@chrischall/gemini-mcp 2.1.3 → 2.2.0

package/dist/client.js

@@ -6,6 +6,7 @@ import { createDiskSink, createR2Sink, tenantIdFor } from './storage/media.js';
 import { createR2Library } from './library.js';
 import { createUploadUrlMinter } from './upload-url.js';
 import { blobStoreFromEnv } from './blob-store.js';
+import { pinnedTenant } from './tenant.js';
 import { createBlobJobStore } from './job-store.js';
 import { SessionState } from './session.js';
 import { fetchRemoteImage, readCapped, MAX_REDIRECTS } from './fetch-image.js';
@@ -367,6 +368,17 @@ export class GeminiClient {
         const blob = await fileBlob(path, { type: mimeType, maxBytes: FILE_MAX_BYTES, label: 'Video' });
         return this.uploadToFilesApi(blob, mimeType, basename(path), blob.size);
     }
+    /**
+     * Upload ANY local file (image, video, audio) by streaming it from disk —
+     * the {@link uploadVideo} path without the video label. `gemini_upload_file`
+     * `path` uses this: reading the file into a Buffer, base64-encoding it and
+     * decoding it back held ~3x the file in memory and hit V8's max string
+     * length on a few-hundred-MB video (chrischall/fleet-audit#117).
+     */
+    async uploadFile(path, mimeType, displayName = basename(path)) {
+        const blob = await fileBlob(path, { type: mimeType, maxBytes: FILE_MAX_BYTES, label: 'File' });
+        return this.uploadToFilesApi(blob, mimeType, displayName, blob.size);
+    }
     /**
      * Upload already-in-memory bytes (a fetched `images_url`, a `data_base64`
      * payload, an inline `gemini_upload_file` body) to the Files API. Same three
@@ -1155,15 +1167,18 @@ function isDeliveryUnsupported(err) {
  *
  * Side-effect-free at module scope: reading two env vars and closing over them.
  */
-function hostedStorage() {
-    const blob = blobStoreFromEnv();
+export function hostedStorage(blob = blobStoreFromEnv()) {
     if (!blob)
         return {};
-    // Namespaced by API key like the connector was. One registration is one
-    // user here, so this is belt-and-braces rather than the tenancy boundary —
-    // that is the blob store's per-registration key. Lazy because the key is
-    // read at request time, not at construction (deferred-config-error).
-    const tenant = () => tenantIdFor(readEnvVar('GEMINI_API_KEY') ?? 'local');
+    // One registration is one user here, so the namespace is belt-and-braces
+    // rather than the tenancy boundary — that is the blob store's
+    // per-registration key. It must be STABLE, though: it used to be a hash of
+    // GEMINI_API_KEY, so rotating the key orphaned the whole library, every job
+    // record and every chain sidecar (chrischall/fleet-audit#116). It is now
+    // pinned in the store on first use — derived from the current key so the
+    // data already there stays reachable — and never re-derived after that.
+    // Lazy because the key is read at request time (deferred-config-error).
+    const tenant = pinnedTenant(blob.bucket, () => tenantIdFor(readEnvVar('GEMINI_API_KEY') ?? 'local'));
     return {
         mediaSink: createR2Sink(blob.bucket, {
             // The SAME `links` object the minter gets below. Media GETs and upload

