neotoma 0.18.8 → 0.19.0

package/dist/actions.d.ts

@@ -180,6 +180,7 @@ export declare function storeStructuredForApi(params: {
         observation_index: number;
         entity_type: string;
         entity_id: string;
+        details?: Record<string, unknown>;
     }[] | undefined;
     warnings?: {
         code: string;

package/dist/actions.d.ts.map

@@ -1 +1 @@
-{"version":3,"file":"actions.d.ts","sourceRoot":"","sources":["../src/actions.ts"],"names":[],"mappings":"AAAA,OAAO,OAAO,MAAM,SAAS,CAAC;AAsC9B,OAAO,EAGL,KAAK,aAAa,EACnB,MAAM,6BAA6B,CAAC;AAarC,OAAO,EAGL,KAAK,aAAa,EAGnB,MAAM,4BAA4B,CAAC;AA4BpC,OAAO,EAQL,KAAK,sBAAsB,EAC5B,MAAM,4BAA4B,CAAC;AAuDpC,OAAO,EAiCL,KAAK,wBAAwB,EAE9B,MAAM,4BAA4B,CAAC;AA8CpC,6FAA6F;AAC7F,wBAAgB,qBAAqB,IAAI,sBAAsB,GAAG,IAAI,CAErE;AAED,eAAO,MAAM,GAAG,6CAAY,CAAC;AAqwB7B,kFAAkF;AAClF,eAAO,MAAM,4BAA4B,QAAS,CAAC;AAEnD;;;;;;;;;GASG;AACH,wBAAgB,sBAAsB,CAAC,GAAG,EAAE,MAAM,GAAG,SAAS,GAAG,MAAM,CAMtE;AAoBD,uFAAuF;AACvF,eAAO,MAAM,wBAAwB,OAAQ,CAAC;AAE9C;;;;;;;GAOG;AACH,wBAAgB,kBAAkB,CAAC,GAAG,EAAE,MAAM,GAAG,SAAS,GAAG,MAAM,CAMlE;AAID;;;;;;GAMG;AACH,wBAAgB,qBAAqB,CACnC,GAAG,EAAE,OAAO,CAAC,OAAO,EACpB,GAAG,EAAE,OAAO,CAAC,QAAQ,EACrB,OAAO,CAAC,EAAE;IAAE,WAAW,CAAC,EAAE,MAAM,CAAC;IAAC,OAAO,CAAC,EAAE,MAAM,CAAC;IAAC,MAAM,CAAC,EAAE;QAAE,IAAI,EAAE,CAAC,GAAG,EAAE,MAAM,KAAK,IAAI,CAAA;KAAE,CAAA;CAAE,GAC7F,IAAI,CA4IN;AAuBD;;;;GAIG;AACH,wBAAgB,gBAAgB,CAAC,EAAE,EAAE,MAAM,EAAE,GAAG,GAAE,MAAM,CAAC,UAAwB,GAAG,OAAO,CA+B1F;AAmCD;;;;;;;;;;;;;;;;;;;;;;;;GAwBG;AACH,wBAAgB,cAAc,CAAC,GAAG,EAAE,OAAO,CAAC,OAAO,GAAG,OAAO,CA2B5D;AA4PD;;;;;;GAMG;AACH,wBAAgB,uBAAuB,IAAI,MAAM,CA2BhD;AA47CD,KAAK,aAAa,GAAG;IACnB,IAAI,EAAE,MAAM,CAAC;IACb,MAAM,EAAE,MAAM,CAAC;CAChB,CAAC;AAEF,KAAK,cAAc,GAAG;IACpB,IAAI,EAAE,OAAO,CAAC;IACd,OAAO,EAAE,aAAa,CAAC;IACvB,aAAa,CAAC,EAAE,aAAa,GAAG,IAAI,CAAC;IACrC,WAAW,CAAC,EAAE,MAAM,CAAC;CACtB,CAAC;AAEF,KAAK,cAAc,GAAG,aAAa,GAAG,cAAc,CAAC;AA2CrD,4GAA4G;AAC5G,wBAAgB,0BAA0B,CAAC,GAAG,EAAE,IAAI,CAAC,OAAO,CAAC,OAAO,EAAE,QAAQ,GAAG,MAAM,CAAC,GAAG,OAAO,CAqBjG;AAED;;;;;;;;GAQG;AACH,wBAAgB,kCAAkC,CAChD,GAAG,EAAE,IAAI,CAAC,OAAO,CAAC,OAAO,EAAE,QAAQ,GAAG,MAAM,CAAC,GAC5C,OAAO,CAST;AAED,oHAAoH;AACpH,wBAAgB,6BAA6B,CAC3C,GAAG,EAAE,IAAI,CAAC,OAAO,CAAC,OAAO,EAAE,QAAQ,GAAG,MAAM,CAAC,GAC5C,OAAO,CAWT;AAED,mGAAmG;AACnG,wBAAgB,sBAAsB,CAAC,GAAG,EAAE,OAAO,CAAC,OAAO,GAAG,MAAM,CAanE;AAgHD;;;;;;;;;;;;;;;;GAgBG;AACH,wBAAsB,kBAAkB,CACtC,GAAG,EAAE,OAAO,CAAC,OAAO,EACpB,SAAS,EAAE,cAAc,GACxB,OAAO,CAAC,MAAM,GAAG,IAAI,CAAC,CAoCxB;AA69FD,KAAK,oBAAoB,GAAG;IAC1B,iBAAiB,EAAE,MAAM,CAAC;IAC1B,YAAY,CAAC,EAAE,MAAM,CAAC;IACtB,YAAY,CAAC,EAAE,MAAM,CAAC;IACtB,gBAAgB,CAAC,EAAE,MAAM,CAAC;IAC1B,gBAAgB,CAAC,EAAE,MAAM,CAAC;IAC1B,QAAQ,CAAC,EAAE,MAAM,CAAC,MAAM,EAAE,OAAO,CAAC,CAAC;CACpC,CAAC;AAuDF,wBAAsB,qBAAqB,CAAC,MAAM,EAAE;IAClD,MAAM,EAAE,MAAM,CAAC;IACf,QAAQ,EAAE,MAAM,CAAC,MAAM,EAAE,OAAO,CAAC,EAAE,CAAC;IACpC,cAAc,EAAE,MAAM,CAAC;IACvB,iBAAiB,CAAC,EAAE,OAAO,4BAA4B,EAAE,iBAAiB,CAAC;IAC3E,kFAAkF;IAClF,YAAY,CAAC,EAAE,MAAM,GAAG,IAAI,CAAC;IAC7B,cAAc,EAAE,MAAM,CAAC;IACvB,gBAAgB,CAAC,EAAE,MAAM,CAAC;IAC1B,aAAa,CAAC,EAAE,oBAAoB,EAAE,CAAC;IACvC,cAAc,CAAC,EAAE,wBAAwB,CAAC;IAC1C,sBAAsB,CAAC,EAAE,MAAM,CAAC;IAChC,MAAM,CAAC,EAAE,OAAO,CAAC;IACjB,MAAM,CAAC,EAAE,OAAO,CAAC;CAClB;;;;;;;;;;;;;;;;qBAm7BgB,MAAM;eACZ,MAAM;2BACM,MAAM;;;;;;cAlBnB,MAAM;iBACH,MAAM;2BACI,MAAM;qBACZ,MAAM;mBACR,MAAM;;;cA/BX,MAAM;gBACJ,MAAM;2BACK,MAAM;qBACZ,MAAM;mBACR,MAAM;wBACD,MAAM;uBACP,MAAM;;;;;mBAhQV,MAAM;qBACJ,MAAM;wBACH,MAAM,GAAG,IAAI;2BACV,MAAM;;wBAET,MAAM;uBACP,MAAM,EAAE;wBACP,MAAM;uBACP,MAAM;;kBAxYX,MAAM;oBACJ,MAAM;yBACD,MAAM;4BACH,MAAM;2BACP,MAAM;;;kBAQf,MAAM;yBACC,MAAM;iCACE,MAAM;sCACD,MAAM;;+BA4Xb,MAAM,CAAC,MAAM,EAAE,OAAO,CAAC,GAAG,IAAI;;;2BAwKlC,MAAM;0BACP,MAAM;0BACN,MAAM;;;;;;;;GA8b3B;AAygHD,wBAAsB,eAAe;;;eAmOpC"}
+{"version":3,"file":"actions.d.ts","sourceRoot":"","sources":["../src/actions.ts"],"names":[],"mappings":"AAAA,OAAO,OAAO,MAAM,SAAS,CAAC;AAsC9B,OAAO,EAGL,KAAK,aAAa,EACnB,MAAM,6BAA6B,CAAC;AAarC,OAAO,EAGL,KAAK,aAAa,EAGnB,MAAM,4BAA4B,CAAC;AA4BpC,OAAO,EAQL,KAAK,sBAAsB,EAC5B,MAAM,4BAA4B,CAAC;AAiEpC,OAAO,EAiCL,KAAK,wBAAwB,EAE9B,MAAM,4BAA4B,CAAC;AA8CpC,6FAA6F;AAC7F,wBAAgB,qBAAqB,IAAI,sBAAsB,GAAG,IAAI,CAErE;AAED,eAAO,MAAM,GAAG,6CAAY,CAAC;AAqwB7B,kFAAkF;AAClF,eAAO,MAAM,4BAA4B,QAAS,CAAC;AAEnD;;;;;;;;;GASG;AACH,wBAAgB,sBAAsB,CAAC,GAAG,EAAE,MAAM,GAAG,SAAS,GAAG,MAAM,CAMtE;AAoBD,uFAAuF;AACvF,eAAO,MAAM,wBAAwB,OAAQ,CAAC;AAE9C;;;;;;;GAOG;AACH,wBAAgB,kBAAkB,CAAC,GAAG,EAAE,MAAM,GAAG,SAAS,GAAG,MAAM,CAMlE;AAID;;;;;;GAMG;AACH,wBAAgB,qBAAqB,CACnC,GAAG,EAAE,OAAO,CAAC,OAAO,EACpB,GAAG,EAAE,OAAO,CAAC,QAAQ,EACrB,OAAO,CAAC,EAAE;IAAE,WAAW,CAAC,EAAE,MAAM,CAAC;IAAC,OAAO,CAAC,EAAE,MAAM,CAAC;IAAC,MAAM,CAAC,EAAE;QAAE,IAAI,EAAE,CAAC,GAAG,EAAE,MAAM,KAAK,IAAI,CAAA;KAAE,CAAA;CAAE,GAC7F,IAAI,CA4IN;AAuBD;;;;GAIG;AACH,wBAAgB,gBAAgB,CAAC,EAAE,EAAE,MAAM,EAAE,GAAG,GAAE,MAAM,CAAC,UAAwB,GAAG,OAAO,CA+B1F;AAmCD;;;;;;;;;;;;;;;;;;;;;;;;GAwBG;AACH,wBAAgB,cAAc,CAAC,GAAG,EAAE,OAAO,CAAC,OAAO,GAAG,OAAO,CA2B5D;AA+QD;;;;;;GAMG;AACH,wBAAgB,uBAAuB,IAAI,MAAM,CA2BhD;AAikDD,KAAK,aAAa,GAAG;IACnB,IAAI,EAAE,MAAM,CAAC;IACb,MAAM,EAAE,MAAM,CAAC;CAChB,CAAC;AAEF,KAAK,cAAc,GAAG;IACpB,IAAI,EAAE,OAAO,CAAC;IACd,OAAO,EAAE,aAAa,CAAC;IACvB,aAAa,CAAC,EAAE,aAAa,GAAG,IAAI,CAAC;IACrC,WAAW,CAAC,EAAE,MAAM,CAAC;CACtB,CAAC;AAEF,KAAK,cAAc,GAAG,aAAa,GAAG,cAAc,CAAC;AA2CrD,4GAA4G;AAC5G,wBAAgB,0BAA0B,CAAC,GAAG,EAAE,IAAI,CAAC,OAAO,CAAC,OAAO,EAAE,QAAQ,GAAG,MAAM,CAAC,GAAG,OAAO,CAqBjG;AAED;;;;;;;;GAQG;AACH,wBAAgB,kCAAkC,CAChD,GAAG,EAAE,IAAI,CAAC,OAAO,CAAC,OAAO,EAAE,QAAQ,GAAG,MAAM,CAAC,GAC5C,OAAO,CAST;AAED,oHAAoH;AACpH,