@chrischall/gemini-mcp 2.1.4 → 2.3.0

package/dist/client.js

@@ -1,4 +1,4 @@
-import { basename } from 'node:path';
+import { basename, delimiter } from 'node:path';
 import { readEnvVar, McpToolError, ApiError, createApiClient, formatApiError, fileBlob } from '@chrischall/mcp-utils';
 import { resolveModel, filterImageModels, DEFAULT_VIDEO_MODEL, DEFAULT_MUSIC_MODEL } from './models.js';
 import { readUsage } from './usage.js';
@@ -181,6 +181,29 @@ export function normalizeFileName(ref) {
     }
     return match[1];
 }
+/**
+ * `GEMINI_UPLOAD_DIR` — the optional allow-list for local files streamed to
+ * the Files API (`gemini_upload_file` `path`, `video_path`). One or more
+ * directories separated by the platform path delimiter (`:` / `;`); `~` is
+ * expanded by mcp-utils. Unset → `undefined` → uploads stay unconfined.
+ * The paths are model-chosen, so a prompt-injected path could otherwise send
+ * any readable file to Google.
+ */
+function uploadRoots() {
+    const roots = readEnvVar('GEMINI_UPLOAD_DIR')?.split(delimiter).map((r) => r.trim()).filter(Boolean);
+    return roots && roots.length > 0 ? roots : undefined;
+}
+/**
+ * Turn mcp-utils' bare "outside the allowed directories" refusal into an
+ * actionable tool error. The remediation is in the MESSAGE — hosts show the
+ * message and drop the hint (see CLAUDE.md, Errors).
+ */
+function explainOutsideUploadDir(err) {
+    if (err instanceof Error && err.message.startsWith('Path is outside the allowed directories')) {
+        throw new McpToolError('Refusing to upload a file outside GEMINI_UPLOAD_DIR, which restricts which local files can be uploaded to Google. Move the file into GEMINI_UPLOAD_DIR, or add its directory to GEMINI_UPLOAD_DIR.');
+    }
+    throw err;
+}
 export class GeminiClient {
     /**
      * A key handed in explicitly (the connector's per-session key). When absent
@@ -365,7 +388,10 @@ export class GeminiClient {
      * (enforced locally before any bytes are sent).
      */
     async uploadVideo(path, mimeType) {
-        const blob = await fileBlob(path, { type: mimeType, maxBytes: FILE_MAX_BYTES, label: 'Video' });
+        const roots = uploadRoots();
+        const blob = await fileBlob(path, {
+            type: mimeType, maxBytes: FILE_MAX_BYTES, label: 'Video', ...(roots ? { allowedRoots: roots } : {}),
+        }).catch(explainOutsideUploadDir);
         return this.uploadToFilesApi(blob, mimeType, basename(path), blob.size);
     }
     /**
@@ -376,7 +402,10 @@ export class GeminiClient {
      * length on a few-hundred-MB video (chrischall/fleet-audit#117).
      */
     async uploadFile(path, mimeType, displayName = basename(path)) {
-        const blob = await fileBlob(path, { type: mimeType, maxBytes: FILE_MAX_BYTES, label: 'File' });
+        const roots = uploadRoots();
+        const blob = await fileBlob(path, {
+            type: mimeType, maxBytes: FILE_MAX_BYTES, label: 'File', ...(roots ? { allowedRoots: roots } : {}),
+        }).catch(explainOutsideUploadDir);
         return this.uploadToFilesApi(blob, mimeType, displayName, blob.size);
     }
     /**