package/dist/images.js

@@ -31,8 +31,12 @@ export async function uniquePath(dir, base, ext) {
     }
     return candidate;
 }
-/** Sniff MIME type from the first bytes of an image buffer. */
+/** Sniff MIME type from the first bytes of an image buffer (PNG fallback). */
 function sniffMimeBytes(buf) {
+    return sniffImageMime(buf) ?? 'image/png';
+}
+/** PNG/JPEG/WebP from the leading bytes, or `undefined` when it is none of them. */
+function sniffImageMime(buf) {
     // PNG: 89 50 4E 47
     if (buf.length >= 4 && buf[0] === 0x89 && buf[1] === 0x50 && buf[2] === 0x4e && buf[3] === 0x47) {
         return 'image/png';
@@ -47,7 +51,7 @@ function sniffMimeBytes(buf) {
         buf[8] === 0x57 && buf[9] === 0x45 && buf[10] === 0x42 && buf[11] === 0x50) {
         return 'image/webp';
     }
-    return 'image/png';
+    return undefined;
 }
 /** File extension for a media MIME (image/video/audio). Falls back to the MIME
  * subtype, so an unforeseen preview type still writes with a sane extension. */
@@ -163,7 +167,7 @@ export function videoMimeType(p) {
 export async function previewImageInput(path) {
     const resolved = resolveImagePath(path);
     // Read only the header bytes needed to sniff the MIME (≤12), and take the size
-    // from stat() — a dry-run must not load a large reference image into memory
+    // from stat() — a preview must not load a large reference image into memory
     // just to report it (matches previewVideoInput).
     const { size } = await stat(resolved);
     const fh = await open(resolved, 'r');
@@ -185,6 +189,52 @@ export async function previewVideoInput(path) {
     const { size } = await stat(resolved);
     return { path: resolved, mimeType: videoMimeType(resolved), size };
 }
+/**
+ * Image and audio types the Files API accepts, by extension. Video comes from
+ * {@link VIDEO_MIME_BY_EXT} so the two lists cannot disagree.
+ */
+const UPLOAD_MIME_BY_EXT = {
+    png: 'image/png',
+    jpg: 'image/jpeg',
+    jpeg: 'image/jpeg',
+    webp: 'image/webp',
+    gif: 'image/gif',
+    heic: 'image/heic',
+    heif: 'image/heif',
+    wav: 'audio/wav',
+    mp3: 'audio/mp3',
+    aiff: 'audio/aiff',
+    aif: 'audio/aiff',
+    aac: 'audio/aac',
+    ogg: 'audio/ogg',
+    flac: 'audio/flac',
+    ...VIDEO_MIME_BY_EXT,
+};
+async function readHead(path, n = 16) {
+    const fh = await open(path, 'r');
+    try {
+        const head = Buffer.alloc(n);
+        const { bytesRead } = await fh.read(head, 0, n, 0);
+        return head.subarray(0, bytesRead);
+    }
+    finally {
+        await fh.close();
+    }
+}
+/**
+ * The MIME a local file should be uploaded to the Files API as, or `undefined`
+ * when it cannot be identified. Bytes win for the image formats we can sniff
+ * (a PNG saved as `.jpg` is still a PNG); otherwise the extension decides,
+ * over image, video AND audio types. Never guesses: `gemini_upload_file` used
+ * to label every unrecognised file image/png (chrischall/fleet-audit#117).
+ */
+export async function detectUploadMime(resolvedPath) {
+    const sniffed = sniffImageMime(await readHead(resolvedPath));
+    if (sniffed)
+        return sniffed;
+    const ext = resolvedPath.includes('.') ? resolvedPath.slice(resolvedPath.lastIndexOf('.') + 1).toLowerCase() : '';
+    return UPLOAD_MIME_BY_EXT[ext];
+}
 /** Read an image file into `{ base64, mimeType }` for an inline_data part. */
 export async function readImageAsInline(path) {
     const resolved = resolveImagePath(path);

package/dist/library.js

@@ -29,6 +29,7 @@
  *
  * Worker-safe: no node imports, no module-scope state, structural bucket type.
  */
+import { tenantResolver } from './tenant.js';
 /** Key prefix for the library — the one prefix the retention sweep must skip. */
 export const LIBRARY_KEY_PREFIX = 'lib';
 /**
@@ -42,8 +43,8 @@ export function isValidLibraryName(name) {
 /** Build the R2-backed library for one session. */
 export function createR2Library(bucket, opts) {
     const now = opts.now ?? (() => new Date());
-    let tenantCache;
-    const tenantId = () => (tenantCache ??= Promise.resolve(typeof opts.tenant === 'function' ? opts.tenant() : opts.tenant));
+    // Cached per library; a rejected resolution is retried, not cached.
+    const tenantId = tenantResolver(opts.tenant);
     const assertName = (name) => {
         if (!isValidLibraryName(name)) {
             throw new Error(`Invalid library name "${name}" — use 1-40 lowercase letters, digits, "-" or "_" (e.g. "finn", "bold-cartoon-sports").`);

