@chrischall/gemini-mcp 2.3.2 → 2.3.4

package/dist/client.js

@@ -12,12 +12,12 @@ import { SessionState } from './session.js';
 import { fetchRemoteImage, readCapped, MAX_REDIRECTS } from './fetch-image.js';
 import { bytesToBase64 } from './bytes.js';
 import { explainOutsideUploadDir, uploadRoots } from './images.js';
-// NOTE: this module must stay SIDE-EFFECT-FREE at module scope — no I/O, no
-// top-level await, no `import.meta.url`. `src/worker.ts` imports it, so every
-// line here runs during Cloudflare isolate startup, where global-scope I/O is
-// forbidden and wrangler's bundle leaves `import.meta.url` undefined. The
-// stdio `.env` bootstrap that used to live here now lives in `src/dotenv.ts`,
-// imported only by `src/index.ts`. Guarded by tests/connector-boot.test.ts.
+// NOTE: this module stays SIDE-EFFECT-FREE at module scope — no I/O, no
+// top-level await, no `import.meta.url` — so importing it (tests, registrars)
+// never boots anything. That rule dates from the retired Cloudflare Worker
+// entry point, where global-scope I/O was forbidden; it is kept because it is
+// what makes the module cheap to import. The stdio `.env` bootstrap lives in
+// `src/dotenv.ts`, imported only by `src/index.ts`.
 const BASE_URL = 'https://generativelanguage.googleapis.com/v1beta'; // v1 lacks gemini-3-pro-image; confirmed via Task 5
 const SERVICE = 'Gemini';
 const INTERACTIONS_SERVICE = 'Gemini Interactions';
@@ -44,6 +44,42 @@ export function resolveTimeoutMs(perCallMs, imageSize) {
 // upload", verified 2026-06-12). The resumable upload endpoint lives under
 // `/upload/v1beta`, NOT the normal `/v1beta` base.
 const UPLOAD_BASE_URL = 'https://generativelanguage.googleapis.com/upload/v1beta';
+/** True when `raw` is an https URL on googleapis.com (or a subdomain) — the
+ * only place a resumable-upload session URL may send the user's file. */
+function isGoogleUploadUrl(raw) {
+    let u;
+    try {
+        u = new URL(raw);
+    }
+    catch {
+        return false;
+    }
+    return u.protocol === 'https:' && (u.hostname === 'googleapis.com' || u.hostname.endsWith('.googleapis.com'));
+}
+/**
+ * Slowest sustained throughput a media transfer is allowed before it is
+ * treated as stalled. A transfer's deadline is the normal request budget plus
+ * the time its size takes at this rate, so a large file on a slow link still
+ * finishes while a connection that stops sending cannot hang the tool call
+ * forever (chrischall/fleet-audit#467) — the progress heartbeat around these
+ * calls actively stops the host from timing them out for us.
+ */
+const MIN_TRANSFER_BYTES_PER_SEC = 256 * 1024;
+/** Deadline for moving `bytes` up or down; see {@link MIN_TRANSFER_BYTES_PER_SEC}. */
+function transferTimeoutMs(bytes) {
+    return resolveTimeoutMs() + Math.ceil((bytes / MIN_TRANSFER_BYTES_PER_SEC) * 1000);
+}
+/**
+ * An abort signal that fires after `ms`. A plain timer rather than
+ * `AbortSignal.timeout` so it can be cleared once the transfer is done (no
+ * stray timer keeping a process alive) and driven by fake timers in tests.
+ */
+function transferDeadline(ms) {
+    const ctrl = new AbortController();
+    const timer = setTimeout(() => ctrl.abort(new DOMException(`timed out after ${ms}ms`, 'TimeoutError')), ms);
+    timer.unref?.();
+    return { signal: ctrl.signal, clear: () => clearTimeout(timer) };
+}
 // Documented Files API per-file cap (2 GB); enforced locally so a too-big video
 // fails fast instead of uploading gigabytes just to be rejected.
 const FILE_MAX_BYTES = 2 * 1024 ** 3;
@@ -201,10 +237,9 @@ export class GeminiClient {
     mediaSink;
     /**
      * This client's session memory — job registry, last-interaction id, written
-     * outputs. One client is one session: the hosted connector builds a client
-     * per authenticated user, so hanging the state here is what keeps it from
-     * leaking between tenants sharing an isolate (see src/session.ts). The stdio
-     * server is single-user, so its one singleton client is one session.
+     * outputs. One client is one session. Production builds one client per
