proton-drive-mcp 1.3.1 → 1.3.3

package/CHANGELOG.md

@@ -1,5 +1,15 @@
 # Changelog
 
+## 1.3.3 — 2026-10-01
+
+### Fixed
+- `drive_find_duplicates` with `verify`: on a real 1,125-file drive about half of the verification downloads failed with `database is locked` (the CLI's SQLite cache, hit by 4 parallel downloads) and left groups unverified. Verification now retries that error in a fresh temp dir (max 4 attempts), runs 2 downloads at a time by default, and failure notes are a single line instead of a SQLite dump. Re-run on the same drive: 30 of 30 groups verified, no lock errors.
+
+## 1.3.2 — 2026-10-01
+
+### Changed
+- Releases are published through npm Trusted Publishing (OIDC) only; the `NPM_TOKEN` fallback is gone from the publish workflow. No code changes.
+
 ## 1.3.1 — 2026-10-01
 
 ### Changed

package/dist/services/analytics.js

@@ -163,14 +163,14 @@ export async function verifyGroups(groups, hash, o) {
         totalMembers += g.members.length;
         const digests = new Map();
         const failed = [];
-        await pool(g.members, o.concurrency ?? 4, async (m) => {
+        await pool(g.members, o.concurrency ?? 2, async (m) => {
             if (o.signal?.aborted)
                 return;
             try {
                 digests.set(m, await hash(m));
             }
             catch (e) {
-                failed.push(`${m.path}: ${e instanceof Error ? e.message : String(e)}`);
+                failed.push(`${m.path}: ${oneLine(e instanceof Error ? e.message : String(e))}`);
             }
         });
         stop(); // the hasher's own finally already removed any temp dir
@@ -187,9 +187,16 @@ export async function verifyGroups(groups, hash, o) {
     }
     return out.filter((g) => g.members.length > 1).sort((a, b) => wasted(b) - wasted(a) || (a.members[0].path < b.members[0].path ? -1 : 1));
 }
-/** Downloads one file into its own private temp dir, sha256s it, and always removes the dir. */
+const LOCKED_RE = /database is locked|SQLITE_BUSY/i;
+const oneLine = (m) => (m.split("\n")[0] ?? m).slice(0, 160);
+const sleep = (ms) => new Promise((r) => setTimeout(r, ms));
+/**
+ * Downloads one file into its own private temp dir, sha256s it, and always removes the dir.
+ * The CLI's SQLite cache can report "database is locked" at startup when several downloads run
+ * at once; nothing has been transferred then, so a fresh attempt is safe (max 4 tries).
+ */
 export function makeDriveHasher(drive) {
-    return async (node) => {
+    const once = async (node) => {
         const dir = await mkdtemp(join(tmpdir(), "pdmcp-dup-"));
         try {
             validateLocalPath(dir); // same local-path rules as drive_download
@@ -208,6 +215,20 @@ export function makeDriveHasher(drive) {
             await rm(dir, { recursive: true, force: true });
         }
     };
+    return async (node) => {
+        const base = Number(process.env["PROTON_DRIVE_RETRY_BASE_MS"] ?? 250);
+        for (let attempt = 1;; attempt++) {
+            try {
+                return await once(node);
+            }
+            catch (e) {
+                const msg = e instanceof Error ? e.message : String(e);
+                if (attempt >= 4 || !LOCKED_RE.test(msg))
+                    throw e;
+                await sleep(base * attempt + Math.random() * base);
+            }
+        }
+    };
 }
 function reportGroup(g) {
     const keeper = keeperOf(g.members);

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "proton-drive-mcp",
-  "version": "1.3.1",
+  "version": "1.3.3",
   "description": "MCP server and CLI that gives Claude full access to Proton Drive — upload, download, share, and manage your end-to-end encrypted files without leaving the conversation.",
   "type": "module",
   "main": "dist/index.js",