wBAAgB,6BAA6B,CAC3C,GAAG,EAAE,IAAI,CAAC,OAAO,CAAC,OAAO,EAAE,QAAQ,GAAG,MAAM,CAAC,GAC5C,OAAO,CAWT;AAED,mGAAmG;AACnG,wBAAgB,sBAAsB,CAAC,GAAG,EAAE,OAAO,CAAC,OAAO,GAAG,MAAM,CAanE;AAgHD;;;;;;;;;;;;;;;;GAgBG;AACH,wBAAsB,kBAAkB,CACtC,GAAG,EAAE,OAAO,CAAC,OAAO,EACpB,SAAS,EAAE,cAAc,GACxB,OAAO,CAAC,MAAM,GAAG,IAAI,CAAC,CAoCxB;AA69FD,KAAK,oBAAoB,GAAG;IAC1B,iBAAiB,EAAE,MAAM,CAAC;IAC1B,YAAY,CAAC,EAAE,MAAM,CAAC;IACtB,YAAY,CAAC,EAAE,MAAM,CAAC;IACtB,gBAAgB,CAAC,EAAE,MAAM,CAAC;IAC1B,gBAAgB,CAAC,EAAE,MAAM,CAAC;IAC1B,QAAQ,CAAC,EAAE,MAAM,CAAC,MAAM,EAAE,OAAO,CAAC,CAAC;CACpC,CAAC;AAuDF,wBAAsB,qBAAqB,CAAC,MAAM,EAAE;IAClD,MAAM,EAAE,MAAM,CAAC;IACf,QAAQ,EAAE,MAAM,CAAC,MAAM,EAAE,OAAO,CAAC,EAAE,CAAC;IACpC,cAAc,EAAE,MAAM,CAAC;IACvB,iBAAiB,CAAC,EAAE,OAAO,4BAA4B,EAAE,iBAAiB,CAAC;IAC3E,kFAAkF;IAClF,YAAY,CAAC,EAAE,MAAM,GAAG,IAAI,CAAC;IAC7B,cAAc,EAAE,MAAM,CAAC;IACvB,gBAAgB,CAAC,EAAE,MAAM,CAAC;IAC1B,aAAa,CAAC,EAAE,oBAAoB,EAAE,CAAC;IACvC,cAAc,CAAC,EAAE,wBAAwB,CAAC;IAC1C,sBAAsB,CAAC,EAAE,MAAM,CAAC;IAChC,MAAM,CAAC,EAAE,OAAO,CAAC;IACjB,MAAM,CAAC,EAAE,OAAO,CAAC;CAClB;;;;;;;;;;;;;;;;qBAu9BgB,MAAM;eACZ,MAAM;2BACM,MAAM;;;;;;cAtBnB,MAAM;iBACH,MAAM;2BACI,MAAM;qBACZ,MAAM;mBACR,MAAM;kBAIP,MAAM,CAAC,MAAM,EAAE,OAAO,CAAC;;;cAnC3B,MAAM;gBACJ,MAAM;2BACK,MAAM;qBACZ,MAAM;mBACR,MAAM;wBACD,MAAM;uBACP,MAAM;;;;;mBAhSV,MAAM;qBACJ,MAAM;wBACH,MAAM,GAAG,IAAI;2BACV,MAAM;;wBAET,MAAM;uBACP,MAAM,EAAE;wBACP,MAAM;uBACP,MAAM;;kBAxYX,MAAM;oBACJ,MAAM;yBACD,MAAM;4BACH,MAAM;2BACP,MAAM;;;kBAQf,MAAM;yBACC,MAAM;iCACE,MAAM;sCACD,MAAM;;+BA4Xb,MAAM,CAAC,MAAM,EAAE,OAAO,CAAC,GAAG,IAAI;;;2BAwMlC,MAAM;0BACP,MAAM;0BACN,MAAM;;;;;;;;GA4e3B;AAygHD,wBAAsB,eAAe;;;eAmOpC"}

package/dist/actions.js

@@ -53,6 +53,7 @@ import { resolveSandboxReportTransport } from "./services/sandbox/transport.js";
 import { getSqliteDb } from "./repositories/sqlite/sqlite_client.js";
 import { getMcpAuthToken } from "./crypto/mcp_auth_token.js";
 import { isOauthKeyCredentialValid, normalizeOauthNextPath, OAuthKeySessionStore, } from "./services/oauth_key_gate.js";
+import { buildGoogleAuthorizeUrl, createGoogleSigninNonce, consumeGoogleSigninNonce, exchangeGoogleAuthorizationCode, getSharedGraphUserId, GoogleIdTokenError, isGoogleSigninEnabled, verifyGoogleIdToken, } from "./services/google_oidc.js";
 import { AnalyzeSchemaCandidatesRequestSchema, AuditUndeclaredFragmentsRequestSchema, CorrectEntityRequestSchema, CreateInterpretationRequestSchema, CreateRelationshipsRequestSchema, CreateRelationshipRequestSchema, DeleteEntityRequestSchema, DeleteRelationshipRequestSchema, IssuesBulkEntityIdsRequestSchema, IssuesAddMessageRequestSchema, IssuesGetStatusRequestSchema, IssuesSubmitRequestSchema, IssuesSyncRequestSchema, EntitiesQueryRequestSchema, EntitySnapshotRequestSchema, FieldProvenanceRequestSchema, GetSchemaRecommendationsRequestSchema, ListObservationsRequestSchema, ListRelationshipsRequestSchema, MergeEntitiesRequestSchema, SplitEntityRequestSchema, ObservationsQueryRequestSchema, RegisterSchemaRequestSchema, RelationshipSnapshotRequestSchema, RestoreEntityRequestSchema, RestoreRelationshipRequestSchema, RetrieveEntityByIdentifierSchema, RetrieveGraphNeighborhoodSchema, RetrieveRelatedEntitiesSchema, RELATIONSHIP_ENTITY_ID_FORMAT_HINT, RELATIONSHIP_ENTITY_ID_FORMAT_ISSUE_CODE, StoreRequestSchema, UpdateSchemaIncrementalRequestSchema, } from "./shared/action_schemas.js";
 import { getMimeTypeFromExtension } from "./services/file_text_extraction.js";
 import { queryEntitiesWithCount } from "./shared/action_handlers/entity_handlers.js";
@@ -1096,6 +1097,16 @@ export function isLocalRequest(req) {
 }
 const OAUTH_KEY_SESSION_COOKIE = "neotoma_oauth_key_session";
 const oauthKeySessions = new OAuthKeySessionStore();
+/**
+ * Maps an OAuth key-session token to the user_id resolved via Google
+ * sign-in for that browser session. Populated only by the
+ * `/mcp/oauth/google/callback` route; every other credential path
+ * (private key / mnemonic / bearer) never writes here, so
+ * `/mcp/oauth/local-login` falls through to `ensureLocalDevUser()`
+ * exactly as before when this map has no entry — behavior for every
+ * existing deploy (Google flag off) is unchanged.
+ */
+const googleVerifiedUserBySessionToken = new Map();
 function readCookie(req, name) {
     const header = (req.headers["cookie"] || req.headers["Cookie"] || "");
     if (!header)
@@ -1335,6 +1346,14 @@ function setOAuthKeySessionCookie(req, res) {
         path: "/mcp/oauth",
         maxAge: 15 * 60 * 1000,
     });
+    return token;
+}
+/** Resolve the local-auth user_id a Google-verified session (if any) mapped to this request. */
+function getGoogleVerifiedUserId(req) {
+    const token = readCookie(req, OAUTH_KEY_SESSION_COOKIE);
+    if (!token || !oauthKeySessions.isValid(token))
+        return undefined;
+    return googleVerifiedUserBySessionToken.get(token);
 }
 /**
  * Derive the canonical `@authority` the AAuth profile requires (AAuth §10.3.1).
@@ -1631,11 +1650,11 @@ app.all("/mcp", async (req, res) => {
             const hadSessionHeader = typeof sessionId === "string" && sessionId.length > 0;
             if (hadSessionHeader) {
                 logger.warn(`[MCP HTTP] Unknown or expired Mcp-Session-Id (first 8 chars): ${sessionId.slice(0, 8)}... often wrong replica behind a load balancer, API restart, or stale client state`);
-                return res.status(503).json({
+                return res.status(404).json({
                     jsonrpc: "2.0",
                     error: {