+     * process and one process is one user, so this is process-wide — see the
+     * invariant (and what a multi-user host would need) in src/session.ts.
      */
     session = new SessionState();
     /** Per-account character/style library — hosted connector only (see options). */
@@ -359,8 +394,9 @@ export class GeminiClient {
      * These two upload calls are raw `fetchImpl` (not `createApiClient`): step 1
      * needs the response *header* and step 2 posts a binary body — neither fits
      * `fetchJson`. The poll DOES go through the shared client (timeout + retry).
-     * Uploads deliberately have no abort timeout: a multi-hundred-MB video can
-     * legitimately take longer than any fixed budget.
+     * The deadline scales with the file (see `transferTimeoutMs`): a
+     * multi-hundred-MB video can legitimately take longer than any fixed budget,
+     * but a stalled upload must still fail rather than hang.
      *
      * Returned files live ~48h (`expirationTime`); per-file cap is 2 GB
      * (enforced locally before any bytes are sent).
@@ -427,9 +463,11 @@ export class GeminiClient {
      * These two upload calls are raw `fetchImpl` (not `createApiClient`): step 1
      * needs the response *header* and step 2 posts a binary body — neither fits
      * `fetchJson`. The poll DOES go through the shared client (timeout + retry).
-     * Uploads carry no abort timeout by default: a multi-hundred-MB file can
-     * legitimately take longer than any fixed budget. A caller that is uploading
-     * OPPORTUNISTICALLY passes its own `signal` (see `uploadBytes`).
+     * By default the two round trips get a deadline sized to the file (see
+     * `transferTimeoutMs`) — a multi-hundred-MB file can legitimately take longer
+     * than any fixed budget, but a stalled one must fail rather than hang. A
+     * caller that is uploading OPPORTUNISTICALLY passes its own, shorter
+     * `signal` instead (see `uploadBytes`).
      */
     async uploadToFilesApi(body, mimeType, displayName, contentLength, 
     /** Bounds the two upload round trips. The PROCESSING poll below is left
@@ -437,6 +475,33 @@ export class GeminiClient {
      * video rather than for the images this is used to bound. */
     signal) {
         const key = this.requireKey();
+        // A caller that uploads opportunistically brings its own (short) signal.
+        // Everyone else gets a deadline sized to the file, so a stalled upload
+        // fails instead of hanging the tool call (chrischall/fleet-audit#467).
+        // The deadline covers the two upload round trips ONLY and is cleared
+        // before the PROCESSING poll: the poll has its own attempt cap, and a
+        // processing failure (or a slow transcode) reached after the deadline must
+        // keep its own error rather than be relabelled a stalled upload.
+        const deadline = signal ? undefined : transferDeadline(transferTimeoutMs(contentLength));
+        let uploaded;
+        try {
+            uploaded = await this.sendToFilesApi(body, mimeType, displayName, contentLength, key, signal ?? deadline.signal);
+        }
+        catch (err) {
+            if (deadline?.signal.aborted) {
+                throw new McpToolError(`${SERVICE} Files API upload of ${displayName} timed out after ${transferTimeoutMs(contentLength)}ms`, {
+                    hint: 'The upload stalled. Retry, or check the network between this server and generativelanguage.googleapis.com.',
+                });
+            }
+            throw err;
+        }
+        finally {
+            deadline?.clear();
+        }
+        return this.awaitFileActive(uploaded.name, uploaded.file, mimeType);
+    }
+    /** {@link uploadToFilesApi}'s steps 1 and 2 (start + upload/finalize), under `signal`. */
+    async sendToFilesApi(body, mimeType, displayName, contentLength, key, signal) {
         // Local alias so the calls below carry NO receiver: `this.fetchImpl(...)`
         // would hand native fetch this GeminiClient as `this`, which workerd
         // rejects with an Illegal invocation (see the constructor note).
