@chrischall/gemini-mcp 2.1.4 → 2.3.0

package/dist/bundle.js

@@ -69,10 +69,37 @@ import { AsyncLocalStorage as AsyncLocalStorage2 } from "node:async_hooks";
 function withCallerCapabilities(capabilities, fn) {
   return capabilities ? storage2.run(capabilities, fn) : fn();
 }
-var storage2;
+function currentCallerCapabilities() {
+  return storage2.getStore();
+}
+function isRecord(value) {
+  return typeof value === "object" && value !== null && !Array.isArray(value);
+}
+function callerCapabilities(ctx) {
+  const envelope = isRecord(ctx) && isRecord(ctx.mcpReq) ? ctx.mcpReq.envelope : void 0;
+  if (isRecord(envelope)) {
+    const declared = envelope[ENVELOPE_CAPABILITIES_KEY];
+    if (isRecord(declared))
+      return declared;
+  }
+  return currentCallerCapabilities();
+}
+function callerAcceptsFormElicitation(ctx) {
+  const capabilities = callerCapabilities(ctx);
+  if (!capabilities)
+    return void 0;
+  const elicitation = capabilities.elicitation;
+  if (!isRecord(elicitation))
+    return false;
+  const namedModes = ELICITATION_MODES.filter((mode) => mode in elicitation);
+  return namedModes.length === 0 || namedModes.includes("form");
+}
+var storage2, ENVELOPE_CAPABILITIES_KEY, ELICITATION_MODES;
 var init_caller = __esm({
   "node_modules/@chrischall/mcp-utils/dist/caller/index.js"() {
     storage2 = new AsyncLocalStorage2();
+    ENVELOPE_CAPABILITIES_KEY = "io.modelcontextprotocol/clientCapabilities";
+    ELICITATION_MODES = ["form", "url"];
   }
 });
 
@@ -1695,8 +1722,8 @@ var require_regexes = __commonJS({
     }
     exports.ipv4 = /^(?:(?:25[0-5]|2[0-4][0-9]|1[0-9][0-9]|[1-9][0-9]|[0-9])\.){3}(?:25[0-5]|2[0-4][0-9]|1[0-9][0-9]|[1-9][0-9]|[0-9])$/;
     exports.ipv6 = /^(([0-9a-fA-F]{1,4}:){7}[0-9a-fA-F]{1,4}|([0-9a-fA-F]{1,4}:){1,7}:|([0-9a-fA-F]{1,4}:){1,6}:[0-9a-fA-F]{1,4}|([0-9a-fA-F]{1,4}:){1,5}(:[0-9a-fA-F]{1,4}){1,2}|([0-9a-fA-F]{1,4}:){1,4}(:[0-9a-fA-F]{1,4}){1,3}|([0-9a-fA-F]{1,4}:){1,3}(:[0-9a-fA-F]{1,4}){1,4}|([0-9a-fA-F]{1,4}:){1,2}(:[0-9a-fA-F]{1,4}){1,5}|[0-9a-fA-F]{1,4}:((:[0-9a-fA-F]{1,4}){1,6})|:((:[0-9a-fA-F]{1,4}){1,7}|:))$/;
-    var mac3 = (delimiter) => {
-      const escapedDelim = util.escapeRegex(delimiter ?? ":");
+    var mac3 = (delimiter2) => {
+      const escapedDelim = util.escapeRegex(delimiter2 ?? ":");
       return new RegExp(`^(?:[0-9A-F]{2}${escapedDelim}){5}[0-9A-F]{2}$|^(?:[0-9a-f]{2}${escapedDelim}){5}[0-9a-f]{2}$`);
     };
     exports.mac = mac3;
@@ -26876,6 +26903,37 @@ function buildInputRequired(spec) {
     ...spec.requestState !== void 0 && { requestState: spec.requestState }
   };
 }
+function acceptedContent(responses, key, schema) {
+  const view = inputResponse(responses, key);
+  if (view.kind !== "elicit" || view.action !== "accept" || view.content === void 0) return void 0;
+  if (schema === void 0) return view.content;
+  const outcome = schema["~standard"].validate(view.content);
+  if (outcome instanceof Promise) throw new TypeError("acceptedContent(responses, key, schema) requires a synchronously-validating schema");
+  return outcome.issues === void 0 ? outcome.value : void 0;
+}
+function inputResponse(responses, key) {
+  if (responses === void 0 || typeof responses !== "object" || responses === null) return { kind: "missing" };
+  const entry = responses[key];
+  if (entry === null || typeof entry !== "object" || Array.isArray(entry)) return { kind: "missing" };
+  const candidate = entry;
+  if (candidate["action"] === "accept" || candidate["action"] === "decline" || candidate["action"] === "cancel") {
+    const content = candidate["content"];
+    return {
+      kind: "elicit",
+      action: candidate["action"],
+      ...content !== null && typeof content === "object" && !Array.isArray(content) && { content }
+    };
+  }
+  if (Array.isArray(candidate["roots"])) return {
+    kind: "roots",
+    roots: candidate["roots"]
+  };
+  if (typeof candidate["role"] === "string" && candidate["content"] !== void 0) return {
+    kind: "sampling",
+    result: candidate
+  };
+  return { kind: "missing" };
+}
 function inputRequiredRoundsExceededMessage(method, maxRounds) {
   return `Multi-round-trip request '${method}' still required input after ${maxRounds} rounds (inputRequired.maxRounds)`;
 }
@@ -37659,14 +37717,14 @@ function serveStdio(factory, options = {}) {
     return false;
   };
   const answerLegacyRejection = (request, reason, requestedVersion) => {
-    const rejection2 = modernOnlyStrictRejection({
+    const rejection3 = modernOnlyStrictRejection({
       kind: "legacy",
       reason,
       ...requestedVersion !== void 0 && { requestedVersion }
     }, SUPPORTED_MODERN_PROTOCOL_VERSIONS);
-    if (rejection2 === void 0) return Promise.resolve();
-    reportError(/* @__PURE__ */ new Error(`Rejected 2025-era request on a modern-only stdio connection (${rejection2.cell}): ${rejection2.message}`));
-    return writeErrorResponse(request.id, rejection2.code, rejection2.message, rejection2.data);
+    if (rejection3 === void 0) return Promise.resolve();
+    reportError(/* @__PURE__ */ new Error(`Rejected 2025-era request on a modern-only stdio connection (${rejection3.cell}): ${rejection3.message}`));
+    return writeErrorResponse(request.id, rejection3.code, rejection3.message, rejection3.data);
   };
   const onInstanceClosed = (channel) => {
     if (closing || channel === discarding) return;
@@ -39590,8 +39648,8 @@ var init_regexes = __esm({
     _emoji = `^(?=[\\s\\S]*[\\p{Extended_Pictographic}\\p{Regional_Indicator}\\u20E3])[\\p{Extended_Pictographic}\\p{Emoji_Component}]+$`;
     ipv4 = /^(?:(?:25[0-5]|2[0-4][0-9]|1[0-9][0-9]|[1-9][0-9]|[0-9])\.){3}(?:25[0-5]|2[0-4][0-9]|1[0-9][0-9]|[1-9][0-9]|[0-9])$/;
     ipv6 = /^(([0-9a-fA-F]{1,4}:){7}[0-9a-fA-F]{1,4}|([0-9a-fA-F]{1,4}:){1,7}:|([0-9a-fA-F]{1,4}:){1,6}:[0-9a-fA-F]{1,4}|([0-9a-fA-F]{1,4}:){1,5}(:[0-9a-fA-F]{1,4}){1,2}|([0-9a-fA-F]{1,4}:){1,4}(:[0-9a-fA-F]{1,4}){1,3}|([0-9a-fA-F]{1,4}:){1,3}(:[0-9a-fA-F]{1,4}){1,4}|([0-9a-fA-F]{1,4}:){1,2}(:[0-9a-fA-F]{1,4}){1,5}|[0-9a-fA-F]{1,4}:((:[0-9a-fA-F]{1,4}){1,6})|:((:[0-9a-fA-F]{1,4}){1,7}|:))$/;
-    mac = (delimiter) => {
-      const escapedDelim = escapeRegex(delimiter ?? ":");
+    mac = (delimiter2) => {
+      const escapedDelim = escapeRegex(delimiter2 ?? ":");
       return new RegExp(`^(?:[0-9A-F]{2}${escapedDelim}){5}[0-9A-F]{2}$|^(?:[0-9a-f]{2}${escapedDelim}){5}[0-9a-f]{2}$`);
     };
     cidrv4 = /^((25[0-5]|2[0-4][0-9]|1[0-9][0-9]|[1-9][0-9]|[0-9])\.){3}(25[0-5]|2[0-4][0-9]|1[0-9][0-9]|[1-9][0-9]|[0-9])\/([0-9]|[1-2][0-9]|3[0-2])$/;
@@ -58498,6 +58556,11 @@ var init_media = __esm({
 });
 
 // node_modules/@chrischall/mcp-utils/dist/response/index.js
+function textResult(data) {
+  return {
+    content: [{ type: "text", text: JSON.stringify(data, null, 2) }]
+  };
+}
 function errorResult(message) {
   return {
     content: [{ type: "text", text: redactSecrets(message) }],