package/dist/storage/media.js

@@ -14,6 +14,7 @@
  */
 import { base64ToBytes } from '../bytes.js';
 import { signedLinks } from '../signed-url.js';
+import { tenantResolver } from '../tenant.js';
 /**
  * The stdio sink: `resolveOutputDir(output_dir)` → `writeMedia` per item, in
  * order (so `uniquePath`'s `name`/`name-2`/`name-3` sequencing is preserved).
@@ -141,8 +142,8 @@ export function createR2Sink(bucket, opts) {
     const signedBase = opts.links?.base ?? opts.signedBaseUrl?.replace(/\/+$/, '');
     const ttlMs = opts.urlTtlMs ?? 0;
     const readPrefixes = [prefix, ...(opts.readPrefixes ?? [])];
-    let tenantCache;
-    const tenantId = () => (tenantCache ??= Promise.resolve(typeof opts.tenant === 'function' ? opts.tenant() : opts.tenant));
+    // Cached per sink; a rejected resolution is retried, not cached.
+    const tenantId = tenantResolver(opts.tenant);
     /** `<prefix>/` or `<prefix>/<tenant>/` — where every WRITE goes. */
     const ownPrefix = async () => {
         const tenant = await tenantId();

package/dist/tenant.js

@@ -0,0 +1,93 @@
+/**
+ * The hosted namespace (`lib/<tenant>/`, `jobs/<tenant>/`, `gen/<tenant>/`,
+ * `up/<tenant>/`), pinned once per registration.
+ *
+ * It used to be `tenantIdFor(GEMINI_API_KEY)`, recomputed every process. That
+ * made the API key — the one credential the healthcheck tells the user to
+ * rotate on `credential_rejected` — the address of everything persistent: a
+ * rotation silently moved the whole namespace, and the character/style library
+ * (advertised as having NO expiry), durable job records and chain sidecars all
+ * came back empty (chrischall/fleet-audit#116).
+ *
+ * The real tenancy boundary is the blob store's per-registration key, so the
+ * tenant only needs to be stable, not secret-derived. It is now read from a
+ * small pin object in the registration's own store; the first process to find
+ * none derives it the old way and writes it. Deriving from the CURRENT key on
+ * first use is deliberate: that is exactly where every existing deployment's
+ * data already lives, so the change needs no migration.
+ */
+/** Under `lib/` so the host's retention prune never reclaims it (blob-store.ts). */
+export const TENANT_PIN_KEY = 'lib/tenant.json';
+/** Same shape `tenantIdFor` produces; anything else in the pin is ignored. */
+const TENANT_SHAPE = /^[0-9a-f]{12}$/;
+async function readPin(bucket) {
+    const object = await bucket.get(TENANT_PIN_KEY);
+    if (!object)
+        return undefined;
+    try {
+        const parsed = JSON.parse(new TextDecoder().decode(await object.arrayBuffer()));
+        return typeof parsed.tenant === 'string' && TENANT_SHAPE.test(parsed.tenant) ? parsed.tenant : undefined;
+    }
+    catch {
+        return undefined;
+    }
+}
+/**
+ * A memoised tenant resolver for the hosted stores.
+ *
+ * Only a fully successful resolution is cached: a failed read rejects and is
+ * retried on the next call, and a failed pin WRITE still returns the derived
+ * tenant (so a transient blob hiccup does not fail the tool call) but leaves
+ * the pin to be written next time.
+ */
+export function pinnedTenant(bucket, derive) {
+    let cached;
+    async function resolve() {
+        const pinned = await readPin(bucket);
+        if (pinned)
+            return { tenant: pinned, pinned: true };
+        const tenant = await derive();
+        try {
+            await bucket.put(TENANT_PIN_KEY, JSON.stringify({ tenant }), {
+                httpMetadata: { contentType: 'application/json' },
+            });
+            return { tenant, pinned: true };
+        }
+        catch {
+            return { tenant, pinned: false };
+        }
+    }
+    return () => {
+        if (cached)
+            return cached;
+        const attempt = resolve().then(({ tenant, pinned }) => {
+            if (!pinned && cached === attempt)
+                cached = undefined;
+            return tenant;
+        });
+        cached = attempt;
+        attempt.catch(() => {
+            if (cached === attempt)
+                cached = undefined;
+        });
+        return attempt;
+    };
+}
+/**
+ * Memoise a tenant source (a static value, or a possibly-async resolver) for
+ * one sink/library. Concurrent callers share one in-flight resolution and a
+ * success is cached for the process, but a REJECTED resolution is dropped, not
+ * cached: the hosted tenant is read from the store (`pinnedTenant`), and one
+ * transient failure must not wedge its consumer for the rest of the process.
+ */
+export function tenantResolver(source) {
+    let cache;
+    return () => {
+        if (cache)
+            return cache;
+        const attempt = Promise.resolve(typeof source === 'function' ? source() : source);
+        attempt.catch(() => { if (cache === attempt)
+            cache = undefined; });
+        return (cache = attempt);
+    };
+}