                         code: -32001,
-                        message: "Service Unavailable: MCP session is unknown on this API instance. If you run multiple replicas, enable sticky sessions for POST /mcp (or route /mcp to a single instance). Otherwise restart the MCP client so initialize runs again after a server restart.",
+                        message: "Not Found: MCP session is unknown or expired on this API instance. The client should re-initialize by sending a new InitializeRequest without a session ID. If you run multiple replicas, enable sticky sessions for POST /mcp (or route /mcp to a single instance).",
                     },
                     id: rpcId,
                 });
@@ -2104,10 +2123,19 @@ app.get("/mcp/oauth/key-auth", async (req, res) => {
     const nextPathEscaped = escapeHtml(nextPath);
     const hasBearerFallback = Boolean((process.env.NEOTOMA_BEARER_TOKEN || "").trim());
     const defaultCredentialMode = hasBearerFallback ? "bearer" : "private_key";
+    const googleEnabled = isGoogleSigninEnabled();
+    const googleStartHref = `/mcp/oauth/google/start?next=${encodeURIComponent(nextPath)}`;
     return res.send(renderOauthPage({
         title: "Authenticate OAuth preflight",
         subtitle: "Choose one credential path below, then continue to complete OAuth authorization.",
         contentHtml: `
+      ${googleEnabled
+            ? `<div class="actions" style="margin-bottom: 1rem;">
+        <a class="btn-link" href="${escapeHtml(googleStartHref)}">Sign in with Google</a>
+      </div>
+      <div class="notice">Signs you in as your own Neotoma user if your Google account's verified email is on this server's approved list. Doesn't require a private key.</div>
+      <hr style="margin: 1.5rem 0; border: none; border-top: 1px solid hsl(var(--border));" />`
+            : ""}
       <form method="post" action="/mcp/oauth/key-auth" id="oauth-key-auth-form">
         <input type="hidden" name="next" value="${nextPathEscaped}" />
         <input type="hidden" name="credential_mode" id="credential_mode" value="${defaultCredentialMode}" />
@@ -2213,6 +2241,107 @@ app.post("/mcp/oauth/key-auth", express.urlencoded({ extended: true }), async (r
     setOAuthKeySessionCookie(req, res);
     return res.redirect(nextPath);
 });
+/**
+ * "Sign in with Google" entry point. Additive to, and independent of, the
+ * key/mnemonic/bearer credential form above — feature-flagged off unless
+ * NEOTOMA_GOOGLE_CLIENT_ID + NEOTOMA_APPROVED_EMAILS are both configured.
+ * AUTH-LAYER ONLY: this establishes who the person is (their own user_id
+ * via the existing per-email primitive); it does not touch data-sharing or
+ * read-scoping.
+ */