@@ -58512,12 +58575,446 @@ var init_response = __esm({
   }
 });
 
+// node_modules/@chrischall/mcp-utils/dist/server/canonical.js
+function canonicalJson(value) {
+  if (value === null || typeof value === "string" || typeof value === "boolean")
+    return JSON.stringify(value);
+  if (value === void 0)
+    return "null";
+  if (typeof value === "number")
+    return Number.isFinite(value) ? JSON.stringify(value) : `{"$num":"${String(value)}"}`;
+  if (typeof value === "bigint")
+    return `{"$bigint":"${value.toString()}"}`;
+  if (typeof value === "function" || typeof value === "symbol") {
+    throw new TypeError(`confirmation: cannot bind a ${typeof value} argument value.`);
+  }
+  if (Array.isArray(value))
+    return `[${value.map(canonicalJson).join(",")}]`;
+  if (value instanceof Date) {
+    return `{"$date":${JSON.stringify(Number.isNaN(value.getTime()) ? "Invalid Date" : value.toISOString())}}`;
+  }
+  if (ArrayBuffer.isView(value)) {
+    const bytes = Buffer.from(value.buffer, value.byteOffset, value.byteLength);
+    return `{"$bytes":${JSON.stringify(bytes.toString("base64"))}}`;
+  }
+  if (value instanceof ArrayBuffer)
+    return `{"$bytes":${JSON.stringify(Buffer.from(value).toString("base64"))}}`;
+  if (value instanceof Map) {
+    const entries2 = [...value.entries()].map(([k, v]) => `[${canonicalJson(k)},${canonicalJson(v)}]`).sort();
+    return `{"$map":[${entries2.join(",")}]}`;
+  }
+  if (value instanceof Set) {
+    return `{"$set":[${[...value].map(canonicalJson).sort().join(",")}]}`;
+  }
+  const proto = Object.getPrototypeOf(value);
+  if (proto !== Object.prototype && proto !== null) {
+    throw new TypeError("confirmation: cannot bind a non-plain object argument value (class instance).");
+  }
+  const entries = Object.entries(value).filter(([, v]) => v !== void 0).sort(([a], [b]) => a < b ? -1 : a > b ? 1 : 0);
+  return `{${entries.map(([k, v]) => `${JSON.stringify(escapeKey(k))}:${canonicalJson(v)}`).join(",")}}`;
+}
+function escapeKey(key) {
+  return key.startsWith("$") ? `$${key}` : key;
+}
+var init_canonical = __esm({
+  "node_modules/@chrischall/mcp-utils/dist/server/canonical.js"() {
+  }
+});
+
 // node_modules/@chrischall/mcp-utils/dist/server/confirmation.js
+import { createHash, createHmac, timingSafeEqual } from "node:crypto";
+function bindingKey(binding) {
+  if (binding.ttlSeconds !== void 0 && !(Number.isFinite(binding.ttlSeconds) && binding.ttlSeconds > 0)) {
+    throw new RangeError("requireConfirmation: binding.ttlSeconds must be a finite number greater than 0.");
+  }
+  const key = typeof binding.key === "string" ? Buffer.from(binding.key, "utf8") : Buffer.from(binding.key);
+  if (key.length < 32) {
+    throw new RangeError("requireConfirmation: binding.key must be at least 32 bytes.");
+  }
+  return key;
+}
+function commitment(action, args) {
+  return createHash("sha256").update(`${action}\0${canonicalJson(args)}`).digest("base64url");
+}
+function mintState(key, action, binding) {
+  const exp = Math.floor(Date.now() / 1e3) + (binding.ttlSeconds ?? 600);
+  const body = Buffer.from(JSON.stringify({ c: commitment(action, binding.args), exp })).toString("base64url");
+  const mac3 = createHmac("sha256", key).update(`${STATE_PREFIX}${body}`).digest("base64url");
+  return `${STATE_PREFIX}${body}.${mac3}`;
+}
+function verifyState(key, action, binding, state) {
+  if (typeof state !== "string" || !state.startsWith(STATE_PREFIX))
+    return false;
+  const rest = state.slice(STATE_PREFIX.length);
+  const dot = rest.indexOf(".");
+  if (dot < 0)
+    return false;
+  const body = rest.slice(0, dot);
+  const mac3 = Buffer.from(rest.slice(dot + 1), "base64url");
+  const expected = createHmac("sha256", key).update(`${STATE_PREFIX}${body}`).digest();
+  if (mac3.length !== expected.length || !timingSafeEqual(mac3, expected))
+    return false;
+  let payload;
+  try {
+    payload = JSON.parse(Buffer.from(body, "base64url").toString("utf8"));
+  } catch {
+    return false;
+  }
+  if (typeof payload.exp !== "number" || payload.exp * 1e3 <= Date.now())
+    return false;
+  const want = Buffer.from(commitment(action, binding.args));
+  const got = Buffer.from(typeof payload.c === "string" ? payload.c : "");
+  return got.length === want.length && timingSafeEqual(got, want);
+}
+function echoedState(ctx) {
+  const accessor = ctx.mcpReq.requestState;
+  return typeof accessor === "function" ? accessor() : void 0;
+}
+function requireConfirmation(ctx, options) {
+  const requestKey = options.requestKey ?? DEFAULT_REQUEST_KEY;
+  const key = options.binding ? bindingKey(options.binding) : void 0;
+  const confirmationSchema = external_exports.object({
+    confirmed: external_exports.boolean().describe(options.confirmationLabel ?? DEFAULT_CONFIRMATION_LABEL)
+  });
+  const ask = () => {
+    const preview = {
+      action: options.action,
+      ...options.details === void 0 ? {} : { details: options.details }
+    };
+    return inputRequired({
+      inputRequests: {
+        [requestKey]: inputRequired.elicit({
+          message: `${options.message}
+${JSON.stringify(preview, null, 2)}`,
+          requestedSchema: confirmationSchema
+        })
+      },
+      ...key && options.binding ? { requestState: mintState(key, options.action, options.binding) } : {}
+    });
+  };
+  const response = inputResponse(ctx.mcpReq.inputResponses, requestKey);
+  const accepted = acceptedContent(ctx.mcpReq.inputResponses, requestKey, confirmationSchema);
+  if (response.kind === "missing") {
+    if (callerAcceptsFormElicitation(ctx) === false) {
+      return textResult({
+        confirmed: false,
+        dispatched: false,
+        action: options.action,
+        reason: "confirmation-unsupported",
+        note: options.unsupportedNote ? `${UNSUPPORTED_NOTE}. ${options.unsupportedNote}` : `${UNSUPPORTED_NOTE}.`
+      });
+    }
+    return ask();
+  }
+  if (response.kind === "elicit" && response.action === "accept" && accepted?.confirmed === true) {
+    if (key && options.binding) {
+      const state = echoedState(ctx);
+      if (state === void 0 || state === null) {
+        return errorResult(`Confirmation for ${options.action} was accepted, but the retry carried no requestState, so it cannot be checked against the prompt that was shown. Nothing was done. The likely cause is that the MCP client or host does not round-trip requestState (it must echo the requestState from the input_required result back on the retry); asking again would loop.`);
+      }
+      if (!verifyState(key, options.action, options.binding, state))
+        return ask();
+    }
+    return void 0;
+  }
+  return textResult({
+    confirmed: false,
+    cancelled: true,
+    action: options.action,
+    note: "Nothing was changed because the confirmation was declined, cancelled, or left unchecked."