package/dist/tools/_confirm.js

@@ -1,39 +1,63 @@
-import { minifiedResult, schemaConfirm } from '@chrischall/mcp-utils';
+import { confirmationFromEnv, confirmTokenParam, requireConfirmationWithFallback } from '@chrischall/mcp-utils';
 import { previewImageInput, previewVideoInput } from '../images.js';
-export { schemaConfirm };
+export { confirmTokenParam };
 /**
- * Confirm-gate for a mutating tool (the fleet convention). When `confirm` is not
- * `true`, returns a no-network dry-run preview of exactly what would be sent;
- * when it is `true`, returns `null` so the caller proceeds with the write.
+ * The sentence every gated tool's description ends with. `lead` names what is
+ * confirmed when it is not the whole call (local file inputs only).
  */
-export function previewUnlessConfirmed(confirm, action, method, path, body) {
-    if (confirm === true)
-        return null;
-    return minifiedResult({
-        dryRun: true,
-        action,
-        method,
-        path,
-        ...(body !== undefined ? { willSend: body } : {}),
-        note: 'Re-run with confirm: true to execute.',
-    });
+export function confirmNote(lead = 'Asks the user to confirm first') {
+    return `${lead}: a confirmation prompt where the client supports one; otherwise the first call returns a preview ` +
+        'and a confirmToken, and only a repeat call with that token proceeds (see MCP_CONFIRM_MODE).';
+}
+/**
+ * Confirm a mutating call before it runs: an elicitation prompt where the
+ * client supports one, otherwise the preview-plus-token fallback governed by
+ * MCP_CONFIRM_MODE. The preview is the same method/path/willSend shape the old
+ * dry-run returned.
+ */
+export async function confirmWrite(ctx, o) {
+    const preview = {
+        action: o.description,
+        method: o.method,
+        path: o.path,
+        ...(o.body !== undefined ? { willSend: o.body } : {}),
+    };
+    return requireConfirmationWithFallback(ctx, confirmationFromEnv({
+        action: o.action,
+        message: o.message,
+        details: preview,
+        tool: o.tool,
+        confirmToken: o.confirmToken,
+        subject: () => ({ target: o.target, payload: o.payload, preview }),
+    }));
 }
 /**
  * Confirm-gate for a Gemini tool that ships LOCAL input files (image/video
- * paths) to Google. Returns `null` (proceed) when `confirm === true` OR the call
- * has no local file inputs — so pure text-to-image / base64 / clipboard calls
- * are unaffected. Otherwise returns a NO-API dry-run echoing each RESOLVED
- * ABSOLUTE input path plus its mime and size, so a prompt-injected path (e.g.
+ * paths) to Google. Proceeds straight away when the call has no local file
+ * inputs — so pure text-to-image / base64 / clipboard calls are unaffected.
+ * Otherwise the preview echoes each RESOLVED ABSOLUTE input path plus its mime
+ * and size (a local read, no network), so a prompt-injected path (e.g.
  * `~/.ssh/id_rsa`) is visible and interceptable before any byte leaves the box.
  */
-export async function previewLocalInputsUnlessConfirmed(confirm, action, endpoint, imagePaths, videoPath) {
-    const hasLocal = (imagePaths?.length ?? 0) > 0 || Boolean(videoPath);
-    if (confirm === true || !hasLocal)
-        return null;
+export async function confirmLocalInputs(ctx, o) {
+    const hasLocal = (o.imagePaths?.length ?? 0) > 0 || Boolean(o.videoPath);
+    if (!hasLocal)
+        return undefined;
     const inputs = [];
-    for (const p of imagePaths ?? [])
+    for (const p of o.imagePaths ?? [])
         inputs.push(await previewImageInput(p));
-    if (videoPath)
-        inputs.push(await previewVideoInput(videoPath));
-    return previewUnlessConfirmed(confirm, action, 'POST', endpoint, { inputs });
+    if (o.videoPath)
+        inputs.push(await previewVideoInput(o.videoPath));
+    return confirmWrite(ctx, {
+        tool: o.tool,
+        action: o.action,
+        message: 'Review and confirm sending these local files to Google:',
+        description: o.description,
+        method: 'POST',
+        path: o.endpoint,
+        body: { inputs },
+        target: '',
+        payload: { request: o.request, inputs },
+        confirmToken: o.confirmToken,
+    });
 }

