@chrischall/gemini-mcp 2.3.2 → 2.3.4

package/dist/bundle.js

@@ -4988,7 +4988,7 @@ var require_memoizer = __commonJS({
     var NONE2 = 0;
     var ASSUMED2 = 1;
     var PROVEN2 = 2;
-    function isRecursive2(inst, stack, resolve5) {
+    function isRecursive2(inst, stack, resolve6) {
       const cached2 = recursive2.get(inst);
       if (cached2 !== void 0)
         return cached2 ? PROVEN2 : NONE2;
@@ -4998,7 +4998,7 @@ var require_memoizer = __commonJS({
       let result = NONE2;
       const check2 = (child) => {
         if (result !== PROVEN2 && child?._zod) {
-          const answer = isRecursive2(child, stack, resolve5);
+          const answer = isRecursive2(child, stack, resolve6);
           if (answer > result)
             result = answer;
         }
@@ -5009,7 +5009,7 @@ var require_memoizer = __commonJS({
           const desc = Object.getOwnPropertyDescriptor(sh, key);
           if (spread && !desc.enumerable)
             continue;
-          const child = desc.get ? ASSUMED2 : desc.value?._zod ? isRecursive2(desc.value, stack, resolve5) : NONE2;
+          const child = desc.get ? ASSUMED2 : desc.value?._zod ? isRecursive2(desc.value, stack, resolve6) : NONE2;
           if (child > answer)
             answer = child;
         }
@@ -5073,7 +5073,7 @@ var require_memoizer = __commonJS({
           break;
         // `$ZodLazy` caches its inner on the def, so a resolved edge is followed exactly
         case "lazy": {
-          const inner = def._cachedInner ?? (resolve5 ? inst._zod.innerType : void 0);
+          const inner = def._cachedInner ?? (resolve6 ? inst._zod.innerType : void 0);
           merge2(inner ? isRecursive2(inner, stack, false) : ASSUMED2);
           break;
         }
@@ -26945,14 +26945,14 @@ function inputRequiredRoundsExceededMessage(method, maxRounds) {
   return `Multi-round-trip request '${method}' still required input after ${maxRounds} rounds (inputRequired.maxRounds)`;
 }
 function sleep(ms, signal) {
-  return new Promise((resolve5, reject) => {
+  return new Promise((resolve6, reject) => {
     if (signal?.aborted) {
       reject(signal.reason instanceof SdkError ? signal.reason : new SdkError(SdkErrorCode.RequestTimeout, String(signal.reason)));
       return;
     }
     const timer = setTimeout(() => {
       signal?.removeEventListener("abort", onAbort);
-      resolve5();
+      resolve6();
     }, ms);
     const onAbort = () => {
       clearTimeout(timer);
@@ -28770,7 +28770,7 @@ var init_src_Cqbh3MYc = __esm({
         const flowStartedAt = Date.now();
         let onAbort;
         let cleanupMessageId;
-        return new Promise((resolve5, reject) => {
+        return new Promise((resolve6, reject) => {
           const earlyReject = (error62) => {
             reject(error62);
           };
@@ -28839,7 +28839,7 @@ var init_src_Cqbh3MYc = __esm({
             }
             if (decoded.kind === "invalid") return reject(decoded.error);
             if (decoded.kind === "input_required") {
-              if (options?.allowInputRequired === true) return resolve5(manualInputRequiredValue(decoded));
+              if (options?.allowInputRequired === true) return resolve6(manualInputRequiredValue(decoded));
               const flow = {
                 codec: codec2,
                 request,
@@ -28851,11 +28851,11 @@ var init_src_Cqbh3MYc = __esm({
                   params
                 }, resultSchema, legOptions)
               };
-              return resolve5(this._resolveNonCompleteResult(decoded, flow));
+              return resolve6(this._resolveNonCompleteResult(decoded, flow));
             }
             const result = decoded.result;
             validateStandardSchema(resultSchema, result).then((parseResult) => {
-              if (parseResult.success) resolve5(parseResult.data);
+              if (parseResult.success) resolve6(parseResult.data);
               else reject(new SdkError(SdkErrorCode.InvalidResult, `Invalid result for ${request.method}: ${parseResult.error}`));
             }, reject);
           });
@@ -31674,7 +31674,7 @@ var init_ajvProvider_CEoC_sr = __esm({
         ref = (0, resolve_1.resolveUrl)(this.opts.uriResolver, baseId, ref);
         const schOrFunc = root.refs[ref];
         if (schOrFunc) return schOrFunc;
-        let _sch = resolve5.call(this, root, ref);
+        let _sch = resolve6.call(this, root, ref);
         if (_sch === void 0) {
           const schema = (_a3 = root.localRefs) === null || _a3 === void 0 ? void 0 : _a3[ref];
           const { schemaId } = this.opts;
@@ -31700,7 +31700,7 @@ var init_ajvProvider_CEoC_sr = __esm({
       function sameSchemaEnv(s1, s2) {
         return s1.schema === s2.schema && s1.root === s2.root && s1.baseId === s2.baseId;
       }
-      function resolve5(root, ref) {
+      function resolve6(root, ref) {
         let sch;
         while (typeof (sch = this.refs[ref]) == "string") ref = sch;
         return sch || this.schemas[ref] || resolveSchema.call(this, root, ref);
@@ -32150,7 +32150,7 @@ var init_ajvProvider_CEoC_sr = __esm({
         else if (typeof uri === "object") uri = parse3(serialize(uri, options), options);
         return uri;
       }
-      function resolve5(baseURI, relativeURI, options) {
+      function resolve6(baseURI, relativeURI, options) {
         const schemelessOptions = options ? Object.assign({ scheme: "null" }, options) : { scheme: "null" };
         const resolved = resolveComponent(parse3(baseURI, schemelessOptions), parse3(relativeURI, schemelessOptions), schemelessOptions, true);
         schemelessOptions.skipEscape = true;
@@ -32324,7 +32324,7 @@ var init_ajvProvider_CEoC_sr = __esm({
       const fastUri = {
         SCHEMES,
         normalize,
-        resolve: resolve5,
+        resolve: resolve6,
         resolveComponent,
         equal,
         serialize,
@@ -38107,7 +38107,7 @@ var init_stdio = __esm({
       }
       send(message) {
         if (this._closed) return Promise.reject(/* @__PURE__ */ new Error("StdioServerTransport is closed"));
-        return new Promise((resolve5, reject) => {
+        return new Promise((resolve6, reject) => {
           const json2 = serializeMessage(message);
           let settled = false;
           const onError = (error62) => {
@@ -38122,14 +38122,14 @@ var init_stdio = __esm({
             settled = true;
             this._stdout.off("error", onError);
             this._stdout.off("drain", onDrain);
-            resolve5();
+            resolve6();
           };
           this._stdout.once("error", onError);
           if (this._stdout.write(json2)) {
             if (settled) return;
             settled = true;
             this._stdout.off("error", onError);
-            resolve5();
+            resolve6();
           } else if (!settled) this._stdout.once("drain", onDrain);
         });
       }
@@ -38183,14 +38183,14 @@ var init_stdio = __esm({
       */
       async whenRequestsAnswered(timeoutMs) {
         if (this._closed || this._pendingRequests.size === 0) return true;
-        return await new Promise((resolve5) => {
+        return await new Promise((resolve6) => {
           const waiter = () => {
             clearTimeout(timer);
-            resolve5(true);
+            resolve6(true);
           };
           const timer = setTimeout(() => {
             this._drainWaiters = this._drainWaiters.filter((pending) => pending !== waiter);
-            resolve5(false);
+            resolve6(false);
           }, timeoutMs);
           this._drainWaiters.push(waiter);
         });
@@ -38231,6 +38231,30 @@ var init_dist = __esm({
 });
 