+  });
+}
+var DEFAULT_REQUEST_KEY, DEFAULT_CONFIRMATION_LABEL, UNSUPPORTED_NOTE, STATE_PREFIX;
 var init_confirmation = __esm({
   "node_modules/@chrischall/mcp-utils/dist/server/confirmation.js"() {
     init_dist();
+    init_zod();
+    init_caller();
+    init_canonical();
+    init_response();
+    DEFAULT_REQUEST_KEY = "confirmation";
+    DEFAULT_CONFIRMATION_LABEL = "Confirm this action should proceed.";
+    UNSUPPORTED_NOTE = "Nothing was done because this client cannot show a confirmation prompt (it declares no MCP elicitation capability), and this action is never taken without one";
+    STATE_PREFIX = "mcpu.confirm.v1.";
+  }
+});
+
+// node_modules/@chrischall/mcp-utils/dist/server/confirm-token.js
+import { createHash as createHash2, createHmac as createHmac2, randomBytes, timingSafeEqual as timingSafeEqual2 } from "node:crypto";
+function createSpentTokenStore() {
+  const spent = /* @__PURE__ */ new Map();
+  return {
+    has: (nonce) => spent.has(nonce),
+    add: (nonce, exp) => {
+      spent.set(nonce, exp);
+    },
+    prune: (now) => {
+      for (const [nonce, exp] of spent)
+        if (exp < now)
+          spent.delete(nonce);
+    },
+    clear: () => spent.clear(),
+    get size() {
+      return spent.size;
+    }
+  };
+}
+function tokenKey(key) {
+  const bytes = typeof key === "string" ? Buffer.from(key, "utf8") : Buffer.from(key);
+  if (bytes.length < 32)
+    throw new RangeError("confirm token: key must be at least 32 bytes.");
+  return bytes;
+}
+function ttlOf(ttlSeconds) {
+  if (ttlSeconds === void 0)
+    return DEFAULT_TTL_SECONDS;
+  if (!(Number.isFinite(ttlSeconds) && ttlSeconds > 0)) {
+    throw new RangeError("confirm token: ttlSeconds must be a finite number greater than 0.");
+  }
+  return ttlSeconds;
+}
+function sign(key, body) {
+  return createHmac2("sha256", key).update(`${PREFIX}${body}`).digest();
+}
+function hashConfirmPayload(payload) {
+  return createHash2("sha256").update(canonicalJson(payload)).digest("base64url");
+}
+function issueConfirmToken(key, binding, options = {}) {
+  const k = tokenKey(key);
+  const now = options.now ?? Date.now();
+  const exp = now + ttlOf(options.ttlSeconds) * 1e3;
+  const claims = {
+    t: binding.tool,
+    ...binding.account === void 0 ? {} : { a: binding.account },
+    g: binding.target,
+    ...binding.revision === void 0 ? {} : { r: binding.revision },
+    h: binding.payloadHash,
+    exp,
+    n: randomBytes(16).toString("base64url")
+  };
+  const body = Buffer.from(JSON.stringify(claims), "utf8").toString("base64url");
+  return { token: `${PREFIX}${body}.${sign(k, body).toString("base64url")}`, expiresAt: new Date(exp).toISOString() };
+}
+function parseClaims(body) {
+  try {
+    const claims = JSON.parse(Buffer.from(body, "base64url").toString("utf8"));
+    return claims && typeof claims === "object" ? claims : void 0;
+  } catch {
+    return void 0;
+  }
+}
+function verifyConfirmToken(key, token, binding, options = {}) {
+  const k = tokenKey(key);
+  const now = options.now ?? Date.now();
+  const spent = options.spent ?? PROCESS_SPENT;
+  spent.prune(now);
+  if (!token.startsWith(PREFIX))
+    return { ok: false, error: "TOKEN_INVALID" };
+  const rest = token.slice(PREFIX.length);
+  const dot = rest.indexOf(".");
+  const body = dot < 0 ? "" : rest.slice(0, dot);
+  const mac3 = Buffer.from(dot < 0 ? "" : rest.slice(dot + 1), "base64url");
+  const expected = sign(k, body);
+  if (!body || mac3.length !== expected.length || !timingSafeEqual2(mac3, expected))
+    return { ok: false, error: "TOKEN_INVALID" };
+  const claims = parseClaims(body);
+  if (!claims)
+    return { ok: false, error: "TOKEN_INVALID" };
+  if (claims.t !== binding.tool || claims.a !== binding.account || claims.g !== binding.target) {
+    return { ok: false, error: "TOKEN_INVALID" };
+  }
+  if (spent.has(claims.n))
+    return { ok: false, error: "TOKEN_REUSED" };
+  if (now > claims.exp)
+    return { ok: false, error: "TOKEN_EXPIRED" };
+  if (claims.r !== binding.revision)
+    return { ok: false, error: "DRAFT_CHANGED", reason: "revision-changed" };
+  if (claims.h !== binding.payloadHash)
+    return { ok: false, error: "DRAFT_CHANGED", reason: "payload-changed" };
+  spent.add(claims.n, claims.exp);
+  return { ok: true };
+}
+function isToolResult(value) {
+  return Array.isArray(value.content);
+}
+function rejection2(data) {
+  return { ...textResult({ status: "confirmation-rejected", confirmed: false, dispatched: false, ...data }), isError: true };
+}
+async function tokenConfirmation(action, fb) {
+  const subject = await fb.subject();
+  if (isToolResult(subject))
+    return subject;
+  const binding = {
+    tool: fb.tool,
+    ...fb.account === void 0 ? {} : { account: fb.account },
+    target: subject.target,
+    ...subject.revision === void 0 ? {} : { revision: subject.revision },
+    payloadHash: hashConfirmPayload(subject.payload)
+  };
+  const phaseOne = () => {
+    const { token, expiresAt } = issueConfirmToken(fb.key, binding, { ttlSeconds: fb.ttlSeconds });
+    return {
+      action,
+      preview: subject.preview,
+      confirmToken: token,
+      expiresAt,
+      ttlSeconds: ttlOf(fb.ttlSeconds),
+      instruction: fb.instruction ?? CONFIRM_TOKEN_INSTRUCTION
+    };
+  };
+  if (!fb.confirmToken) {
+    return textResult({ status: "confirmation-required", confirmed: false, dispatched: false, ...phaseOne() });
+  }
+  const verdict = verifyConfirmToken(fb.key, fb.confirmToken, binding, { spent: fb.spent });
+  if (verdict.ok)
+    return void 0;
+  if (verdict.error === "DRAFT_CHANGED") {
+    return rejection2({
+      error: "DRAFT_CHANGED",
+      reason: verdict.reason,
+      note: `${CHANGED_NOTE[verdict.reason]} The current preview and a fresh confirmToken are below.`,
+      ...phaseOne()
+    });
+  }
+  return rejection2({ error: verdict.error, action, note: TOKEN_ERROR_NOTE[verdict.error] });
+}
+async function requireConfirmationWithFallback(ctx, options) {
+  const { tokenFallback, ...confirmation } = options;
+  if (tokenFallback && callerAcceptsFormElicitation(ctx) === false) {
+    return tokenConfirmation(options.action, tokenFallback);
+  }
+  return requireConfirmation(ctx, confirmation);
+}
+var PROCESS_SPENT, PREFIX, DEFAULT_TTL_SECONDS, CONFIRM_TOKEN_INSTRUCTION, confirmTokenParam, TOKEN_ERROR_NOTE, CHANGED_NOTE;
+var init_confirm_token = __esm({
+  "node_modules/@chrischall/mcp-utils/dist/server/confirm-token.js"() {
+    init_zod();
     init_caller();
     init_response();
+    init_canonical();
+    init_confirmation();
+    PROCESS_SPENT = createSpentTokenStore();
+    PREFIX = "mcpu.token.v1.";
+    DEFAULT_TTL_SECONDS = 600;
+    CONFIRM_TOKEN_INSTRUCTION = "Show this preview to the user verbatim and proceed only after they explicitly approve in chat. Then call again with confirmToken.";
+    confirmTokenParam = external_exports.string().optional().describe(`ONLY for the two-step confirmation fallback (a client without MCP elicitation). The confirmToken from this same tool's phase-1 "confirmation-required" response, passed back ONLY after the user has seen that preview and explicitly approved it in chat \u2014 never on the first call, never invented, never reused. Call again with the same arguments. Ignored when the client supports elicitation.`);
+    TOKEN_ERROR_NOTE = {
+      TOKEN_EXPIRED: "Nothing was sent or changed: the confirmToken expired. Call again WITHOUT confirmToken for a fresh preview, and ask the user to approve it again.",
+      TOKEN_REUSED: "Nothing was sent or changed by this call: this confirmToken was already used, and one approval acts once. If doing it again is really intended, call again WITHOUT confirmToken and get a new approval.",
+      TOKEN_INVALID: "Nothing was sent or changed: this confirmToken was not issued by this server for this tool, account and target (or the server has restarted since). Call again WITHOUT confirmToken for a fresh preview and approval."