package/dist/images.js

@@ -31,10 +31,26 @@ export async function uniquePath(dir, base, ext) {
     }
     return candidate;
 }
-/** Sniff MIME type from the first bytes of an image buffer (PNG fallback). */
+/** Sniff MIME type from the first bytes of an image buffer (PNG fallback).
+ * Only for bytes that arrive as base64 with no other type information; a LOCAL
+ * file goes through {@link localImageMime}, which never guesses. */
 function sniffMimeBytes(buf) {
     return sniffImageMime(buf) ?? 'image/png';
 }
+/**
+ * The MIME of a LOCAL image input (PNG/JPEG/WebP, sniffed from its bytes), or a
+ * refusal. Never defaults: an unidentifiable file used to be previewed and sent
+ * as image/png, so a prompt-injected `images: ['~/.ssh/id_rsa']` showed up in
+ * the confirmation preview mislabelled as a PNG (chrischall/fleet-audit#929).
+ */
+function localImageMime(resolvedPath, head) {
+    const mime = sniffImageMime(head);
+    if (!mime) {
+        throw new McpToolError(`Cannot tell what kind of image ${resolvedPath} is — its bytes are not PNG, JPEG or WebP, ` +
+            'so it is not sent to Gemini as a reference image.', { hint: 'Pass a PNG, JPEG or WebP file (convert other formats first).' });
+    }
+    return mime;
+}
 /** PNG/JPEG/WebP from the leading bytes, or `undefined` when it is none of them. */
 function sniffImageMime(buf) {
     // PNG: 89 50 4E 47
@@ -167,14 +183,14 @@ export function videoMimeType(p) {
 export async function previewImageInput(path) {
     const resolved = resolveImagePath(path);
     // Read only the header bytes needed to sniff the MIME (≤12), and take the size
-    // from stat() — a dry-run must not load a large reference image into memory
+    // from stat() — a preview must not load a large reference image into memory
     // just to report it (matches previewVideoInput).
     const { size } = await stat(resolved);
     const fh = await open(resolved, 'r');
     try {
         const head = Buffer.alloc(16);
         const { bytesRead } = await fh.read(head, 0, 16, 0);
-        return { path: resolved, mimeType: sniffMimeBytes(head.subarray(0, bytesRead)), size };
+        return { path: resolved, mimeType: localImageMime(resolved, head.subarray(0, bytesRead)), size };
     }
     finally {
         await fh.close();
@@ -239,7 +255,7 @@ export async function detectUploadMime(resolvedPath) {
 export async function readImageAsInline(path) {
     const resolved = resolveImagePath(path);
     const buf = await readFile(resolved);
-    const mimeType = sniffMimeBytes(buf);
+    const mimeType = localImageMime(resolved, buf);
     return { base64: buf.toString('base64'), mimeType };
 }
 /**

package/dist/tools/_confirm.js

@@ -1,39 +1,63 @@
-import { minifiedResult, schemaConfirm } from '@chrischall/mcp-utils';
+import { confirmationFromEnv, confirmTokenParam, requireConfirmationWithFallback } from '@chrischall/mcp-utils';
 import { previewImageInput, previewVideoInput } from '../images.js';
-export { schemaConfirm };
+export { confirmTokenParam };
 /**
- * Confirm-gate for a mutating tool (the fleet convention). When `confirm` is not
- * `true`, returns a no-network dry-run preview of exactly what would be sent;
- * when it is `true`, returns `null` so the caller proceeds with the write.
+ * The sentence every gated tool's description ends with. `lead` names what is
+ * confirmed when it is not the whole call (local file inputs only).
  */
-export function previewUnlessConfirmed(confirm, action, method, path, body) {
-    if (confirm === true)
-        return null;
-    return minifiedResult({
-        dryRun: true,
-        action,
-        method,
-        path,
-        ...(body !== undefined ? { willSend: body } : {}),
-        note: 'Re-run with confirm: true to execute.',
-    });
+export function confirmNote(lead = 'Asks the user to confirm first') {
+    return `${lead}: a confirmation prompt where the client supports one; otherwise the first call returns a preview ` +
+        'and a confirmToken, and only a repeat call with that token proceeds (see MCP_CONFIRM_MODE).';
+}
+/**
+ * Confirm a mutating call before it runs: an elicitation prompt where the
+ * client supports one, otherwise the preview-plus-token fallback governed by
+ * MCP_CONFIRM_MODE. The preview is the same method/path/willSend shape the old
+ * dry-run returned.
+ */
+export async function confirmWrite(ctx, o) {
+    const preview = {
+        action: o.description,
+        method: o.method,
+        path: o.path,
+        ...(o.body !== undefined ? { willSend: o.body } : {}),
+    };
+    return requireConfirmationWithFallback(ctx, confirmationFromEnv({
+        action: o.action,
+        message: o.message,
+        details: preview,
+        tool: o.tool,
+        confirmToken: o.confirmToken,
+        subject: () => ({ target: o.target, payload: o.payload, preview }),
+    }));
 }
 /**
  * Confirm-gate for a Gemini tool that ships LOCAL input files (image/video
- * paths) to Google. Returns `null` (proceed) when `confirm === true` OR the call
- * has no local file inputs — so pure text-to-image / base64 / clipboard calls
- * are unaffected. Otherwise returns a NO-API dry-run echoing each RESOLVED
- * ABSOLUTE input path plus its mime and size, so a prompt-injected path (e.g.
+ * paths) to Google. Proceeds straight away when the call has no local file
+ * inputs — so pure text-to-image / base64 / clipboard calls are unaffected.
+ * Otherwise the preview echoes each RESOLVED ABSOLUTE input path plus its mime
+ * and size (a local read, no network), so a prompt-injected path (e.g.
  * `~/.ssh/id_rsa`) is visible and interceptable before any byte leaves the box.
  */
-export async function previewLocalInputsUnlessConfirmed(confirm, action, endpoint, imagePaths, videoPath) {
-    const hasLocal = (imagePaths?.length ?? 0) > 0 || Boolean(videoPath);
-    if (confirm === true || !hasLocal)
-        return null;
+export async function confirmLocalInputs(ctx, o) {
+    const hasLocal = (o.imagePaths?.length ?? 0) > 0 || Boolean(o.videoPath);
+    if (!hasLocal)
+        return undefined;
     const inputs = [];
-    for (const p of imagePaths ?? [])
+    for (const p of o.imagePaths ?? [])
         inputs.push(await previewImageInput(p));
-    if (videoPath)
-        inputs.push(await previewVideoInput(videoPath));
-    return previewUnlessConfirmed(confirm, action, 'POST', endpoint, { inputs });
+    if (o.videoPath)
+        inputs.push(await previewVideoInput(o.videoPath));
+    return confirmWrite(ctx, {
+        tool: o.tool,
+        action: o.action,
+        message: 'Review and confirm sending these local files to Google:',
+        description: o.description,
+        method: 'POST',
+        path: o.endpoint,
+        body: { inputs },
+        target: '',
+        payload: { request: o.request, inputs },
+        confirmToken: o.confirmToken,
+    });
 }