 // node_modules/@chrischall/mcp-utils/dist/errors/index.js
+function firstDeclared(err, read) {
+  let cur = err;
+  for (let depth = 0; depth < DECLARATION_CAUSE_DEPTH && cur !== null && typeof cur === "object"; depth++) {
+    const found = read(cur);
+    if (found !== void 0)
+      return found;
+    cur = cur.cause;
+  }
+  return void 0;
+}
+function errorStatusOf(err) {
+  return firstDeclared(err, (link) => {
+    const e = link;
+    if (typeof e.status === "number")
+      return e.status;
+    return typeof e.statusCode === "number" ? e.statusCode : void 0;
+  });
+}
+function errorKindOf(err) {
+  return firstDeclared(err, (link) => {
+    const k = link.kind;
+    return typeof k === "string" && MCP_TOOL_ERROR_KINDS.has(k) ? k : void 0;
+  });
+}
 function redactJsonCookie(quote) {
   const stringRe = quote === '"' ? DQ_STRING_RE : SQ_STRING_RE;
   return (_m, prefix, key, value) => {
@@ -38258,21 +38282,82 @@ function messageOf(err) {
     return err.message;
   return String(err);
 }
-var DEFAULT_ERROR_MESSAGE_MAX, McpToolError, HEADER_NAME_RUN, BEARER_RE, JWT_RE, BASIC_AUTH_RE, SET_COOKIE_RE, COOKIE_HEADER_RE, API_KEY_RE, GOOGLE_OAUTH_TOKEN_RE, QUERY_SECRET_RE, OAUTH_CODE_RE, FORM_PASSWORD_RE, HEADER_SECRET_RE, AWS_SIGV4_RE, JSON_SECRET_KEYS, JSON_SECRET_DQ_RE, JSON_SECRET_SQ_RE, JSON_SECRET_NUM_RE, JSON_COOKIE_DQ_RE, JSON_COOKIE_SQ_RE, DQ_STRING_RE, SQ_STRING_RE, ERROR_REDACTION_INPUT_MAX;
+var DEFAULT_ERROR_MESSAGE_MAX, MCP_TOOL_ERROR_KINDS, McpToolError, DECLARATION_CAUSE_DEPTH, UPSTREAM_BODY_PHRASE, UpstreamFormatError, HEADER_NAME_RUN, BEARER_RE, JWT_RE, BASIC_AUTH_RE, SET_COOKIE_RE, COOKIE_HEADER_RE, API_KEY_RE, GOOGLE_OAUTH_TOKEN_RE, QUERY_SECRET_RE, OAUTH_CODE_RE, FORM_PASSWORD_RE, HEADER_SECRET_RE, AWS_SIGV4_RE, JSON_SECRET_KEYS, JSON_SECRET_DQ_RE, JSON_SECRET_SQ_RE, JSON_SECRET_NUM_RE, JSON_COOKIE_DQ_RE, JSON_COOKIE_SQ_RE, DQ_STRING_RE, SQ_STRING_RE, ERROR_REDACTION_INPUT_MAX;
 var init_errors = __esm({
   "node_modules/@chrischall/mcp-utils/dist/errors/index.js"() {
     DEFAULT_ERROR_MESSAGE_MAX = 500;
+    MCP_TOOL_ERROR_KINDS = /* @__PURE__ */ new Set([
+      "no_credential",
+      "credential_rejected",
+      "edge_blocked",
+      "session_expired",
+      "verification_pending",
+      "timeout",
+      "http",
+      "transport",
+      "too_large",
+      "unknown"
+    ]);
     McpToolError = class extends Error {
       /** Actionable remediation text, when one applies. */
       hint;
+      /** The upstream HTTP status this failure came from, when known. */
+      status;
+      /** What kind of failure this is, when the thrower knows. */
+      kind;
       constructor(message, opts) {
         super(message, opts?.cause !== void 0 ? { cause: opts.cause } : void 0);
         this.name = "McpToolError";
         if (opts?.hint !== void 0)
           this.hint = opts.hint;
+        if (opts?.status !== void 0)
+          this.status = opts.status;
+        if (opts?.kind !== void 0)
+          this.kind = opts.kind;
         Object.setPrototypeOf(this, new.target.prototype);
       }
     };
+    DECLARATION_CAUSE_DEPTH = 4;
+    UPSTREAM_BODY_PHRASE = {
+      "non-json": "a non-JSON response",
+      empty: "an empty body",
+      null: "null",
+      array: "an array",
+      object: "an object",
+      string: "a string",
+      number: "a number",
+      boolean: "a boolean"
+    };
+    UpstreamFormatError = class extends McpToolError {
+      /** What the body turned out to be. */
+      received;
+      /** The shape the caller required, when it required one. */
+      expected;
+      /** The response `Content-Type`, when known. (`status` is the base class's.) */
+      contentType;
+      constructor(details) {
+        const service = details.service ?? "The upstream service";
+        const request = details.method !== void 0 && details.path !== void 0 ? `${details.method.toUpperCase()} ${details.path}` : void 0;
+        const meta3 = [
+          details.status !== void 0 ? `HTTP ${details.status}` : void 0,
+          details.contentType || void 0
+        ].filter((p) => p !== void 0);
+        const what = details.expected !== void 0 ? `${UPSTREAM_BODY_PHRASE[details.received]} where a JSON ${details.expected} was expected` + (request ? ` for ${request}` : "") : `${UPSTREAM_BODY_PHRASE[details.received]}` + (request ? ` to ${request}` : "");
+        const message = `${service} returned ${what}${meta3.length > 0 ? ` (${meta3.join(", ")})` : ""}.`;
+        const hint = details.received === "non-json" ? "The service answered with something other than JSON, usually a sign-in page or interstitial, or its API has changed. Check the session, then retry." : "The service answered with a body of the wrong shape: the resource may be missing or its API may have changed.";
+        super(truncateErrorMessage(message), {
+          hint,
+          cause: details.cause,
+          ...details.status !== void 0 ? { status: details.status } : {}
+        });
+        this.name = "UpstreamFormatError";
+        this.received = details.received;
+        if (details.expected !== void 0)
+          this.expected = details.expected;
+        if (details.contentType)
+          this.contentType = details.contentType;
+      }
+    };
     HEADER_NAME_RUN = "[a-z0-9_-]{0,40}";
     BEARER_RE = /(bearer\s+)[A-Za-z0-9._~+/=-]{8,}/gi;
     JWT_RE = /(?<![A-Za-z0-9_-])[A-Za-z0-9_-]{10,}\.[A-Za-z0-9_-]{10,}\.[A-Za-z0-9_-]{8,}(?![A-Za-z0-9_-])/g;
@@ -38294,7 +38379,7 @@ var init_errors = __esm({
       // webhook signing secret (Stripe-style)
     ].map((p) => `\\b${p}`).join("|"), "g");
     GOOGLE_OAUTH_TOKEN_RE = /(?<![A-Za-z0-9+/])(?:ya29\.|1\/\/)[A-Za-z0-9._-]{8,}/g;
-    QUERY_SECRET_RE = new RegExp(`([?&](?:(?:access|refresh|id|auth|session|csrf|xsrf)[_-]?token|client[_-]?secret|api[_-]?secret|api[_-]?key|password|passwd|signature|token|key|sig|(?:php|j)?sess(?:ion)?[_-]?id|sid|x[-_]${HEADER_NAME_RUN}?(?:api[-_]?key|token|secret|auth)${HEADER_NAME_RUN})=)[^&#\\s"'<>\`]+`, "gi");
+    QUERY_SECRET_RE = new RegExp(`([?&](?:(?:access|refresh|id|auth|session|csrf|xsrf)[_-]?token|client[_-]?secret|api[_-]?secret|api[_-]?key|password|passwd|signature|token|key|sig|(?:code[_-]?)?verifier|(?:php|j)?sess(?:ion)?[_-]?id|sid|x[-_]${HEADER_NAME_RUN}?(?:api[-_]?key|token|secret|auth)${HEADER_NAME_RUN})=)[^&#\\s"'<>\`]+`, "gi");
     OAUTH_CODE_RE = /([?&]code=)(?=[^&#\s"'<>`]{16,})[^&#\s"'<>`]+/gi;
     FORM_PASSWORD_RE = /((?:^|[\s,;:"'(\[{])(?:password|passwd)=)[^&#\s"'<>`]+/gim;
     HEADER_SECRET_RE = new RegExp(`(\\b(?:x[-_]${HEADER_NAME_RUN}?(?:api[-_]?key|token|secret|auth)${HEADER_NAME_RUN}|api[-_]?key)\\s*:\\s*)[^\\s,;"'<>\`]+`, "gi");
@@ -38305,6 +38390,8 @@ var init_errors = __esm({
       "api[_-]?secret",
       "(?:x[_-])?api[_-]?key",
       "private[_-]?key",
+      "code[_-]?verifier",
+      // PKCE; a bare `verifier` key is too generic for JSON
       `x[_-]${HEADER_NAME_RUN}?(?:api[_-]?key|token|secret|auth)${HEADER_NAME_RUN}`,
       // bounded like HEADER_SECRET_RE
       "(?:proxy-)?authorization",
@@ -42820,7 +42907,7 @@ function isRef(value) {
 function cloneIssues(issues) {
   return issues.map((iss) => iss.path ? { ...iss, path: iss.path.slice() } : { ...iss });
 }
-function isRecursive(inst, stack, resolve5) {
+function isRecursive(inst, stack, resolve6) {
   const cached2 = recursive.get(inst);
   if (cached2 !== void 0)
     return cached2 ? PROVEN : NONE;
@@ -42830,7 +42917,7 @@ function isRecursive(inst, stack, resolve5) {
   let result = NONE;
   const check2 = (child) => {
     if (result !== PROVEN && child?._zod) {
-      const answer = isRecursive(child, stack, resolve5);
+      const answer = isRecursive(child, stack, resolve6);
       if (answer > result)
         result = answer;
     }
@@ -42841,7 +42928,7 @@ function isRecursive(inst, stack, resolve5) {
       const desc = Object.getOwnPropertyDescriptor(sh, key);
       if (spread && !desc.enumerable)
         continue;
-      const child = desc.get ? ASSUMED : desc.value?._zod ? isRecursive(desc.value, stack, resolve5) : NONE;
+      const child = desc.get ? ASSUMED : desc.value?._zod ? isRecursive(desc.value, stack, resolve6) : NONE;
       if (child > answer)
         answer = child;
     }
@@ -42905,7 +42992,7 @@ function isRecursive(inst, stack, resolve5) {
       break;
     // `$ZodLazy` caches its inner on the def, so a resolved edge is followed exactly
     case "lazy": {
-      const inner = def._cachedInner ?? (resolve5 ? inst._zod.innerType : void 0);
+      const inner = def._cachedInner ?? (resolve6 ? inst._zod.innerType : void 0);
       merge2(inner ? isRecursive(inner, stack, false) : ASSUMED);
       break;
     }
@@ -58852,6 +58939,15 @@ ${JSON.stringify(preview, null, 2)}`,
   };
   const response = inputResponse(ctx.mcpReq.inputResponses, requestKey);
   const accepted = acceptedContent(ctx.mcpReq.inputResponses, requestKey, confirmationSchema);
+  if (options.elicitation === false) {
+    return textResult({
+      confirmed: false,
+      dispatched: false,
+      action: options.action,
+      reason: "confirmation-unsupported",
+      note: options.unsupportedNote ? `${DISABLED_NOTE}. ${options.unsupportedNote}` : `${DISABLED_NOTE}.`
+    });
+  }
   if (response.kind === "missing") {
     if (callerAcceptsFormElicitation(ctx) === false) {
       return textResult({
@@ -58882,7 +58978,7 @@ ${JSON.stringify(preview, null, 2)}`,
     note: "Nothing was changed because the confirmation was declined, cancelled, or left unchecked."
   });
 }
-var DEFAULT_REQUEST_KEY, DEFAULT_CONFIRMATION_LABEL, UNSUPPORTED_NOTE, STATE_PREFIX;
+var DEFAULT_REQUEST_KEY, DEFAULT_CONFIRMATION_LABEL, UNSUPPORTED_NOTE, DISABLED_NOTE, STATE_PREFIX;
 var init_confirmation = __esm({
   "node_modules/@chrischall/mcp-utils/dist/server/confirmation.js"() {
     init_dist();
@@ -58893,6 +58989,7 @@ var init_confirmation = __esm({
     DEFAULT_REQUEST_KEY = "confirmation";
     DEFAULT_CONFIRMATION_LABEL = "Confirm this action should proceed.";
     UNSUPPORTED_NOTE = "Nothing was done because this client cannot show a confirmation prompt (it declares no MCP elicitation capability), and this action is never taken without one";
+    DISABLED_NOTE = "Nothing was done because confirmation prompts are turned off for this server, and this action is never taken without one";
     STATE_PREFIX = "mcpu.confirm.v1.";
   }
 });
@@ -59046,7 +59143,7 @@ async function tokenConfirmation(action, fb) {
 }
 async function requireConfirmationWithFallback(ctx, options) {
   const { tokenFallback, ...confirmation } = options;
-  if (tokenFallback && callerAcceptsFormElicitation(ctx) === false) {
+  if (tokenFallback && (options.elicitation === false || callerAcceptsFormElicitation(ctx) === false)) {
     return tokenConfirmation(options.action, tokenFallback);
   }
   return requireConfirmation(ctx, confirmation);
@@ -59085,7 +59182,7 @@ function readEnvVar(key, opts = {}) {
   if (typeof raw === "string") {
     const trimmed = raw.trim();
     if (trimmed.length > 0 && trimmed !== "undefined" && trimmed !== "null" && !PLACEHOLDER_RE.test(trimmed)) {
-      return trimmed;
+      return opts.trim === false ? raw : trimmed;
     }
   }
   return opts.default;
@@ -59223,6 +59320,20 @@ function readConfirmMode(env = process.env) {
   }
   return "refuse";
 }
+function readConfirmElicitation(env = process.env) {
+  const raw = readEnvVar("MCP_CONFIRM_ELICITATION", { env })?.trim().toLowerCase();
+  if (!raw || raw === "on")
+    return "on";
+  if (raw === "off")
+    return "off";
+  const key = `elicitation:${raw}`;
+  if (!warned.has(key)) {
+    warned.add(key);
+    process.stderr.write(`MCP_CONFIRM_ELICITATION="${raw}" is not one of on, off; treating it as on.
+`);
+  }
+  return "on";
+}
 function readConfirmTtl(env) {
   const raw = readEnvVar("MCP_CONFIRM_TTL_SECONDS", { env })?.trim();
   if (!raw)
@@ -59272,19 +59383,29 @@ function boundArgs(args) {
 }
 function confirmationFromEnv(options) {
   const { tool, account, confirmToken, subject, instruction, args, env = process.env, spent: callerSpent, ...rest } = options;
+  if (args === void 0 || args === null) {
+    throw new TypeError(`confirmationFromEnv: ${tool} passed no args; pass the tool's validated arguments ({} for a tool with none).`);
+  }
   const spent = callerSpent ?? spentTokenStoreFromEnv(env);
   const mode = readConfirmMode(env);
   const ttlSeconds = readConfirmTtl(env);
-  const bound = args === void 0 ? void 0 : boundArgs(args);
-  const confirmation = bound === void 0 || rest.binding ? rest : { ...rest, binding: { key: confirmKeyFromEnv(env), args: bound, ttlSeconds: ttlSeconds ?? DEFAULT_TTL_SECONDS2 } };
+  const elicitationOff = readConfirmElicitation(env) === "off";
+  const bound = boundArgs(args);
+  const elicitationBound = account === void 0 ? { args: bound } : { account, args: bound };
+  const bindingAdded = rest.binding ? rest : {
+    ...rest,
+    binding: { key: confirmKeyFromEnv(env), args: elicitationBound, ttlSeconds: ttlSeconds ?? DEFAULT_TTL_SECONDS2 }
+  };
+  const confirmation = elicitationOff ? { ...bindingAdded, elicitation: false } : bindingAdded;
   if (mode === "refuse" || ttlSeconds === void 0) {
-    const hint = mode === "refuse" ? REFUSE_HINT : BAD_TTL_HINT;
+    const reason = mode === "refuse" ? REFUSE_HINT : BAD_TTL_HINT;
+    const hint = elicitationOff ? `${ELICITATION_OFF_HINT} ${reason}` : reason;
     return {
       ...confirmation,
       unsupportedNote: confirmation.unsupportedNote ? `${confirmation.unsupportedNote} ${hint}` : hint
     };
   }
-  const boundSubject = bound === void 0 ? subject : async () => {
+  const boundSubject = async () => {
     const read = await subject();
     if ("content" in read)
       return read;
@@ -59304,7 +59425,7 @@ function confirmationFromEnv(options) {
     }
   };
 }
-var MODES, DEFAULT_TTL_SECONDS2, warned, processKey, fileStores, CONFIRM_TOKEN_AUTO_INSTRUCTION, REFUSE_HINT, BAD_TTL_HINT;
+var MODES, DEFAULT_TTL_SECONDS2, warned, processKey, fileStores, CONFIRM_TOKEN_AUTO_INSTRUCTION, REFUSE_HINT, ELICITATION_OFF_HINT, BAD_TTL_HINT;
 var init_confirm_env = __esm({
   "node_modules/@chrischall/mcp-utils/dist/server/confirm-env.js"() {
     init_config();
@@ -59316,6 +59437,7 @@ var init_confirm_env = __esm({
     fileStores = /* @__PURE__ */ new Map();
     CONFIRM_TOKEN_AUTO_INSTRUCTION = "Nothing has been done yet. Review this preview; if it is what was intended, call again with the same arguments plus confirmToken. (This server runs with MCP_CONFIRM_MODE=auto, so the user's approval in chat is not required.)";
     REFUSE_HINT = "Set MCP_CONFIRM_MODE=ask-user on the server to allow two-step confirmation instead.";
+    ELICITATION_OFF_HINT = "MCP_CONFIRM_ELICITATION=off on the server turns confirmation prompts off.";
     BAD_TTL_HINT = "MCP_CONFIRM_TTL_SECONDS on the server is not a positive whole number of seconds; fix it to allow two-step confirmation.";
   }
 });
@@ -59336,12 +59458,14 @@ var init_merge_write = __esm({
 