+    };
+    CHANGED_NOTE = {
+      "revision-changed": "Nothing was sent or changed: the target was edited since the user approved it (its version rotated), so what would happen is not what they saw.",
+      "payload-changed": "Nothing was sent or changed: what would happen no longer matches what the user approved."
+    };
+  }
+});
+
+// node_modules/@chrischall/mcp-utils/dist/config/index.js
+import { homedir } from "node:os";
+import { isAbsolute, join, resolve } from "node:path";
+function readEnvVar(key, opts = {}) {
+  const env = opts.env ?? process.env;
+  const raw = env[key];
+  if (typeof raw === "string") {
+    const trimmed = raw.trim();
+    if (trimmed.length > 0 && trimmed !== "undefined" && trimmed !== "null" && !PLACEHOLDER_RE.test(trimmed)) {
+      return trimmed;
+    }
+  }
+  return opts.default;
+}
+function expandPath(p) {
+  let expanded = p;
+  if (p === "~") {
+    expanded = homedir();
+  } else if (p.startsWith("~/")) {
+    expanded = join(homedir(), p.slice(2));
+  }
+  return isAbsolute(expanded) ? expanded : resolve(expanded);
+}
+async function loadDotenvSafely(opts = {}) {
+  try {
+    const mod = await import(
+      /* @vite-ignore */
+      "dotenv"
+    );
+    const result = mod.config({
+      ...opts.path !== void 0 ? { path: opts.path } : {},
+      override: opts.override ?? false,
+      quiet: true
+    });
+    return result.error === void 0;
+  } catch {
+    return false;
+  }
+}
+var PLACEHOLDER_RE;
+var init_config = __esm({
+  "node_modules/@chrischall/mcp-utils/dist/config/index.js"() {
+    PLACEHOLDER_RE = /^\$\{[^}]*\}$/;
+  }
+});
+
+// node_modules/@chrischall/mcp-utils/dist/server/confirm-env.js
+import { createHash as createHash3, randomBytes as randomBytes2 } from "node:crypto";
+function readConfirmMode(env = process.env) {
+  const raw = readEnvVar("MCP_CONFIRM_MODE", { env })?.trim().toLowerCase();
+  if (!raw)
+    return "ask-user";
+  if (MODES.has(raw))
+    return raw;
+  if (!warned.has(raw)) {
+    warned.add(raw);
+    process.stderr.write(`MCP_CONFIRM_MODE="${raw}" is not one of ask-user, auto, refuse; treating it as refuse.
+`);
+  }
+  return "refuse";
+}
+function confirmTtlFromEnv(env = process.env) {
+  const raw = readEnvVar("MCP_CONFIRM_TTL_SECONDS", { env })?.trim();
+  return raw && /^[1-9]\d*$/.test(raw) ? Number(raw) : DEFAULT_TTL_SECONDS2;
+}
+function confirmKeyFromEnv(env = process.env) {
+  const secret = readEnvVar("MCP_CONFIRM_SECRET", { env });
+  if (secret)
+    return createHash3("sha256").update(secret, "utf8").digest();
+  processKey ??= randomBytes2(32);
+  return processKey;
+}
+function confirmationFromEnv(options) {
+  const { tool, account, confirmToken, subject, instruction, spent, env = process.env, ...confirmation } = options;
+  const mode = readConfirmMode(env);
+  if (mode === "refuse") {
+    return {
+      ...confirmation,
+      unsupportedNote: confirmation.unsupportedNote ? `${confirmation.unsupportedNote} ${REFUSE_HINT}` : REFUSE_HINT
+    };
+  }
+  return {
+    ...confirmation,
+    tokenFallback: {
+      key: confirmKeyFromEnv(env),
+      tool,
+      ...account === void 0 ? {} : { account },
+      ...confirmToken === void 0 ? {} : { confirmToken },
+      subject,
+      ttlSeconds: confirmTtlFromEnv(env),
+      instruction: mode === "auto" ? CONFIRM_TOKEN_AUTO_INSTRUCTION : instruction ?? CONFIRM_TOKEN_INSTRUCTION,
+      ...spent === void 0 ? {} : { spent }
+    }
+  };
+}
+var MODES, DEFAULT_TTL_SECONDS2, warned, processKey, CONFIRM_TOKEN_AUTO_INSTRUCTION, REFUSE_HINT;
+var init_confirm_env = __esm({
+  "node_modules/@chrischall/mcp-utils/dist/server/confirm-env.js"() {
+    init_config();
+    init_confirm_token();
+    MODES = /* @__PURE__ */ new Set(["ask-user", "auto", "refuse"]);
+    DEFAULT_TTL_SECONDS2 = 600;
+    warned = /* @__PURE__ */ new Set();
+    CONFIRM_TOKEN_AUTO_INSTRUCTION = "Nothing has been done yet. Review this preview; if it is what was intended, call again with the same arguments plus confirmToken. (This server runs with MCP_CONFIRM_MODE=auto, so the user's approval in chat is not required.)";
+    REFUSE_HINT = "Set MCP_CONFIRM_MODE=ask-user on the server to allow two-step confirmation instead.";
   }
 });
 
@@ -58697,6 +59194,8 @@ var init_server = __esm({
     init_errors();
     init_response();
     init_confirmation();
+    init_confirm_token();
+    init_confirm_env();
     init_cancel();
     init_caller();
     SERVER_PROTOCOL_VERSIONS = Object.freeze([
@@ -58708,52 +59207,6 @@ var init_server = __esm({
   }
 });
 
-// node_modules/@chrischall/mcp-utils/dist/config/index.js
-import { homedir } from "node:os";
-import { isAbsolute, join, resolve } from "node:path";
-function readEnvVar(key, opts = {}) {
-  const env = opts.env ?? process.env;
-  const raw = env[key];
-  if (typeof raw === "string") {
-    const trimmed = raw.trim();
-    if (trimmed.length > 0 && trimmed !== "undefined" && trimmed !== "null" && !PLACEHOLDER_RE.test(trimmed)) {
-      return trimmed;
-    }
-  }
-  return opts.default;
-}
-function expandPath(p) {
-  let expanded = p;
-  if (p === "~") {
-    expanded = homedir();
-  } else if (p.startsWith("~/")) {
-    expanded = join(homedir(), p.slice(2));
-  }
-  return isAbsolute(expanded) ? expanded : resolve(expanded);
-}
-async function loadDotenvSafely(opts = {}) {
-  try {
-    const mod = await import(
-      /* @vite-ignore */
-      "dotenv"
-    );
-    const result = mod.config({
-      ...opts.path !== void 0 ? { path: opts.path } : {},
-      override: opts.override ?? false,
-      quiet: true
-    });
-    return result.error === void 0;
-  } catch {
-    return false;
-  }
-}
-var PLACEHOLDER_RE;
-var init_config = __esm({
-  "node_modules/@chrischall/mcp-utils/dist/config/index.js"() {
-    PLACEHOLDER_RE = /^\$\{[^}]*\}$/;
-  }
-});
-
 // node_modules/@chrischall/mcp-utils/dist/fs/confine.js
 import { existsSync, realpathSync } from "node:fs";
 import { dirname, isAbsolute as isAbsolute2, relative, resolve as resolve2, sep } from "node:path";
@@ -59275,6 +59728,16 @@ async function uniquePath(dir, base, ext) {
 function sniffMimeBytes(buf) {
   return sniffImageMime(buf) ?? "image/png";
 }
+function localImageMime(resolvedPath, head) {
+  const mime = sniffImageMime(head);
+  if (!mime) {
+    throw new McpToolError(
+      `Cannot tell what kind of image ${resolvedPath} is \u2014 its bytes are not PNG, JPEG or WebP, so it is not sent to Gemini as a reference image.`,
+      { hint: "Pass a PNG, JPEG or WebP file (convert other formats first)." }
+    );
+  }
+  return mime;
+}
 function sniffImageMime(buf) {
   if (buf.length >= 4 && buf[0] === 137 && buf[1] === 80 && buf[2] === 78 && buf[3] === 71) {
     return "image/png";
@@ -59350,7 +59813,7 @@ async function previewImageInput(path) {
   try {
     const head = Buffer.alloc(16);
     const { bytesRead } = await fh.read(head, 0, 16, 0);
-    return { path: resolved, mimeType: sniffMimeBytes(head.subarray(0, bytesRead)), size };
+    return { path: resolved, mimeType: localImageMime(resolved, head.subarray(0, bytesRead)), size };
   } finally {
