@chrischall/gemini-mcp 2.2.0 → 2.3.0

package/.claude-plugin/marketplace.json

@@ -7,7 +7,7 @@
   },
   "metadata": {
     "description": "MCP server for Google Gemini image generation and editing — generate and edit images via the Gemini API",
-    "version": "2.2.0"
+    "version": "2.3.0"
   },
   "plugins": [
     {
@@ -15,7 +15,7 @@
       "displayName": "Gemini Images",
       "source": "./",
       "description": "Generate and edit images with Google Gemini image models (Nano Banana / Nano Banana Pro) via natural language prompts",
-      "version": "2.2.0",
+      "version": "2.3.0",
       "author": {
         "name": "Chris Hall"
       },

package/.claude-plugin/plugin.json

@@ -1,7 +1,7 @@
 {
   "name": "gemini-mcp",
   "displayName": "Gemini Images",
-  "version": "2.2.0",
+  "version": "2.3.0",
   "description": "MCP server for Google Gemini image generation and editing — generate and edit images via the Gemini API",
   "author": {
     "name": "Chris Hall",

package/README.md

@@ -16,6 +16,7 @@ Developed and maintained by AI (Claude Code).
 | `GEMINI_IMAGE_MODEL` | No | Override the default image model (default: `gemini-3.1-flash-image`) |
 | `GEMINI_OUTPUT_DIR` | No | Default directory for generated images (default: current working directory) |
 | `GEMINI_INPUT_DIR` | No | Directory to resolve bare input-image filenames against (so `images: ["foo.jpg"]` works) |
+| `GEMINI_UPLOAD_DIR` | No | Restrict local files streamed to the Gemini Files API (`gemini_upload_file` `path`, `video_path`) to these directories — one or more, separated by `:` (`;` on Windows); `~` allowed. A path outside is refused before any upload. Unset: no restriction |
 | `GEMINI_TIMEOUT_MS` | No | Upstream request timeout in ms (default: `60000`, or `120000` for `image_size: "4K"`); each generation tool also takes a per-call `timeout_ms` |
 | `GEMINI_HEARTBEAT_MS` | No | Progress-notification cadence in ms while a generation runs (default: `10000`; `0` disables) — keeps MCP hosts that reset their timeout on progress from timing out long generations |
 | `GEMINI_CHAIN_RETRY_MS` | No | How long to wait out interactions-store lag when a chained call 404s (default: `120000`; `0` disables retrying) |
@@ -189,6 +190,15 @@ safe form, and a markdown link is a reasonable enhancement where you know it ren
 Signed-URL lifetime is clamped to `MEDIA_TTL_DAYS`, so a link never outlives the object it
 points at.
 
+**Prompts are stored too.** Each generated object on a hosted deployment gets a small JSON
+record beside it holding the prompt (first 500 characters), model and interaction id — that is
+what `gemini_list_recent_media` shows and what lets a lost turn be recovered. The record lives
+and is swept with its object, so it is kept for the same `MEDIA_TTL_DAYS` window, not longer.
+Locally, `gemini_interact` writes an `<image>.json` sidecar (model, interaction id, options and
+any text the model replied with — not the prompt itself) next to each image in the output dir;
+those files are yours to keep or delete and never expire on their own. If your
+prompts describe real people, bear in mind they sit in your bucket for the retention window.
+
 ## Sending reference images without burning context
 
 Every tool that takes a reference image — `gemini_image_generate`, `gemini_image_edit`,