 // node_modules/@chrischall/mcp-utils/dist/server/index.js
 function hintResultOrRethrow(err) {
+  if (err instanceof ProtocolError && err.code === ProtocolErrorCode.UrlElicitationRequired)
+    throw err;
   if (err instanceof McpToolError && err.hint) {
     return errorResult(`${err.message}
 
 Hint: ${err.hint}`);
   }
-  throw err;
+  return errorResult(messageOf(err));
 }
 function mcpRequestFrom(args) {
   const ctx = args.at(-1);
@@ -59684,10 +59808,12 @@ var init_write = __esm({
 
 // node_modules/@chrischall/mcp-utils/dist/fs/output.js
 import { existsSync as existsSync2, mkdirSync as mkdirSync3 } from "node:fs";
+import { homedir as homedir2 } from "node:os";
+import { join as join5 } from "node:path";
 function resolveOutputDir(perCall, envVar, opts = {}) {
   const raw = perCall ?? readEnvVar(envVar, opts.env ? { env: opts.env } : {});
   if (!raw)
-    return process.cwd();
+    return defaultOutputDir(envVar, opts.name);
   const dir = expandPath(raw);
   if (perCall !== void 0 && opts.allowedRoots) {
     assertPathWithinRoots(dir, opts.allowedRoots);
@@ -59698,9 +59824,23 @@ function resolveOutputDir(perCall, envVar, opts = {}) {
   mkdirSync3(dir, { recursive: true });
   return dir;
 }
+function defaultOutputDir(envVar, name) {
+  if (name === void 0) {
+    throw new McpToolError(`No output directory is configured: ${envVar} is not set.`, {
+      hint: `Set ${envVar} to a writable directory, or pass an output directory with the call.`
+    });
+  }
+  if (!name || name === "." || name === ".." || /[/\\]/.test(name)) {
+    throw new TypeError(`resolveOutputDir: name must be a single path segment, got ${JSON.stringify(name)}`);
+  }
+  const dir = join5(homedir2(), "Downloads", name);
+  mkdirSync3(dir, { recursive: true, mode: 448 });
+  return dir;
+}
 var init_output = __esm({
   "node_modules/@chrischall/mcp-utils/dist/fs/output.js"() {
     init_config();
+    init_errors();
     init_confine();
     init_write();
   }
@@ -59860,6 +60000,7 @@ var init_scrape = __esm({
 // node_modules/@chrischall/mcp-utils/dist/http/throttle.js
 var init_throttle = __esm({
   "node_modules/@chrischall/mcp-utils/dist/http/throttle.js"() {
+    init_cancel();
   }
 });
 
@@ -59885,6 +60026,113 @@ var init_net_atoms = __esm({
   }
 });
 
+// node_modules/@chrischall/mcp-utils/dist/http/body-limit.js
+async function readBytesCapped(res, maxBytes, service, bounded) {
+  if (maxBytes !== void 0) {
+    const declared = Number(res.headers.get("content-length") ?? NaN);
+    if (Number.isFinite(declared) && declared > maxBytes) {
+      cancelStream(res.body);
+      throw new ResponseTooLargeError(service, maxBytes);
+    }
+  }
+  if (!res.body)
+    return new Uint8Array(0);
+  const reader = res.body.getReader();
+  const chunks = [];
+  let total = 0;
+  try {
+    for (; ; ) {
+      const { done, value } = await bounded(reader.read());
+      if (done)
+        break;
+      total += value.byteLength;
+      if (maxBytes !== void 0 && total > maxBytes)
+        throw new ResponseTooLargeError(service, maxBytes);
+      chunks.push(value);
+    }
+  } catch (err) {
+    reader.cancel().catch(() => {
+    });
+    throw err;
+  }
+  const out = new Uint8Array(total);
+  let offset = 0;
+  for (const c of chunks) {
+    out.set(c, offset);
+    offset += c.byteLength;
+  }
+  return out;
+}
+function cancelStream(body) {
+  try {
+    body?.cancel().catch(() => {
+    });
+  } catch {
+  }
+}
+var ResponseTooLargeError;
+var init_body_limit = __esm({
+  "node_modules/@chrischall/mcp-utils/dist/http/body-limit.js"() {
+    init_errors();
+    ResponseTooLargeError = class extends McpToolError {
+      maxBytes;
+      constructor(service, maxBytes) {
+        super(`Response from ${service} is larger than the ${maxBytes}-byte limit.`, {
+          hint: "Raise maxBytes (or the client's maxResponseBytes) if a response this large is expected.",
+          kind: "too_large"
+        });
+        this.name = "ResponseTooLargeError";
+        this.maxBytes = maxBytes;
+      }
+    };
+  }
+});
+
+// node_modules/@chrischall/mcp-utils/dist/http/fetch-bounded.js
+var init_fetch_bounded = __esm({
+  "node_modules/@chrischall/mcp-utils/dist/http/fetch-bounded.js"() {
+    init_cancel();
+    init_errors();
+    init_body_limit();
+    init_http();
+  }
+});
+
+// node_modules/@chrischall/mcp-utils/dist/http/url-safety.js
+function isDotSegment(segment) {
+  const s = segment.replace(/%2e/gi, ".");
+  return s === "." || s === "..";
+}
+function pathPartOf(path) {
+  const end = path.search(/[?#]/);
+  return end === -1 ? path : path.slice(0, end);
+}
+function findPathHazard(path) {
+  const pathPart = pathPartOf(path);
+  if (/[\x00-\x1f\x7f]/.test(pathPart))
+    return "control character";
+  if (pathPart.endsWith(" "))
+    return "trailing space";
+  if (pathPart.includes("\\"))
+    return "backslash";
+  if (pathPart.split("/").some(isDotSegment))
+    return "dot segment";
+  return void 0;
+}
+var RedirectRefusedError;
+var init_url_safety = __esm({
+  "node_modules/@chrischall/mcp-utils/dist/http/url-safety.js"() {
+    init_errors();
+    init_config();
+    RedirectRefusedError = class extends McpToolError {
+      constructor(message) {
+        super(message);
+        this.name = "RedirectRefusedError";
+      }
+    };
+  }
+});
+
 // node_modules/@chrischall/mcp-utils/dist/internal/retry-after.js
 function retryAfterToMs(header, now = Date.now()) {
   if (header == null)
@@ -59905,6 +60153,14 @@ var init_retry_after = __esm({
 });
 