package/dist/tools/files.js

@@ -5,7 +5,7 @@ import { withProgressHeartbeat } from './shared.js';
 import { base64ToBytes, bytesToBase64, formatMb, wholeMb } from '../bytes.js';
 import { fileNameFromUrl } from '../fetch-image.js';
 import { downloadFilename } from '../media-name.js';
-import { previewUnlessConfirmed, schemaConfirm } from './_confirm.js';
+import { confirmNote, confirmTokenParam, confirmWrite } from './_confirm.js';
 /**
  * First-class Gemini Files API access.
  *
@@ -86,7 +86,7 @@ export function registerFileTools(server, client) {
                 ? ', or `path` (a local file).'
                 : ', or `r2_key` (re-upload media this connector generated, from media[].r2_key in an earlier result).') +
             (onDisk
-                ? ''
+                ? ' ' + confirmNote('A local `path` is confirmed first')
                 : ' To upload a local file without base64: mint a signed PUT URL with gemini_get_upload_url, PUT the bytes to it, ' +
                     'then pass the returned r2_key here.'),
         annotations: { readOnlyHint: false, openWorldHint: true },
@@ -126,7 +126,7 @@ export function registerFileTools(server, client) {
                 .optional()
                 .describe('Override the detected MIME type (sniffed from the bytes / taken from the server response otherwise)'),
             display_name: z.string().min(1).optional().describe('Human-readable name recorded against the upload'),
-            confirm: schemaConfirm,
+            confirmToken: confirmTokenParam,
         }),
     }, async (args, extra) => {
         const sources = [args.url && 'url', args.data_base64 && 'data_base64', args.r2_key && 'r2_key', args.path && 'path'].filter(Boolean);
@@ -156,12 +156,22 @@ export function registerFileTools(server, client) {
             // Same gate as every other local-file input: a prompt-injected `path`
             // would otherwise ship an arbitrary local file to Google, and an
             // uploaded file is readable by anyone holding the api key for ~48h.
-            if (args.confirm !== true) {
-                const { size } = await stat(resolved);
-                return previewUnlessConfirmed(args.confirm, 'Upload a local file to the Gemini Files API', 'POST', '/upload/v1beta/files', {
-                    inputs: [{ path: resolved, mimeType, size }],
-                });
-            }
+            const { size } = await stat(resolved);
+            const inputs = [{ path: resolved, mimeType, size }];
+            const gate = await confirmWrite(extra, {
+                tool: 'gemini_upload_file',
+                action: 'file.upload',
+                message: 'Review and confirm uploading this local file to Google:',
+                description: 'Upload a local file to the Gemini Files API',
+                method: 'POST',
+                path: '/upload/v1beta/files',
+                body: { inputs },
+                target: resolved,
+                payload: { inputs, display_name: args.display_name },
+                confirmToken: args.confirmToken,
+            });
+            if (gate)
+                return gate;
             localUpload = { path: resolved, mimeType };
         }
         const uploaded = await withProgressHeartbeat(extra, 'Uploading to the Gemini Files API', async () => {
@@ -351,16 +361,27 @@ export function registerFileTools(server, client) {
     }
     server.registerTool('gemini_delete_file', {
         description: 'Delete an uploaded file, image or photo (by file_uri) from the Gemini Files API before its ~48h expiry. Any tool call still referencing it ' +
-            'will then fail with a generic 404, so delete only references you are finished with.',
+            'will then fail with a generic 404, so delete only references you are finished with. ' +
+            confirmNote(),
         annotations: { readOnlyHint: false, destructiveHint: true, openWorldHint: true },
         inputSchema: z.object({
             file_uri: z.string().min(1).describe('The `files/<id>` reference (or full uri) to delete'),
-            confirm: schemaConfirm,
+            confirmToken: confirmTokenParam,
         }),
-    }, async (args) => {
+    }, async (args, extra) => {
         // Deleting is a remote mutation with no undo — confirm-gated per the
         // fleet convention (unlike writing a generated image, which is local).
-        const gate = previewUnlessConfirmed(args.confirm, 'Delete an uploaded Gemini file', 'DELETE', `/v1beta/${args.file_uri}`);
+        const gate = await confirmWrite(extra, {
+            tool: 'gemini_delete_file',
+            action: 'file.delete',
+            message: 'Review and confirm this deletion:',
+            description: 'Delete an uploaded Gemini file',
+            method: 'DELETE',
+            path: `/v1beta/${args.file_uri}`,
+            target: args.file_uri,
+            payload: { file_uri: args.file_uri },
+            confirmToken: args.confirmToken,
+        });
         if (gate)
             return gate;
         await client.deleteFile(args.file_uri);