package/dist/tools/files.js

@@ -1,10 +1,11 @@
 import { z } from 'zod';
+import { stat } from 'node:fs/promises';
 import { McpToolError, minifiedResult } from '@chrischall/mcp-utils';
 import { withProgressHeartbeat } from './shared.js';
 import { base64ToBytes, bytesToBase64, formatMb, wholeMb } from '../bytes.js';
 import { fileNameFromUrl } from '../fetch-image.js';
 import { downloadFilename } from '../media-name.js';
-import { previewUnlessConfirmed, previewLocalInputsUnlessConfirmed, schemaConfirm } from './_confirm.js';
+import { confirmNote, confirmTokenParam, confirmWrite } from './_confirm.js';
 /**
  * First-class Gemini Files API access.
  *
@@ -85,7 +86,7 @@ export function registerFileTools(server, client) {
                 ? ', or `path` (a local file).'
                 : ', or `r2_key` (re-upload media this connector generated, from media[].r2_key in an earlier result).') +
             (onDisk
-                ? ''
+                ? ' ' + confirmNote('A local `path` is confirmed first')
                 : ' To upload a local file without base64: mint a signed PUT URL with gemini_get_upload_url, PUT the bytes to it, ' +
                     'then pass the returned r2_key here.'),
         annotations: { readOnlyHint: false, openWorldHint: true },
@@ -125,7 +126,7 @@ export function registerFileTools(server, client) {
                 .optional()
                 .describe('Override the detected MIME type (sniffed from the bytes / taken from the server response otherwise)'),
             display_name: z.string().min(1).optional().describe('Human-readable name recorded against the upload'),
-            confirm: schemaConfirm,
+            confirmToken: confirmTokenParam,
         }),
     }, async (args, extra) => {
         const sources = [args.url && 'url', args.data_base64 && 'data_base64', args.r2_key && 'r2_key', args.path && 'path'].filter(Boolean);
@@ -134,18 +135,44 @@ export function registerFileTools(server, client) {
                 ? 'Provide exactly one of `url`, `data_base64`' + (onDisk ? ' or `path`.' : ' or `r2_key`.')
                 : `Provide exactly one source, not ${sources.length} (${sources.join(', ')}).`);
         }
+        let localUpload;
         if (args.path) {
             if (!onDisk) {
                 throw new McpToolError('`path` is unavailable on the hosted connector: it runs on a remote machine with no access to your filesystem. ' +
                     'Use `url` (the server downloads it), `r2_key` after PUTting the file to a URL from gemini_get_upload_url, or ' +
                     '`data_base64` if you cannot make HTTP requests at all.', { hint: 'Use `url`, `r2_key` (gemini_get_upload_url), or `data_base64`.' });
             }
+            // Resolve and identify BEFORE the gate, so the preview shows the MIME
+            // that will actually be sent. An unidentifiable file is refused rather
+            // than labelled image/png — the old image-only sniffer's default, which
+            // shipped every video, audio clip, GIF and HEIC mislabelled (#117).
+            const { resolveImagePath, detectUploadMime } = await import('../images.js');
+            const resolved = resolveImagePath(args.path);
+            const mimeType = args.mime_type ?? (await detectUploadMime(resolved));
+            if (!mimeType) {
+                throw new McpToolError(`Cannot tell what kind of file ${resolved} is from its bytes or extension — pass \`mime_type\` ` +
+                    '(e.g. video/mp4, audio/mp3, image/gif) so it is not uploaded under the wrong type.', { hint: 'Pass mime_type explicitly.' });
+            }
             // Same gate as every other local-file input: a prompt-injected `path`
             // would otherwise ship an arbitrary local file to Google, and an
             // uploaded file is readable by anyone holding the api key for ~48h.
