@chrischall/gemini-mcp 2.1.4 → 2.2.0

package/dist/images.js

@@ -167,7 +167,7 @@ export function videoMimeType(p) {
 export async function previewImageInput(path) {
     const resolved = resolveImagePath(path);
     // Read only the header bytes needed to sniff the MIME (≤12), and take the size
-    // from stat() — a dry-run must not load a large reference image into memory
+    // from stat() — a preview must not load a large reference image into memory
     // just to report it (matches previewVideoInput).
     const { size } = await stat(resolved);
     const fh = await open(resolved, 'r');

package/dist/tools/_confirm.js

@@ -1,39 +1,63 @@
-import { minifiedResult, schemaConfirm } from '@chrischall/mcp-utils';
+import { confirmationFromEnv, confirmTokenParam, requireConfirmationWithFallback } from '@chrischall/mcp-utils';
 import { previewImageInput, previewVideoInput } from '../images.js';
-export { schemaConfirm };
+export { confirmTokenParam };
 /**
- * Confirm-gate for a mutating tool (the fleet convention). When `confirm` is not
- * `true`, returns a no-network dry-run preview of exactly what would be sent;
- * when it is `true`, returns `null` so the caller proceeds with the write.
+ * The sentence every gated tool's description ends with. `lead` names what is
+ * confirmed when it is not the whole call (local file inputs only).
  */
-export function previewUnlessConfirmed(confirm, action, method, path, body) {
-    if (confirm === true)
-        return null;
-    return minifiedResult({
-        dryRun: true,
-        action,
-        method,
-        path,
-        ...(body !== undefined ? { willSend: body } : {}),
-        note: 'Re-run with confirm: true to execute.',
-    });
+export function confirmNote(lead = 'Asks the user to confirm first') {
+    return `${lead}: a confirmation prompt where the client supports one; otherwise the first call returns a preview ` +
+        'and a confirmToken, and only a repeat call with that token proceeds (see MCP_CONFIRM_MODE).';
+}
+/**
+ * Confirm a mutating call before it runs: an elicitation prompt where the
+ * client supports one, otherwise the preview-plus-token fallback governed by
+ * MCP_CONFIRM_MODE. The preview is the same method/path/willSend shape the old
+ * dry-run returned.
+ */
+export async function confirmWrite(ctx, o) {
+    const preview = {
+        action: o.description,
+        method: o.method,
+        path: o.path,
+        ...(o.body !== undefined ? { willSend: o.body } : {}),
+    };
+    return requireConfirmationWithFallback(ctx, confirmationFromEnv({
+        action: o.action,
+        message: o.message,
+        details: preview,
+        tool: o.tool,
+        confirmToken: o.confirmToken,
+        subject: () => ({ target: o.target, payload: o.payload, preview }),
+    }));
 }
 /**
  * Confirm-gate for a Gemini tool that ships LOCAL input files (image/video
- * paths) to Google. Returns `null` (proceed) when `confirm === true` OR the call
- * has no local file inputs — so pure text-to-image / base64 / clipboard calls
- * are unaffected. Otherwise returns a NO-API dry-run echoing each RESOLVED
- * ABSOLUTE input path plus its mime and size, so a prompt-injected path (e.g.
+ * paths) to Google. Proceeds straight away when the call has no local file
+ * inputs — so pure text-to-image / base64 / clipboard calls are unaffected.
+ * Otherwise the preview echoes each RESOLVED ABSOLUTE input path plus its mime
+ * and size (a local read, no network), so a prompt-injected path (e.g.
  * `~/.ssh/id_rsa`) is visible and interceptable before any byte leaves the box.
  */
-export async function previewLocalInputsUnlessConfirmed(confirm, action, endpoint, imagePaths, videoPath) {
-    const hasLocal = (imagePaths?.length ?? 0) > 0 || Boolean(videoPath);
-    if (confirm === true || !hasLocal)
-        return null;
+export async function confirmLocalInputs(ctx, o) {
+    const hasLocal = (o.imagePaths?.length ?? 0) > 0 || Boolean(o.videoPath);
+    if (!hasLocal)
+        return undefined;
     const inputs = [];
-    for (const p of imagePaths ?? [])
+    for (const p of o.imagePaths ?? [])
         inputs.push(await previewImageInput(p));
-    if (videoPath)
-        inputs.push(await previewVideoInput(videoPath));
-    return previewUnlessConfirmed(confirm, action, 'POST', endpoint, { inputs });
+    if (o.videoPath)
+        inputs.push(await previewVideoInput(o.videoPath));
+    return confirmWrite(ctx, {
+        tool: o.tool,
+        action: o.action,
+        message: 'Review and confirm sending these local files to Google:',
+        description: o.description,
+        method: 'POST',
+        path: o.endpoint,
+        body: { inputs },
+        target: '',
+        payload: { request: o.request, inputs },
+        confirmToken: o.confirmToken,
+    });
 }

