binaryPath = join(vendorDir, currentTarget);

package/bin/targets.js

@@ -0,0 +1,16 @@
+// Single source of truth for the platform -> bundled-binary mapping shared by
+// the launcher (abom.js) and the prepublish guard (check-package.js). Keep this
+// list in step with the GOOS/GOARCH matrix in scripts/build-release.sh.
+const targets = {
+  "darwin-arm64": "abom-darwin-arm64",
+  "darwin-x64": "abom-darwin-amd64",
+  "linux-arm64": "abom-linux-arm64",
+  "linux-x64": "abom-linux-amd64",
+  "win32-x64": "abom-windows-amd64.exe"
+};
+
+// The artifacts a complete package must vendor: every mapped binary plus the
+// checksum manifest used to verify them.
+const requiredArtifacts = [...new Set(Object.values(targets)), "SHA256SUMS"];
+
+module.exports = { targets, requiredArtifacts };

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "mmggws",
-  "version": "0.1.0",
+  "version": "0.1.2",
   "description": "Zero-config launcher for the abom Google Workspace MCP server",
   "bin": {
     "abom": "bin/abom.js"

package/vendor/SHA256SUMS

@@ -1,5 +1,5 @@
-90a250ef598a6fd0dfdc9ae46dfb865d1717f22257f47cac030a752252d5e370  abom-darwin-amd64
-5ff18fff07b704630306e35d44681d1bb12ed95534f7547e3357999bdd1ee110  abom-darwin-arm64
-0ba872da21e67980e8e9433765988e42e45df7c3b1fc7363b407adcca4c1a009  abom-linux-amd64
-65422427a98159ec72ca9164c83bb60cf9add9135c4b16fa839cea0efca70d47  abom-linux-arm64
-0e71309cf63f1d613ca598e50cc59429b2768347d36492879d3f382bd7808318  abom-windows-amd64.exe
+b74b30a974da8634a76dbf11c0f9bbe771406f3d28162a768a805216f223b12e  abom-darwin-amd64
+69882cf9fe8aac555d2b9b05adf4515c80480a1051a5b106117442303b49f270  abom-darwin-arm64
+6bb14ca0b0a0437796a665ccb13adb31ed4461276344f9e8d47486a8fe127fab  abom-linux-amd64
+dba3679f3b3713a0f71ac2cfb787f1370171f41bba2e6683a7c8230efd1fe6cd  abom-linux-arm64
+c49cfead32f8b881a731e8caa19617c32512e0feb264c14c9a7f7a2c2be42409  abom-windows-amd64.exe