package/dist/tools/generate.js

@@ -7,7 +7,7 @@ import { emit, resolveAspectRatio, ASPECT_RATIOS, sharedImageSchema, pickSeed, b
 import { fingerprintRequest } from '../jobs.js';
 import { sumUsage } from '../usage.js';
 import { attachCost } from '../pricing.js';
-import { previewLocalInputsUnlessConfirmed, schemaConfirm } from './_confirm.js';
+import { confirmLocalInputs, confirmNote, confirmTokenParam } from './_confirm.js';
 const GENERATE_ENDPOINT = '/v1beta/models/{model}:generateContent';
 const SEND_LOCAL_ACTION = 'Send local file input(s) to the Gemini API';
 // generateContent output can't seed an Interactions-API conversation, so
@@ -17,7 +17,8 @@ const REFINE_HINT = 'To iteratively refine this image, use gemini_interact (pass
 export function registerGenerateTools(server, client) {
     server.registerTool('gemini_image_generate', {
         description: 'Generate image(s) from a text prompt with a Gemini image model (Nano Banana / Nano Banana Pro). ' +
-            'If the result will likely be refined iteratively, prefer gemini_interact (multi-turn) as the entry point.',
+            'If the result will likely be refined iteratively, prefer gemini_interact (multi-turn) as the entry point. ' +
+            confirmNote('Local file inputs are confirmed first'),
         annotations: { readOnlyHint: false, openWorldHint: true },
         inputSchema: z.object({
             prompt: z.string().min(1).describe('Text prompt describing the image'),
@@ -32,7 +33,7 @@ export function registerGenerateTools(server, client) {
             style: styleSchema,
             video_url: z.string().url().optional().describe('Public YouTube URL (or a previously uploaded Files API uri) as a video reference (video→image; use a Flash model e.g. gemini-3.1-flash-image)'),
             video_path: videoPathSchema,
-            confirm: schemaConfirm,
+            confirmToken: confirmTokenParam,
             ...sharedImageSchema,
         }),
     }, async (args, extra) => {
@@ -42,8 +43,12 @@ export function registerGenerateTools(server, client) {
         assertLocalInputsAvailable(client.mediaSink, args);
         // Confirm-gate local file inputs: a prompt-injected `images`/`video_path`
         // could exfiltrate a local file. Pure text-to-image calls (no local input)
-        // are unaffected. Dry-run makes NO API call.
-        const gate = await previewLocalInputsUnlessConfirmed(args.confirm, SEND_LOCAL_ACTION, GENERATE_ENDPOINT, args.images, args.video_path);
+        // are unaffected. The preview makes NO API call.
+        const { confirmToken, ...request } = args;
+        const gate = await confirmLocalInputs(extra, {
+            tool: 'gemini_image_generate', action: 'image.generate', description: SEND_LOCAL_ACTION, endpoint: GENERATE_ENDPOINT,
+            imagePaths: args.images, videoPath: args.video_path, request, confirmToken,
+        });
         if (gate)
             return gate;
         const count = args.count ?? 1;
@@ -159,7 +164,8 @@ export function registerGenerateTools(server, client) {
         description: 'Edit or compose images: provide one or more input images (paths or base64), plus a text instruction. ' +
             'For a SERIES of successive edits to the same image, prefer gemini_interact (multi-turn) — it keeps edit context ' +
             'and avoids re-processing the full image each round; use gemini_image_edit for one-off edits or composing multiple distinct inputs. ' +
-            'Gemini over-preserves the input; there is no edit-strength control — for large structural changes, reroll with a different `seed` or more forceful wording.',
+            'Gemini over-preserves the input; there is no edit-strength control — for large structural changes, reroll with a different `seed` or more forceful wording. ' +
+            confirmNote('Local file inputs are confirmed first'),
         annotations: { readOnlyHint: false, openWorldHint: true },
         inputSchema: z.object({
             prompt: z.string().min(1).describe('Instruction describing the edit or composition'),
@@ -171,7 +177,7 @@ export function registerGenerateTools(server, client) {
             characters: charactersSchema,
             style: styleSchema,
             filename: z.string().optional().describe('Base filename for the output image (extension stripped; default: slugified prompt)'),
-            confirm: schemaConfirm,
+            confirmToken: confirmTokenParam,
             ...sharedImageSchema,
         }),
     }, async (args, extra) => {
@@ -182,7 +188,11 @@ export function registerGenerateTools(server, client) {
             requireImageInput(args);
         // Confirm-gate local file inputs (see gemini_image_generate). base64 /
         // clipboard inputs are not local-path reads and pass through ungated.
-        const gate = await previewLocalInputsUnlessConfirmed(args.confirm, SEND_LOCAL_ACTION, GENERATE_ENDPOINT, args.images);
+        const { confirmToken, ...request } = args;
+        const gate = await confirmLocalInputs(extra, {
+            tool: 'gemini_image_edit', action: 'image.edit', description: SEND_LOCAL_ACTION, endpoint: GENERATE_ENDPOINT,
+            imagePaths: args.images, request, confirmToken,
+        });
         if (gate)
             return gate;
         const model = resolveModel(args.model, readEnvVar('GEMINI_IMAGE_MODEL'));