package/dist/bundle.js

@@ -1722,8 +1722,8 @@ var require_regexes = __commonJS({
     }
     exports.ipv4 = /^(?:(?:25[0-5]|2[0-4][0-9]|1[0-9][0-9]|[1-9][0-9]|[0-9])\.){3}(?:25[0-5]|2[0-4][0-9]|1[0-9][0-9]|[1-9][0-9]|[0-9])$/;
     exports.ipv6 = /^(([0-9a-fA-F]{1,4}:){7}[0-9a-fA-F]{1,4}|([0-9a-fA-F]{1,4}:){1,7}:|([0-9a-fA-F]{1,4}:){1,6}:[0-9a-fA-F]{1,4}|([0-9a-fA-F]{1,4}:){1,5}(:[0-9a-fA-F]{1,4}){1,2}|([0-9a-fA-F]{1,4}:){1,4}(:[0-9a-fA-F]{1,4}){1,3}|([0-9a-fA-F]{1,4}:){1,3}(:[0-9a-fA-F]{1,4}){1,4}|([0-9a-fA-F]{1,4}:){1,2}(:[0-9a-fA-F]{1,4}){1,5}|[0-9a-fA-F]{1,4}:((:[0-9a-fA-F]{1,4}){1,6})|:((:[0-9a-fA-F]{1,4}){1,7}|:))$/;
-    var mac3 = (delimiter) => {
-      const escapedDelim = util.escapeRegex(delimiter ?? ":");
+    var mac3 = (delimiter2) => {
+      const escapedDelim = util.escapeRegex(delimiter2 ?? ":");
       return new RegExp(`^(?:[0-9A-F]{2}${escapedDelim}){5}[0-9A-F]{2}$|^(?:[0-9a-f]{2}${escapedDelim}){5}[0-9a-f]{2}$`);
     };
     exports.mac = mac3;
@@ -39648,8 +39648,8 @@ var init_regexes = __esm({
     _emoji = `^(?=[\\s\\S]*[\\p{Extended_Pictographic}\\p{Regional_Indicator}\\u20E3])[\\p{Extended_Pictographic}\\p{Emoji_Component}]+$`;
     ipv4 = /^(?:(?:25[0-5]|2[0-4][0-9]|1[0-9][0-9]|[1-9][0-9]|[0-9])\.){3}(?:25[0-5]|2[0-4][0-9]|1[0-9][0-9]|[1-9][0-9]|[0-9])$/;
     ipv6 = /^(([0-9a-fA-F]{1,4}:){7}[0-9a-fA-F]{1,4}|([0-9a-fA-F]{1,4}:){1,7}:|([0-9a-fA-F]{1,4}:){1,6}:[0-9a-fA-F]{1,4}|([0-9a-fA-F]{1,4}:){1,5}(:[0-9a-fA-F]{1,4}){1,2}|([0-9a-fA-F]{1,4}:){1,4}(:[0-9a-fA-F]{1,4}){1,3}|([0-9a-fA-F]{1,4}:){1,3}(:[0-9a-fA-F]{1,4}){1,4}|([0-9a-fA-F]{1,4}:){1,2}(:[0-9a-fA-F]{1,4}){1,5}|[0-9a-fA-F]{1,4}:((:[0-9a-fA-F]{1,4}){1,6})|:((:[0-9a-fA-F]{1,4}){1,7}|:))$/;
-    mac = (delimiter) => {
-      const escapedDelim = escapeRegex(delimiter ?? ":");
+    mac = (delimiter2) => {
+      const escapedDelim = escapeRegex(delimiter2 ?? ":");
       return new RegExp(`^(?:[0-9A-F]{2}${escapedDelim}){5}[0-9A-F]{2}$|^(?:[0-9a-f]{2}${escapedDelim}){5}[0-9a-f]{2}$`);
     };
     cidrv4 = /^((25[0-5]|2[0-4][0-9]|1[0-9][0-9]|[1-9][0-9]|[0-9])\.){3}(25[0-5]|2[0-4][0-9]|1[0-9][0-9]|[1-9][0-9]|[0-9])\/([0-9]|[1-2][0-9]|3[0-2])$/;
@@ -59728,6 +59728,16 @@ async function uniquePath(dir, base, ext) {
 function sniffMimeBytes(buf) {
   return sniffImageMime(buf) ?? "image/png";
 }
+function localImageMime(resolvedPath, head) {
+  const mime = sniffImageMime(head);
+  if (!mime) {
+    throw new McpToolError(
+      `Cannot tell what kind of image ${resolvedPath} is \u2014 its bytes are not PNG, JPEG or WebP, so it is not sent to Gemini as a reference image.`,
+      { hint: "Pass a PNG, JPEG or WebP file (convert other formats first)." }
+    );
+  }
+  return mime;
+}
 function sniffImageMime(buf) {
   if (buf.length >= 4 && buf[0] === 137 && buf[1] === 80 && buf[2] === 78 && buf[3] === 71) {
     return "image/png";
@@ -59803,7 +59813,7 @@ async function previewImageInput(path) {
   try {
     const head = Buffer.alloc(16);
     const { bytesRead } = await fh.read(head, 0, 16, 0);
-    return { path: resolved, mimeType: sniffMimeBytes(head.subarray(0, bytesRead)), size };
+    return { path: resolved, mimeType: localImageMime(resolved, head.subarray(0, bytesRead)), size };
   } finally {
     await fh.close();
   }
@@ -59832,7 +59842,7 @@ async function detectUploadMime(resolvedPath) {
 async function readImageAsInline(path) {
   const resolved = resolveImagePath(path);
   const buf = await readFile(resolved);
-  const mimeType = sniffMimeBytes(buf);
+  const mimeType = localImageMime(resolved, buf);
   return { base64: buf.toString("base64"), mimeType };
 }
 function decodeImageInput(input2) {
@@ -59966,7 +59976,7 @@ async function loadStdioDotenv() {
 }
 