+app.get("/mcp/oauth/google/start", async (req, res) => {
+    if (!isGoogleSigninEnabled()) {
+        return res.status(404).send("Not found");
+    }
+    const nextPath = normalizeOauthNextPath(req.query.next || undefined);
+    const nonce = createGoogleSigninNonce(nextPath);
+    const redirectUri = `${req.protocol}://${req.get("host") || ""}/mcp/oauth/google/callback`;
+    try {
+        const authorizeUrl = buildGoogleAuthorizeUrl({ redirectUri, nonce });
+        return res.redirect(authorizeUrl);
+    }
+    catch (error) {
+        logError("GoogleOAuthStart", req, error);
+        return res.status(500).send(error?.message ?? "Failed to start Google sign-in");
+    }
+});
+app.get("/mcp/oauth/google/callback", async (req, res) => {
+    if (!isGoogleSigninEnabled()) {
+        return res.status(404).send("Not found");
+    }
+    const errorParam = req.query.error?.trim();
+    const code = req.query.code?.trim();
+    const nonceParam = req.query.state?.trim();
+    const failWith = (subtitle) => {
+        res.setHeader("Content-Type", "text/html; charset=utf-8");
+        return res.status(401).send(renderOauthPage({
+            title: "Google sign-in failed",
+            subtitle,
+            contentHtml: `<div class="actions">
+          <a class="btn-link secondary" href="/mcp/oauth/key-auth">Back to authentication</a>
+        </div>`,
+        }));
+    };
+    if (errorParam) {
+        logger.warn("[Google OAuth] Callback returned an error", { error: errorParam });
+        return failWith("Google sign-in was cancelled or denied.");
+    }
+    if (!code || !nonceParam) {
+        return failWith("Missing code or state from Google callback.");
+    }
+    const nonceEntry = consumeGoogleSigninNonce(nonceParam);
+    if (!nonceEntry) {
+        return failWith("This sign-in link has expired or was already used. Please try again.");
+    }
+    // Same nextPath contract as the key/mnemonic/bearer path above: normalized
+    // back to a /mcp/oauth/* path (typically /mcp/oauth/authorize?...), never
+    // an external URL.
+    const nextPath = normalizeOauthNextPath(nonceEntry.next);
+    const redirectUri = `${req.protocol}://${req.get("host") || ""}/mcp/oauth/google/callback`;
+    try {
+        const { idToken } = await exchangeGoogleAuthorizationCode({ code, redirectUri });
+        const { email } = await verifyGoogleIdToken(idToken);
+        // Resolve the verified email to a stable user_id via the EXISTING per-email
+        // primitive (local_auth.ts) — the same primitive createLocalAuthUser /
+        // hashEmailToUserId already uses elsewhere. By default this person is
+        // admitted as their own isolated user_id, same as any other local-auth user.