package/dist/tools/interact.js

@@ -9,7 +9,7 @@ import { emit, reportShape, resolveAspectRatio, orientationSchema, ASPECT_RATIOS
 import { bytesToBase64 } from '../bytes.js';
 import { fingerprintRequest } from '../jobs.js';
 import { attachCost } from '../pricing.js';
-import { previewLocalInputsUnlessConfirmed, schemaConfirm } from './_confirm.js';
+import { confirmLocalInputs, confirmNote, confirmTokenParam } from './_confirm.js';
 // The last-interaction id and the written-outputs set used to live here, at
 // module scope. On the hosted connector that leaks across tenants — one
 // Cloudflare isolate serves many authenticated sessions, so `continue_last`
@@ -89,7 +89,8 @@ export function registerInteractTools(server, client) {
             'do NOT start a new interaction or re-send the image for each tweak. `continue_last: true` chains from this ' +
             "session's most recent interaction without threading the id. " +
             recoveryDescription +
-            'Output is JPEG.',
+            'Output is JPEG. ' +
+            confirmNote('Local file inputs are confirmed first'),
         annotations: { readOnlyHint: false, openWorldHint: true },
         inputSchema: z.object({
             input: z.string().min(1).describe('Text prompt or editing instruction'),
@@ -160,7 +161,7 @@ export function registerInteractTools(server, client) {
                 .boolean()
                 .optional()
                 .describe('Use the image currently on the macOS system clipboard as an input (downscaled to JPEG)'),
-            confirm: schemaConfirm,
+            confirmToken: confirmTokenParam,
         }),
     }, async (args, extra) => {
         assertLocalInputsAvailable(client.mediaSink, args);
@@ -205,8 +206,13 @@ export function registerInteractTools(server, client) {
         // Confirm-gate local file inputs AFTER the re-attach split, so the preview
         // reflects the paths actually sent (dropped prior-output paths aren't). A
         // prompt-injected `images`/`video_path` could exfiltrate a local file;
-        // base64/clipboard inputs pass through ungated. Dry-run makes NO API call.
-        const gate = await previewLocalInputsUnlessConfirmed(args.confirm, 'Send local file input(s) to the Gemini Interactions API', '/v1beta/interactions', images, args.video_path);
+        // base64/clipboard inputs pass through ungated. The preview makes NO API call.
+        const { confirmToken, ...request } = args;
+        const gate = await confirmLocalInputs(extra, {
+            tool: 'gemini_interact', action: 'interaction.create', description: 'Send local file input(s) to the Gemini Interactions API', endpoint: '/v1beta/interactions',
+            imagePaths: images, videoPath: args.video_path,
+            request: { ...request, images, previous_interaction_id: previousInteractionId }, confirmToken,
+        });
         if (gate)
             return gate;
         const model = resolveModel(args.model, readEnvVar('GEMINI_IMAGE_MODEL'));