 // src/version.ts
-var VERSION = "2.2.0";
+var VERSION = "2.3.0";
 
 // src/errors.ts
 init_dist2();
@@ -62556,7 +62566,7 @@ init_dist2();
 
 // src/client.ts
 init_dist2();
-import { basename } from "node:path";
+import { basename, delimiter } from "node:path";
 
 // src/library.ts
 var LIBRARY_KEY_PREFIX = "lib";
@@ -63008,6 +63018,18 @@ function normalizeFileName(ref) {
   }
   return match[1];
 }
+function uploadRoots() {
+  const roots = readEnvVar("GEMINI_UPLOAD_DIR")?.split(delimiter).map((r) => r.trim()).filter(Boolean);
+  return roots && roots.length > 0 ? roots : void 0;
+}
+function explainOutsideUploadDir(err) {
+  if (err instanceof Error && err.message.startsWith("Path is outside the allowed directories")) {
+    throw new McpToolError(
+      "Refusing to upload a file outside GEMINI_UPLOAD_DIR, which restricts which local files can be uploaded to Google. Move the file into GEMINI_UPLOAD_DIR, or add its directory to GEMINI_UPLOAD_DIR."
+    );
+  }
+  throw err;
+}
 var GeminiClient = class {
   /**
    * A key handed in explicitly (the connector's per-session key). When absent
@@ -63170,7 +63192,13 @@ var GeminiClient = class {
    * (enforced locally before any bytes are sent).
    */
   async uploadVideo(path, mimeType) {
-    const blob = await fileBlob(path, { type: mimeType, maxBytes: FILE_MAX_BYTES, label: "Video" });
+    const roots = uploadRoots();
+    const blob = await fileBlob(path, {
+      type: mimeType,
+      maxBytes: FILE_MAX_BYTES,
+      label: "Video",
+      ...roots ? { allowedRoots: roots } : {}
+    }).catch(explainOutsideUploadDir);
     return this.uploadToFilesApi(blob, mimeType, basename(path), blob.size);
   }
   /**
@@ -63181,7 +63209,13 @@ var GeminiClient = class {
    * length on a few-hundred-MB video (chrischall/fleet-audit#117).
    */
   async uploadFile(path, mimeType, displayName = basename(path)) {
-    const blob = await fileBlob(path, { type: mimeType, maxBytes: FILE_MAX_BYTES, label: "File" });
+    const roots = uploadRoots();
+    const blob = await fileBlob(path, {
+      type: mimeType,
+      maxBytes: FILE_MAX_BYTES,
+      label: "File",
+      ...roots ? { allowedRoots: roots } : {}
+    }).catch(explainOutsideUploadDir);
     return this.uploadToFilesApi(blob, mimeType, displayName, blob.size);
   }
   /**