+        const { createLocalAuthUser } = await import("./services/local_auth.js");
+        const { randomBytes } = await import("node:crypto");
+        // Password is unused for Google-authenticated users (they never log in
+        // with it) — generate an unguessable throwaway so createLocalAuthUser's
+        // shared code path is satisfied without weakening any other account.
+        const throwawayPassword = randomBytes(32).toString("hex");
+        const perEmailUser = createLocalAuthUser(email, throwawayPassword);
+        // Shared-graph opt-in: when NEOTOMA_SHARED_GRAPH_USER_ID is set, an
+        // approved teammate (the email already passed the allowlist inside
+        // verifyGoogleIdToken) is bound to the shared graph's user_id instead of
+        // their isolated per-email one — so the whole allowlisted team, plus the
+        // bearer/MCP identity that owns the data, share one populated graph. Unset
+        // → isolated per-email behavior (unchanged). See getSharedGraphUserId.
+        const resolvedUserId = getSharedGraphUserId() ?? perEmailUser.id;
+        // Mark this browser session as Google-verified and bound to the resolved
+        // user_id, exactly the same OAuth key-session cookie the private-key/
+        // mnemonic/bearer path sets. `/mcp/oauth/authorize` -> `/mcp/oauth/
+        // local-login` then runs completely unmodified, except local-login now
+        // resolves the user via this session instead of always ensureLocalDevUser().
+        const sessionToken = setOAuthKeySessionCookie(req, res);
+        googleVerifiedUserBySessionToken.set(sessionToken, resolvedUserId);
+        return res.redirect(nextPath);
+    }
+    catch (error) {
+        logError("GoogleOAuthCallback", req, error);
+        if (error instanceof GoogleIdTokenError) {
+            if (error.code === "EMAIL_NOT_APPROVED") {
+                return failWith("Your Google account is not on the approved list for this server.");
+            }
+            if (error.code === "EMAIL_NOT_VERIFIED") {
+                return failWith("Your Google account's email is not verified.");
+            }
+            return failWith("Google sign-in could not be verified.");
+        }
+        return failWith(error?.message ?? "Google sign-in failed.");
+    }
+});
 // RFC 8414 authorization endpoint (GET) for Cursor and other OAuth clients
 app.get("/mcp/oauth/authorize", async (req, res) => {
     try {
@@ -2263,7 +2392,10 @@ app.get("/mcp/oauth/authorize", async (req, res) => {
             // When reached via tunnel, only allow redirect_uri to localhost, app schemes, or OpenAI Custom GPT
             if (!isLocalRequest(req)) {
                 const { isRedirectUriAllowedForTunnel } = await import("./services/mcp_oauth.js");
-                if (!isRedirectUriAllowedForTunnel(redirect_uri)) {
+                // Public host as seen from outside the tunnel (x-forwarded-host set by the
+                // proxy) so an Inspector callback on this instance's own origin is allowed.
+                const selfHost = req.header("x-forwarded-host")?.split(",")[0]?.trim() || req.get("host");
+                if (!isRedirectUriAllowedForTunnel(redirect_uri, selfHost)) {
                     logger.warn("[MCP OAuth] Authorize rejected: redirect_uri not allowed for tunnel", {
                         redirect_uri: sanitizeRedirectUriForLog(redirect_uri),
                     });
@@ -2378,9 +2510,15 @@ app.get("/mcp/oauth/local-login", async (req, res) => {
         }));
     }
     try {
-        const devUser = ensureLocalDevUser();
+        // If this browser session was admitted via Google sign-in (see
+        // /mcp/oauth/google/callback), complete authorization as THAT verified
+        // user's own user_id instead of the shared dev user. Every other path
+        // (no Google session on this cookie — the default, and the only
+        // possibility when the Google feature flag is off) is unchanged.