package/dist/tools/files.js

@@ -5,7 +5,7 @@ import { withProgressHeartbeat } from './shared.js';
 import { base64ToBytes, bytesToBase64, formatMb, wholeMb } from '../bytes.js';
 import { fileNameFromUrl } from '../fetch-image.js';
 import { downloadFilename } from '../media-name.js';
-import { previewUnlessConfirmed, schemaConfirm } from './_confirm.js';
+import { confirmNote, confirmTokenParam, confirmWrite } from './_confirm.js';
 /**
  * First-class Gemini Files API access.
  *
@@ -86,7 +86,7 @@ export function registerFileTools(server, client) {
                 ? ', or `path` (a local file).'
                 : ', or `r2_key` (re-upload media this connector generated, from media[].r2_key in an earlier result).') +
             (onDisk
-                ? ''
+                ? ' ' + confirmNote('A local `path` is confirmed first')
                 : ' To upload a local file without base64: mint a signed PUT URL with gemini_get_upload_url, PUT the bytes to it, ' +
                     'then pass the returned r2_key here.'),
         annotations: { readOnlyHint: false, openWorldHint: true },
@@ -126,7 +126,7 @@ export function registerFileTools(server, client) {
                 .optional()
                 .describe('Override the detected MIME type (sniffed from the bytes / taken from the server response otherwise)'),
             display_name: z.string().min(1).optional().describe('Human-readable name recorded against the upload'),
-            confirm: schemaConfirm,
+            confirmToken: confirmTokenParam,
         }),
     }, async (args, extra) => {
         const sources = [args.url && 'url', args.data_base64 && 'data_base64', args.r2_key && 'r2_key', args.path && 'path'].filter(Boolean);
@@ -156,12 +156,22 @@ export function registerFileTools(server, client) {
             // Same gate as every other local-file input: a prompt-injected `path`
             // would otherwise ship an arbitrary local file to Google, and an
             // uploaded file is readable by anyone holding the api key for ~48h.
-            if (args.confirm !== true) {
-                const { size } = await stat(resolved);
-                return previewUnlessConfirmed(args.confirm, 'Upload a local file to the Gemini Files API', 'POST', '/upload/v1beta/files', {
-                    inputs: [{ path: resolved, mimeType, size }],
-                });
-            }
+            const { size } = await stat(resolved);
+            const inputs = [{ path: resolved, mimeType, size }];
+            const gate = await confirmWrite(extra, {
+                tool: 'gemini_upload_file',
+                action: 'file.upload',
+                message: 'Review and confirm uploading this local file to Google:',
+                description: 'Upload a local file to the Gemini Files API',
+                method: 'POST',
+                path: '/upload/v1beta/files',
+                body: { inputs },
+                target: resolved,
+                payload: { inputs, display_name: args.display_name },
+                confirmToken: args.confirmToken,
+            });
+            if (gate)
+                return gate;
             localUpload = { path: resolved, mimeType };
         }
         const uploaded = await withProgressHeartbeat(extra, 'Uploading to the Gemini Files API', async () => {
@@ -351,16 +361,27 @@ export function registerFileTools(server, client) {
     }
     server.registerTool('gemini_delete_file', {
         description: 'Delete an uploaded file, image or photo (by file_uri) from the Gemini Files API before its ~48h expiry. Any tool call still referencing it ' +
-            'will then fail with a generic 404, so delete only references you are finished with.',
+            'will then fail with a generic 404, so delete only references you are finished with. ' +
+            confirmNote(),
         annotations: { readOnlyHint: false, destructiveHint: true, openWorldHint: true },
         inputSchema: z.object({
             file_uri: z.string().min(1).describe('The `files/<id>` reference (or full uri) to delete'),
-            confirm: schemaConfirm,
+            confirmToken: confirmTokenParam,
         }),
-    }, async (args) => {
+    }, async (args, extra) => {
         // Deleting is a remote mutation with no undo — confirm-gated per the
         // fleet convention (unlike writing a generated image, which is local).
-        const gate = previewUnlessConfirmed(args.confirm, 'Delete an uploaded Gemini file', 'DELETE', `/v1beta/${args.file_uri}`);
+        const gate = await confirmWrite(extra, {
+            tool: 'gemini_delete_file',
+            action: 'file.delete',
+            message: 'Review and confirm this deletion:',
+            description: 'Delete an uploaded Gemini file',
+            method: 'DELETE',
+            path: `/v1beta/${args.file_uri}`,
+            target: args.file_uri,
+            payload: { file_uri: args.file_uri },
+            confirmToken: args.confirmToken,
+        });
         if (gate)
             return gate;
         await client.deleteFile(args.file_uri);