-            const gate = await previewLocalInputsUnlessConfirmed(args.confirm, 'Upload a local file to the Gemini Files API', '/upload/v1beta/files', [args.path]);
+            const { size } = await stat(resolved);
+            const inputs = [{ path: resolved, mimeType, size }];
+            const gate = await confirmWrite(extra, {
+                tool: 'gemini_upload_file',
+                action: 'file.upload',
+                message: 'Review and confirm uploading this local file to Google:',
+                description: 'Upload a local file to the Gemini Files API',
+                method: 'POST',
+                path: '/upload/v1beta/files',
+                body: { inputs },
+                target: resolved,
+                payload: { inputs, display_name: args.display_name },
+                confirmToken: args.confirmToken,
+            });
             if (gate)
                 return gate;
+            localUpload = { path: resolved, mimeType };
         }
         const uploaded = await withProgressHeartbeat(extra, 'Uploading to the Gemini Files API', async () => {
             if (args.url) {
@@ -172,11 +199,9 @@ export function registerFileTools(server, client) {
                 const bytes = base64ToBytes(decoded.base64);
                 return client.uploadBytes(bytes, args.mime_type ?? decoded.mimeType, args.display_name ?? 'upload');
             }
-            const { readImageAsInline, resolveImagePath } = await import('../images.js');
-            const resolved = resolveImagePath(args.path);
-            const inline = await readImageAsInline(resolved);
-            const bytes = base64ToBytes(inline.base64);
-            return client.uploadBytes(bytes, args.mime_type ?? inline.mimeType, args.display_name ?? (resolved.split(/[\\/]/).pop() || 'upload'));
+            // Streamed from disk (fileBlob), never buffered and re-encoded.
+            const local = localUpload;
+            return client.uploadFile(local.path, local.mimeType, args.display_name ?? (local.path.split(/[\\/]/).pop() || 'upload'));
         });
         return uploadResult(uploaded);
     });
@@ -336,16 +361,27 @@ export function registerFileTools(server, client) {
     }
     server.registerTool('gemini_delete_file', {
         description: 'Delete an uploaded file, image or photo (by file_uri) from the Gemini Files API before its ~48h expiry. Any tool call still referencing it ' +
-            'will then fail with a generic 404, so delete only references you are finished with.',
+            'will then fail with a generic 404, so delete only references you are finished with. ' +
+            confirmNote(),
         annotations: { readOnlyHint: false, destructiveHint: true, openWorldHint: true },
         inputSchema: z.object({
             file_uri: z.string().min(1).describe('The `files/<id>` reference (or full uri) to delete'),
-            confirm: schemaConfirm,
+            confirmToken: confirmTokenParam,
         }),
-    }, async (args) => {
+    }, async (args, extra) => {
         // Deleting is a remote mutation with no undo — confirm-gated per the
         // fleet convention (unlike writing a generated image, which is local).
-        const gate = previewUnlessConfirmed(args.confirm, 'Delete an uploaded Gemini file', 'DELETE', `/v1beta/${args.file_uri}`);
+        const gate = await confirmWrite(extra, {
+            tool: 'gemini_delete_file',
+            action: 'file.delete',
+            message: 'Review and confirm this deletion:',
+            description: 'Delete an uploaded Gemini file',
+            method: 'DELETE',
+            path: `/v1beta/${args.file_uri}`,
+            target: args.file_uri,
+            payload: { file_uri: args.file_uri },
+            confirmToken: args.confirmToken,
+        });
         if (gate)
             return gate;
         await client.deleteFile(args.file_uri);