 // node_modules/@chrischall/mcp-utils/dist/http/index.js
+function cancelBody(res) {
+  try {
+    const body = res.body;
+    body?.cancel?.()?.catch(() => {
+    });
+  } catch {
+  }
+}
 function headerOf(headers, name) {
   if (headers === void 0)
     return void 0;
@@ -59930,6 +60186,49 @@ function detectEdgeBlock(input2) {
   }
   return null;
 }
+function jsonKind(value) {
+  if (value === null)
+    return "null";
+  if (Array.isArray(value))
+    return "array";
+  return typeof value;
+}
+function parseJsonBody(text, opts = {}) {
+  const contentType = opts.contentType ?? headerOf(opts.headers, "content-type");
+  const details = {
+    service: opts.service,
+    method: opts.method,
+    path: opts.path,
+    status: opts.status,
+    contentType,
+    expected: opts.expect
+  };
+  if (text.trim().length === 0) {
+    if (opts.expect === void 0)
+      return void 0;
+    throw new UpstreamFormatError({ ...details, received: "empty" });
+  }
+  let value;
+  try {
+    value = JSON.parse(text);
+  } catch (cause) {
+    const edge = detectEdgeBlock({ body: text, headers: opts.headers, status: opts.status });
+    if (edge) {
+      throw new EdgeBlockedError(opts.status ?? 200, edge.vendor, {
+        service: opts.service ?? "the upstream service",
+        method: opts.method,
+        path: opts.path
+      });
+    }
+    throw new UpstreamFormatError({ ...details, expected: void 0, received: "non-json", cause });
+  }
+  if (opts.expect !== void 0) {
+    const kind = jsonKind(value);
+    if (kind !== opts.expect)
+      throw new UpstreamFormatError({ ...details, received: kind });
+  }
+  return value;
+}
 function httpError(res, text, method, path, service) {
   const edge = detectEdgeBlock({ body: text, headers: res.headers, status: res.status });
   if (edge)
@@ -59980,13 +60279,26 @@ function createApiClient(opts) {
   const sleep2 = opts.sleep ?? defaultSleep;
   const unauthorized = () => opts.onUnauthorized ? opts.onUnauthorized() : new UnauthorizedError(service);
   const retryStatuses = retry.statuses ?? [429];
-  const timeoutMs = opts.timeout;
+  const timeoutMs = opts.timeout === false ? 0 : opts.timeout ?? DEFAULT_REQUEST_TIMEOUT_MS;
+  const redirectMode = opts.redirect;
+  const maxRedirects = opts.maxRedirects ?? DEFAULT_MAX_REDIRECTS;
+  const reportWriteOutcome = opts.writeOutcomeUnknown !== false;
+  const defaultMaxBytes = checkMaxBytes("maxResponseBytes", opts.maxResponseBytes);
+  if (!Number.isSafeInteger(maxRedirects) || maxRedirects < 0) {
+    throw new TypeError(`createApiClient: maxRedirects must be a non-negative integer, got ${String(maxRedirects)}.`);
+  }
   const authHeader = (token) => !token ? {} : opts.tokenHeader ? { [opts.tokenHeader]: token } : { Authorization: `Bearer ${token}` };
+  const transportFailures = /* @__PURE__ */ new WeakSet();
+  const markTransportFailure = (err) => {
+    if (typeof err === "object" && err !== null && err.name !== "AbortError") {
+      transportFailures.add(err);
+    }
+  };
   async function withTimeout(run) {
-    if (timeoutMs == null || timeoutMs <= 0) {
+    if (timeoutMs <= 0) {
       const res2 = await run(withAmbientCancellation(void 0));
       return { res: res2, done: () => {
-      }, expired: void 0 };
+      }, expired: void 0, timedOut: () => false };
     }
     const controller = new AbortController();
     const timer = setTimeout(() => controller.abort(), timeoutMs);
@@ -60007,16 +60319,11 @@ function createApiClient(opts) {
     });
     expired.catch(() => {
     });
-    return { res, done: () => clearTimeout(timer), expired };
+    return { res, done: () => clearTimeout(timer), expired, timedOut: () => controller.signal.aborted };
   }
   function discard(attempt) {
     attempt.done();
-    try {
-      const body = attempt.res.body;
-      body?.cancel?.()?.catch(() => {
-      });
-    } catch {
-    }
+    cancelBody(attempt.res);
   }
   async function readBody(attempt, read) {
     try {
@@ -60024,15 +60331,40 @@ function createApiClient(opts) {
         return await read(attempt.res);
       return await Promise.race([read(attempt.res), attempt.expired]);
     } catch (err) {
-      if (err instanceof RequestTimeoutError) {
-        attempt.res.body?.cancel().catch(() => {
-        });
+      const timeout = err instanceof RequestTimeoutError || err instanceof Error && err.name === "AbortError" && attempt.timedOut();
+      if (timeout) {
+        cancelBody(attempt.res);
+        throw err instanceof RequestTimeoutError ? err : new RequestTimeoutError(service, timeoutMs);
       }
+      if (!(err instanceof ResponseTooLargeError))
+        markTransportFailure(err);
       throw err;
     } finally {
       attempt.done();
     }
   }
+  function readBytes(attempt, maxBytes) {
+    if (maxBytes === void 0)
+      return readBody(attempt, async (r) => new Uint8Array(await r.arrayBuffer()));
+    const race = (p) => attempt.expired ? Promise.race([p, attempt.expired]) : p;
+    return readBody(attempt, (r) => readBytesCapped(r, maxBytes, service, race));
+  }
+  async function readText(attempt, maxBytes) {
+    if (maxBytes === void 0)
+      return readBody(attempt, (r) => r.text());
+    return new TextDecoder().decode(await readBytes(attempt, maxBytes));
+  }
+  function readErrorText(attempt, maxBytes) {
+    return readText(attempt, maxBytes).catch((err) => {
+      if (err instanceof ResponseTooLargeError)
+        return "";
+      throw err;
+    });
+  }
+  function scanText(attempt, maxBytes) {
+    return readText(attempt, maxBytes).catch(() => "");
+  }
+  const capOf = (opt) => opt.maxBytes !== void 0 ? checkMaxBytes("maxBytes", opt.maxBytes) : defaultMaxBytes;
   const baseParts = (() => {
     try {
       const u = new URL(base);
@@ -60043,6 +60375,14 @@ function createApiClient(opts) {
   })();
   const baseOrigin = baseParts?.origin;
   function resolveUrl2(path, query) {
+    const hazard = findPathHazard(path);
+    if (hazard !== void 0) {
+      throw new Error(
+        // Quote only the path part: this fires on hostile input, and the
+        // query may carry values that do not belong in a log line.
+        `Refusing request to ${service}: path ${JSON.stringify(path.split(/[?#]/, 1)[0])} contains a ${hazard}, which URL normalisation would rewrite. Build paths with apiPath\`...\` so each value is one encoded segment.`
+      );
+    }
     const url4 = `${base}${path}${query}`;
     if (baseOrigin === void 0)
       return url4;
@@ -60057,23 +60397,66 @@ function createApiClient(opts) {
     }
     return url4;
   }
-  async function send(method, path, opt) {
+  function sameOriginHop(location, from) {
+    let next;
+    try {
+      next = new URL(location, from);
+    } catch {
+      throw new RedirectRefusedError(`Refusing redirect from ${service}: the Location header is not a valid URL.`);
+    }
+    if (baseOrigin === void 0 || next.origin !== baseOrigin || next.username !== baseParts?.username || next.password !== baseParts?.password) {
+      throw new RedirectRefusedError(`Refusing redirect from ${service} to ${next.origin}: it leaves the base origin ${baseOrigin ?? "(unparseable)"}, and following it would re-send the credential there.`);
+    }
+    return next.href;
+  }
+  async function send(method, path, opt, dispatch) {
     const { body: reqBody, contentType } = encodeBody(opt);
     const query = opt.query ? buildQueryString(opt.query) : "";
     const url4 = resolveUrl2(path, query);
     const bodyInit = reqBody !== void 0 ? { body: reqBody } : {};
-    const fetchWith = (token, signal) => doFetch(url4, {
-      method,
-      headers: {
-        Accept: "application/json",
-        ...contentType !== void 0 ? { "Content-Type": contentType } : {},
-        ...opts.baseHeaders,
-        ...authHeader(token || void 0),
-        ...opt.headers
-      },
-      ...signal ? { signal } : {},
-      ...bodyInit
-    });
+    const fetchHop = (hopUrl, hopMethod, withBody, token, signal) => {
+      if (!signal?.aborted)
+        dispatch.sent = true;
+      return doFetch(hopUrl, {
+        method: hopMethod,
+        headers: {
+          Accept: "application/json",
+          ...withBody && contentType !== void 0 ? { "Content-Type": contentType } : {},
+          ...opts.baseHeaders,
+          ...authHeader(token || void 0),
+          ...opt.headers
+        },
+        ...signal ? { signal } : {},
+        ...redirectMode !== void 0 ? { redirect: redirectMode === "same-origin" ? "manual" : redirectMode } : {},
+        ...withBody ? bodyInit : {}
+      }).catch((err) => {
+        markTransportFailure(err);
+        throw err;
+      });
+    };
+    const fetchWith = async (token, signal) => {
+      if (redirectMode !== "same-origin")
+        return fetchHop(url4, method, true, token, signal);
+      let hopUrl = url4;
+      let hopMethod = method;
+      let withBody = true;
+      for (let hops = 0; ; hops += 1) {
+        const res = await fetchHop(hopUrl, hopMethod, withBody, token, signal);
+        const location = REDIRECT_STATUSES.has(res.status) ? responseHeader(res, "location") : void 0;
+        if (location === void 0 || location === null)
+          return res;
+        cancelBody(res);
+        if (hops >= maxRedirects) {
+          throw new RedirectRefusedError(`Refusing request to ${service}: too many redirects (more than ${maxRedirects}).`);
+        }
+        hopUrl = sameOriginHop(location, hopUrl);
+        if (res.status === 303 || (res.status === 301 || res.status === 302) && hopMethod === "POST") {
+          if (hopMethod !== "HEAD")
+            hopMethod = "GET";
+          withBody = false;
+        }
+      }
+    };
     const once = () => withTimeout((signal) => opts.tokenManager ? opts.tokenManager.withAuth((token) => fetchWith(token, signal)) : (async () => fetchWith(await opts.getToken?.() || void 0, signal))());
     let attempt = 0;
     for (; ; ) {
@@ -60092,20 +60475,20 @@ function createApiClient(opts) {
       return current;
     }
   }
-  async function unauthorizedOrEdge(attempt, method, path) {
+  async function unauthorizedOrEdge(attempt, method, path, maxBytes) {
     const res = attempt.res;
     let text = "";
     if (/json/i.test(responseHeader(res, "content-type") ?? "")) {
       discard(attempt);
     } else {
-      text = await readBody(attempt, (r) => r.text()).catch(() => "");
+      text = await scanText(attempt, maxBytes);
     }
     const edge = detectEdgeBlock({ body: text, headers: res.headers, status: res.status });
     if (edge)
       return new EdgeBlockedError(res.status, edge.vendor, { service, method, path });
     return unauthorized();
   }
-  async function rateLimitedError(attempt, method, path) {
+  async function rateLimitedError(attempt, method, path, maxBytes) {
     const res = attempt.res;
     const retryAfter = responseHeader(res, "retry-after");
     const retryAfterMs = retryAfterToMs(retryAfter);
@@ -60117,61 +60500,92 @@ function createApiClient(opts) {
     if (/json/i.test(responseHeader(res, "content-type") ?? "")) {
       discard(attempt);
     } else {
-      text = await readBody(attempt, (r) => r.text()).catch(() => "");
+      text = await scanText(attempt, maxBytes);
     }
     const edgeBlock = detectEdgeBlock({ body: text, headers: res.headers, status: res.status });
     return opts.onRateLimited({ status: res.status, retryAfter, retryAfterMs, edgeBlock, method, path });
   }
-  async function fetchJson(method, path, opt = {}) {
-    const attempt = await send(method, path, opt);
+  async function guardWrite(method, opt, call) {
+    const dispatch = { sent: false };
+    try {
+      return await call(dispatch);
+    } catch (err) {
+      const write = reportWriteOutcome && opt.idempotent !== true && !SAFE_METHODS.has(method.toUpperCase());
+      if (!write || !dispatch.sent)
+        throw err;
+      if (err instanceof RequestTimeoutError) {
+        throw new WriteOutcomeUnknownError(service, method, {
+          timeoutMs: err.timeoutMs,
+          cause: err,
+          hint: opts.writeOutcomeHint
+        });
+      }
+      if (typeof err === "object" && err !== null && transportFailures.has(err)) {
+        throw new WriteOutcomeUnknownError(service, method, { cause: err, hint: opts.writeOutcomeHint });
+      }
+      throw err;
+    }
+  }
+  const fetchJson = (method, path, opt = {}) => guardWrite(method, opt, (dispatch) => fetchJsonOnce(method, path, opt, dispatch));
+  const fetchHtml = (method, path, opt = {}) => guardWrite(method, opt, (dispatch) => fetchHtmlOnce(method, path, opt, dispatch));
+  const fetchRaw = (method, path, opt = {}) => guardWrite(method, opt, (dispatch) => fetchRawOnce(method, path, opt, dispatch));
+  async function fetchJsonOnce(method, path, opt, dispatch) {
+    const maxBytes = capOf(opt);
+    const attempt = await send(method, path, opt, dispatch);
     const res = attempt.res;
     if (res.status === 401)
-      throw await unauthorizedOrEdge(attempt, method, path);
+      throw await unauthorizedOrEdge(attempt, method, path, maxBytes);
     if (res.status === 429)
-      throw await rateLimitedError(attempt, method, path);
+      throw await rateLimitedError(attempt, method, path, maxBytes);
     if (res.status === 204) {
       discard(attempt);
-      return void 0;
+      return parseJsonBody("", { expect: opt.expect, service, method, path, status: 204 });
     }
-    const text = await readBody(attempt, (r) => r.text());
     if (!res.ok) {
-      throw httpError(res, text, method, path, service);
+      throw httpError(res, await readErrorText(attempt, maxBytes), method, path, service);
     }
-    if (text.length === 0)
-      return void 0;
-    return JSON.parse(text);
+    const text = await readText(attempt, maxBytes);
+    return parseJsonBody(text, {
+      expect: opt.expect,
+      service,
+      method,
+      path,
+      status: res.status,
+      headers: res.headers
+    });
   }
-  async function fetchHtml(method, path, opt = {}) {
+  async function fetchHtmlOnce(method, path, opt, dispatch) {
+    const maxBytes = capOf(opt);
     const headers = { Accept: "text/html,*/*", ...opt.headers };
-    const attempt = await send(method, path, { ...opt, headers });
+    const attempt = await send(method, path, { ...opt, headers }, dispatch);
     const res = attempt.res;
     if (res.status === 401)
-      throw await unauthorizedOrEdge(attempt, method, path);
+      throw await unauthorizedOrEdge(attempt, method, path, maxBytes);
     if (res.status === 429)
-      throw await rateLimitedError(attempt, method, path);
-    const text = await readBody(attempt, (r) => r.text());
+      throw await rateLimitedError(attempt, method, path, maxBytes);
     if (!res.ok) {
-      throw httpError(res, text, method, path, service);
+      throw httpError(res, await readErrorText(attempt, maxBytes), method, path, service);
     }
-    return text;
+    return readText(attempt, maxBytes);
   }
-  async function fetchRaw(method, path, opt = {}) {
+  async function fetchRawOnce(method, path, opt, dispatch) {
+    const maxBytes = capOf(opt);
     const headers = { Accept: "*/*", ...opt.headers };
-    const attempt = await send(method, path, { ...opt, headers });
+    const attempt = await send(method, path, { ...opt, headers }, dispatch);
     const res = attempt.res;
     if (res.status === 401)
-      throw await unauthorizedOrEdge(attempt, method, path);
+      throw await unauthorizedOrEdge(attempt, method, path, maxBytes);
     if (res.status === 429)
-      throw await rateLimitedError(attempt, method, path);
+      throw await rateLimitedError(attempt, method, path, maxBytes);
     if (!res.ok) {
-      const text = await readBody(attempt, (r) => r.text()).catch((err) => {
+      const text = await readText(attempt, maxBytes).catch((err) => {
         if (err instanceof RequestTimeoutError)
           throw err;
         return "";
       });
       throw httpError(res, text, method, path, service);
     }
-    const bytes = new Uint8Array(await readBody(attempt, (r) => r.arrayBuffer()));
+    const bytes = await readBytes(attempt, maxBytes);
     return {
       status: res.status,
       contentType: responseHeader(res, "content-type"),
@@ -60181,6 +60595,14 @@ function createApiClient(opts) {
   }
   return { fetchJson, fetchHtml, fetchRaw };
 }
+function checkMaxBytes(name, value) {
+  if (value === void 0)
+    return void 0;
+  if (typeof value !== "number" || Number.isNaN(value) || value < 0) {
+    throw new TypeError(`createApiClient: ${name} must be a non-negative number, got ${String(value)}.`);
+  }
+  return value === Infinity ? void 0 : value;
+}
 function buildQueryString(params) {
   const parts = [];
   for (const [key, value] of Object.entries(params)) {
@@ -60204,7 +60626,7 @@ function formatApiError(status, method, path, errorText, opts = {}) {
   const safe = truncateErrorMessage(errorText ?? "", opts.max).trim();
   return safe.length > 0 ? `${head}: ${safe}` : head;
 }
-var DEFAULT_RETRY, defaultSleep, UnauthorizedError, RateLimitedError, RequestTimeoutError, ApiError, EdgeBlockedError, EDGE_BLOCK_SCAN_MAX, EDGE_BLOCK_MARKERS;
+var DEFAULT_RETRY, defaultSleep, DEFAULT_REQUEST_TIMEOUT_MS, DEFAULT_MAX_REDIRECTS, REDIRECT_STATUSES, UnauthorizedError, RateLimitedError, RequestTimeoutError, DEFAULT_WRITE_OUTCOME_HINT, WriteOutcomeUnknownError, SAFE_METHODS, ApiError, EdgeBlockedError, EDGE_BLOCK_SCAN_MAX, EDGE_BLOCK_MARKERS;
 var init_http = __esm({
   "node_modules/@chrischall/mcp-utils/dist/http/index.js"() {
     init_headers();
@@ -60214,12 +60636,21 @@ var init_http = __esm({
     init_throttle();
     init_response_cache();
     init_net_atoms();
+    init_fetch_bounded();
+    init_url_safety();
+    init_body_limit();
     init_net_atoms();
+    init_url_safety();
     init_retry_after();
     DEFAULT_RETRY = { count: 1, delayMs: 2e3 };
     defaultSleep = (ms) => new Promise((r) => setTimeout(r, ms));
+    DEFAULT_REQUEST_TIMEOUT_MS = 3e4;
+    DEFAULT_MAX_REDIRECTS = 5;
+    REDIRECT_STATUSES = /* @__PURE__ */ new Set([301, 302, 303, 307, 308]);
     UnauthorizedError = class extends Error {
       status = 401;
+      /** Always `'credential_rejected'` unless a subclass says otherwise. */
+      kind = "credential_rejected";
       constructor(service) {
         super(`Unauthorized (401) from ${service} \u2014 the token is missing, invalid, or expired.`);
         this.name = "UnauthorizedError";
@@ -60228,6 +60659,8 @@ var init_http = __esm({
     };
     RateLimitedError = class extends Error {
       status = 429;
+      /** `'http'`: the far side answered, with a 429 (see `status`). */
+      kind = "http";
       retryAfterMs;
       constructor(service, retryAfterMs) {
         super(`Rate limited (429) by ${service} after retries.`);
@@ -60238,6 +60671,8 @@ var init_http = __esm({
     };
     RequestTimeoutError = class extends Error {
       timeoutMs;
+      /** Always `'timeout'` unless a subclass says otherwise. */
+      kind = "timeout";
       constructor(service, timeoutMs) {
         super(`Request to ${service} timed out after ${timeoutMs}ms.`);
         this.name = "RequestTimeoutError";
@@ -60245,6 +60680,33 @@ var init_http = __esm({
         Object.setPrototypeOf(this, new.target.prototype);
       }
     };
+    DEFAULT_WRITE_OUTCOME_HINT = "The write may have happened \u2014 check before retrying; do not resend blindly.";
+    WriteOutcomeUnknownError = class extends McpToolError {
+      /** Always `true`: whether the write happened is not known. */
+      outcomeUnknown = true;
+      /** Always `false`: never replay this request without checking first. */
+      retrySafe = false;
+      /** `true` when the request's timeout expired; `false` for a dropped connection or broken body. */
+      timedOut;
+      /** The timeout that expired, when {@link timedOut}. */
+      timeoutMs;
+      /** The request method, upper-cased. */
+      method;
+      constructor(service, method, opts = {}) {
+        const verb = method.toUpperCase();
+        const what = opts.timeoutMs !== void 0 ? `${verb} to ${service} timed out after ${opts.timeoutMs}ms` : `${verb} to ${service} failed: ${truncateErrorMessage(messageOf(opts.cause), 200)}`;
+        super(`${what} \u2014 the write may already have been applied (outcome is unknown).`, {
+          hint: opts.hint ?? DEFAULT_WRITE_OUTCOME_HINT,
+          cause: opts.cause,
+          kind: opts.timeoutMs !== void 0 ? "timeout" : "transport"
+        });
+        this.name = "WriteOutcomeUnknownError";
+        this.timedOut = opts.timeoutMs !== void 0;
+        this.timeoutMs = opts.timeoutMs;
+        this.method = verb;
+      }
+    };
+    SAFE_METHODS = /* @__PURE__ */ new Set(["GET", "HEAD", "OPTIONS", "TRACE"]);
     ApiError = class extends Error {
       status;
       constructor(status, message) {
@@ -60257,6 +60719,8 @@ var init_http = __esm({
     EdgeBlockedError = class extends ApiError {
       /** Which edge refused the request, e.g. `'CloudFront'` or `'Cloudflare'`. */
       vendor;
+      /** Always `'edge_blocked'`: the credential was never judged. */
+      kind = "edge_blocked";
       /**
        * @param where The service the request was for, and — when the thrower knows
        *   it — the method and path, which the message names.
@@ -60320,6 +60784,7 @@ var init_concurrency = __esm({
 // node_modules/@chrischall/mcp-utils/dist/dates/index.js
 var init_dates = __esm({
   "node_modules/@chrischall/mcp-utils/dist/dates/index.js"() {
+    init_config();
   }
 });
 