package/dist/tools/generate.js

@@ -7,7 +7,7 @@ import { emit, resolveAspectRatio, ASPECT_RATIOS, sharedImageSchema, pickSeed, b
 import { fingerprintRequest } from '../jobs.js';
 import { sumUsage } from '../usage.js';
 import { attachCost } from '../pricing.js';
-import { previewLocalInputsUnlessConfirmed, schemaConfirm } from './_confirm.js';
+import { confirmLocalInputs, confirmNote, confirmTokenParam } from './_confirm.js';
 const GENERATE_ENDPOINT = '/v1beta/models/{model}:generateContent';
 const SEND_LOCAL_ACTION = 'Send local file input(s) to the Gemini API';
 // generateContent output can't seed an Interactions-API conversation, so
@@ -17,7 +17,8 @@ const REFINE_HINT = 'To iteratively refine this image, use gemini_interact (pass
 export function registerGenerateTools(server, client) {
     server.registerTool('gemini_image_generate', {
         description: 'Generate image(s) from a text prompt with a Gemini image model (Nano Banana / Nano Banana Pro). ' +
-            'If the result will likely be refined iteratively, prefer gemini_interact (multi-turn) as the entry point.',
+            'If the result will likely be refined iteratively, prefer gemini_interact (multi-turn) as the entry point. ' +
+            confirmNote('Local file inputs are confirmed first'),
         annotations: { readOnlyHint: false, openWorldHint: true },
         inputSchema: z.object({
             prompt: z.string().min(1).describe('Text prompt describing the image'),
@@ -32,7 +33,7 @@ export function registerGenerateTools(server, client) {
             style: styleSchema,
             video_url: z.string().url().optional().describe('Public YouTube URL (or a previously uploaded Files API uri) as a video reference (video→image; use a Flash model e.g. gemini-3.1-flash-image)'),
             video_path: videoPathSchema,
-            confirm: schemaConfirm,
+            confirmToken: confirmTokenParam,
             ...sharedImageSchema,
         }),
     }, async (args, extra) => {
@@ -42,8 +43,12 @@ export function registerGenerateTools(server, client) {
         assertLocalInputsAvailable(client.mediaSink, args);
         // Confirm-gate local file inputs: a prompt-injected `images`/`video_path`
         // could exfiltrate a local file. Pure text-to-image calls (no local input)
-        // are unaffected. Dry-run makes NO API call.
-        const gate = await previewLocalInputsUnlessConfirmed(args.confirm, SEND_LOCAL_ACTION, GENERATE_ENDPOINT, args.images, args.video_path);
+        // are unaffected. The preview makes NO API call.
+        const { confirmToken, ...request } = args;
+        const gate = await confirmLocalInputs(extra, {
+            tool: 'gemini_image_generate', action: 'image.generate', description: SEND_LOCAL_ACTION, endpoint: GENERATE_ENDPOINT,
+            imagePaths: args.images, videoPath: args.video_path, request, confirmToken,
+        });
         if (gate)
             return gate;
         const count = args.count ?? 1;
@@ -159,7 +164,8 @@ export function registerGenerateTools(server, client) {
         description: 'Edit or compose images: provide one or more input images (paths or base64), plus a text instruction. ' +
             'For a SERIES of successive edits to the same image, prefer gemini_interact (multi-turn) — it keeps edit context ' +
             'and avoids re-processing the full image each round; use gemini_image_edit for one-off edits or composing multiple distinct inputs. ' +
-            'Gemini over-preserves the input; there is no edit-strength control — for large structural changes, reroll with a different `seed` or more forceful wording.',
+            'Gemini over-preserves the input; there is no edit-strength control — for large structural changes, reroll with a different `seed` or more forceful wording. ' +
+            confirmNote('Local file inputs are confirmed first'),
         annotations: { readOnlyHint: false, openWorldHint: true },
         inputSchema: z.object({
             prompt: z.string().min(1).describe('Instruction describing the edit or composition'),
@@ -171,7 +177,7 @@ export function registerGenerateTools(server, client) {
             characters: charactersSchema,
             style: styleSchema,
             filename: z.string().optional().describe('Base filename for the output image (extension stripped; default: slugified prompt)'),
-            confirm: schemaConfirm,
+            confirmToken: confirmTokenParam,
             ...sharedImageSchema,
         }),
     }, async (args, extra) => {
@@ -182,7 +188,11 @@ export function registerGenerateTools(server, client) {
             requireImageInput(args);
         // Confirm-gate local file inputs (see gemini_image_generate). base64 /
         // clipboard inputs are not local-path reads and pass through ungated.
-        const gate = await previewLocalInputsUnlessConfirmed(args.confirm, SEND_LOCAL_ACTION, GENERATE_ENDPOINT, args.images);
+        const { confirmToken, ...request } = args;
+        const gate = await confirmLocalInputs(extra, {
+            tool: 'gemini_image_edit', action: 'image.edit', description: SEND_LOCAL_ACTION, endpoint: GENERATE_ENDPOINT,
+            imagePaths: args.images, request, confirmToken,
+        });
         if (gate)
             return gate;
         const model = resolveModel(args.model, readEnvVar('GEMINI_IMAGE_MODEL'));

