@chrischall/gemini-mcp 2.1.2 → 2.1.4

package/dist/client.js

@@ -6,6 +6,7 @@ import { createDiskSink, createR2Sink, tenantIdFor } from './storage/media.js';
 import { createR2Library } from './library.js';
 import { createUploadUrlMinter } from './upload-url.js';
 import { blobStoreFromEnv } from './blob-store.js';
+import { pinnedTenant } from './tenant.js';
 import { createBlobJobStore } from './job-store.js';
 import { SessionState } from './session.js';
 import { fetchRemoteImage, readCapped, MAX_REDIRECTS } from './fetch-image.js';
@@ -367,6 +368,17 @@ export class GeminiClient {
         const blob = await fileBlob(path, { type: mimeType, maxBytes: FILE_MAX_BYTES, label: 'Video' });
         return this.uploadToFilesApi(blob, mimeType, basename(path), blob.size);
     }
+    /**
+     * Upload ANY local file (image, video, audio) by streaming it from disk —
+     * the {@link uploadVideo} path without the video label. `gemini_upload_file`
+     * `path` uses this: reading the file into a Buffer, base64-encoding it and
+     * decoding it back held ~3x the file in memory and hit V8's max string
+     * length on a few-hundred-MB video (chrischall/fleet-audit#117).
+     */
+    async uploadFile(path, mimeType, displayName = basename(path)) {
+        const blob = await fileBlob(path, { type: mimeType, maxBytes: FILE_MAX_BYTES, label: 'File' });
+        return this.uploadToFilesApi(blob, mimeType, displayName, blob.size);
+    }
     /**
      * Upload already-in-memory bytes (a fetched `images_url`, a `data_base64`
      * payload, an inline `gemini_upload_file` body) to the Files API. Same three
@@ -1155,15 +1167,18 @@ function isDeliveryUnsupported(err) {
  *
  * Side-effect-free at module scope: reading two env vars and closing over them.
  */
-function hostedStorage() {
-    const blob = blobStoreFromEnv();
+export function hostedStorage(blob = blobStoreFromEnv()) {
     if (!blob)
         return {};
-    // Namespaced by API key like the connector was. One registration is one
-    // user here, so this is belt-and-braces rather than the tenancy boundary —
-    // that is the blob store's per-registration key. Lazy because the key is
-    // read at request time, not at construction (deferred-config-error).
-    const tenant = () => tenantIdFor(readEnvVar('GEMINI_API_KEY') ?? 'local');
+    // One registration is one user here, so the namespace is belt-and-braces
+    // rather than the tenancy boundary — that is the blob store's
+    // per-registration key. It must be STABLE, though: it used to be a hash of
+    // GEMINI_API_KEY, so rotating the key orphaned the whole library, every job
+    // record and every chain sidecar (chrischall/fleet-audit#116). It is now
+    // pinned in the store on first use — derived from the current key so the
+    // data already there stays reachable — and never re-derived after that.
+    // Lazy because the key is read at request time (deferred-config-error).
+    const tenant = pinnedTenant(blob.bucket, () => tenantIdFor(readEnvVar('GEMINI_API_KEY') ?? 'local'));
     return {
         mediaSink: createR2Sink(blob.bucket, {
             // The SAME `links` object the minter gets below. Media GETs and upload

package/dist/images.js

@@ -31,8 +31,12 @@ export async function uniquePath(dir, base, ext) {
     }
     return candidate;
 }
-/** Sniff MIME type from the first bytes of an image buffer. */
+/** Sniff MIME type from the first bytes of an image buffer (PNG fallback). */
 function sniffMimeBytes(buf) {
+    return sniffImageMime(buf) ?? 'image/png';
+}
+/** PNG/JPEG/WebP from the leading bytes, or `undefined` when it is none of them. */
+function sniffImageMime(buf) {
     // PNG: 89 50 4E 47
     if (buf.length >= 4 && buf[0] === 0x89 && buf[1] === 0x50 && buf[2] === 0x4e && buf[3] === 0x47) {
         return 'image/png';
@@ -47,7 +51,7 @@ function sniffMimeBytes(buf) {
         buf[8] === 0x57 && buf[9] === 0x45 && buf[10] === 0x42 && buf[11] === 0x50) {
         return 'image/webp';
     }
-    return 'image/png';
+    return undefined;
 }
 /** File extension for a media MIME (image/video/audio). Falls back to the MIME
  * subtype, so an unforeseen preview type still writes with a sane extension. */
@@ -185,6 +189,52 @@ export async function previewVideoInput(path) {
     const { size } = await stat(resolved);
     return { path: resolved, mimeType: videoMimeType(resolved), size };
 }
+/**
+ * Image and audio types the Files API accepts, by extension. Video comes from
+ * {@link VIDEO_MIME_BY_EXT} so the two lists cannot disagree.
+ */
+const UPLOAD_MIME_BY_EXT = {
+    png: 'image/png',
+    jpg: 'image/jpeg',
+    jpeg: 'image/jpeg',
+    webp: 'image/webp',
+    gif: 'image/gif',
+    heic: 'image/heic',
+    heif: 'image/heif',
+    wav: 'audio/wav',
+    mp3: 'audio/mp3',
+    aiff: 'audio/aiff',
+    aif: 'audio/aiff',
+    aac: 'audio/aac',
+    ogg: 'audio/ogg',
+    flac: 'audio/flac',
+    ...VIDEO_MIME_BY_EXT,
+};
+async function readHead(path, n = 16) {
+    const fh = await open(path, 'r');
+    try {
+        const head = Buffer.alloc(n);
+        const { bytesRead } = await fh.read(head, 0, n, 0);
+        return head.subarray(0, bytesRead);
+    }
+    finally {
+        await fh.close();
+    }
+}
+/**
+ * The MIME a local file should be uploaded to the Files API as, or `undefined`
+ * when it cannot be identified. Bytes win for the image formats we can sniff
+ * (a PNG saved as `.jpg` is still a PNG); otherwise the extension decides,
+ * over image, video AND audio types. Never guesses: `gemini_upload_file` used
+ * to label every unrecognised file image/png (chrischall/fleet-audit#117).
+ */
+export async function detectUploadMime(resolvedPath) {
+    const sniffed = sniffImageMime(await readHead(resolvedPath));
+    if (sniffed)
+        return sniffed;
+    const ext = resolvedPath.includes('.') ? resolvedPath.slice(resolvedPath.lastIndexOf('.') + 1).toLowerCase() : '';
+    return UPLOAD_MIME_BY_EXT[ext];
+}
 /** Read an image file into `{ base64, mimeType }` for an inline_data part. */
 export async function readImageAsInline(path) {
     const resolved = resolveImagePath(path);

package/dist/library.js

@@ -29,6 +29,7 @@
  *
  * Worker-safe: no node imports, no module-scope state, structural bucket type.
  */
+import { tenantResolver } from './tenant.js';
 /** Key prefix for the library — the one prefix the retention sweep must skip. */
 export const LIBRARY_KEY_PREFIX = 'lib';
 /**
@@ -42,8 +43,8 @@ export function isValidLibraryName(name) {
 /** Build the R2-backed library for one session. */
 export function createR2Library(bucket, opts) {
     const now = opts.now ?? (() => new Date());
-    let tenantCache;
-    const tenantId = () => (tenantCache ??= Promise.resolve(typeof opts.tenant === 'function' ? opts.tenant() : opts.tenant));
+    // Cached per library; a rejected resolution is retried, not cached.
+    const tenantId = tenantResolver(opts.tenant);
     const assertName = (name) => {
         if (!isValidLibraryName(name)) {
             throw new Error(`Invalid library name "${name}" — use 1-40 lowercase letters, digits, "-" or "_" (e.g. "finn", "bold-cartoon-sports").`);

package/dist/storage/media.js

@@ -14,6 +14,7 @@
  */
 import { base64ToBytes } from '../bytes.js';
 import { signedLinks } from '../signed-url.js';
+import { tenantResolver } from '../tenant.js';
 /**
  * The stdio sink: `resolveOutputDir(output_dir)` → `writeMedia` per item, in
  * order (so `uniquePath`'s `name`/`name-2`/`name-3` sequencing is preserved).
@@ -141,8 +142,8 @@ export function createR2Sink(bucket, opts) {
     const signedBase = opts.links?.base ?? opts.signedBaseUrl?.replace(/\/+$/, '');
     const ttlMs = opts.urlTtlMs ?? 0;
     const readPrefixes = [prefix, ...(opts.readPrefixes ?? [])];
-    let tenantCache;
-    const tenantId = () => (tenantCache ??= Promise.resolve(typeof opts.tenant === 'function' ? opts.tenant() : opts.tenant));
+    // Cached per sink; a rejected resolution is retried, not cached.
+    const tenantId = tenantResolver(opts.tenant);
     /** `<prefix>/` or `<prefix>/<tenant>/` — where every WRITE goes. */
     const ownPrefix = async () => {
         const tenant = await tenantId();