package/dist/client.js

@@ -1,4 +1,4 @@
-import { basename } from 'node:path';
+import { basename, delimiter } from 'node:path';
 import { readEnvVar, McpToolError, ApiError, createApiClient, formatApiError, fileBlob } from '@chrischall/mcp-utils';
 import { resolveModel, filterImageModels, DEFAULT_VIDEO_MODEL, DEFAULT_MUSIC_MODEL } from './models.js';
 import { readUsage } from './usage.js';
@@ -181,6 +181,29 @@ export function normalizeFileName(ref) {
     }
     return match[1];
 }
+/**
+ * `GEMINI_UPLOAD_DIR` — the optional allow-list for local files streamed to
+ * the Files API (`gemini_upload_file` `path`, `video_path`). One or more
+ * directories separated by the platform path delimiter (`:` / `;`); `~` is
+ * expanded by mcp-utils. Unset → `undefined` → uploads stay unconfined.
+ * The paths are model-chosen, so a prompt-injected path could otherwise send
+ * any readable file to Google.
+ */
+function uploadRoots() {
+    const roots = readEnvVar('GEMINI_UPLOAD_DIR')?.split(delimiter).map((r) => r.trim()).filter(Boolean);
+    return roots && roots.length > 0 ? roots : undefined;
+}
+/**
+ * Turn mcp-utils' bare "outside the allowed directories" refusal into an
+ * actionable tool error. The remediation is in the MESSAGE — hosts show the
+ * message and drop the hint (see CLAUDE.md, Errors).
+ */
+function explainOutsideUploadDir(err) {
+    if (err instanceof Error && err.message.startsWith('Path is outside the allowed directories')) {
+        throw new McpToolError('Refusing to upload a file outside GEMINI_UPLOAD_DIR, which restricts which local files can be uploaded to Google. Move the file into GEMINI_UPLOAD_DIR, or add its directory to GEMINI_UPLOAD_DIR.');
+    }
+    throw err;
+}
 export class GeminiClient {
     /**
      * A key handed in explicitly (the connector's per-session key). When absent
@@ -365,7 +388,10 @@ export class GeminiClient {
      * (enforced locally before any bytes are sent).
      */
     async uploadVideo(path, mimeType) {
-        const blob = await fileBlob(path, { type: mimeType, maxBytes: FILE_MAX_BYTES, label: 'Video' });
+        const roots = uploadRoots();
+        const blob = await fileBlob(path, {
+            type: mimeType, maxBytes: FILE_MAX_BYTES, label: 'Video', ...(roots ? { allowedRoots: roots } : {}),
+        }).catch(explainOutsideUploadDir);
         return this.uploadToFilesApi(blob, mimeType, basename(path), blob.size);
     }
     /**
@@ -376,7 +402,10 @@ export class GeminiClient {
      * length on a few-hundred-MB video (chrischall/fleet-audit#117).
      */
     async uploadFile(path, mimeType, displayName = basename(path)) {
-        const blob = await fileBlob(path, { type: mimeType, maxBytes: FILE_MAX_BYTES, label: 'File' });
+        const roots = uploadRoots();
+        const blob = await fileBlob(path, {
+            type: mimeType, maxBytes: FILE_MAX_BYTES, label: 'File', ...(roots ? { allowedRoots: roots } : {}),
+        }).catch(explainOutsideUploadDir);
         return this.uploadToFilesApi(blob, mimeType, displayName, blob.size);
     }
     /**