package/dist/tools/interact.js

@@ -9,7 +9,7 @@ import { emit, reportShape, resolveAspectRatio, orientationSchema, ASPECT_RATIOS
 import { bytesToBase64 } from '../bytes.js';
 import { fingerprintRequest } from '../jobs.js';
 import { attachCost } from '../pricing.js';
-import { previewLocalInputsUnlessConfirmed, schemaConfirm } from './_confirm.js';
+import { confirmLocalInputs, confirmNote, confirmTokenParam } from './_confirm.js';
 // The last-interaction id and the written-outputs set used to live here, at
 // module scope. On the hosted connector that leaks across tenants — one
 // Cloudflare isolate serves many authenticated sessions, so `continue_last`
@@ -89,7 +89,8 @@ export function registerInteractTools(server, client) {
             'do NOT start a new interaction or re-send the image for each tweak. `continue_last: true` chains from this ' +
             "session's most recent interaction without threading the id. " +
             recoveryDescription +
-            'Output is JPEG.',
+            'Output is JPEG. ' +
+            confirmNote('Local file inputs are confirmed first'),
         annotations: { readOnlyHint: false, openWorldHint: true },
         inputSchema: z.object({
             input: z.string().min(1).describe('Text prompt or editing instruction'),
@@ -160,7 +161,7 @@ export function registerInteractTools(server, client) {
                 .boolean()
                 .optional()
                 .describe('Use the image currently on the macOS system clipboard as an input (downscaled to JPEG)'),
-            confirm: schemaConfirm,
+            confirmToken: confirmTokenParam,
         }),
     }, async (args, extra) => {
         assertLocalInputsAvailable(client.mediaSink, args);
@@ -205,8 +206,13 @@ export function registerInteractTools(server, client) {
         // Confirm-gate local file inputs AFTER the re-attach split, so the preview
         // reflects the paths actually sent (dropped prior-output paths aren't). A
         // prompt-injected `images`/`video_path` could exfiltrate a local file;
-        // base64/clipboard inputs pass through ungated. Dry-run makes NO API call.
-        const gate = await previewLocalInputsUnlessConfirmed(args.confirm, 'Send local file input(s) to the Gemini Interactions API', '/v1beta/interactions', images, args.video_path);
+        // base64/clipboard inputs pass through ungated. The preview makes NO API call.
+        const { confirmToken, ...request } = args;
+        const gate = await confirmLocalInputs(extra, {
+            tool: 'gemini_interact', action: 'interaction.create', description: 'Send local file input(s) to the Gemini Interactions API', endpoint: '/v1beta/interactions',
+            imagePaths: images, videoPath: args.video_path,
+            request: { ...request, images, previous_interaction_id: previousInteractionId }, confirmToken,
+        });
         if (gate)
             return gate;
         const model = resolveModel(args.model, readEnvVar('GEMINI_IMAGE_MODEL'));