@@ -60352,7 +60817,7 @@ var init_zod2 = __esm({
     NonNegInt = external_exports.number().int().nonnegative();
     NonEmptyString = external_exports.string().min(1);
     IsoDate = external_exports.iso.date();
-    IsoTime = external_exports.string().regex(/^([01]?\d|2[0-3]):[0-5]\d$/, "must be HH:MM (24h), e.g. 19:30");
+    IsoTime = external_exports.string().regex(/^([01]?\d|2[0-3]):[0-5]\d$/, "must be HH:MM (24h), e.g. 19:30").overwrite((v) => v.padStart(5, "0"));
     NumericIdString = external_exports.string().regex(/^\d+$/, "must be a numeric id (digits only)").describe("A numeric id string (digits only), safe to interpolate into a URL path.");
     SafePathSegment = external_exports.string().min(1).regex(/^[^/?#\s]+$/, 'must not contain "/", "?", "#", or whitespace').refine((v) => !v.includes(".."), 'must not contain ".."').describe('A single URL path segment, safe to interpolate: no "/", "..", "?", "#", or whitespace.');
     schemaOrigin = external_exports.string().optional().describe("Portal origin (e.g. https://<vendor>.example.co) selecting which active session to use. Optional when only one session is active.");
@@ -60387,6 +60852,7 @@ var init_auth = __esm({
     init_config();
     init_errors();
     init_http();
+    init_cancel();
     init_cached_token();
     init_es256();
   }
@@ -60438,7 +60904,8 @@ __export(images_exports, {
 });
 import { readFile, stat } from "node:fs/promises";
 import { existsSync as existsSync3 } from "node:fs";
-import { delimiter, join as join6, resolve as resolve4, isAbsolute as isAbsolute4 } from "node:path";
+import { homedir as homedir3 } from "node:os";
+import { delimiter, join as join7, resolve as resolve4, isAbsolute as isAbsolute4 } from "node:path";
 function uploadRoots() {
   const roots = readEnvVar("GEMINI_UPLOAD_DIR")?.split(delimiter).map((r) => r.trim()).filter(Boolean);
   return roots && roots.length > 0 ? roots : void 0;
@@ -60459,7 +60926,7 @@ function referenceRoots(env = process.env) {
   let roots = rootList("GEMINI_REFERENCE_DIR", env) ?? rootList("GEMINI_UPLOAD_DIR", env);
   if (!roots) {
     const dataDir = readEnvVar("MCP_DATA_DIR", { env });
-    if (dataDir) roots = [join6(dataDir, "uploads")];
+    if (dataDir) roots = [join7(dataDir, "uploads")];
   }
   if (!roots) return void 0;
   const output2 = readEnvVar("GEMINI_OUTPUT_DIR", { env })?.trim();
@@ -60535,7 +61002,7 @@ function resolveInputPath(p, kind) {
   if (isAbsolute4(p) && existsSync3(p)) return p;
   const inputDir = readEnvVar("GEMINI_INPUT_DIR");
   if (inputDir) {
-    const candidate2 = join6(inputDir, p);
+    const candidate2 = join7(inputDir, p);
     if (existsSync3(candidate2)) return resolve4(candidate2);
   }
   const cwd = resolve4(p);
@@ -60629,11 +61096,14 @@ function baseName(name) {
   const safe = stripped.replace(/[^A-Za-z0-9._-]+/g, "-").replace(/-+/g, "-").replace(/^-+|-+$/g, "");
   return safe || "image";
 }
+function defaultOutputDir2() {
+  return join7(homedir3(), "Downloads", OUTPUT_DIR_NAME);
+}
 function lookupOutputDir(perCall) {
   const trimmed = perCall?.trim() || void 0;
   const configured = readEnvVar("GEMINI_OUTPUT_DIR");
   const raw = trimmed ?? configured;
-  if (!raw) return process.cwd();
+  if (!raw) return defaultOutputDir2();
   const dir = expandPath(raw);
   if (trimmed && configured) assertPathWithinRoots(dir, [configured]);
   return dir;
@@ -60641,10 +61111,11 @@ function lookupOutputDir(perCall) {
 function resolveOutputDir2(perCall) {
   const configured = readEnvVar("GEMINI_OUTPUT_DIR");
   return resolveOutputDir(perCall?.trim() || void 0, "GEMINI_OUTPUT_DIR", {
+    name: OUTPUT_DIR_NAME,
     ...configured ? { allowedRoots: [configured] } : {}
   });
 }
-var REFERENCE_IMAGE_MIMES, VIDEO_MIME_BY_EXT, UPLOAD_MIME_BY_EXT;
+var REFERENCE_IMAGE_MIMES, VIDEO_MIME_BY_EXT, UPLOAD_MIME_BY_EXT, OUTPUT_DIR_NAME;
 var init_images = __esm({
   "src/images.ts"() {
     "use strict";
@@ -60679,6 +61150,7 @@ var init_images = __esm({
       flac: "audio/flac",
       ...VIDEO_MIME_BY_EXT
     };
+    OUTPUT_DIR_NAME = "gemini-mcp";
   }
 });
 
@@ -60691,7 +61163,7 @@ import { execFile } from "node:child_process";
 import { promisify } from "node:util";
 import { readFile as readFile2, unlink } from "node:fs/promises";
 import { tmpdir } from "node:os";
-import { join as join7 } from "node:path";
+import { join as join8 } from "node:path";
 async function readClipboardImage(run = defaultRun) {
   if (process.platform !== "darwin") {
     throw new McpToolError("from_clipboard is only supported on macOS", {
@@ -60699,8 +61171,8 @@ async function readClipboardImage(run = defaultRun) {
     });
   }
   const id = `${Date.now()}-${Math.random().toString(36).slice(2)}`;
-  const png = join7(tmpdir(), `gemini-clip-${id}.png`);
-  const jpg = join7(tmpdir(), `gemini-clip-${id}.jpg`);
+  const png = join8(tmpdir(), `gemini-clip-${id}.png`);
+  const jpg = join8(tmpdir(), `gemini-clip-${id}.jpg`);
   try {
     try {
       await run("osascript", [
@@ -60747,15 +61219,15 @@ init_dist2();
 
 // src/dotenv.ts
 init_dist2();
-import { dirname as dirname3, join as join5 } from "node:path";
+import { dirname as dirname3, join as join6 } from "node:path";
 import { fileURLToPath } from "node:url";
 async function loadStdioDotenv() {
   const here = dirname3(fileURLToPath(import.meta.url));
-  await loadDotenvSafely({ path: join5(here, "..", ".env"), override: false });
+  await loadDotenvSafely({ path: join6(here, "..", ".env"), override: false });
 }
 
 // src/version.ts
-var VERSION = "2.3.2";
+var VERSION = "2.3.4";
 
 // src/errors.ts
 init_dist2();
@@ -60822,7 +61294,7 @@ function registerModelTools(server, client2) {
     "gemini_list_models",
     {
       description: "List the Gemini image-generation models available to your API key (Nano Banana / Nano Banana Pro family), and the current default model.",
-      annotations: { readOnlyHint: true }
+      annotations: toolAnnotations({ readOnly: true, openWorld: true })
     },
     async () => {
       const models = await client2.listModels();
@@ -60866,12 +61338,6 @@ function statusOf(err) {
 