package/dist/tenant.js

@@ -0,0 +1,93 @@
+/**
+ * The hosted namespace (`lib/<tenant>/`, `jobs/<tenant>/`, `gen/<tenant>/`,
+ * `up/<tenant>/`), pinned once per registration.
+ *
+ * It used to be `tenantIdFor(GEMINI_API_KEY)`, recomputed every process. That
+ * made the API key — the one credential the healthcheck tells the user to
+ * rotate on `credential_rejected` — the address of everything persistent: a
+ * rotation silently moved the whole namespace, and the character/style library
+ * (advertised as having NO expiry), durable job records and chain sidecars all
+ * came back empty (chrischall/fleet-audit#116).
+ *
+ * The real tenancy boundary is the blob store's per-registration key, so the
+ * tenant only needs to be stable, not secret-derived. It is now read from a
+ * small pin object in the registration's own store; the first process to find
+ * none derives it the old way and writes it. Deriving from the CURRENT key on
+ * first use is deliberate: that is exactly where every existing deployment's
+ * data already lives, so the change needs no migration.
+ */
+/** Under `lib/` so the host's retention prune never reclaims it (blob-store.ts). */
+export const TENANT_PIN_KEY = 'lib/tenant.json';
+/** Same shape `tenantIdFor` produces; anything else in the pin is ignored. */
+const TENANT_SHAPE = /^[0-9a-f]{12}$/;
+async function readPin(bucket) {
+    const object = await bucket.get(TENANT_PIN_KEY);
+    if (!object)
+        return undefined;
+    try {
+        const parsed = JSON.parse(new TextDecoder().decode(await object.arrayBuffer()));
+        return typeof parsed.tenant === 'string' && TENANT_SHAPE.test(parsed.tenant) ? parsed.tenant : undefined;
+    }
+    catch {
+        return undefined;
+    }
+}
+/**
+ * A memoised tenant resolver for the hosted stores.
+ *
+ * Only a fully successful resolution is cached: a failed read rejects and is
+ * retried on the next call, and a failed pin WRITE still returns the derived
+ * tenant (so a transient blob hiccup does not fail the tool call) but leaves
+ * the pin to be written next time.
+ */
+export function pinnedTenant(bucket, derive) {
+    let cached;
+    async function resolve() {
+        const pinned = await readPin(bucket);
+        if (pinned)
+            return { tenant: pinned, pinned: true };
+        const tenant = await derive();
+        try {
+            await bucket.put(TENANT_PIN_KEY, JSON.stringify({ tenant }), {
+                httpMetadata: { contentType: 'application/json' },
+            });
+            return { tenant, pinned: true };
+        }
+        catch {
+            return { tenant, pinned: false };
+        }
+    }
+    return () => {
+        if (cached)
+            return cached;
+        const attempt = resolve().then(({ tenant, pinned }) => {
+            if (!pinned && cached === attempt)
+                cached = undefined;
+            return tenant;
+        });
+        cached = attempt;
+        attempt.catch(() => {
+            if (cached === attempt)
+                cached = undefined;
+        });
+        return attempt;
+    };
+}
+/**
+ * Memoise a tenant source (a static value, or a possibly-async resolver) for
+ * one sink/library. Concurrent callers share one in-flight resolution and a
+ * success is cached for the process, but a REJECTED resolution is dropped, not
+ * cached: the hosted tenant is read from the store (`pinnedTenant`), and one
+ * transient failure must not wedge its consumer for the rest of the process.
+ */
+export function tenantResolver(source) {
+    let cache;
+    return () => {
+        if (cache)
+            return cache;
+        const attempt = Promise.resolve(typeof source === 'function' ? source() : source);
+        attempt.catch(() => { if (cache === attempt)
+            cache = undefined; });
+        return (cache = attempt);
+    };
+}