package/dist/tools/library.js

@@ -3,7 +3,7 @@ import { McpToolError, minifiedResult } from '@chrischall/mcp-utils';
 import { LIBRARY_NAME_PATTERN } from '../library.js';
 import { acceptableUploadType } from '../upload-url.js';
 import { withProgressHeartbeat } from './shared.js';
-import { previewUnlessConfirmed, schemaConfirm } from './_confirm.js';
+import { confirmNote, confirmTokenParam, confirmWrite } from './_confirm.js';
 /**
  * Tools over the per-account reference library (src/library.ts): named
  * characters and styles that persist across sessions with NO expiry.
@@ -111,11 +111,21 @@ export function registerLibraryTools(server, client) {
         });
     });
     server.registerTool('gemini_delete_character', {
-        description: 'Delete a saved character from this account\'s reference library. Generation calls naming it will then fail until it is re-saved.',
+        description: 'Delete a saved character from this account\'s reference library. Generation calls naming it will then fail until it is re-saved. ' + confirmNote(),
         annotations: { readOnlyHint: false, destructiveHint: true, openWorldHint: false },
-        inputSchema: z.object({ name: NAME_FIELD, confirm: schemaConfirm }),
-    }, async (args) => {
-        const gate = previewUnlessConfirmed(args.confirm, 'Delete a saved character (its reference image and description)', 'DELETE', `characters/${args.name}`);
+        inputSchema: z.object({ name: NAME_FIELD, confirmToken: confirmTokenParam }),
+    }, async (args, extra) => {
+        const gate = await confirmWrite(extra, {
+            tool: 'gemini_delete_character',
+            action: 'character.delete',
+            message: 'Review and confirm this deletion:',
+            description: 'Delete a saved character (its reference image and description)',
+            method: 'DELETE',
+            path: `characters/${args.name}`,
+            target: args.name,
+            payload: { name: args.name },
+            confirmToken: args.confirmToken,
+        });
         if (gate)
             return gate;
         const existed = await library.deleteCharacter(args.name);
@@ -170,11 +180,21 @@ export function registerLibraryTools(server, client) {
         });
     });
     server.registerTool('gemini_delete_style', {
-        description: 'Delete a saved style preset from this account\'s reference library.',
+        description: 'Delete a saved style preset from this account\'s reference library. ' + confirmNote(),
         annotations: { readOnlyHint: false, destructiveHint: true, openWorldHint: false },
-        inputSchema: z.object({ name: NAME_FIELD, confirm: schemaConfirm }),
-    }, async (args) => {
-        const gate = previewUnlessConfirmed(args.confirm, 'Delete a saved style preset', 'DELETE', `styles/${args.name}`);
+        inputSchema: z.object({ name: NAME_FIELD, confirmToken: confirmTokenParam }),
+    }, async (args, extra) => {
+        const gate = await confirmWrite(extra, {
+            tool: 'gemini_delete_style',
+            action: 'style.delete',
+            message: 'Review and confirm this deletion:',
+            description: 'Delete a saved style preset',
+            method: 'DELETE',
+            path: `styles/${args.name}`,
+            target: args.name,
+            payload: { name: args.name },
+            confirmToken: args.confirmToken,
+        });
         if (gate)
             return gate;
         const existed = await library.deleteStyle(args.name);