+        const googleUserId = getGoogleVerifiedUserId(req);
+        const resolvedUserId = googleUserId ?? ensureLocalDevUser().id;
         const { completeLocalAuthorization } = await import("./services/mcp_oauth.js");
-        const { connectionId, redirectUri, clientState } = await completeLocalAuthorization(state, devUser.id);
+        const { connectionId, redirectUri, clientState } = await completeLocalAuthorization(state, resolvedUserId);
         const frontendBase = process.env.NEOTOMA_FRONTEND_URL || process.env.FRONTEND_URL || "http://localhost:5195";
         const frontendOauth = `${frontendBase}/oauth`;
         if (redirectUri) {
@@ -5834,6 +5972,12 @@ export async function storeStructuredForApi(params) {
     // entity_id.
     const priorSnapshotByEntityId = new Map();
     const newSnapshotByEntityId = new Map();
+    // #1963: auto-link may retract a stale reference-field edge (e.g. a contact's
+    // organization moved companies). A retraction *failure* must not be silent —
+    // that would reproduce the very silent-drift bug this fix exists to close, one
+    // layer up. Accumulate per-observation retraction outcomes here so the
+    // schemaStoreWarnings pass below can surface them on the store response.
+    const autoLinkRetractionByObsIndex = new Map();
     for (const r of resolved) {
         let observation_id = null;
         let snapshotAfter = null;
@@ -5917,14 +6061,25 @@ export async function storeStructuredForApi(params) {
                 const schemaEntry = await schemaRegistry.loadActiveSchema(r.entity_type, userId);
                 if (schemaEntry?.schema_definition?.reference_fields?.length) {
                     const { autoLinkReferenceFields } = await import("./services/schema_reference_linking.js");
-                    await autoLinkReferenceFields({
+                    const autoLinkResult = await autoLinkReferenceFields({
                         entityId: r.entity_id,
                         entityType: r.entity_type,
                         fields: r.fields,
                         schema: schemaEntry.schema_definition,
                         userId,
                         sourceId: observationSourceId,
+                        commit,
                     });
+                    if (autoLinkResult.retracted > 0 || autoLinkResult.retraction_failures > 0) {
+                        autoLinkRetractionByObsIndex.set(r.observation_index, {
+                            entity_type: r.entity_type,
+                            entity_id: r.entity_id,
+                            retracted: autoLinkResult.retracted,
+                            retraction_failures: autoLinkResult.retraction_failures,
+                            failed_target_entity_ids: autoLinkResult.failed_retraction_target_entity_ids,
+                            failed_retractions: autoLinkResult.failed_retractions,
+                        });
+                    }
                 }
             }
             catch (linkErr) {
@@ -6254,6 +6409,46 @@ export async function storeStructuredForApi(params) {
             }
         }
     }
+    // #1963: surface auto-link edge retractions on the store response so a
+    // retraction — and especially a retraction *failure* — is never silent. A
+    // failure means a stale reference-field edge may still be live despite the
+    // store reporting success, so it is emitted as its own actionable warning.
+    for (const [obsIndex, rec] of autoLinkRetractionByObsIndex) {
+        if (rec.retraction_failures > 0) {
+            schemaStoreWarnings.push({
+                code: "AUTO_LINK_RETRACTION_FAILED",
+                message: `Auto-link retraction failed for ${rec.retraction_failures} stale ` +
+                    `reference-field edge(s) on ${rec.entity_type}/${rec.entity_id}. ` +
+                    `A superseded edge (e.g. a prior works_at) may still be live even though ` +
+                    `the store succeeded. To clean up, call delete_relationship for each ` +
+                    `stale edge in details.stale_edges, or re-run the store.`,
+                observation_index: obsIndex,
+                entity_type: rec.entity_type,
+                entity_id: rec.entity_id,
+                // Structured remediation: each entry is a ready-to-use delete_relationship
+                // argument set, so the caller needs no knowledge of its own schema.
+                details: {
+                    stale_edges: rec.failed_retractions.map((f) => ({
+                        source_entity_id: rec.entity_id,
+                        target_entity_id: f.target_entity_id,
+                        relationship_type: f.relationship_type,
+                        field_name: f.field,
+                    })),
+                },
+            });
+        }
+        else if (rec.retracted > 0) {
+            schemaStoreWarnings.push({
+                code: "AUTO_LINK_EDGE_RETRACTED",
+                message: `Retracted ${rec.retracted} stale auto-linked reference-field edge(s) on ` +
+                    `${rec.entity_type}/${rec.entity_id} because the field's resolved target ` +
+                    `changed (#1963).`,
+                observation_index: obsIndex,
+                entity_type: rec.entity_type,
+                entity_id: rec.entity_id,
+            });
+        }
+    }
     const unknownFieldNames = Array.from(unknownFieldNamesSet).sort();
     // Conditional hint (#1549): update_schema_incremental requires the schema to
     // declare canonical_name_fields, else it dead-ends on