@@ -454,7 +519,7 @@ export class GeminiClient {
                 'Content-Type': 'application/json',
             },
             body: JSON.stringify({ file: { display_name: displayName } }),
-            ...(signal ? { signal } : {}),
+            signal,
         });
         if (!startRes.ok) {
             throw new McpToolError(formatApiError(startRes.status, 'POST', `/upload/v1beta${startPath}`, await startRes.text(), { service: SERVICE }));
@@ -465,6 +530,14 @@ export class GeminiClient {
                 hint: 'The Files API resumable-upload contract may have changed — see docs/GEMINI-API.md.',
             });
         }
+        // The session URL is the destination of the user's file bytes, and it
+        // comes from a response header — so it must be a Google upload host over
+        // https before anything is posted to it (chrischall/fleet-audit#1011).
+        if (!isGoogleUploadUrl(uploadUrl)) {
+            throw new McpToolError(`${SERVICE} upload start returned a session URL outside googleapis.com; refusing to send the file`, {
+                hint: 'The Files API resumable-upload contract may have changed — see docs/GEMINI-API.md.',
+            });
+        }
         // 2. upload + finalize — single shot; the session URL is self-authorizing
         // (no api-key header needed; verified live).
         // The Blob body is left EXACTLY as the live-verified video upload sent it:
@@ -479,7 +552,7 @@ export class GeminiClient {
                 'X-Goog-Upload-Command': 'upload, finalize',
             },
             body: body,
-            ...(signal ? { signal } : {}),
+            signal,
         });
         if (!upRes.ok) {
             throw new McpToolError(formatApiError(upRes.status, 'POST', '/upload/v1beta/files (finalize)', await upRes.text(), { service: SERVICE }));
@@ -492,6 +565,10 @@ export class GeminiClient {
         if (!/^files\/[\w-]+$/.test(name)) {
             throw new McpToolError(`${SERVICE} upload returned an unexpected file name: ${name || '(none)'}`);
         }
+        return { name, file };
+    }
+    /** {@link uploadToFilesApi}'s step 3: wait out PROCESSING. Outside the upload deadline. */
+    async awaitFileActive(name, file, mimeType) {
         // 3. poll PROCESSING → ACTIVE. Images are normally ACTIVE on arrival; it is
         // video that spends time here.
         for (let attempt = 0; file.state === 'PROCESSING'; attempt++) {
@@ -1015,31 +1092,50 @@ export class GeminiClient {
             // fetch-image.ts enforces, and stricter: there is exactly one host
             // generated media is ever served from.
             const url = assertMediaHost(current, requested);
-            const res = await doFetch(url.toString(), {
-                redirect: 'manual',
-                headers: { 'x-goog-api-key': key },
-            });
-            if (res.status >= 300 && res.status < 400) {
-                const location = res.headers?.get('location');
-                if (!location) {
-                    throw new McpToolError(`${SERVICE} media download returned HTTP ${res.status} with no Location header for ${current}`);
+            // One deadline per hop, covering the body as well as the headers: a
+            // server that answers and then stops sending would otherwise hang the
+            // tool call forever (chrischall/fleet-audit#467).
+            const budgetMs = transferTimeoutMs(MEDIA_DOWNLOAD_MAX_BYTES);
+            const deadline = transferDeadline(budgetMs);
+            try {
+                const res = await doFetch(url.toString(), {
+                    redirect: 'manual',
+                    headers: { 'x-goog-api-key': key },
+                    signal: deadline.signal,
+                });
+                if (res.status >= 300 && res.status < 400) {
+                    const location = res.headers?.get('location');
+                    if (!location) {
+                        throw new McpToolError(`${SERVICE} media download returned HTTP ${res.status} with no Location header for ${current}`);
+                    }
+                    if (hop >= MAX_REDIRECTS) {