package/dist/tools/library.js

@@ -3,7 +3,7 @@ import { McpToolError, minifiedResult } from '@chrischall/mcp-utils';
 import { LIBRARY_NAME_PATTERN } from '../library.js';
 import { acceptableUploadType } from '../upload-url.js';
 import { withProgressHeartbeat } from './shared.js';
-import { previewUnlessConfirmed, schemaConfirm } from './_confirm.js';
+import { confirmNote, confirmTokenParam, confirmWrite } from './_confirm.js';
 /**
  * Tools over the per-account reference library (src/library.ts): named
  * characters and styles that persist across sessions with NO expiry.
@@ -111,11 +111,21 @@ export function registerLibraryTools(server, client) {
         });
     });
     server.registerTool('gemini_delete_character', {
-        description: 'Delete a saved character from this account\'s reference library. Generation calls naming it will then fail until it is re-saved.',
+        description: 'Delete a saved character from this account\'s reference library. Generation calls naming it will then fail until it is re-saved. ' + confirmNote(),
         annotations: { readOnlyHint: false, destructiveHint: true, openWorldHint: false },
-        inputSchema: z.object({ name: NAME_FIELD, confirm: schemaConfirm }),
-    }, async (args) => {
-        const gate = previewUnlessConfirmed(args.confirm, 'Delete a saved character (its reference image and description)', 'DELETE', `characters/${args.name}`);
+        inputSchema: z.object({ name: NAME_FIELD, confirmToken: confirmTokenParam }),
+    }, async (args, extra) => {
+        const gate = await confirmWrite(extra, {
+            tool: 'gemini_delete_character',
+            action: 'character.delete',
+            message: 'Review and confirm this deletion:',
+            description: 'Delete a saved character (its reference image and description)',
+            method: 'DELETE',
+            path: `characters/${args.name}`,
+            target: args.name,
+            payload: { name: args.name },
+            confirmToken: args.confirmToken,
+        });
         if (gate)
             return gate;
         const existed = await library.deleteCharacter(args.name);
@@ -170,11 +180,21 @@ export function registerLibraryTools(server, client) {
         });
     });
     server.registerTool('gemini_delete_style', {
-        description: 'Delete a saved style preset from this account\'s reference library.',
+        description: 'Delete a saved style preset from this account\'s reference library. ' + confirmNote(),
         annotations: { readOnlyHint: false, destructiveHint: true, openWorldHint: false },
-        inputSchema: z.object({ name: NAME_FIELD, confirm: schemaConfirm }),
-    }, async (args) => {
-        const gate = previewUnlessConfirmed(args.confirm, 'Delete a saved style preset', 'DELETE', `styles/${args.name}`);
+        inputSchema: z.object({ name: NAME_FIELD, confirmToken: confirmTokenParam }),
+    }, async (args, extra) => {
+        const gate = await confirmWrite(extra, {
+            tool: 'gemini_delete_style',
+            action: 'style.delete',
+            message: 'Review and confirm this deletion:',
+            description: 'Delete a saved style preset',
+            method: 'DELETE',
+            path: `styles/${args.name}`,
+            target: args.name,
+            payload: { name: args.name },
+            confirmToken: args.confirmToken,
+        });
         if (gate)
             return gate;
         const existed = await library.deleteStyle(args.name);