package/dist/tools/music.js

@@ -5,7 +5,7 @@ import { DEFAULT_MUSIC_MODEL } from '../models.js';
 import { emitMedia, timeoutMsSchema, idempotencyKeySchema, asyncSchema, maxWaitMsSchema, withProgressHeartbeat, assertLocalInputsAvailable, imagesUrlSchema, imagesFileUrisSchema, imagesBase64Schema } from './shared.js';
 import { fingerprintRequest } from '../jobs.js';
 import { attachCost } from '../pricing.js';
-import { previewLocalInputsUnlessConfirmed, schemaConfirm } from './_confirm.js';
+import { confirmLocalInputs, confirmNote, confirmTokenParam } from './_confirm.js';
 const MUSIC_MODELS = ['lyria-3-clip-preview', 'lyria-3.5', 'lyria-3-pro-preview'];
 /**
  * There is no output-format parameter, and there is no chaining.
@@ -28,7 +28,8 @@ export function registerMusicTools(server, client) {
             'lyria-3-clip-preview (30s instrumental clip, default, cheapest), lyria-3.5 (full-length song with vocals) or ' +
             'lyria-3-pro-preview (longer-form). Output is MP3, written to disk (or returned inline). Single-turn: a track ' +
             'cannot be refined by a follow-up call, so put the whole brief in the prompt. Runs long — give it a `max_wait_ms` ' +
-            'budget (or `async: true` + gemini_get_result on a local install), or raise `timeout_ms`. Needs a funded account.',
+            'budget (or `async: true` + gemini_get_result on a local install), or raise `timeout_ms`. Needs a funded account. ' +
+            confirmNote('Local file inputs are confirmed first'),
         annotations: { readOnlyHint: false, openWorldHint: true },
         inputSchema: z.object({
             prompt: z.string().min(1).describe('Description of the music: mood, genre, instruments, tempo, structure, or lyrics'),
@@ -46,12 +47,16 @@ export function registerMusicTools(server, client) {
             idempotency_key: idempotencyKeySchema,
             async: asyncSchema,
             max_wait_ms: maxWaitMsSchema,
-            confirm: schemaConfirm,
+            confirmToken: confirmTokenParam,
         }),
     }, async (args, extra) => {
         assertLocalInputsAvailable(client.mediaSink, args);
         const model = args.model ?? DEFAULT_MUSIC_MODEL;
-        const gate = await previewLocalInputsUnlessConfirmed(args.confirm, 'Send local image input(s) to the Gemini Lyria API', '/v1beta/interactions', args.images);
+        const { confirmToken, ...request } = args;
+        const gate = await confirmLocalInputs(extra, {
+            tool: 'gemini_music_generate', action: 'music.generate', description: 'Send local image input(s) to the Gemini Lyria API', endpoint: '/v1beta/interactions',
+            imagePaths: args.images, request, confirmToken,
+        });
         if (gate)
             return gate;
         const fingerprint = fingerprintRequest('gemini_music_generate', {

package/dist/tools/set.js

@@ -7,11 +7,12 @@ import { emit, resolveAspectRatio, ASPECT_RATIOS, sharedImageSchema, pickSeed, b
 import { fingerprintRequest } from '../jobs.js';
 import { sumUsage } from '../usage.js';
 import { attachCost } from '../pricing.js';
-import { previewLocalInputsUnlessConfirmed, schemaConfirm } from './_confirm.js';
+import { confirmLocalInputs, confirmNote, confirmTokenParam } from './_confirm.js';
 export function registerSetTools(server, client) {
     server.registerTool('gemini_image_set', {
         description: 'Generate a consistent SET of images: a master image from master_prompt, then one image per scene that references the master so the subject/style stays consistent. Provide `scenes` (explicit per-image prompts) OR `count` (variations of the master). ' +
-            'Scene generations run in parallel (reference_mode "master", the default). On the hosted connector: saved `characters` and a saved `style` can seed the whole set by name, multi-image results include a `bundle_url` zip of every image (one curl instead of N), and `max_wait_ms` returns a pollable job handle if the batch runs long.',
+            'Scene generations run in parallel (reference_mode "master", the default). On the hosted connector: saved `characters` and a saved `style` can seed the whole set by name, multi-image results include a `bundle_url` zip of every image (one curl instead of N), and `max_wait_ms` returns a pollable job handle if the batch runs long. ' +
+            confirmNote('Local file inputs are confirmed first'),
         annotations: { readOnlyHint: false, openWorldHint: true },
         inputSchema: z.object({
             master_prompt: z.string().min(1).describe('Prompt for the master/reference image'),
@@ -26,7 +27,7 @@ export function registerSetTools(server, client) {
             characters: charactersSchema,
             style: styleSchema,
             master_images_base64: imagesBase64Schema('Reference images for the master generation', 'master_images'),
-            confirm: schemaConfirm,
+            confirmToken: confirmTokenParam,
             ...sharedImageSchema,
         }),
     }, async (args, extra) => {
@@ -36,8 +37,12 @@ export function registerSetTools(server, client) {
             throw new McpToolError('Provide exactly one of `scenes` or `count`.');
         }
         // Confirm-gate local file inputs: only `master_images` (paths) can read a
-        // local file; base64 references pass through ungated. Dry-run makes NO API call.
-        const gate = await previewLocalInputsUnlessConfirmed(args.confirm, 'Send local master image input(s) to the Gemini API', '/v1beta/models/{model}:generateContent', args.master_images);
+        // local file; base64 references pass through ungated. The preview makes NO API call.
+        const { confirmToken, ...request } = args;
+        const gate = await confirmLocalInputs(extra, {
+            tool: 'gemini_image_set', action: 'image.set', description: 'Send local master image input(s) to the Gemini API', endpoint: '/v1beta/models/{model}:generateContent',
+            imagePaths: args.master_images, request, confirmToken,
+        });
         if (gate)
             return gate;
         const model = resolveModel(args.model, readEnvVar('GEMINI_IMAGE_MODEL'));