package/dist/tools/generate.js

@@ -7,7 +7,7 @@ import { emit, resolveAspectRatio, ASPECT_RATIOS, sharedImageSchema, pickSeed, b
 import { fingerprintRequest } from '../jobs.js';
 import { sumUsage } from '../usage.js';
 import { attachCost } from '../pricing.js';
-import { previewLocalInputsUnlessConfirmed, schemaConfirm } from './_confirm.js';
+import { confirmLocalInputs, confirmNote, confirmTokenParam } from './_confirm.js';
 const GENERATE_ENDPOINT = '/v1beta/models/{model}:generateContent';
 const SEND_LOCAL_ACTION = 'Send local file input(s) to the Gemini API';
 // generateContent output can't seed an Interactions-API conversation, so
@@ -17,7 +17,8 @@ const REFINE_HINT = 'To iteratively refine this image, use gemini_interact (pass
 export function registerGenerateTools(server, client) {
     server.registerTool('gemini_image_generate', {
         description: 'Generate image(s) from a text prompt with a Gemini image model (Nano Banana / Nano Banana Pro). ' +
-            'If the result will likely be refined iteratively, prefer gemini_interact (multi-turn) as the entry point.',
+            'If the result will likely be refined iteratively, prefer gemini_interact (multi-turn) as the entry point. ' +
+            confirmNote('Local file inputs are confirmed first'),
         annotations: { readOnlyHint: false, openWorldHint: true },
         inputSchema: z.object({
             prompt: z.string().min(1).describe('Text prompt describing the image'),
@@ -32,7 +33,7 @@ export function registerGenerateTools(server, client) {
             style: styleSchema,
             video_url: z.string().url().optional().describe('Public YouTube URL (or a previously uploaded Files API uri) as a video reference (video→image; use a Flash model e.g. gemini-3.1-flash-image)'),
             video_path: videoPathSchema,
-            confirm: schemaConfirm,
+            confirmToken: confirmTokenParam,
             ...sharedImageSchema,
         }),
     }, async (args, extra) => {
@@ -42,8 +43,12 @@ export function registerGenerateTools(server, client) {
         assertLocalInputsAvailable(client.mediaSink, args);
         // Confirm-gate local file inputs: a prompt-injected `images`/`video_path`
         // could exfiltrate a local file. Pure text-to-image calls (no local input)
-        // are unaffected. Dry-run makes NO API call.
-        const gate = await previewLocalInputsUnlessConfirmed(args.confirm, SEND_LOCAL_ACTION, GENERATE_ENDPOINT, args.images, args.video_path);
+        // are unaffected. The preview makes NO API call.
+        const { confirmToken, ...request } = args;
+        const gate = await confirmLocalInputs(extra, {
+            tool: 'gemini_image_generate', action: 'image.generate', description: SEND_LOCAL_ACTION, endpoint: GENERATE_ENDPOINT,
+            imagePaths: args.images, videoPath: args.video_path, request, confirmToken,
+        });
         if (gate)
             return gate;
         const count = args.count ?? 1;
@@ -159,7 +164,8 @@ export function registerGenerateTools(server, client) {
         description: 'Edit or compose images: provide one or more input images (paths or base64), plus a text instruction. ' +
             'For a SERIES of successive edits to the same image, prefer gemini_interact (multi-turn) — it keeps edit context ' +
             'and avoids re-processing the full image each round; use gemini_image_edit for one-off edits or composing multiple distinct inputs. ' +
-            'Gemini over-preserves the input; there is no edit-strength control — for large structural changes, reroll with a different `seed` or more forceful wording.',
+            'Gemini over-preserves the input; there is no edit-strength control — for large structural changes, reroll with a different `seed` or more forceful wording. ' +
+            confirmNote('Local file inputs are confirmed first'),
         annotations: { readOnlyHint: false, openWorldHint: true },
         inputSchema: z.object({
             prompt: z.string().min(1).describe('Instruction describing the edit or composition'),
@@ -171,7 +177,7 @@ export function registerGenerateTools(server, client) {
             characters: charactersSchema,
             style: styleSchema,
             filename: z.string().optional().describe('Base filename for the output image (extension stripped; default: slugified prompt)'),
-            confirm: schemaConfirm,
+            confirmToken: confirmTokenParam,
             ...sharedImageSchema,
         }),
     }, async (args, extra) => {
@@ -182,7 +188,11 @@ export function registerGenerateTools(server, client) {
             requireImageInput(args);
         // Confirm-gate local file inputs (see gemini_image_generate). base64 /
         // clipboard inputs are not local-path reads and pass through ungated.
-        const gate = await previewLocalInputsUnlessConfirmed(args.confirm, SEND_LOCAL_ACTION, GENERATE_ENDPOINT, args.images);
+        const { confirmToken, ...request } = args;
+        const gate = await confirmLocalInputs(extra, {
+            tool: 'gemini_image_edit', action: 'image.edit', description: SEND_LOCAL_ACTION, endpoint: GENERATE_ENDPOINT,
+            imagePaths: args.images, request, confirmToken,
+        });
         if (gate)
             return gate;
         const model = resolveModel(args.model, readEnvVar('GEMINI_IMAGE_MODEL'));