package/dist/tools/music.js

@@ -5,7 +5,7 @@ import { DEFAULT_MUSIC_MODEL } from '../models.js';
 import { emitMedia, timeoutMsSchema, idempotencyKeySchema, asyncSchema, maxWaitMsSchema, withProgressHeartbeat, assertLocalInputsAvailable, imagesUrlSchema, imagesFileUrisSchema, imagesBase64Schema } from './shared.js';
 import { fingerprintRequest } from '../jobs.js';
 import { attachCost } from '../pricing.js';
-import { previewLocalInputsUnlessConfirmed, schemaConfirm } from './_confirm.js';
+import { confirmLocalInputs, confirmNote, confirmTokenParam } from './_confirm.js';
 const MUSIC_MODELS = ['lyria-3-clip-preview', 'lyria-3.5', 'lyria-3-pro-preview'];
 /**
  * There is no output-format parameter, and there is no chaining.
@@ -28,7 +28,8 @@ export function registerMusicTools(server, client) {
             'lyria-3-clip-preview (30s instrumental clip, default, cheapest), lyria-3.5 (full-length song with vocals) or ' +
             'lyria-3-pro-preview (longer-form). Output is MP3, written to disk (or returned inline). Single-turn: a track ' +
             'cannot be refined by a follow-up call, so put the whole brief in the prompt. Runs long — give it a `max_wait_ms` ' +
-            'budget (or `async: true` + gemini_get_result on a local install), or raise `timeout_ms`. Needs a funded account.',
+            'budget (or `async: true` + gemini_get_result on a local install), or raise `timeout_ms`. Needs a funded account. ' +
+            confirmNote('Local file inputs are confirmed first'),
         annotations: { readOnlyHint: false, openWorldHint: true },
         inputSchema: z.object({
             prompt: z.string().min(1).describe('Description of the music: mood, genre, instruments, tempo, structure, or lyrics'),
@@ -46,12 +47,16 @@ export function registerMusicTools(server, client) {
             idempotency_key: idempotencyKeySchema,
             async: asyncSchema,
             max_wait_ms: maxWaitMsSchema,
-            confirm: schemaConfirm,
+            confirmToken: confirmTokenParam,
         }),
     }, async (args, extra) => {
         assertLocalInputsAvailable(client.mediaSink, args);
         const model = args.model ?? DEFAULT_MUSIC_MODEL;
-        const gate = await previewLocalInputsUnlessConfirmed(args.confirm, 'Send local image input(s) to the Gemini Lyria API', '/v1beta/interactions', args.images);
+        const { confirmToken, ...request } = args;
+        const gate = await confirmLocalInputs(extra, {
+            tool: 'gemini_music_generate', action: 'music.generate', description: 'Send local image input(s) to the Gemini Lyria API', endpoint: '/v1beta/interactions',
+            imagePaths: args.images, request, confirmToken,
+        });
         if (gate)
             return gate;
         const fingerprint = fingerprintRequest('gemini_music_generate', {

package/dist/tools/set.js

@@ -7,11 +7,12 @@ import { emit, resolveAspectRatio, ASPECT_RATIOS, sharedImageSchema, pickSeed, b
 import { fingerprintRequest } from '../jobs.js';
 import { sumUsage } from '../usage.js';
 import { attachCost } from '../pricing.js';
-import { previewLocalInputsUnlessConfirmed, schemaConfirm } from './_confirm.js';
+import { confirmLocalInputs, confirmNote, confirmTokenParam } from './_confirm.js';
 export function registerSetTools(server, client) {
     server.registerTool('gemini_image_set', {
         description: 'Generate a consistent SET of images: a master image from master_prompt, then one image per scene that references the master so the subject/style stays consistent. Provide `scenes` (explicit per-image prompts) OR `count` (variations of the master). ' +
-            'Scene generations run in parallel (reference_mode "master", the default). On the hosted connector: saved `characters` and a saved `style` can seed the whole set by name, multi-image results include a `bundle_url` zip of every image (one curl instead of N), and `max_wait_ms` returns a pollable job handle if the batch runs long.',
+            'Scene generations run in parallel (reference_mode "master", the default). On the hosted connector: saved `characters` and a saved `style` can seed the whole set by name, multi-image results include a `bundle_url` zip of every image (one curl instead of N), and `max_wait_ms` returns a pollable job handle if the batch runs long. ' +
+            confirmNote('Local file inputs are confirmed first'),
         annotations: { readOnlyHint: false, openWorldHint: true },
         inputSchema: z.object({
             master_prompt: z.string().min(1).describe('Prompt for the master/reference image'),
@@ -26,7 +27,7 @@ export function registerSetTools(server, client) {
             characters: charactersSchema,
             style: styleSchema,
             master_images_base64: imagesBase64Schema('Reference images for the master generation', 'master_images'),
-            confirm: schemaConfirm,
+            confirmToken: confirmTokenParam,
             ...sharedImageSchema,
         }),
     }, async (args, extra) => {
@@ -36,8 +37,12 @@ export function registerSetTools(server, client) {
             throw new McpToolError('Provide exactly one of `scenes` or `count`.');
         }
         // Confirm-gate local file inputs: only `master_images` (paths) can read a
-        // local file; base64 references pass through ungated. Dry-run makes NO API call.
-        const gate = await previewLocalInputsUnlessConfirmed(args.confirm, 'Send local master image input(s) to the Gemini API', '/v1beta/models/{model}:generateContent', args.master_images);
+        // local file; base64 references pass through ungated. The preview makes NO API call.
+        const { confirmToken, ...request } = args;
+        const gate = await confirmLocalInputs(extra, {
+            tool: 'gemini_image_set', action: 'image.set', description: 'Send local master image input(s) to the Gemini API', endpoint: '/v1beta/models/{model}:generateContent',
+            imagePaths: args.master_images, request, confirmToken,
+        });
         if (gate)
             return gate;
         const model = resolveModel(args.model, readEnvVar('GEMINI_IMAGE_MODEL'));