+                        throw new McpToolError(`${SERVICE} media download for ${requested} exceeded ${MAX_REDIRECTS} redirects (last hop: ${location}).`);
+                    }
+                    current = new URL(location, url).toString();
+                    continue;
                 }
-                if (hop >= MAX_REDIRECTS) {
-                    throw new McpToolError(`${SERVICE} media download for ${requested} exceeded ${MAX_REDIRECTS} redirects (last hop: ${location}).`);
+                if (!res.ok) {
+                    throw new McpToolError(`${SERVICE} media download failed (HTTP ${res.status}) for ${current}`, { hint: 'Generated files live in the Files API for ~48h and the download requires the api key that created them.' });
                 }
-                current = new URL(location, url).toString();
-                continue;
+                // Capped while streaming rather than buffered whole: a generated clip is
+                // small, but `arrayBuffer()` on a surprise is an unbounded allocation.
+                const bytes = await readCapped(res, MEDIA_DOWNLOAD_MAX_BYTES, current, requested, MEDIA_CAP_SUBJECT);
+                return {
+                    base64: bytesToBase64(bytes),
+                    mimeType: media.mimeType || res.headers?.get('content-type') || 'application/octet-stream',
+                };
             }
-            if (!res.ok) {
-                throw new McpToolError(`${SERVICE} media download failed (HTTP ${res.status}) for ${current}`, { hint: 'Generated files live in the Files API for ~48h and the download requires the api key that created them.' });
+            catch (err) {
+                if (deadline.signal.aborted && !(err instanceof McpToolError)) {
+                    throw new McpToolError(`${SERVICE} media download timed out after ${budgetMs}ms for ${current}`, {
+                        hint: 'The download stalled. Recover the result with gemini_get_result, or retry.',
+                    });
+                }
+                throw err;
+            }
+            finally {
+                deadline.clear();
             }
-            // Capped while streaming rather than buffered whole: a generated clip is
-            // small, but `arrayBuffer()` on a surprise is an unbounded allocation.
-            const bytes = await readCapped(res, MEDIA_DOWNLOAD_MAX_BYTES, current, requested, MEDIA_CAP_SUBJECT);
-            return {
-                base64: bytesToBase64(bytes),
-                mimeType: media.mimeType || res.headers?.get('content-type') || 'application/octet-stream',
-            };
         }
     }
     /** {@link downloadMedia} over a list, preserving order. */
@@ -1185,7 +1281,18 @@ export function hostedStorage(blob = blobStoreFromEnv()) {
     // pinned in the store on first use — derived from the current key so the
     // data already there stays reachable — and never re-derived after that.
     // Lazy because the key is read at request time (deferred-config-error).
-    const tenant = pinnedTenant(blob.bucket, () => tenantIdFor(readEnvVar('GEMINI_API_KEY') ?? 'local'));
+    // With no key configured yet the tenant is provisional: used for that call
+    // but never pinned, or the permanent pin would lock the namespace to
+    // sha('local') and orphan the key's data (chrischall/fleet-audit#1009).
+    // Accepted boundary: the library and media sink memoise their tenant per
+    // process (`tenantResolver`), so a process that starts keyless and has its
+    // key set later WITHOUT a restart keeps using the provisional 'local'
+    // namespace until it restarts. Nothing is pinned, so the restart recovers;
+    // mcp-host sets env at spawn, so a key never arrives mid-process there.
+    const tenant = pinnedTenant(blob.bucket, async () => {
+        const key = readEnvVar('GEMINI_API_KEY');
+        return key ? tenantIdFor(key) : { tenant: await tenantIdFor('local'), pin: false };
+    });
     return {
         mediaSink: createR2Sink(blob.bucket, {
             // The SAME `links` object the minter gets below. Media GETs and upload