     await fh.close();
   }
@@ -59379,7 +59842,7 @@ async function detectUploadMime(resolvedPath) {
 async function readImageAsInline(path) {
   const resolved = resolveImagePath(path);
   const buf = await readFile(resolved);
-  const mimeType = sniffMimeBytes(buf);
+  const mimeType = localImageMime(resolved, buf);
   return { base64: buf.toString("base64"), mimeType };
 }
 function decodeImageInput(input2) {
@@ -59513,7 +59976,7 @@ async function loadStdioDotenv() {
 }
 
 // src/version.ts
-var VERSION = "2.1.4";
+var VERSION = "2.3.0";
 
 // src/errors.ts
 init_dist2();
@@ -60942,21 +61405,21 @@ function assertLocalInputsAvailable(sink, args) {
 
 // src/jobs.ts
 init_dist2();
-import { randomUUID, createHash as createHash2 } from "node:crypto";
+import { randomUUID, createHash as createHash5 } from "node:crypto";
 
 // src/job-store.ts
-import { createHash } from "node:crypto";
+import { createHash as createHash4 } from "node:crypto";
 var HEARTBEAT_MS = 6e4;
 var EXECUTOR_LOST_AFTER_MS = 3 * HEARTBEAT_MS;
-var PREFIX = "jobs";
+var PREFIX2 = "jobs";
 function keyHash(idempotencyKey) {
-  return createHash("sha256").update(idempotencyKey).digest("hex").slice(0, 32);
+  return createHash4("sha256").update(idempotencyKey).digest("hex").slice(0, 32);
 }
 function createBlobJobStore(bucket, opts) {
   const now = opts.now ?? (() => Date.now());
   const tenantOf = async () => typeof opts.tenant === "function" ? opts.tenant() : opts.tenant;
-  const recordKey = async (jobId) => `${PREFIX}/${await tenantOf()}/${encodeURIComponent(jobId)}.json`;
-  const pointerKey = async (k) => `${PREFIX}/${await tenantOf()}/keys/${keyHash(k)}.json`;
+  const recordKey = async (jobId) => `${PREFIX2}/${await tenantOf()}/${encodeURIComponent(jobId)}.json`;
+  const pointerKey = async (k) => `${PREFIX2}/${await tenantOf()}/keys/${keyHash(k)}.json`;
   async function writeJson(key, value) {
     try {
       await bucket.put(key, JSON.stringify(value), { httpMetadata: { contentType: "application/json" } });
@@ -61100,7 +61563,7 @@ function isExpired(entry, now) {
   return entry.settledAt !== void 0 && now - entry.settledAt > JOB_TTL_MS;
 }
 function fingerprintRequest(toolName, parts) {
-  return createHash2("sha256").update(`${toolName}\0${JSON.stringify(parts)}`).digest("hex");
+  return createHash5("sha256").update(`${toolName}\0${JSON.stringify(parts)}`).digest("hex");
 }
 function replayKey(idempotencyKey, fingerprint) {
   return `${idempotencyKey}\0${fingerprint}`;
@@ -61693,24 +62156,43 @@ function attachCost(meta3, model, usage) {
 // src/tools/_confirm.ts
 init_dist2();
 init_images();
-function previewUnlessConfirmed(confirm, action, method, path, body) {
-  if (confirm === true) return null;
-  return minifiedResult({
-    dryRun: true,
-    action,
-    method,
-    path,
-    ...body !== void 0 ? { willSend: body } : {},
-    note: "Re-run with confirm: true to execute."
-  });
+function confirmNote(lead = "Asks the user to confirm first") {
+  return `${lead}: a confirmation prompt where the client supports one; otherwise the first call returns a preview and a confirmToken, and only a repeat call with that token proceeds (see MCP_CONFIRM_MODE).`;
+}
+async function confirmWrite(ctx, o) {
+  const preview = {
+    action: o.description,
+    method: o.method,
+    path: o.path,
+    ...o.body !== void 0 ? { willSend: o.body } : {}
+  };
+  return requireConfirmationWithFallback(ctx, confirmationFromEnv({
+    action: o.action,
+    message: o.message,
+    details: preview,
+    tool: o.tool,
+    confirmToken: o.confirmToken,
+    subject: () => ({ target: o.target, payload: o.payload, preview })
+  }));
 }
-async function previewLocalInputsUnlessConfirmed(confirm, action, endpoint, imagePaths, videoPath) {
-  const hasLocal = (imagePaths?.length ?? 0) > 0 || Boolean(videoPath);
-  if (confirm === true || !hasLocal) return null;
+async function confirmLocalInputs(ctx, o) {
+  const hasLocal = (o.imagePaths?.length ?? 0) > 0 || Boolean(o.videoPath);
+  if (!hasLocal) return void 0;
   const inputs = [];
-  for (const p of imagePaths ?? []) inputs.push(await previewImageInput(p));
-  if (videoPath) inputs.push(await previewVideoInput(videoPath));
-  return previewUnlessConfirmed(confirm, action, "POST", endpoint, { inputs });
+  for (const p of o.imagePaths ?? []) inputs.push(await previewImageInput(p));
+  if (o.videoPath) inputs.push(await previewVideoInput(o.videoPath));
+  return confirmWrite(ctx, {
+    tool: o.tool,
+    action: o.action,
+    message: "Review and confirm sending these local files to Google:",
+    description: o.description,
+    method: "POST",
+    path: o.endpoint,
+    body: { inputs },
+    target: "",
+    payload: { request: o.request, inputs },
+    confirmToken: o.confirmToken
+  });
 }
 
 // src/tools/generate.ts
@@ -61721,7 +62203,7 @@ function registerGenerateTools(server, client2) {
   server.registerTool(
     "gemini_image_generate",
     {
-      description: "Generate image(s) from a text prompt with a Gemini image model (Nano Banana / Nano Banana Pro). If the result will likely be refined iteratively, prefer gemini_interact (multi-turn) as the entry point.",
+      description: "Generate image(s) from a text prompt with a Gemini image model (Nano Banana / Nano Banana Pro). If the result will likely be refined iteratively, prefer gemini_interact (multi-turn) as the entry point. " + confirmNote("Local file inputs are confirmed first"),
       annotations: { readOnlyHint: false, openWorldHint: true },
       inputSchema: external_exports.object({
         prompt: external_exports.string().min(1).describe("Text prompt describing the image"),
@@ -61736,13 +62218,23 @@ function registerGenerateTools(server, client2) {
         style: styleSchema,
         video_url: external_exports.string().url().optional().describe("Public YouTube URL (or a previously uploaded Files API uri) as a video reference (video\u2192image; use a Flash model e.g. gemini-3.1-flash-image)"),
         video_path: videoPathSchema,
-        confirm: schemaConfirm,
+        confirmToken: confirmTokenParam,
         ...sharedImageSchema
       })
     },
     async (args, extra) => {
       assertLocalInputsAvailable(client2.mediaSink, args);
-      const gate = await previewLocalInputsUnlessConfirmed(args.confirm, SEND_LOCAL_ACTION, GENERATE_ENDPOINT, args.images, args.video_path);
+      const { confirmToken, ...request } = args;
+      const gate = await confirmLocalInputs(extra, {
+        tool: "gemini_image_generate",
+        action: "image.generate",
+        description: SEND_LOCAL_ACTION,
+        endpoint: GENERATE_ENDPOINT,
+        imagePaths: args.images,
+        videoPath: args.video_path,
+        request,
+        confirmToken
+      });
       if (gate) return gate;
       const count = args.count ?? 1;
       const model = resolveModel(args.model, readEnvVar("GEMINI_IMAGE_MODEL"));
@@ -61831,7 +62323,7 @@ function registerGenerateTools(server, client2) {
   server.registerTool(
     "gemini_image_edit",
     {