package/dist/tools/video.js

@@ -6,7 +6,7 @@ import { DEFAULT_VIDEO_MODEL } from '../models.js';
 import { emitMedia, reportShape, resolveAspectRatio, orientationSchema, timeoutMsSchema, idempotencyKeySchema, asyncSchema, maxWaitMsSchema, withProgressHeartbeat, assertLocalInputsAvailable, imagesUrlSchema, imagesFileUrisSchema, imagesBase64Schema } from './shared.js';
 import { fingerprintRequest } from '../jobs.js';
 import { attachCost } from '../pricing.js';
-import { previewLocalInputsUnlessConfirmed, schemaConfirm } from './_confirm.js';
+import { confirmLocalInputs, confirmNote, confirmTokenParam } from './_confirm.js';
 /** omni's own aspect-ratio enum — NOT the image tools' ASPECT_RATIOS. */
 const VIDEO_ASPECT_RATIOS = ['16:9', '9:16'];
 const VIDEO_TASKS = ['text_to_video', 'image_to_video', 'reference_to_video', 'edit', 'extend'];
@@ -36,7 +36,8 @@ export function registerVideoTools(server, client) {
             'or continue a prior video (task: "edit" or "extend" + previous_interaction_id / continue_last; extensions ' +
             'add ~3-10s each, to ~40s total). Cost scales with `resolution` — draft at 360p, keep at 1080p/4k. ' +
             'Output is written to disk as MP4 (video has no inline MCP block). Video runs long — give it a `max_wait_ms` budget ' +
-            '(or `async: true` + gemini_get_result on a local install), or raise `timeout_ms`. Needs a funded account.',
+            '(or `async: true` + gemini_get_result on a local install), or raise `timeout_ms`. Needs a funded account. ' +
+            confirmNote('Local file inputs are confirmed first'),
         annotations: { readOnlyHint: false, openWorldHint: true },
         inputSchema: z.object({
             prompt: z.string().min(1).describe('Description of the video to generate (or the edit instruction when task=edit)'),
@@ -64,7 +65,7 @@ export function registerVideoTools(server, client) {
             idempotency_key: idempotencyKeySchema,
             async: asyncSchema,
             max_wait_ms: maxWaitMsSchema,
-            confirm: schemaConfirm,
+            confirmToken: confirmTokenParam,
         }),
     }, async (args, extra) => {
         assertLocalInputsAvailable(client.mediaSink, args);
@@ -79,7 +80,11 @@ export function registerVideoTools(server, client) {
         }
         // Confirm-gate local file inputs (a prompt-injected `images` path could
         // exfiltrate a local file); base64 / clipboard pass through ungated.
-        const gate = await previewLocalInputsUnlessConfirmed(args.confirm, 'Send local image input(s) to the Gemini omni API', '/v1beta/interactions', args.images);
+        const { confirmToken, ...request } = args;
+        const gate = await confirmLocalInputs(extra, {
+            tool: 'gemini_video_generate', action: 'video.generate', description: 'Send local image input(s) to the Gemini omni API', endpoint: '/v1beta/interactions',
+            imagePaths: args.images, request: { ...request, previous_interaction_id: previousInteractionId }, confirmToken,
+        });
         if (gate)
             return gate;
         const model = args.model?.trim() || DEFAULT_VIDEO_MODEL;

package/dist/version.js

@@ -1,2 +1,2 @@
 /** Single source of the server version. release-please bumps the literal below. */
-export const VERSION = '2.1.4'; // x-release-please-version
+export const VERSION = '2.2.0'; // x-release-please-version