package/dist/dotenv.js

@@ -5,14 +5,13 @@ import { loadDotenvSafely } from '@chrischall/mcp-utils';
  * The stdio server's `.env` bootstrap. **Imported only by `src/index.ts`.**
  *
  * This used to run at module scope in `src/client.ts`, which put it in the
- * hosted connector's import graph (`src/worker.ts` → `./client.js`) and so ran
- * it during Worker isolate startup. Two things go wrong there:
+ * import graph of the (since retired) Cloudflare Worker connector and so ran
+ * it during Worker isolate startup. Two things went wrong there:
  *
  * 1. wrangler's bundle leaves `import.meta.url` undefined, so
  *    `fileURLToPath(import.meta.url)` threw and the isolate never booted —
  *    `The Workers runtime failed to start`. Not a test failure: a deploy
- *    failure, invisible to the workers-pool suite (see
- *    `tests/connector-boot.test.ts` for why).
+ *    failure, invisible to the workers-pool suite.
  * 2. Even had it resolved, it is async I/O at global scope, which Workers
  *    forbids — and there is no `.env` on a Worker regardless. Config arrives
  *    through bindings.

package/dist/fetch-image.js

@@ -23,9 +23,8 @@ import { formatMb } from './bytes.js';
  *  - **A hard byte cap enforced while streaming**, not from `Content-Length` —
  *    a hostile or merely wrong server can under-report or omit it.
  *
- * Module scope stays side-effect-free: `src/worker.ts` reaches this file
- * through the tool registrars, so anything executed here would run during
- * Cloudflare isolate startup.
+ * Module scope stays side-effect-free (the same rule as client.ts): the tool
+ * registrars import this file, and importing must never do work.
  */
 /** Hard ceiling on a fetched image. Above this the URL is rejected outright. */
 export const IMAGE_URL_MAX_BYTES = 15 * 1024 * 1024;
@@ -192,7 +191,10 @@ function assertPublicHttpsUrl(raw, requested) {
     // that this is a literal and not a name.
     const rawHost = url.hostname.toLowerCase();
     const isIpv6Literal = rawHost.startsWith('[') && rawHost.endsWith(']');
-    const host = isIpv6Literal ? rawHost.slice(1, -1) : rawHost;
+    // A name may carry a trailing dot (the fully-qualified spelling): WHATWG URL
+    // keeps it, and `localhost.` still resolves to loopback, so the suffix
+    // checks below must see the name without it (chrischall/fleet-audit#472).
+    const host = isIpv6Literal ? rawHost.slice(1, -1) : rawHost.replace(/\.+$/, '');
     const v4 = isIpv6Literal ? undefined : ipv4Octets(host);
     const v6 = isIpv6Literal ? ipv6Groups(host) : undefined;
     const blocked = isIpv6Literal
@@ -202,6 +204,10 @@ function assertPublicHttpsUrl(raw, requested) {
         : host === 'localhost' ||
             host.endsWith('.localhost') ||
             host.endsWith('.local') ||
+            // Private-network names: Fly's 6PN (`<app>.internal`, where the hosted
+            // build runs) and GCP's metadata server (`metadata.google.internal`).
+            host === 'internal' ||
+            host.endsWith('.internal') ||
             (v4 ? isPrivateIpv4(v4) : false);
     if (blocked) {
         throw new McpToolError(`Refusing to fetch ${describeUrl(raw, requested)}: "${url.hostname}" is a private, loopback or link-local address, not a public host.`, { hint: 'images_url is fetched by the server, so it must point at a publicly reachable https:// image.' });

package/dist/images.js

@@ -1,5 +1,6 @@
 import { readFile, stat } from 'node:fs/promises';
 import { existsSync } from 'node:fs';
+import { homedir } from 'node:os';
 import { delimiter, join, resolve, isAbsolute } from 'node:path';
 import { assertPathWithinRoots, expandPath, fileBlob, readEnvVar, McpToolError, readFileHead, resolveOutputDir as resolveSharedOutputDir, sniffMimeBytes as sniffSharedMime, writeFileSafe, writeUniqueFile, } from '@chrischall/mcp-utils';
 /**
@@ -388,6 +389,12 @@ export function baseName(name) {
         .replace(/^-+|-+$/g, '');
     return safe || 'image';
 }
+/** The `~/Downloads/<name>` segment mcp-utils' `resolveOutputDir` defaults to. */
+const OUTPUT_DIR_NAME = 'gemini-mcp';
+/** Where output goes when neither a per-call dir nor GEMINI_OUTPUT_DIR is set. */
+function defaultOutputDir() {
+    return join(homedir(), 'Downloads', OUTPUT_DIR_NAME);
+}
 /**
  * The output directory to LOOK IN (sidecar lookups: `continue_last`'s disk
  * fallback, the chain-404 re-anchor) — the same resolution and the same
@@ -400,17 +407,19 @@ export function lookupOutputDir(perCall) {
     const configured = readEnvVar('GEMINI_OUTPUT_DIR');
     const raw = trimmed ?? configured;
     if (!raw)
-        return process.cwd();
+        return defaultOutputDir();
     const dir = expandPath(raw);
     if (trimmed && configured)
         assertPathWithinRoots(dir, [configured]);
     return dir;
 }
 /**
- * per-call → $GEMINI_OUTPUT_DIR → cwd (mcp-utils `resolveOutputDir`: `~` and
- * relative paths expanded, the directory created; a per-call dir confined to
- * GEMINI_OUTPUT_DIR when that is set). A blank per-call value
- * counts as unset, so it falls through to the env var rather than to cwd.
+ * per-call → $GEMINI_OUTPUT_DIR → ~/Downloads/gemini-mcp (mcp-utils
+ * `resolveOutputDir`: `~` and relative paths expanded, the directory created;
+ * a per-call dir confined to GEMINI_OUTPUT_DIR when that is set). Never the
+ * cwd — that is `/` under Claude Desktop and the user's repo under Claude
+ * Code. A blank per-call value counts as unset, so it falls through to the
+ * env var rather than to the default.
  */
 export function resolveOutputDir(perCall) {
     // output_dir is model-chosen: once the operator sets GEMINI_OUTPUT_DIR, a
@@ -418,6 +427,7 @@ export function resolveOutputDir(perCall) {
     // keeps the old, unconfined behaviour (the fleet pattern, as in splitwise-mcp).
     const configured = readEnvVar('GEMINI_OUTPUT_DIR');
     return resolveSharedOutputDir(perCall?.trim() || undefined, 'GEMINI_OUTPUT_DIR', {
+        name: OUTPUT_DIR_NAME,
         ...(configured ? { allowedRoots: [configured] } : {}),
     });
 }