-      description: "Edit or compose images: provide one or more input images (paths or base64), plus a text instruction. For a SERIES of successive edits to the same image, prefer gemini_interact (multi-turn) \u2014 it keeps edit context and avoids re-processing the full image each round; use gemini_image_edit for one-off edits or composing multiple distinct inputs. Gemini over-preserves the input; there is no edit-strength control \u2014 for large structural changes, reroll with a different `seed` or more forceful wording.",
+      description: "Edit or compose images: provide one or more input images (paths or base64), plus a text instruction. For a SERIES of successive edits to the same image, prefer gemini_interact (multi-turn) \u2014 it keeps edit context and avoids re-processing the full image each round; use gemini_image_edit for one-off edits or composing multiple distinct inputs. Gemini over-preserves the input; there is no edit-strength control \u2014 for large structural changes, reroll with a different `seed` or more forceful wording. " + confirmNote("Local file inputs are confirmed first"),
       annotations: { readOnlyHint: false, openWorldHint: true },
       inputSchema: external_exports.object({
         prompt: external_exports.string().min(1).describe("Instruction describing the edit or composition"),
@@ -61843,14 +62335,23 @@ function registerGenerateTools(server, client2) {
         characters: charactersSchema,
         style: styleSchema,
         filename: external_exports.string().optional().describe("Base filename for the output image (extension stripped; default: slugified prompt)"),
-        confirm: schemaConfirm,
+        confirmToken: confirmTokenParam,
         ...sharedImageSchema
       })
     },
     async (args, extra) => {
       assertLocalInputsAvailable(client2.mediaSink, args);
       if (!args.characters?.length) requireImageInput(args);
-      const gate = await previewLocalInputsUnlessConfirmed(args.confirm, SEND_LOCAL_ACTION, GENERATE_ENDPOINT, args.images);
+      const { confirmToken, ...request } = args;
+      const gate = await confirmLocalInputs(extra, {
+        tool: "gemini_image_edit",
+        action: "image.edit",
+        description: SEND_LOCAL_ACTION,
+        endpoint: GENERATE_ENDPOINT,
+        imagePaths: args.images,
+        request,
+        confirmToken
+      });
       if (gate) return gate;
       const model = resolveModel(args.model, readEnvVar("GEMINI_IMAGE_MODEL"));
       const aspectRatio = resolveAspectRatio(args, ASPECT_RATIOS);
@@ -61913,7 +62414,7 @@ function registerSetTools(server, client2) {
   server.registerTool(
     "gemini_image_set",
     {
-      description: 'Generate a consistent SET of images: a master image from master_prompt, then one image per scene that references the master so the subject/style stays consistent. Provide `scenes` (explicit per-image prompts) OR `count` (variations of the master). Scene generations run in parallel (reference_mode "master", the default). On the hosted connector: saved `characters` and a saved `style` can seed the whole set by name, multi-image results include a `bundle_url` zip of every image (one curl instead of N), and `max_wait_ms` returns a pollable job handle if the batch runs long.',
+      description: 'Generate a consistent SET of images: a master image from master_prompt, then one image per scene that references the master so the subject/style stays consistent. Provide `scenes` (explicit per-image prompts) OR `count` (variations of the master). Scene generations run in parallel (reference_mode "master", the default). On the hosted connector: saved `characters` and a saved `style` can seed the whole set by name, multi-image results include a `bundle_url` zip of every image (one curl instead of N), and `max_wait_ms` returns a pollable job handle if the batch runs long. ' + confirmNote("Local file inputs are confirmed first"),
       annotations: { readOnlyHint: false, openWorldHint: true },
       inputSchema: external_exports.object({
         master_prompt: external_exports.string().min(1).describe("Prompt for the master/reference image"),
@@ -61928,7 +62429,7 @@ function registerSetTools(server, client2) {
         characters: charactersSchema,
         style: styleSchema,
         master_images_base64: imagesBase64Schema("Reference images for the master generation", "master_images"),
-        confirm: schemaConfirm,
+        confirmToken: confirmTokenParam,
         ...sharedImageSchema
       })
     },
@@ -61937,7 +62438,16 @@ function registerSetTools(server, client2) {
       if (args.scenes && args.count || !args.scenes && !args.count) {
         throw new McpToolError("Provide exactly one of `scenes` or `count`.");
       }
-      const gate = await previewLocalInputsUnlessConfirmed(args.confirm, "Send local master image input(s) to the Gemini API", "/v1beta/models/{model}:generateContent", args.master_images);
+      const { confirmToken, ...request } = args;
+      const gate = await confirmLocalInputs(extra, {
+        tool: "gemini_image_set",
+        action: "image.set",
+        description: "Send local master image input(s) to the Gemini API",
+        endpoint: "/v1beta/models/{model}:generateContent",
+        imagePaths: args.master_images,
+        request,
+        confirmToken
+      });
       if (gate) return gate;
       const model = resolveModel(args.model, readEnvVar("GEMINI_IMAGE_MODEL"));
       const aspectRatio = resolveAspectRatio(args, ASPECT_RATIOS);
@@ -62056,7 +62566,7 @@ init_dist2();
 
 // src/client.ts
 init_dist2();
-import { basename } from "node:path";
+import { basename, delimiter } from "node:path";
 
 // src/library.ts
 var LIBRARY_KEY_PREFIX = "lib";
@@ -62508,6 +63018,18 @@ function normalizeFileName(ref) {
   }
   return match[1];
 }
+function uploadRoots() {
+  const roots = readEnvVar("GEMINI_UPLOAD_DIR")?.split(delimiter).map((r) => r.trim()).filter(Boolean);
+  return roots && roots.length > 0 ? roots : void 0;
+}
+function explainOutsideUploadDir(err) {
+  if (err instanceof Error && err.message.startsWith("Path is outside the allowed directories")) {
+    throw new McpToolError(
+      "Refusing to upload a file outside GEMINI_UPLOAD_DIR, which restricts which local files can be uploaded to Google. Move the file into GEMINI_UPLOAD_DIR, or add its directory to GEMINI_UPLOAD_DIR."
+    );
+  }
+  throw err;
+}
 var GeminiClient = class {
   /**
    * A key handed in explicitly (the connector's per-session key). When absent
@@ -62670,7 +63192,13 @@ var GeminiClient = class {
    * (enforced locally before any bytes are sent).
    */
   async uploadVideo(path, mimeType) {
-    const blob = await fileBlob(path, { type: mimeType, maxBytes: FILE_MAX_BYTES, label: "Video" });
+    const roots = uploadRoots();
+    const blob = await fileBlob(path, {
+      type: mimeType,
+      maxBytes: FILE_MAX_BYTES,
+      label: "Video",
+      ...roots ? { allowedRoots: roots } : {}
+    }).catch(explainOutsideUploadDir);
     return this.uploadToFilesApi(blob, mimeType, basename(path), blob.size);
   }
   /**
@@ -62681,7 +63209,13 @@ var GeminiClient = class {
    * length on a few-hundred-MB video (chrischall/fleet-audit#117).