package/dist/tools/video.js

@@ -6,7 +6,7 @@ import { DEFAULT_VIDEO_MODEL } from '../models.js';
 import { emitMedia, reportShape, resolveAspectRatio, orientationSchema, timeoutMsSchema, idempotencyKeySchema, asyncSchema, maxWaitMsSchema, withProgressHeartbeat, assertLocalInputsAvailable, imagesUrlSchema, imagesFileUrisSchema, imagesBase64Schema } from './shared.js';
 import { fingerprintRequest } from '../jobs.js';
 import { attachCost } from '../pricing.js';
-import { previewLocalInputsUnlessConfirmed, schemaConfirm } from './_confirm.js';
+import { confirmLocalInputs, confirmNote, confirmTokenParam } from './_confirm.js';
 /** omni's own aspect-ratio enum — NOT the image tools' ASPECT_RATIOS. */
 const VIDEO_ASPECT_RATIOS = ['16:9', '9:16'];
 const VIDEO_TASKS = ['text_to_video', 'image_to_video', 'reference_to_video', 'edit', 'extend'];
@@ -36,7 +36,8 @@ export function registerVideoTools(server, client) {
             'or continue a prior video (task: "edit" or "extend" + previous_interaction_id / continue_last; extensions ' +
             'add ~3-10s each, to ~40s total). Cost scales with `resolution` — draft at 360p, keep at 1080p/4k. ' +
             'Output is written to disk as MP4 (video has no inline MCP block). Video runs long — give it a `max_wait_ms` budget ' +
-            '(or `async: true` + gemini_get_result on a local install), or raise `timeout_ms`. Needs a funded account.',
+            '(or `async: true` + gemini_get_result on a local install), or raise `timeout_ms`. Needs a funded account. ' +
+            confirmNote('Local file inputs are confirmed first'),
         annotations: { readOnlyHint: false, openWorldHint: true },
         inputSchema: z.object({
             prompt: z.string().min(1).describe('Description of the video to generate (or the edit instruction when task=edit)'),
@@ -64,7 +65,7 @@ export function registerVideoTools(server, client) {
             idempotency_key: idempotencyKeySchema,
             async: asyncSchema,
             max_wait_ms: maxWaitMsSchema,
-            confirm: schemaConfirm,
+            confirmToken: confirmTokenParam,
         }),
     }, async (args, extra) => {
         assertLocalInputsAvailable(client.mediaSink, args);
@@ -79,7 +80,11 @@ export function registerVideoTools(server, client) {
         }
         // Confirm-gate local file inputs (a prompt-injected `images` path could
         // exfiltrate a local file); base64 / clipboard pass through ungated.
-        const gate = await previewLocalInputsUnlessConfirmed(args.confirm, 'Send local image input(s) to the Gemini omni API', '/v1beta/interactions', args.images);
+        const { confirmToken, ...request } = args;
+        const gate = await confirmLocalInputs(extra, {
+            tool: 'gemini_video_generate', action: 'video.generate', description: 'Send local image input(s) to the Gemini omni API', endpoint: '/v1beta/interactions',
+            imagePaths: args.images, request: { ...request, previous_interaction_id: previousInteractionId }, confirmToken,
+        });
         if (gate)
             return gate;
         const model = args.model?.trim() || DEFAULT_VIDEO_MODEL;

package/dist/version.js

@@ -1,2 +1,2 @@
 /** Single source of the server version. release-please bumps the literal below. */
-export const VERSION = '2.1.4'; // x-release-please-version
+export const VERSION = '2.3.0'; // x-release-please-version

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "@chrischall/gemini-mcp",
-  "version": "2.1.4",
+  "version": "2.3.0",
   "mcpName": "io.github.chrischall/gemini-mcp",
   "description": "Gemini image-generation MCP server for Claude — developed and maintained by AI (Claude Code)",
   "author": "Claude Code (AI) <https://www.anthropic.com/claude>",
@@ -46,9 +46,9 @@
     "typecheck": "tsc -p tsconfig.test.json"
   },
   "dependencies": {
-    "@chrischall/mcp-utils": "^2.4.0",
+    "@chrischall/mcp-utils": "^2.6.0",
     "@modelcontextprotocol/server": "^2.0.0",
-    "dotenv": "^17.4.0",
+    "dotenv": "^18.0.2",
     "zod": "^4.6.5"
   },
   "devDependencies": {