package/dist/index.js

@@ -13,13 +13,15 @@ import { client } from './client.js';
 // singleton is constructed (by the import above) before this line runs.
 await loadStdioDotenv();
 // The registrars take their GeminiClient as an argument (they import only the
-// *type*), so a non-stdio entry point can build one client per authenticated
-// user. This stdio entry point threads the env-driven module-level singleton
-// through runMcp's `deps`, which passes it as each registrar's second argument.
+// *type*), so a future multi-user entry point COULD build one client per user.
+// None does: this is the only entry point (mcp-host runs it as a per-registration
+// child), and it threads the env-driven module-level singleton through runMcp's
+// `deps` to every connection — sound because one registration is one user (see
+// src/session.ts).
 // That singleton defers its config error to the first request — so the server
 // boots and answers the host's install-time tools/list probe even without
 // GEMINI_API_KEY. It also owns this process's session state (job registry,
-// last-interaction memory); stdio is single-user, so one client is one session.
+// last-interaction memory); one process is one user, so one client is one session.
 //
 // The roster itself lives in registrars.ts: this file cannot be imported
 // without booting a server, and a list nothing can import is a list nothing

package/dist/inputs.js

@@ -14,7 +14,7 @@ export function hasImageInput(args) {
  * How long the opportunistic base64 upload gets before it is abandoned.
  *
  * The promotion adds two round trips in front of a generation nobody asked to
- * wait for, and `uploadToFilesApi` is otherwise untimed. Past this the call
+ * wait for, and `uploadToFilesApi`'s own deadline is sized for big files. Past this the call
  * proceeds inline: slower to repeat, but not stalled.
  */
 const BASE64_UPLOAD_TIMEOUT_MS = 30_000;

package/dist/library.js

@@ -17,8 +17,8 @@
  *
  * Two properties are load-bearing:
  *
- *  - **No expiry.** The retention cron sweeps `gen/`, `media/` and `up/` but
- *    deliberately never `lib/` (media-cleanup.ts) — a saved character outlives
+ *  - **No expiry.** The host's retention prune reclaims `gen/` and `up/` but
+ *    never `lib/` (see blob-store.ts) — a saved character outlives
  *    every signed URL and every upload. That is why saving COPIES the image
  *    bytes into `lib/` rather than storing an `r2_key` pointer: a pointer into
  *    `gen/` or `up/` would dangle after the next sweep.
@@ -40,6 +40,8 @@ export const LIBRARY_NAME_PATTERN = /^[a-z0-9][a-z0-9_-]{0,39}$/;
 export function isValidLibraryName(name) {
     return LIBRARY_NAME_PATTERN.test(name);
 }
+/** Pages one library listing will walk: 20 x 1000 keys, far past any real library. */
+const LIBRARY_MAX_LIST_PAGES = 20;
 /** Build the R2-backed library for one session. */
 export function createR2Library(bucket, opts) {
     const now = opts.now ?? (() => new Date());
@@ -77,10 +79,13 @@ export function createR2Library(bucket, opts) {
         const prefix = `${LIBRARY_KEY_PREFIX}/${await tenantId()}/${kind}/`;
         const keys = [];
         let cursor;
-        for (;;) {
+        // Bounded, like the media walk in storage/media.ts: a store that reports
+        // `truncated` with no cursor would otherwise re-list page one forever
+        // (chrischall/fleet-audit#468), and a listing is unbounded work on a tool call.
+        for (let n = 0; n < LIBRARY_MAX_LIST_PAGES; n++) {
             const page = await bucket.list({ prefix, cursor, limit: 1000 });
             keys.push(...page.objects.map((o) => o.key).filter((k) => k.endsWith('.json')));
-            if (!page.truncated)
+            if (!page.truncated || !page.cursor)
                 break;
             cursor = page.cursor;
         }