    */
   async uploadFile(path, mimeType, displayName = basename(path)) {
-    const blob = await fileBlob(path, { type: mimeType, maxBytes: FILE_MAX_BYTES, label: "File" });
+    const roots = uploadRoots();
+    const blob = await fileBlob(path, {
+      type: mimeType,
+      maxBytes: FILE_MAX_BYTES,
+      label: "File",
+      ...roots ? { allowedRoots: roots } : {}
+    }).catch(explainOutsideUploadDir);
     return this.uploadToFilesApi(blob, mimeType, displayName, blob.size);
   }
   /**
@@ -63429,7 +63963,7 @@ function registerInteractTools(server, client2) {
   server.registerTool(
     "gemini_interact",
     {
-      description: "Preferred tool for iterative refinement of a single image \u2014 multi-turn generation and editing via the Interactions API. To refine, pass the returned interaction `id` as `previous_interaction_id` on the next call; do NOT start a new interaction or re-send the image for each tweak. `continue_last: true` chains from this session's most recent interaction without threading the id. " + recoveryDescription + "Output is JPEG.",
+      description: "Preferred tool for iterative refinement of a single image \u2014 multi-turn generation and editing via the Interactions API. To refine, pass the returned interaction `id` as `previous_interaction_id` on the next call; do NOT start a new interaction or re-send the image for each tweak. `continue_last: true` chains from this session's most recent interaction without threading the id. " + recoveryDescription + "Output is JPEG. " + confirmNote("Local file inputs are confirmed first"),
       annotations: { readOnlyHint: false, openWorldHint: true },
       inputSchema: external_exports.object({
         input: external_exports.string().min(1).describe("Text prompt or editing instruction"),
@@ -63458,7 +63992,7 @@ function registerInteractTools(server, client2) {
         async: asyncSchema,
         max_wait_ms: maxWaitMsSchema,
         from_clipboard: external_exports.boolean().optional().describe("Use the image currently on the macOS system clipboard as an input (downscaled to JPEG)"),
-        confirm: schemaConfirm
+        confirmToken: confirmTokenParam
       })
     },
     async (args, extra) => {
@@ -63483,7 +64017,17 @@ function registerInteractTools(server, client2) {
       if (previousInteractionId && images?.length) {
         ({ kept: images, dropped } = splitReattachedOutputs(images, client2.session.writtenOutputs));
       }
-      const gate = await previewLocalInputsUnlessConfirmed(args.confirm, "Send local file input(s) to the Gemini Interactions API", "/v1beta/interactions", images, args.video_path);
+      const { confirmToken, ...request } = args;
+      const gate = await confirmLocalInputs(extra, {
+        tool: "gemini_interact",
+        action: "interaction.create",
+        description: "Send local file input(s) to the Gemini Interactions API",
+        endpoint: "/v1beta/interactions",
+        imagePaths: images,
+        videoPath: args.video_path,
+        request: { ...request, images, previous_interaction_id: previousInteractionId },
+        confirmToken
+      });
       if (gate) return gate;
       const model = resolveModel(args.model, readEnvVar("GEMINI_IMAGE_MODEL"));
       const aspectRatio = resolveAspectRatio(args, ASPECT_RATIOS);
@@ -63592,7 +64136,7 @@ function registerVideoTools(server, client2) {
   server.registerTool(
     "gemini_video_generate",
     {
-      description: 'Generate a short video (~10s) via the Gemini omni model: text\u2192video, image\u2192video / reference\u2192video (supply reference image[s]), interpolate between two stills (pass first frame then last frame as images), or continue a prior video (task: "edit" or "extend" + previous_interaction_id / continue_last; extensions add ~3-10s each, to ~40s total). Cost scales with `resolution` \u2014 draft at 360p, keep at 1080p/4k. Output is written to disk as MP4 (video has no inline MCP block). Video runs long \u2014 give it a `max_wait_ms` budget (or `async: true` + gemini_get_result on a local install), or raise `timeout_ms`. Needs a funded account.',
+      description: 'Generate a short video (~10s) via the Gemini omni model: text\u2192video, image\u2192video / reference\u2192video (supply reference image[s]), interpolate between two stills (pass first frame then last frame as images), or continue a prior video (task: "edit" or "extend" + previous_interaction_id / continue_last; extensions add ~3-10s each, to ~40s total). Cost scales with `resolution` \u2014 draft at 360p, keep at 1080p/4k. Output is written to disk as MP4 (video has no inline MCP block). Video runs long \u2014 give it a `max_wait_ms` budget (or `async: true` + gemini_get_result on a local install), or raise `timeout_ms`. Needs a funded account. ' + confirmNote("Local file inputs are confirmed first"),
       annotations: { readOnlyHint: false, openWorldHint: true },
       inputSchema: external_exports.object({
         prompt: external_exports.string().min(1).describe("Description of the video to generate (or the edit instruction when task=edit)"),
@@ -63616,7 +64160,7 @@ function registerVideoTools(server, client2) {
         idempotency_key: idempotencyKeySchema,
         async: asyncSchema,
         max_wait_ms: maxWaitMsSchema,
-        confirm: schemaConfirm
+        confirmToken: confirmTokenParam
       })
     },
     async (args, extra) => {
@@ -63630,7 +64174,16 @@ function registerVideoTools(server, client2) {
         }
         previousInteractionId = client2.session.lastVideoInteractionId;
       }
-      const gate = await previewLocalInputsUnlessConfirmed(args.confirm, "Send local image input(s) to the Gemini omni API", "/v1beta/interactions", args.images);
+      const { confirmToken, ...request } = args;
+      const gate = await confirmLocalInputs(extra, {
+        tool: "gemini_video_generate",
+        action: "video.generate",
+        description: "Send local image input(s) to the Gemini omni API",
+        endpoint: "/v1beta/interactions",
+        imagePaths: args.images,
+        request: { ...request, previous_interaction_id: previousInteractionId },
+        confirmToken
+      });
       if (gate) return gate;
       const model = args.model?.trim() || DEFAULT_VIDEO_MODEL;
       const aspectRatio = resolveAspectRatio(args, VIDEO_ASPECT_RATIOS);
@@ -63695,7 +64248,7 @@ function registerMusicTools(server, client2) {
   server.registerTool(
     "gemini_music_generate",
     {
-      description: "Generate music from a text prompt (mood, genre, instruments, structure, or lyrics inline) via a Lyria model: lyria-3-clip-preview (30s instrumental clip, default, cheapest), lyria-3.5 (full-length song with vocals) or lyria-3-pro-preview (longer-form). Output is MP3, written to disk (or returned inline). Single-turn: a track cannot be refined by a follow-up call, so put the whole brief in the prompt. Runs long \u2014 give it a `max_wait_ms` budget (or `async: true` + gemini_get_result on a local install), or raise `timeout_ms`. Needs a funded account.",
+      description: "Generate music from a text prompt (mood, genre, instruments, structure, or lyrics inline) via a Lyria model: lyria-3-clip-preview (30s instrumental clip, default, cheapest), lyria-3.5 (full-length song with vocals) or lyria-3-pro-preview (longer-form). Output is MP3, written to disk (or returned inline). Single-turn: a track cannot be refined by a follow-up call, so put the whole brief in the prompt. Runs long \u2014 give it a `max_wait_ms` budget (or `async: true` + gemini_get_result on a local install), or raise `timeout_ms`. Needs a funded account. " + confirmNote("Local file inputs are confirmed first"),
       annotations: { readOnlyHint: false, openWorldHint: true },
       inputSchema: external_exports.object({
         prompt: external_exports.string().min(1).describe("Description of the music: mood, genre, instruments, tempo, structure, or lyrics"),
@@ -63713,13 +64266,22 @@ function registerMusicTools(server, client2) {
         idempotency_key: idempotencyKeySchema,
         async: asyncSchema,
         max_wait_ms: maxWaitMsSchema,
-        confirm: schemaConfirm
+        confirmToken: confirmTokenParam
       })
     },
     async (args, extra) => {
       assertLocalInputsAvailable(client2.mediaSink, args);
       const model = args.model ?? DEFAULT_MUSIC_MODEL;
-      const gate = await previewLocalInputsUnlessConfirmed(args.confirm, "Send local image input(s) to the Gemini Lyria API", "/v1beta/interactions", args.images);
+      const { confirmToken, ...request } = args;
+      const gate = await confirmLocalInputs(extra, {
+        tool: "gemini_music_generate",
+        action: "music.generate",
+        description: "Send local image input(s) to the Gemini Lyria API",
+        endpoint: "/v1beta/interactions",
+        imagePaths: args.images,
+        request,
+        confirmToken