package/dist/tools/files.js

@@ -1,10 +1,11 @@
 import { z } from 'zod';
+import { stat } from 'node:fs/promises';
 import { McpToolError, minifiedResult } from '@chrischall/mcp-utils';
 import { withProgressHeartbeat } from './shared.js';
 import { base64ToBytes, bytesToBase64, formatMb, wholeMb } from '../bytes.js';
 import { fileNameFromUrl } from '../fetch-image.js';
 import { downloadFilename } from '../media-name.js';
-import { previewUnlessConfirmed, previewLocalInputsUnlessConfirmed, schemaConfirm } from './_confirm.js';
+import { previewUnlessConfirmed, schemaConfirm } from './_confirm.js';
 /**
  * First-class Gemini Files API access.
  *
@@ -134,18 +135,34 @@ export function registerFileTools(server, client) {
                 ? 'Provide exactly one of `url`, `data_base64`' + (onDisk ? ' or `path`.' : ' or `r2_key`.')
                 : `Provide exactly one source, not ${sources.length} (${sources.join(', ')}).`);
         }
+        let localUpload;
         if (args.path) {
             if (!onDisk) {
                 throw new McpToolError('`path` is unavailable on the hosted connector: it runs on a remote machine with no access to your filesystem. ' +
                     'Use `url` (the server downloads it), `r2_key` after PUTting the file to a URL from gemini_get_upload_url, or ' +
                     '`data_base64` if you cannot make HTTP requests at all.', { hint: 'Use `url`, `r2_key` (gemini_get_upload_url), or `data_base64`.' });
             }
+            // Resolve and identify BEFORE the gate, so the preview shows the MIME
+            // that will actually be sent. An unidentifiable file is refused rather
+            // than labelled image/png — the old image-only sniffer's default, which
+            // shipped every video, audio clip, GIF and HEIC mislabelled (#117).
+            const { resolveImagePath, detectUploadMime } = await import('../images.js');
+            const resolved = resolveImagePath(args.path);
+            const mimeType = args.mime_type ?? (await detectUploadMime(resolved));
+            if (!mimeType) {
+                throw new McpToolError(`Cannot tell what kind of file ${resolved} is from its bytes or extension — pass \`mime_type\` ` +
+                    '(e.g. video/mp4, audio/mp3, image/gif) so it is not uploaded under the wrong type.', { hint: 'Pass mime_type explicitly.' });
+            }
             // Same gate as every other local-file input: a prompt-injected `path`
             // would otherwise ship an arbitrary local file to Google, and an
             // uploaded file is readable by anyone holding the api key for ~48h.
-            const gate = await previewLocalInputsUnlessConfirmed(args.confirm, 'Upload a local file to the Gemini Files API', '/upload/v1beta/files', [args.path]);
-            if (gate)
-                return gate;
+            if (args.confirm !== true) {
+                const { size } = await stat(resolved);
+                return previewUnlessConfirmed(args.confirm, 'Upload a local file to the Gemini Files API', 'POST', '/upload/v1beta/files', {
+                    inputs: [{ path: resolved, mimeType, size }],
+                });
+            }
+            localUpload = { path: resolved, mimeType };
         }
         const uploaded = await withProgressHeartbeat(extra, 'Uploading to the Gemini Files API', async () => {
             if (args.url) {
@@ -172,11 +189,9 @@ export function registerFileTools(server, client) {
                 const bytes = base64ToBytes(decoded.base64);
                 return client.uploadBytes(bytes, args.mime_type ?? decoded.mimeType, args.display_name ?? 'upload');
             }
-            const { readImageAsInline, resolveImagePath } = await import('../images.js');
-            const resolved = resolveImagePath(args.path);
-            const inline = await readImageAsInline(resolved);
-            const bytes = base64ToBytes(inline.base64);
-            return client.uploadBytes(bytes, args.mime_type ?? inline.mimeType, args.display_name ?? (resolved.split(/[\\/]/).pop() || 'upload'));
+            // Streamed from disk (fileBlob), never buffered and re-encoded.
+            const local = localUpload;
+            return client.uploadFile(local.path, local.mimeType, args.display_name ?? (local.path.split(/[\\/]/).pop() || 'upload'));
         });
         return uploadResult(uploaded);
     });

package/dist/version.js

@@ -1,2 +1,2 @@
 /** Single source of the server version. release-please bumps the literal below. */
-export const VERSION = '2.1.2'; // x-release-please-version
+export const VERSION = '2.1.4'; // x-release-please-version

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "@chrischall/gemini-mcp",
-  "version": "2.1.2",
+  "version": "2.1.4",
   "mcpName": "io.github.chrischall/gemini-mcp",
   "description": "Gemini image-generation MCP server for Claude — developed and maintained by AI (Claude Code)",
   "author": "Claude Code (AI) <https://www.anthropic.com/claude>",
@@ -46,10 +46,10 @@
     "typecheck": "tsc -p tsconfig.test.json"
   },
   "dependencies": {
-    "@chrischall/mcp-utils": "^1.0.0",
+    "@chrischall/mcp-utils": "^2.4.0",
     "@modelcontextprotocol/server": "^2.0.0",
     "dotenv": "^17.4.0",
-    "zod": "^4.6.2"
+    "zod": "^4.6.5"
   },
   "devDependencies": {
     "@modelcontextprotocol/client": "^2.0.0",

package/server.json

@@ -6,12 +6,12 @@
     "url": "https://github.com/chrischall/gemini-mcp",
     "source": "github"
   },
-  "version": "2.1.2",
+  "version": "2.1.4",
   "packages": [
     {
       "registryType": "npm",
       "identifier": "@chrischall/gemini-mcp",
-      "version": "2.1.2",
+      "version": "2.1.4",
       "transport": {
         "type": "stdio"
       },