 // node_modules/@chrischall/mcp-utils/dist/healthcheck/index.js
 init_zod();
-function statusOf2(err) {
-  if (typeof err !== "object" || err === null)
-    return void 0;
-  const s = err.status ?? err.statusCode;
-  return typeof s === "number" ? s : void 0;
-}
 var CREDENTIAL_ARMS = /* @__PURE__ */ new Set([
   "ok",
   "no_credential",
@@ -60887,6 +61353,9 @@ var CREDENTIAL_ARMS = /* @__PURE__ */ new Set([
 function isArm(kind) {
   return kind !== void 0 && CREDENTIAL_ARMS.has(kind);
 }
+function fromSource(source) {
+  return source !== null ? ` from '${source}'` : "";
+}
 function credentialHint(arm, prefix, hostLabel, source) {
   switch (arm) {
     case "ok":
@@ -60894,15 +61363,15 @@ function credentialHint(arm, prefix, hostLabel, source) {
     case "no_credential":
       return `No credential resolved. Nothing was available to authenticate with \u2014 sign in and reconnect the connector so ${prefix} receives a token, or set the documented environment variable.`;
     case "credential_rejected":
-      return `${hostLabel} rejected the credential from '${source}'. It is present but no longer valid \u2014 most often expired or revoked upstream. Re-authenticate and reconnect; retrying will not fix it.`;
+      return `${hostLabel} rejected the credential${fromSource(source)}. It is present but no longer valid \u2014 most often expired or revoked upstream. Re-authenticate and reconnect; retrying will not fix it.`;
     case "edge_blocked":
       return `${hostLabel} refused the request at its CDN/WAF before it reached the API, so the credential${source !== null ? ` from '${source}'` : ""} was never judged \u2014 re-signing in or rotating it will not help. This is usually a block on this host's IP address or request fingerprint: route through the ContextMint Bridge if this connector supports it, or retry later from a different network.`;
     case "session_expired":
-      return `The credential from '${source}' is configured, but no session is live \u2014 ${hostLabel} served a sign-in page rather than the data. Sign in again; a cookie-session portal expires these on its own, so this recurs between uses.`;
+      return `The credential${fromSource(source)} is configured, but no session is live \u2014 ${hostLabel} served a sign-in page rather than the data. Sign in again; a cookie-session portal expires these on its own, so this recurs between uses.`;
     case "verification_pending":
       return `${hostLabel} is holding the sign-in on a second factor rather than refusing it. Supply the verification code the ACCOUNT HOLDER received \u2014 the credential itself is not the problem, so changing it will not help.`;
     case "timeout":
-      return `The credential from '${source}' resolved, but ${hostLabel} did not answer in time. Usually transient \u2014 retry. If it persists, ${hostLabel} is slow or unreachable from here.`;
+      return `${source !== null ? `The credential from '${source}' resolved, but ` : ""}${hostLabel} did not answer in time. Usually transient \u2014 retry. If it persists, ${hostLabel} is slow or unreachable from here.`;
     case "http":
       return `${hostLabel} answered with an error status that is not an auth rejection. That is USUALLY a ${hostLabel}-side problem rather than an auth one \u2014 but a 404 here more often means the probe path is wrong than that ${hostLabel} is broken, so check error.message and probe.url before concluding anything about the credential.`;
     case "transport":
@@ -60923,7 +61392,8 @@ async function runCredentialHealthcheck(args) {
     state = await resolveCredential();
   } catch (e) {
     const edge = edgeBlockOf(e);
-    const classified = classifyThrown?.(e) ?? (edge !== null ? { kind: "edge_blocked", detail: { vendor: edge.vendor } } : void 0);
+    const declared = errorKindOf(e);
+    const classified = classifyThrown?.(e) ?? (edge !== null ? { kind: "edge_blocked", detail: { vendor: edge.vendor } } : declared !== void 0 ? { kind: declared } : void 0);
     const result2 = {
       ok: false,
       // Still false, and still no source: a classification explains WHY
@@ -60970,10 +61440,11 @@ async function runCredentialHealthcheck(args) {
   try {
     await probeFn();
   } catch (e) {
-    status = statusOf2(e);
+    status = errorStatusOf(e);
     const aborted2 = e instanceof Error && e.name === "AbortError";
     const edge = edgeBlockOf(e);
-    arm = edge !== null ? "edge_blocked" : status === 401 || status === 403 ? "credential_rejected" : status !== void 0 ? "http" : aborted2 || /timeout|timed out|ETIMEDOUT/i.test(messageOf(e)) ? "timeout" : /fetch failed|ENOTFOUND|ECONNREFUSED|ECONNRESET|network/i.test(messageOf(e)) ? "transport" : "unknown";
+    const declared = errorKindOf(e);
+    arm = edge !== null ? "edge_blocked" : declared !== void 0 ? declared : status === 401 || status === 403 ? "credential_rejected" : status !== void 0 ? "http" : aborted2 || /timeout|timed out|ETIMEDOUT/i.test(messageOf(e)) ? "timeout" : /fetch failed|ENOTFOUND|ECONNREFUSED|ECONNRESET|network/i.test(messageOf(e)) ? "transport" : "unknown";
     let kind = arm;
     let detail = edge !== null ? { vendor: edge.vendor } : void 0;
     const custom2 = classifyThrown?.(e);
@@ -61176,10 +61647,12 @@ function assertPublicHttpsUrl(raw, requested) {
   }
   const rawHost = url4.hostname.toLowerCase();
   const isIpv6Literal = rawHost.startsWith("[") && rawHost.endsWith("]");
-  const host = isIpv6Literal ? rawHost.slice(1, -1) : rawHost;
+  const host = isIpv6Literal ? rawHost.slice(1, -1) : rawHost.replace(/\.+$/, "");
   const v4 = isIpv6Literal ? void 0 : ipv4Octets(host);
   const v6 = isIpv6Literal ? ipv6Groups(host) : void 0;
-  const blocked = isIpv6Literal ? v6 === void 0 || isPrivateIpv6(v6) : host === "localhost" || host.endsWith(".localhost") || host.endsWith(".local") || (v4 ? isPrivateIpv4(v4) : false);
+  const blocked = isIpv6Literal ? v6 === void 0 || isPrivateIpv6(v6) : host === "localhost" || host.endsWith(".localhost") || host.endsWith(".local") || // Private-network names: Fly's 6PN (`<app>.internal`, where the hosted
+  // build runs) and GCP's metadata server (`metadata.google.internal`).
+  host === "internal" || host.endsWith(".internal") || (v4 ? isPrivateIpv4(v4) : false);
   if (blocked) {
     throw new McpToolError(
       `Refusing to fetch ${describeUrl(raw, requested)}: "${url4.hostname}" is a private, loopback or link-local address, not a public host.`,
@@ -61526,10 +61999,12 @@ async function readPin(bucket) {
 }
 function pinnedTenant(bucket, derive) {
   let cached2;
-  async function resolve5() {
+  async function resolve6() {
     const pinned = await readPin(bucket);
     if (pinned) return { tenant: pinned, pinned: true };
-    const tenant = await derive();
+    const derived2 = await derive();
+    if (typeof derived2 !== "string") return { tenant: derived2.tenant, pinned: false };
+    const tenant = derived2;
     try {
       await bucket.put(TENANT_PIN_KEY, JSON.stringify({ tenant }), {
         httpMetadata: { contentType: "application/json" }
@@ -61541,7 +62016,7 @@ function pinnedTenant(bucket, derive) {
   }
   return () => {
     if (cached2) return cached2;
-    const attempt = resolve5().then(({ tenant, pinned }) => {
+    const attempt = resolve6().then(({ tenant, pinned }) => {
       if (!pinned && cached2 === attempt) cached2 = void 0;
       return tenant;
     });
@@ -62028,7 +62503,7 @@ var sharedImageSchema = {
   aspect_ratio: external_exports.enum(ASPECT_RATIOS).optional().describe("Exact output aspect ratio. For a plain landscape/portrait/square request, `orientation` is the shorthand; this wins if both are given."),
   orientation: orientationSchema,
   image_size: external_exports.enum(IMAGE_SIZES).optional().describe("Output resolution (512 = 0.5K, Flash-only)"),
-  output_dir: external_exports.string().optional().describe("Directory to write images to (default: $GEMINI_OUTPUT_DIR or cwd)"),
+  output_dir: external_exports.string().optional().describe("Directory to write images to (default: $GEMINI_OUTPUT_DIR or ~/Downloads/gemini-mcp)"),
   inline: external_exports.boolean().optional().describe("Return the image as an inline image block you can SEE, instead of a path (stdio) or link (hosted). The default costs nothing to carry and hands back a reference you can reuse; use this when you need to check the result yourself. On the hosted connector gemini_view_media does the same for an image you already have"),
   seed: external_exports.number().int().optional().describe("Seed for reproducible generation; random if omitted"),
   thinking_level: external_exports.enum(["minimal", "high"]).optional().describe("Reasoning depth (Gemini 3 models); higher can help complex/structural edits"),
@@ -62482,13 +62957,13 @@ function persistableResult(result) {
   return { result };
 }
 function awaitWithBudget(promise2, waitMs) {
-  return new Promise((resolve5, reject) => {
-    const timer = setTimeout(() => resolve5(void 0), waitMs);
+  return new Promise((resolve6, reject) => {
+    const timer = setTimeout(() => resolve6(void 0), waitMs);
     timer.unref?.();
     promise2.then(
       (result) => {
         clearTimeout(timer);
-        resolve5(result);
+        resolve6(result);
       },
       (err) => {
         clearTimeout(timer);
@@ -62556,7 +63031,7 @@ var JobRegistry = class {
   /** Await outstanding durable writes. Tests only — handlers never need it. */
   async drain() {
     for (let round = 0; round < 50; round++) {
-      await new Promise((resolve5) => setTimeout(resolve5, 0));
+      await new Promise((resolve6) => setTimeout(resolve6, 0));
       if (!this.pending.size) return;
       await Promise.allSettled([...this.pending]);
     }
@@ -62988,10 +63463,18 @@ async function confirmWrite(ctx, o) {
     message: o.message,
     details: preview,
     tool: o.tool,
+    // One API key per process (a hosted deployment runs one child per
+    // account), so there is no in-process principal to bind.
+    account: void 0,
+    args: withoutConfirmToken(o.args),
     confirmToken: o.confirmToken,
     subject: () => ({ target: o.target, payload: o.payload, preview })
   }));
 }
+function withoutConfirmToken(args) {
+  const { confirmToken: _omit, ...rest } = args;
+  return rest;
+}
 async function confirmLocalInputs(ctx, o) {
   const hasLocal = (o.imagePaths?.length ?? 0) > 0 || Boolean(o.videoPath);
   if (!hasLocal) return void 0;
@@ -63008,6 +63491,7 @@ async function confirmLocalInputs(ctx, o) {
     body: { inputs },
     target: "",
     payload: { request: o.request, inputs },
+    args: o.request,
     confirmToken: o.confirmToken
   });
 }
@@ -63021,7 +63505,7 @@ function registerGenerateTools(server, client2) {
     "gemini_image_generate",
     {
       description: "Generate image(s) from a text prompt with a Gemini image model (Nano Banana / Nano Banana Pro). If the result will likely be refined iteratively, prefer gemini_interact (multi-turn) as the entry point. " + confirmNote("Local file inputs are confirmed first"),
-      annotations: { readOnlyHint: false, openWorldHint: true },
+      annotations: { readOnlyHint: false, destructiveHint: true, openWorldHint: true },
       inputSchema: external_exports.object({
         prompt: external_exports.string().min(1).describe("Text prompt describing the image"),
         count: external_exports.number().int().positive().max(8).optional().describe("Number of independent images (default 1)"),
@@ -63141,7 +63625,7 @@ function registerGenerateTools(server, client2) {
     "gemini_image_edit",
     {
       description: "Edit or compose images: provide one or more input images (paths or base64), plus a text instruction. For a SERIES of successive edits to the same image, prefer gemini_interact (multi-turn) \u2014 it keeps edit context and avoids re-processing the full image each round; use gemini_image_edit for one-off edits or composing multiple distinct inputs. Gemini over-preserves the input; there is no edit-strength control \u2014 for large structural changes, reroll with a different `seed` or more forceful wording. " + confirmNote("Local file inputs are confirmed first"),
-      annotations: { readOnlyHint: false, openWorldHint: true },
+      annotations: { readOnlyHint: false, destructiveHint: true, openWorldHint: true },
       inputSchema: external_exports.object({
         prompt: external_exports.string().min(1).describe("Instruction describing the edit or composition"),
         images: external_exports.array(external_exports.string().min(1)).optional().describe("Paths to input image file(s) (1 = edit, 2+ = compose). Local paths must be inside GEMINI_REFERENCE_DIR (else GEMINI_UPLOAD_DIR) when set."),
@@ -63232,7 +63716,7 @@ function registerSetTools(server, client2) {
     "gemini_image_set",
     {