package/dist/tools/interact.js

@@ -9,7 +9,7 @@ import { emit, reportShape, resolveAspectRatio, orientationSchema, ASPECT_RATIOS
 import { bytesToBase64 } from '../bytes.js';
 import { fingerprintRequest } from '../jobs.js';
 import { attachCost } from '../pricing.js';
-import { previewLocalInputsUnlessConfirmed, schemaConfirm } from './_confirm.js';
+import { confirmLocalInputs, confirmNote, confirmTokenParam } from './_confirm.js';
 // The last-interaction id and the written-outputs set used to live here, at
 // module scope. On the hosted connector that leaks across tenants — one
 // Cloudflare isolate serves many authenticated sessions, so `continue_last`
@@ -89,7 +89,8 @@ export function registerInteractTools(server, client) {
             'do NOT start a new interaction or re-send the image for each tweak. `continue_last: true` chains from this ' +
             "session's most recent interaction without threading the id. " +
             recoveryDescription +
-            'Output is JPEG.',
+            'Output is JPEG. ' +
+            confirmNote('Local file inputs are confirmed first'),
         annotations: { readOnlyHint: false, openWorldHint: true },
         inputSchema: z.object({
             input: z.string().min(1).describe('Text prompt or editing instruction'),
@@ -160,7 +161,7 @@ export function registerInteractTools(server, client) {
                 .boolean()
                 .optional()
                 .describe('Use the image currently on the macOS system clipboard as an input (downscaled to JPEG)'),
-            confirm: schemaConfirm,
+            confirmToken: confirmTokenParam,
         }),
     }, async (args, extra) => {
         assertLocalInputsAvailable(client.mediaSink, args);
@@ -205,8 +206,13 @@ export function registerInteractTools(server, client) {
         // Confirm-gate local file inputs AFTER the re-attach split, so the preview
         // reflects the paths actually sent (dropped prior-output paths aren't). A
         // prompt-injected `images`/`video_path` could exfiltrate a local file;
-        // base64/clipboard inputs pass through ungated. Dry-run makes NO API call.
-        const gate = await previewLocalInputsUnlessConfirmed(args.confirm, 'Send local file input(s) to the Gemini Interactions API', '/v1beta/interactions', images, args.video_path);
+        // base64/clipboard inputs pass through ungated. The preview makes NO API call.
+        const { confirmToken, ...request } = args;
+        const gate = await confirmLocalInputs(extra, {
+            tool: 'gemini_interact', action: 'interaction.create', description: 'Send local file input(s) to the Gemini Interactions API', endpoint: '/v1beta/interactions',
+            imagePaths: images, videoPath: args.video_path,
+            request: { ...request, images, previous_interaction_id: previousInteractionId }, confirmToken,
+        });
         if (gate)
             return gate;
         const model = resolveModel(args.model, readEnvVar('GEMINI_IMAGE_MODEL'));