package/dist/images.js

@@ -31,10 +31,26 @@ export async function uniquePath(dir, base, ext) {
     }
     return candidate;
 }
-/** Sniff MIME type from the first bytes of an image buffer (PNG fallback). */
+/** Sniff MIME type from the first bytes of an image buffer (PNG fallback).
+ * Only for bytes that arrive as base64 with no other type information; a LOCAL
+ * file goes through {@link localImageMime}, which never guesses. */
 function sniffMimeBytes(buf) {
     return sniffImageMime(buf) ?? 'image/png';
 }
+/**
+ * The MIME of a LOCAL image input (PNG/JPEG/WebP, sniffed from its bytes), or a
+ * refusal. Never defaults: an unidentifiable file used to be previewed and sent
+ * as image/png, so a prompt-injected `images: ['~/.ssh/id_rsa']` showed up in
+ * the confirmation preview mislabelled as a PNG (chrischall/fleet-audit#929).
+ */
+function localImageMime(resolvedPath, head) {
+    const mime = sniffImageMime(head);
+    if (!mime) {
+        throw new McpToolError(`Cannot tell what kind of image ${resolvedPath} is — its bytes are not PNG, JPEG or WebP, ` +
+            'so it is not sent to Gemini as a reference image.', { hint: 'Pass a PNG, JPEG or WebP file (convert other formats first).' });
+    }
+    return mime;
+}
 /** PNG/JPEG/WebP from the leading bytes, or `undefined` when it is none of them. */
 function sniffImageMime(buf) {
     // PNG: 89 50 4E 47
@@ -174,7 +190,7 @@ export async function previewImageInput(path) {
     try {
         const head = Buffer.alloc(16);
         const { bytesRead } = await fh.read(head, 0, 16, 0);
-        return { path: resolved, mimeType: sniffMimeBytes(head.subarray(0, bytesRead)), size };
+        return { path: resolved, mimeType: localImageMime(resolved, head.subarray(0, bytesRead)), size };
     }
     finally {
         await fh.close();
@@ -239,7 +255,7 @@ export async function detectUploadMime(resolvedPath) {
 export async function readImageAsInline(path) {
     const resolved = resolveImagePath(path);
     const buf = await readFile(resolved);
-    const mimeType = sniffMimeBytes(buf);
+    const mimeType = localImageMime(resolved, buf);
     return { base64: buf.toString('base64'), mimeType };
 }
 /**

package/dist/version.js

@@ -1,2 +1,2 @@
 /** Single source of the server version. release-please bumps the literal below. */
-export const VERSION = '2.2.0'; // x-release-please-version
+export const VERSION = '2.3.0'; // x-release-please-version

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "@chrischall/gemini-mcp",
-  "version": "2.2.0",
+  "version": "2.3.0",
   "mcpName": "io.github.chrischall/gemini-mcp",
   "description": "Gemini image-generation MCP server for Claude — developed and maintained by AI (Claude Code)",
   "author": "Claude Code (AI) <https://www.anthropic.com/claude>",
@@ -48,7 +48,7 @@
   "dependencies": {
     "@chrischall/mcp-utils": "^2.6.0",
     "@modelcontextprotocol/server": "^2.0.0",
-    "dotenv": "^17.4.0",
+    "dotenv": "^18.0.2",
     "zod": "^4.6.5"
   },
   "devDependencies": {

package/server.json

@@ -6,12 +6,12 @@
     "url": "https://github.com/chrischall/gemini-mcp",
     "source": "github"
   },
-  "version": "2.2.0",
+  "version": "2.3.0",
   "packages": [
     {
       "registryType": "npm",
       "identifier": "@chrischall/gemini-mcp",
-      "version": "2.2.0",
+      "version": "2.3.0",
       "transport": {
         "type": "stdio"
       },
@@ -43,6 +43,13 @@
           "isRequired": false,
           "format": "string",
           "isSecret": false
+        },
+        {
+          "name": "GEMINI_UPLOAD_DIR",
+          "description": "Restrict local-file uploads to the Gemini Files API to these directories (path.delimiter-separated; unset = unrestricted)",
+          "isRequired": false,
+          "format": "string",
+          "isSecret": false
         }
       ]
     }