       description: 'Generate a consistent SET of images: a master image from master_prompt, then one image per scene that references the master so the subject/style stays consistent. Provide `scenes` (explicit per-image prompts) OR `count` (variations of the master). Scene generations run in parallel (reference_mode "master", the default). On the hosted connector: saved `characters` and a saved `style` can seed the whole set by name, multi-image results include a `bundle_url` zip of every image (one curl instead of N), and `max_wait_ms` returns a pollable job handle if the batch runs long. ' + confirmNote("Local file inputs are confirmed first"),
-      annotations: { readOnlyHint: false, openWorldHint: true },
+      annotations: { readOnlyHint: false, destructiveHint: true, openWorldHint: true },
       inputSchema: external_exports.object({
         master_prompt: external_exports.string().min(1).describe("Prompt for the master/reference image"),
         scenes: external_exports.array(external_exports.string().min(1)).min(1).max(8).optional().describe("Per-image prompts (1-8); each references the master"),
@@ -63391,6 +63875,7 @@ var LIBRARY_NAME_PATTERN = /^[a-z0-9][a-z0-9_-]{0,39}$/;
 function isValidLibraryName(name) {
   return LIBRARY_NAME_PATTERN.test(name);
 }
+var LIBRARY_MAX_LIST_PAGES = 20;
 function createR2Library(bucket, opts) {
   const now = opts.now ?? (() => /* @__PURE__ */ new Date());
   const tenantId = tenantResolver(opts.tenant);
@@ -63422,10 +63907,10 @@ function createR2Library(bucket, opts) {
     const prefix = `${LIBRARY_KEY_PREFIX}/${await tenantId()}/${kind}/`;
     const keys = [];
     let cursor;
-    for (; ; ) {
+    for (let n = 0; n < LIBRARY_MAX_LIST_PAGES; n++) {
       const page = await bucket.list({ prefix, cursor, limit: 1e3 });
       keys.push(...page.objects.map((o) => o.key).filter((k) => k.endsWith(".json")));
-      if (!page.truncated) break;
+      if (!page.truncated || !page.cursor) break;
       cursor = page.cursor;
     }
     const records = await Promise.all(keys.map((k) => readJson(k)));
@@ -63713,8 +64198,9 @@ var SessionState = class {
    * Accumulated in the CLIENT rather than in the tools, so a call that was
    * billed and then failed (a safety filter returning no image, say) still
    * counts — it cost money regardless of whether a tool could use the result.
-   * Per session, never module scope: one hosted process serves many tenants,
-   * and a shared total would report other people's spend as yours.
+   * On the session, never module scope: a module-level total would report
+   * other users' spend as yours on any host that served several users from one
+   * process (see the invariant above).
    */
   usageTotal;
   /** How many upstream calls contributed to {@link usageTotal}. */
@@ -63779,6 +64265,25 @@ function resolveTimeoutMs(perCallMs, imageSize) {
   return imageSize === "4K" ? REQUEST_TIMEOUT_4K_MS : REQUEST_TIMEOUT_MS;
 }
 var UPLOAD_BASE_URL = "https://generativelanguage.googleapis.com/upload/v1beta";
+function isGoogleUploadUrl(raw) {
+  let u;
+  try {
+    u = new URL(raw);
+  } catch {
+    return false;
+  }
+  return u.protocol === "https:" && (u.hostname === "googleapis.com" || u.hostname.endsWith(".googleapis.com"));
+}
+var MIN_TRANSFER_BYTES_PER_SEC = 256 * 1024;
+function transferTimeoutMs(bytes) {
+  return resolveTimeoutMs() + Math.ceil(bytes / MIN_TRANSFER_BYTES_PER_SEC * 1e3);
+}
+function transferDeadline(ms) {
+  const ctrl = new AbortController();
+  const timer = setTimeout(() => ctrl.abort(new DOMException(`timed out after ${ms}ms`, "TimeoutError")), ms);
+  timer.unref?.();
+  return { signal: ctrl.signal, clear: () => clearTimeout(timer) };
+}
 var FILE_MAX_BYTES = 2 * 1024 ** 3;
 var FILE_POLL_INTERVAL_MS = 2e3;
 var FILE_POLL_MAX_ATTEMPTS = 150;
@@ -63855,10 +64360,9 @@ var GeminiClient = class {
   mediaSink;
   /**
    * This client's session memory — job registry, last-interaction id, written
-   * outputs. One client is one session: the hosted connector builds a client
-   * per authenticated user, so hanging the state here is what keeps it from
-   * leaking between tenants sharing an isolate (see src/session.ts). The stdio
-   * server is single-user, so its one singleton client is one session.
+   * outputs. One client is one session. Production builds one client per
+   * process and one process is one user, so this is process-wide — see the
+   * invariant (and what a multi-user host would need) in src/session.ts.
    */
   session = new SessionState();
   /** Per-account character/style library — hosted connector only (see options). */
@@ -63991,8 +64495,9 @@ var GeminiClient = class {
    * These two upload calls are raw `fetchImpl` (not `createApiClient`): step 1
    * needs the response *header* and step 2 posts a binary body — neither fits
    * `fetchJson`. The poll DOES go through the shared client (timeout + retry).
-   * Uploads deliberately have no abort timeout: a multi-hundred-MB video can
-   * legitimately take longer than any fixed budget.
+   * The deadline scales with the file (see `transferTimeoutMs`): a
+   * multi-hundred-MB video can legitimately take longer than any fixed budget,
+   * but a stalled upload must still fail rather than hang.
    *
    * Returned files live ~48h (`expirationTime`); per-file cap is 2 GB
    * (enforced locally before any bytes are sent).
@@ -64058,12 +64563,32 @@ var GeminiClient = class {
    * These two upload calls are raw `fetchImpl` (not `createApiClient`): step 1
    * needs the response *header* and step 2 posts a binary body — neither fits
    * `fetchJson`. The poll DOES go through the shared client (timeout + retry).
-   * Uploads carry no abort timeout by default: a multi-hundred-MB file can
-   * legitimately take longer than any fixed budget. A caller that is uploading
-   * OPPORTUNISTICALLY passes its own `signal` (see `uploadBytes`).
+   * By default the two round trips get a deadline sized to the file (see
+   * `transferTimeoutMs`) — a multi-hundred-MB file can legitimately take longer
+   * than any fixed budget, but a stalled one must fail rather than hang. A
+   * caller that is uploading OPPORTUNISTICALLY passes its own, shorter
+   * `signal` instead (see `uploadBytes`).
    */
   async uploadToFilesApi(body, mimeType, displayName, contentLength, signal) {
     const key = this.requireKey();
+    const deadline = signal ? void 0 : transferDeadline(transferTimeoutMs(contentLength));
+    let uploaded;
+    try {
+      uploaded = await this.sendToFilesApi(body, mimeType, displayName, contentLength, key, signal ?? deadline.signal);
+    } catch (err) {
+      if (deadline?.signal.aborted) {
+        throw new McpToolError(`${SERVICE} Files API upload of ${displayName} timed out after ${transferTimeoutMs(contentLength)}ms`, {
+          hint: "The upload stalled. Retry, or check the network between this server and generativelanguage.googleapis.com."
+        });
+      }
+      throw err;
+    } finally {
+      deadline?.clear();
+    }
+    return this.awaitFileActive(uploaded.name, uploaded.file, mimeType);
+  }
+  /** {@link uploadToFilesApi}'s steps 1 and 2 (start + upload/finalize), under `signal`. */
+  async sendToFilesApi(body, mimeType, displayName, contentLength, key, signal) {
     const doFetch = this.fetchImpl;
     const startPath = "/files";
     const startRes = await doFetch(`${UPLOAD_BASE_URL}${startPath}`, {
@@ -64077,7 +64602,7 @@ var GeminiClient = class {
         "Content-Type": "application/json"
       },
       body: JSON.stringify({ file: { display_name: displayName } }),
-      ...signal ? { signal } : {}
+      signal
     });
     if (!startRes.ok) {
       throw new McpToolError(
@@ -64090,6 +64615,11 @@ var GeminiClient = class {
         hint: "The Files API resumable-upload contract may have changed \u2014 see docs/GEMINI-API.md."
       });
     }
+    if (!isGoogleUploadUrl(uploadUrl)) {
+      throw new McpToolError(`${SERVICE} upload start returned a session URL outside googleapis.com; refusing to send the file`, {
+        hint: "The Files API resumable-upload contract may have changed \u2014 see docs/GEMINI-API.md."
+      });
+    }
     const upRes = await doFetch(uploadUrl, {
       method: "POST",
       headers: {
@@ -64097,7 +64627,7 @@ var GeminiClient = class {
         "X-Goog-Upload-Command": "upload, finalize"
       },
       body,
-      ...signal ? { signal } : {}
+      signal
     });
     if (!upRes.ok) {
       throw new McpToolError(
@@ -64109,6 +64639,10 @@ var GeminiClient = class {
     if (!/^files\/[\w-]+$/.test(name)) {
       throw new McpToolError(`${SERVICE} upload returned an unexpected file name: ${name || "(none)"}`);
     }
+    return { name, file: file2 };
+  }
+  /** {@link uploadToFilesApi}'s step 3: wait out PROCESSING. Outside the upload deadline. */
+  async awaitFileActive(name, file2, mimeType) {
     for (let attempt = 0; file2.state === "PROCESSING"; attempt++) {
       if (attempt >= FILE_POLL_MAX_ATTEMPTS) {
         throw new McpToolError(`${SERVICE} file ${name} is still processing after ${FILE_POLL_INTERVAL_MS * FILE_POLL_MAX_ATTEMPTS / 6e4} minutes`, {
@@ -64546,32 +65080,46 @@ var GeminiClient = class {
     let current = requested;
     for (let hop = 0; ; hop++) {
       const url4 = assertMediaHost(current, requested);
-      const res = await doFetch(url4.toString(), {
-        redirect: "manual",
-        headers: { "x-goog-api-key": key }
-      });
-      if (res.status >= 300 && res.status < 400) {
-        const location = res.headers?.get("location");
-        if (!location) {
-          throw new McpToolError(`${SERVICE} media download returned HTTP ${res.status} with no Location header for ${current}`);
+      const budgetMs = transferTimeoutMs(MEDIA_DOWNLOAD_MAX_BYTES);
+      const deadline = transferDeadline(budgetMs);
+      try {
+        const res = await doFetch(url4.toString(), {
+          redirect: "manual",
+          headers: { "x-goog-api-key": key },
+          signal: deadline.signal
+        });
+        if (res.status >= 300 && res.status < 400) {
+          const location = res.headers?.get("location");
+          if (!location) {
+            throw new McpToolError(`${SERVICE} media download returned HTTP ${res.status} with no Location header for ${current}`);
+          }
+          if (hop >= MAX_REDIRECTS) {
+            throw new McpToolError(`${SERVICE} media download for ${requested} exceeded ${MAX_REDIRECTS} redirects (last hop: ${location}).`);
+          }
+          current = new URL(location, url4).toString();
+          continue;
+        }
+        if (!res.ok) {
+          throw new McpToolError(
+            `${SERVICE} media download failed (HTTP ${res.status}) for ${current}`,
+            { hint: "Generated files live in the Files API for ~48h and the download requires the api key that created them." }
+          );
         }
-        if (hop >= MAX_REDIRECTS) {
-          throw new McpToolError(`${SERVICE} media download for ${requested} exceeded ${MAX_REDIRECTS} redirects (last hop: ${location}).`);
+        const bytes = await readCapped(res, MEDIA_DOWNLOAD_MAX_BYTES, current, requested, MEDIA_CAP_SUBJECT);
+        return {
+          base64: bytesToBase64(bytes),
+          mimeType: media.mimeType || res.headers?.get("content-type") || "application/octet-stream"
+        };
+      } catch (err) {
+        if (deadline.signal.aborted && !(err instanceof McpToolError)) {
+          throw new McpToolError(`${SERVICE} media download timed out after ${budgetMs}ms for ${current}`, {
+            hint: "The download stalled. Recover the result with gemini_get_result, or retry."
+          });
         }
-        current = new URL(location, url4).toString();
-        continue;
-      }
-      if (!res.ok) {
-        throw new McpToolError(
-          `${SERVICE} media download failed (HTTP ${res.status}) for ${current}`,
-          { hint: "Generated files live in the Files API for ~48h and the download requires the api key that created them." }
-        );
+        throw err;
+      } finally {
+        deadline.clear();
       }
-      const bytes = await readCapped(res, MEDIA_DOWNLOAD_MAX_BYTES, current, requested, MEDIA_CAP_SUBJECT);
-      return {
-        base64: bytesToBase64(bytes),
-        mimeType: media.mimeType || res.headers?.get("content-type") || "application/octet-stream"
-      };
     }
   }
   /** {@link downloadMedia} over a list, preserving order. */
@@ -64651,7 +65199,10 @@ function isDeliveryUnsupported(err) {
 }
 function hostedStorage(blob = blobStoreFromEnv()) {
   if (!blob) return {};
-  const tenant = pinnedTenant(blob.bucket, () => tenantIdFor(readEnvVar("GEMINI_API_KEY") ?? "local"));
+  const tenant = pinnedTenant(blob.bucket, async () => {
+    const key = readEnvVar("GEMINI_API_KEY");
+    return key ? tenantIdFor(key) : { tenant: await tenantIdFor("local"), pin: false };
+  });
   return {
     mediaSink: createR2Sink(blob.bucket, {
       // The SAME `links` object the minter gets below. Media GETs and upload
@@ -64690,10 +65241,17 @@ var client = new GeminiClient(hostedStorage());
 init_images();
 