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "@chrischall/gemini-mcp",
-  "version": "2.1.4",
+  "version": "2.2.0",
   "mcpName": "io.github.chrischall/gemini-mcp",
   "description": "Gemini image-generation MCP server for Claude — developed and maintained by AI (Claude Code)",
   "author": "Claude Code (AI) <https://www.anthropic.com/claude>",
@@ -46,7 +46,7 @@
     "typecheck": "tsc -p tsconfig.test.json"
   },
   "dependencies": {
-    "@chrischall/mcp-utils": "^2.4.0",
+    "@chrischall/mcp-utils": "^2.6.0",
     "@modelcontextprotocol/server": "^2.0.0",
     "dotenv": "^17.4.0",
     "zod": "^4.6.5"

package/server.json

@@ -6,12 +6,12 @@
     "url": "https://github.com/chrischall/gemini-mcp",
     "source": "github"
   },
-  "version": "2.1.4",
+  "version": "2.2.0",
   "packages": [
     {
       "registryType": "npm",
       "identifier": "@chrischall/gemini-mcp",
-      "version": "2.1.4",
+      "version": "2.2.0",
       "transport": {
         "type": "stdio"
       },

package/skills/gemini-mcp/SKILL.md

@@ -125,9 +125,9 @@ not an error.
 ### Files API
 | Tool | Description |
 |------|-------------|
-| `gemini_upload_file(url? \| data_base64? \| path?, mime_type?, display_name?, confirm?)` | Upload once, get a reusable `files/<id>`. Exactly one source. `url` is fetched by the server (image/video/audio, ≤100MB); `path` is stdio-only and confirm-gated; `data_base64` is the last resort |
+| `gemini_upload_file(url? \| data_base64? \| path?, mime_type?, display_name?, confirmToken?)` | Upload once, get a reusable `files/<id>`. Exactly one source. `url` is fetched by the server (image/video/audio, ≤100MB); `path` is stdio-only and confirmed first (see Notes); `data_base64` is the last resort |
 | `gemini_list_files(page_size?)` | List current uploads with MIME types and expiry |
-| `gemini_delete_file(file_uri, confirm)` | Delete an upload before its ~48h expiry |
+| `gemini_delete_file(file_uri, confirmToken?)` | Delete an upload before its ~48h expiry (confirmed first — see Notes) |
 
 On the **hosted hosted deployment** there is also `POST /upload`, behind the same OAuth token as
 `/mcp` — the zero-base64 path for an agent with a shell:
@@ -307,6 +307,7 @@ Condensed from Google's official Nano Banana prompting guide. Core rule:
 
 ## Notes
 
+- **Confirmations.** Local file inputs (`images`, `master_images`, `video_path`, `gemini_upload_file`'s `path`) and every delete are confirmed before anything is sent: a confirmation prompt where the client supports one; otherwise the first call does nothing and returns `status: "confirmation-required"` with a `preview` (resolved paths, MIME types, sizes — or the method/path being deleted) and a `confirmToken`. Show the preview to the user, and only after they approve call again with the **same arguments** plus `confirmToken`. The token is single-use, expires (default 10 min), and is bound to those exact arguments — change anything and the call is refused (`DRAFT_CHANGED`, with a fresh preview and token). `MCP_CONFIRM_MODE` on the server picks `ask-user` (default), `auto` (the model may approve after reviewing the preview) or `refuse`. Text prompts, URLs, `files/` references and base64 inputs are not gated.
 - **Input images** accept either file **paths** (`images` / `master_images`) or **base64/data-URI values** (`images_base64` / `master_images_base64`).
 - **`seed`** makes a result reproducible; it's echoed in the result metadata (a random one is chosen + echoed when omitted). `count>1` uses `seed, seed+1, …` so the images differ. Determinism isn't fully guaranteed by the model.
 - **`filename`/`basename`** set the output name (extension stripped); names never overwrite (a `-2`, `-3` suffix is added). The result echoes the absolute path(s), `model`, `seed`, and aspect/size.