+      });
       if (gate) return gate;
       const fingerprint = fingerprintRequest("gemini_music_generate", {
         model,
@@ -63907,7 +64469,7 @@ function registerFileTools(server, client2) {
   server.registerTool(
     "gemini_upload_file",
     {
-      description: "Upload a file \u2014 an image, reference photo, picture, screenshot, video or audio clip \u2014 to the Gemini Files API ONCE, and get back a reusable `file_uri` (`files/<id>`) to attach to later image, video or music generations. Keywords: upload, upload file, upload image, upload photo, attach, reference image, reference photo, file_uri, files api, image reference, reuse across calls. Use this instead of pasting base64 into a tool call: the reference is a short string, so no image bytes ever enter the conversation, and it can be reused across many generations until it expires (~48h). Provide exactly one of `url` (the server downloads it), `data_base64`" + (onDisk ? ", or `path` (a local file)." : ", or `r2_key` (re-upload media this connector generated, from media[].r2_key in an earlier result).") + (onDisk ? "" : " To upload a local file without base64: mint a signed PUT URL with gemini_get_upload_url, PUT the bytes to it, then pass the returned r2_key here."),
+      description: "Upload a file \u2014 an image, reference photo, picture, screenshot, video or audio clip \u2014 to the Gemini Files API ONCE, and get back a reusable `file_uri` (`files/<id>`) to attach to later image, video or music generations. Keywords: upload, upload file, upload image, upload photo, attach, reference image, reference photo, file_uri, files api, image reference, reuse across calls. Use this instead of pasting base64 into a tool call: the reference is a short string, so no image bytes ever enter the conversation, and it can be reused across many generations until it expires (~48h). Provide exactly one of `url` (the server downloads it), `data_base64`" + (onDisk ? ", or `path` (a local file)." : ", or `r2_key` (re-upload media this connector generated, from media[].r2_key in an earlier result).") + (onDisk ? " " + confirmNote("A local `path` is confirmed first") : " To upload a local file without base64: mint a signed PUT URL with gemini_get_upload_url, PUT the bytes to it, then pass the returned r2_key here."),
       annotations: { readOnlyHint: false, openWorldHint: true },
       inputSchema: external_exports.object({
         url: external_exports.string().url().optional().describe(
@@ -63922,7 +64484,7 @@ function registerFileTools(server, client2) {
         ),
         mime_type: external_exports.string().regex(/^[\w.+-]+\/[\w.+-]+$/, "must be a MIME type like image/png").optional().describe("Override the detected MIME type (sniffed from the bytes / taken from the server response otherwise)"),
         display_name: external_exports.string().min(1).optional().describe("Human-readable name recorded against the upload"),
-        confirm: schemaConfirm
+        confirmToken: confirmTokenParam
       })
     },
     async (args, extra) => {
@@ -63949,12 +64511,21 @@ function registerFileTools(server, client2) {
             { hint: "Pass mime_type explicitly." }
           );
         }
-        if (args.confirm !== true) {
-          const { size } = await stat3(resolved);
-          return previewUnlessConfirmed(args.confirm, "Upload a local file to the Gemini Files API", "POST", "/upload/v1beta/files", {
-            inputs: [{ path: resolved, mimeType, size }]
-          });
-        }
+        const { size } = await stat3(resolved);
+        const inputs = [{ path: resolved, mimeType, size }];
+        const gate = await confirmWrite(extra, {
+          tool: "gemini_upload_file",
+          action: "file.upload",
+          message: "Review and confirm uploading this local file to Google:",
+          description: "Upload a local file to the Gemini Files API",
+          method: "POST",
+          path: "/upload/v1beta/files",
+          body: { inputs },
+          target: resolved,
+          payload: { inputs, display_name: args.display_name },
+          confirmToken: args.confirmToken
+        });
+        if (gate) return gate;
         localUpload = { path: resolved, mimeType };
       }
       const uploaded = await withProgressHeartbeat(extra, "Uploading to the Gemini Files API", async () => {
@@ -64125,15 +64696,25 @@ function registerFileTools(server, client2) {
   server.registerTool(
     "gemini_delete_file",
     {
-      description: "Delete an uploaded file, image or photo (by file_uri) from the Gemini Files API before its ~48h expiry. Any tool call still referencing it will then fail with a generic 404, so delete only references you are finished with.",
+      description: "Delete an uploaded file, image or photo (by file_uri) from the Gemini Files API before its ~48h expiry. Any tool call still referencing it will then fail with a generic 404, so delete only references you are finished with. " + confirmNote(),
       annotations: { readOnlyHint: false, destructiveHint: true, openWorldHint: true },
       inputSchema: external_exports.object({
         file_uri: external_exports.string().min(1).describe("The `files/<id>` reference (or full uri) to delete"),
-        confirm: schemaConfirm
+        confirmToken: confirmTokenParam
       })
     },
-    async (args) => {
-      const gate = previewUnlessConfirmed(args.confirm, "Delete an uploaded Gemini file", "DELETE", `/v1beta/${args.file_uri}`);
+    async (args, extra) => {
+      const gate = await confirmWrite(extra, {
+        tool: "gemini_delete_file",
+        action: "file.delete",
+        message: "Review and confirm this deletion:",
+        description: "Delete an uploaded Gemini file",
+        method: "DELETE",
+        path: `/v1beta/${args.file_uri}`,
+        target: args.file_uri,
+        payload: { file_uri: args.file_uri },
+        confirmToken: args.confirmToken
+      });
       if (gate) return gate;
       await client2.deleteFile(args.file_uri);
       return minifiedResult({ deleted: args.file_uri });
@@ -64269,12 +64850,22 @@ function registerLibraryTools(server, client2) {
   server.registerTool(
     "gemini_delete_character",
     {
-      description: "Delete a saved character from this account's reference library. Generation calls naming it will then fail until it is re-saved.",
+      description: "Delete a saved character from this account's reference library. Generation calls naming it will then fail until it is re-saved. " + confirmNote(),
       annotations: { readOnlyHint: false, destructiveHint: true, openWorldHint: false },
-      inputSchema: external_exports.object({ name: NAME_FIELD, confirm: schemaConfirm })
+      inputSchema: external_exports.object({ name: NAME_FIELD, confirmToken: confirmTokenParam })
     },
-    async (args) => {
-      const gate = previewUnlessConfirmed(args.confirm, "Delete a saved character (its reference image and description)", "DELETE", `characters/${args.name}`);
+    async (args, extra) => {
+      const gate = await confirmWrite(extra, {
+        tool: "gemini_delete_character",
+        action: "character.delete",
+        message: "Review and confirm this deletion:",
+        description: "Delete a saved character (its reference image and description)",
+        method: "DELETE",
+        path: `characters/${args.name}`,
+        target: args.name,
+        payload: { name: args.name },
+        confirmToken: args.confirmToken
+      });
       if (gate) return gate;
       const existed = await library.deleteCharacter(args.name);
       if (!existed) {
@@ -64338,12 +64929,22 @@ function registerLibraryTools(server, client2) {
   server.registerTool(
     "gemini_delete_style",
     {
-      description: "Delete a saved style preset from this account's reference library.",
+      description: "Delete a saved style preset from this account's reference library. " + confirmNote(),
       annotations: { readOnlyHint: false, destructiveHint: true, openWorldHint: false },
-      inputSchema: external_exports.object({ name: NAME_FIELD, confirm: schemaConfirm })
+      inputSchema: external_exports.object({ name: NAME_FIELD, confirmToken: confirmTokenParam })
     },
-    async (args) => {
-      const gate = previewUnlessConfirmed(args.confirm, "Delete a saved style preset", "DELETE", `styles/${args.name}`);
+    async (args, extra) => {
+      const gate = await confirmWrite(extra, {
+        tool: "gemini_delete_style",
+        action: "style.delete",
+        message: "Review and confirm this deletion:",
+        description: "Delete a saved style preset",
+        method: "DELETE",
+        path: `styles/${args.name}`,
+        target: args.name,
+        payload: { name: args.name },
+        confirmToken: args.confirmToken
+      });
       if (gate) return gate;
       const existed = await library.deleteStyle(args.name);
       if (!existed) {