 // src/sidecar.ts
-import { readdir, readFile as readFile3, stat as stat2 } from "node:fs/promises";
-import { existsSync as existsSync4 } from "node:fs";
-import { join as join8 } from "node:path";
+import { readdir, readFile as readFile3, stat as stat2, lstat } from "node:fs/promises";
+import { join as join9, resolve as resolve5 } from "node:path";
 var SIDECAR_SUFFIX2 = ".json";
+var SIDECAR_NAME = /^.+\.[A-Za-z0-9]+\.json$/;
+async function isRegularFile(path) {
+  try {
+    return (await lstat(path)).isFile();
+  } catch {
+    return false;
+  }
+}
 async function readSidecars(dir) {
   let entries;
   try {
@@ -64701,20 +65259,25 @@ async function readSidecars(dir) {
   } catch {
     return [];
   }
+  const sidecarNames = entries.filter((e) => SIDECAR_NAME.test(e));
+  const outputs = new Set(sidecarNames.map((e) => resolve5(dir, e.slice(0, -SIDECAR_SUFFIX2.length))));
   const records = [];
-  for (const entry of entries) {
-    if (!entry.endsWith(SIDECAR_SUFFIX2)) continue;
-    const sidecarPath = join8(dir, entry);
+  for (const entry of sidecarNames) {
+    const sidecarPath = join9(dir, entry);
     try {
       const parsed = JSON.parse(await readFile3(sidecarPath, "utf8"));
       if (typeof parsed !== "object" || parsed === null) continue;
       const { interaction_id: interactionId, images } = parsed;
       if (typeof interactionId !== "string" || !interactionId) continue;
       const paths = Array.isArray(images) ? images.filter((p) => typeof p === "string") : [];
+      const kept = [];
+      for (const p of paths) {
+        if (outputs.has(resolve5(p)) && await isRegularFile(p)) kept.push(p);
+      }
       records.push({
         sidecarPath,
         interactionId,
-        images: paths.filter((p) => existsSync4(p)),
+        images: kept,
         mtimeMs: (await stat2(sidecarPath)).mtimeMs
       });
     } catch {
@@ -64770,7 +65333,7 @@ function registerInteractTools(server, client2) {
     "gemini_interact",
     {
       description: "Preferred tool for iterative refinement of a single image \u2014 multi-turn generation and editing via the Interactions API. To refine, pass the returned interaction `id` as `previous_interaction_id` on the next call; do NOT start a new interaction or re-send the image for each tweak. `continue_last: true` chains from this session's most recent interaction without threading the id. " + recoveryDescription + "Output is JPEG. " + confirmNote("Local file inputs are confirmed first"),
-      annotations: { readOnlyHint: false, openWorldHint: true },
+      annotations: { readOnlyHint: false, destructiveHint: true, openWorldHint: true },
       inputSchema: external_exports.object({
         input: external_exports.string().min(1).describe("Text prompt or editing instruction"),
         previous_interaction_id: external_exports.string().optional().describe("ID from a prior gemini_interact call \u2014 continues that multi-turn conversation"),
@@ -64785,7 +65348,7 @@ function registerInteractTools(server, client2) {
         image_size: external_exports.enum(IMAGE_SIZES).optional().describe("Output resolution (512 = 0.5K, Flash-only)"),
         thinking_level: external_exports.enum(["minimal", "high"]).optional().describe("Reasoning depth; higher can help complex/structural edits"),
         filename: external_exports.string().optional().describe("Base filename for the output image (extension stripped; default: slugified input)"),
-        output_dir: external_exports.string().optional().describe("Directory to write images to (default: $GEMINI_OUTPUT_DIR or cwd)"),
+        output_dir: external_exports.string().optional().describe("Directory to write images to (default: $GEMINI_OUTPUT_DIR or ~/Downloads/gemini-mcp)"),
         inline: external_exports.boolean().optional().describe("Return base64 images inline instead of writing to disk"),
         google_search: external_exports.boolean().optional().describe("Ground the image in live Google Search results (current events, weather, data)"),
         search_types: external_exports.array(external_exports.enum(["web_search", "image_search"])).optional().describe(
@@ -64943,7 +65506,7 @@ function registerVideoTools(server, client2) {
     "gemini_video_generate",
     {
       description: 'Generate a short video (~10s) via the Gemini omni model: text\u2192video, image\u2192video / reference\u2192video (supply reference image[s]), interpolate between two stills (pass first frame then last frame as images), or continue a prior video (task: "edit" or "extend" + previous_interaction_id / continue_last; extensions add ~3-10s each, to ~40s total). Cost scales with `resolution` \u2014 draft at 360p, keep at 1080p/4k. Output is written to disk as MP4 (video has no inline MCP block). Video runs long \u2014 give it a `max_wait_ms` budget (or `async: true` + gemini_get_result on a local install), or raise `timeout_ms`. Needs a funded account. ' + confirmNote("Local file inputs are confirmed first"),
-      annotations: { readOnlyHint: false, openWorldHint: true },
+      annotations: { readOnlyHint: false, destructiveHint: true, openWorldHint: true },
       inputSchema: external_exports.object({
         prompt: external_exports.string().min(1).describe("Description of the video to generate (or the edit instruction when task=edit)"),
         aspect_ratio: external_exports.enum(VIDEO_ASPECT_RATIOS).optional().describe("Exact output aspect ratio (omni: 16:9 or 9:16). `orientation` is the plain-language shorthand; this wins if both are given."),
@@ -64956,7 +65519,7 @@ function registerVideoTools(server, client2) {
         images_base64: imagesBase64Schema(),
         from_clipboard: external_exports.boolean().optional().describe("Use the image currently on the macOS clipboard as a reference"),
         filename: external_exports.string().optional().describe("Base filename for the output video (extension stripped; default: slugified prompt)"),
-        output_dir: external_exports.string().optional().describe("Directory to write the video to (default: $GEMINI_OUTPUT_DIR or cwd)"),
+        output_dir: external_exports.string().optional().describe("Directory to write the video to (default: $GEMINI_OUTPUT_DIR or ~/Downloads/gemini-mcp)"),
         model: external_exports.string().regex(/^[\w.-]+$/, 'must be a bare model id (letters, digits, ".", "_", "-")').optional().describe(`Model id override (default: ${DEFAULT_VIDEO_MODEL})`),
         delivery: external_exports.enum(VIDEO_DELIVERY).optional().describe('How the clip comes back: "uri" (default \u2014 a Files API link the server downloads, no size ceiling) or "inline" (base64, capped ~4MB)'),
         background: external_exports.boolean().optional().describe("Run the generation on Google's side and poll it, so a killed job can be recovered by gemini_get_result. Trade-off: retrieving a backgrounded interaction is unreliable today (some become permanently unreadable), so the default is off"),
@@ -65055,7 +65618,7 @@ function registerMusicTools(server, client2) {
     "gemini_music_generate",
     {
       description: "Generate music from a text prompt (mood, genre, instruments, structure, or lyrics inline) via a Lyria model: lyria-3-clip-preview (30s instrumental clip, default, cheapest), lyria-3.5 (full-length song with vocals) or lyria-3-pro-preview (longer-form). Output is MP3, written to disk (or returned inline). Single-turn: a track cannot be refined by a follow-up call, so put the whole brief in the prompt. Runs long \u2014 give it a `max_wait_ms` budget (or `async: true` + gemini_get_result on a local install), or raise `timeout_ms`. Needs a funded account. " + confirmNote("Local file inputs are confirmed first"),
-      annotations: { readOnlyHint: false, openWorldHint: true },
+      annotations: { readOnlyHint: false, destructiveHint: true, openWorldHint: true },
       inputSchema: external_exports.object({
         prompt: external_exports.string().min(1).describe("Description of the music: mood, genre, instruments, tempo, structure, or lyrics"),
         model: external_exports.enum(MUSIC_MODELS).optional().describe(`Lyria model (default: ${DEFAULT_MUSIC_MODEL} \u2014 30s, $0.04). lyria-3.5 and lyria-3-pro-preview run minutes-long at $0.08.`),
@@ -65065,7 +65628,7 @@ function registerMusicTools(server, client2) {
         images_base64: imagesBase64Schema(),
         from_clipboard: external_exports.boolean().optional().describe("Use the image currently on the macOS clipboard as a reference"),
         filename: external_exports.string().optional().describe("Base filename for the output audio (extension stripped; default: slugified prompt)"),
-        output_dir: external_exports.string().optional().describe("Directory to write audio to (default: $GEMINI_OUTPUT_DIR or cwd)"),
+        output_dir: external_exports.string().optional().describe("Directory to write audio to (default: $GEMINI_OUTPUT_DIR or ~/Downloads/gemini-mcp)"),
         inline: external_exports.boolean().optional().describe("Return base64 audio inline instead of writing to disk. A 30s track is ~1.9MB of base64 \u2014 the default hands back a path instead"),
         background: external_exports.boolean().optional().describe("Run the generation on Google's side and poll it, so a killed job can be recovered by gemini_get_result. Off by default \u2014 see gemini_video_generate"),
         timeout_ms: timeoutMsSchema,
@@ -65137,10 +65700,10 @@ function registerJobTools(server, client2) {
       description: 'Retrieve a generation started with `async: true` or handed off by `max_wait_ms`. Pass the returned `job_id`: while running it reports status "running"; on completion it returns the normal result (image URLs/paths + meta); on failure it raises the recorded error, including the case where the generation was killed before it finished. On the hosted connector job records are stored durably and survive a restart; on a local stdio server they live with the process and expire ~10 min after completion, where the output dir / <image>.json sidecar is the fallback. A killed video/music job started with `background: true` is recovered from its upstream interaction when it finished there.',
       // NOT read-only any more: recovering a killed job writes the media it
       // pulls back, exactly as the generation tool would have.
-      annotations: { readOnlyHint: false, openWorldHint: true },
+      annotations: { readOnlyHint: false, destructiveHint: true, openWorldHint: true },
       inputSchema: external_exports.object({
         job_id: external_exports.string().min(1).describe("The job_id returned by a generation tool called with async: true"),
-        output_dir: external_exports.string().optional().describe("Where to write media recovered from a killed job (default: $GEMINI_OUTPUT_DIR or cwd)")
+        output_dir: external_exports.string().optional().describe("Where to write media recovered from a killed job (default: $GEMINI_OUTPUT_DIR or ~/Downloads/gemini-mcp)")
       })
     },
     async (args) => {
@@ -65215,7 +65778,7 @@ function registerUsageTools(server, client2) {
     "gemini_token_usage",
     {
       description: "Token usage for this session so far \u2014 what every generation has cost in tokens, added up. Call it before and after a workflow and subtract to get that workflow's cost; call it after a single generation for that call's. Reports tokens AND an estimated USD cost, priced per call against each call's own model and stamped with the date its rates were read (override with GEMINI_RATE_CARD). Note there is no account-balance endpoint to query \u2014 Google Cloud is post-paid and its billing data lags by hours \u2014 so this is the accurate way to attribute spend to a call.",
-      annotations: toolAnnotations({ readOnly: true }),
+      annotations: toolAnnotations({ readOnly: true, openWorld: false }),
       inputSchema: external_exports.object({
         reset: external_exports.boolean().optional().describe("Zero the running total after reporting it, so the next call measures from here. Use it to bracket a workflow without arithmetic.")
       })
@@ -65276,7 +65839,7 @@ function registerFileTools(server, client2) {
     "gemini_upload_file",
     {
       description: "Upload a file \u2014 an image, reference photo, picture, screenshot, video or audio clip \u2014 to the Gemini Files API ONCE, and get back a reusable `file_uri` (`files/<id>`) to attach to later image, video or music generations. Keywords: upload, upload file, upload image, upload photo, attach, reference image, reference photo, file_uri, files api, image reference, reuse across calls. Use this instead of pasting base64 into a tool call: the reference is a short string, so no image bytes ever enter the conversation, and it can be reused across many generations until it expires (~48h). Provide exactly one of `url` (the server downloads it), `data_base64`" + (onDisk ? ", or `path` (a local file)." : ", or `r2_key` (re-upload media this connector generated, from media[].r2_key in an earlier result).") + (onDisk ? " " + confirmNote("A local `path` is confirmed first") : " To upload a local file without base64: mint a signed PUT URL with gemini_get_upload_url, PUT the bytes to it, then pass the returned r2_key here."),
-      annotations: { readOnlyHint: false, openWorldHint: true },
+      annotations: { readOnlyHint: false, destructiveHint: false, openWorldHint: true },
       inputSchema: external_exports.object({
         url: external_exports.string().url().optional().describe(
           `Public https URL the SERVER downloads and uploads (image/video/audio, up to ${wholeMb(urlMaxBytes)}MB). No bytes pass through the conversation.` + (onDisk ? "" : " Larger files: PUT them to a gemini_get_upload_url link and pass the r2_key instead \u2014 that path does not buffer.")
@@ -65329,6 +65892,7 @@ function registerFileTools(server, client2) {
           body: { inputs },
           target: resolved,
           payload: { inputs, display_name: args.display_name },
+          args,
           confirmToken: args.confirmToken
         });
         if (gate) return gate;
@@ -65519,6 +66083,7 @@ function registerFileTools(server, client2) {
         path: `/v1beta/${args.file_uri}`,
         target: args.file_uri,
         payload: { file_uri: args.file_uri },
+        args,
         confirmToken: args.confirmToken
       });
       if (gate) return gate;
@@ -65605,7 +66170,7 @@ function registerLibraryTools(server, client2) {
     "gemini_save_character",
     {
       description: "Save a named character to this account's persistent reference library: one reference image plus a short description. Saved characters have NO expiry \u2014 unlike uploads (~retention window) and Files API references (~48h) \u2014 so a name saved once keeps working in every later session. Re-saving a name replaces it. " + USE_CHARACTERS_HINT,
-      annotations: { readOnlyHint: false, openWorldHint: false },
+      annotations: { readOnlyHint: false, destructiveHint: true, openWorldHint: true },
       inputSchema: external_exports.object({
         name: NAME_FIELD,
         description: external_exports.string().min(1).describe("Short prose description woven into generation prompts (age, look, defining features, species\u2026)"),
@@ -65670,6 +66235,7 @@ function registerLibraryTools(server, client2) {
         path: `characters/${args.name}`,
         target: args.name,
         payload: { name: args.name },
+        args,
         confirmToken: args.confirmToken
       });
       if (gate) return gate;
@@ -65684,7 +66250,7 @@ function registerLibraryTools(server, client2) {
     "gemini_save_style",
     {
       description: "Save a named style preset to this account's persistent reference library: a reusable prompt fragment (and optionally a reference image) that a single word then applies to any generation. No expiry; re-saving a name replaces it. " + USE_STYLE_HINT,
-      annotations: { readOnlyHint: false, openWorldHint: false },
+      annotations: { readOnlyHint: false, destructiveHint: true, openWorldHint: true },
       inputSchema: external_exports.object({
         name: NAME_FIELD,
         prompt_fragment: external_exports.string().min(1).describe('The style text appended to generation prompts, e.g. "bold cartoon style, thick outlines, saturated colors"'),
@@ -65749,6 +66315,7 @@ function registerLibraryTools(server, client2) {
         path: `styles/${args.name}`,
         target: args.name,
         payload: { name: args.name },
+        args,
         confirmToken: args.confirmToken
       });
       if (gate) return gate;