package/dist/session.js

@@ -5,20 +5,25 @@ import { estimateCost } from './pricing.js';
  * Everything the server remembers *between tool calls on behalf of one user*.
  *
  * All of this used to be module-level (`jobs`/`byKey`/`runningByFingerprint` in
- * jobs.ts, `lastInteractionId`/`writtenOutputs` in tools/interact.ts). That is
- * correct for stdio, where a process serves exactly one user — and a
- * cross-tenant leak on the hosted connector, where ONE child process serves
- * every session of this registration at once (mcp-host runs the stdio server as
- * a supervised child). Module state there is shared by
- * every authenticated claude.ai session on that child: the per-session
- * `GeminiClient` isolated the API key but not the memory around it, so a
- * colliding `idempotency_key` replayed another user's result, an identical
- * prompt attached to another user's in-flight (billable) job, and
- * `continue_last: true` resumed another user's interaction under your key.
+ * jobs.ts, `lastInteractionId`/`writtenOutputs` in tools/interact.ts). That was
+ * a cross-tenant leak on the retired Cloudflare Worker connector, which served
+ * many users from one isolate: a colliding `idempotency_key` replayed another
+ * user's result, an identical prompt attached to another user's in-flight
+ * (billable) job, and `continue_last: true` resumed another user's interaction.
  *
- * So session memory hangs off the `GeminiClient` — the one object the connector
- * already builds per authenticated session and
- * threads into every registrar. Handlers reach it as `client.session`.
+ * So session memory hangs off the `GeminiClient` and is threaded into every
+ * registrar; handlers reach it as `client.session`.
+ *
+ * **The invariant production relies on today: one registration is one user.**
+ * Both entry points — stdio, and mcp-host, which runs this same stdio server as
+ * a supervised child per registration — build exactly ONE `GeminiClient` (the
+ * module-level `client` in client.ts, handed to every connection by `runMcp`
+ * in index.ts), so there is one process-wide `SessionState`, shared by every
+ * connection to that process. That is safe only because every one of those
+ * connections is the same user. If a host ever multiplexes several users onto
+ * one process, this is NOT enough on its own: it must also build a client per
+ * user (tests/session-isolation.test.ts shows that separate clients do not
+ * share state; nothing in production builds more than one today).
  *
  * The rule this encodes: **`src/` must hold no module-level mutable state.**
  * If you need to remember something across calls, put it here.
@@ -92,8 +97,9 @@ export class SessionState {
      * Accumulated in the CLIENT rather than in the tools, so a call that was
      * billed and then failed (a safety filter returning no image, say) still
      * counts — it cost money regardless of whether a tool could use the result.
-     * Per session, never module scope: one hosted process serves many tenants,
-     * and a shared total would report other people's spend as yours.
+     * On the session, never module scope: a module-level total would report
+     * other users' spend as yours on any host that served several users from one
+     * process (see the invariant above).
      */
     usageTotal;
     /** How many upstream calls contributed to {@link usageTotal}. */

package/dist/sidecar.js

@@ -13,10 +13,24 @@
  *    sidecar for that id names the image file to re-attach, which is exactly
  *    the manual recovery the old error message asked the caller to perform.
  */
-import { readdir, readFile, stat } from 'node:fs/promises';
-import { existsSync } from 'node:fs';
-import { join } from 'node:path';
+import { readdir, readFile, stat, lstat } from 'node:fs/promises';
+import { join, resolve } from 'node:path';
 const SIDECAR_SUFFIX = '.json';
+/**
+ * `writeSidecar` always names the sidecar after its output: `<file>.<ext>.json`.
+ * Any other `.json` in the directory — the output dir can be any
+ * operator- or model-chosen directory, such as a cloned repo — is not ours and is never read (chrischall/fleet-audit#473).
+ */
+const SIDECAR_NAME = /^.+\.[A-Za-z0-9]+\.json$/;
+/** True for a regular file (NOT a symlink — the server never writes through one). */
+async function isRegularFile(path) {
+    try {
+        return (await lstat(path)).isFile();
+    }
+    catch {
+        return false;
+    }
+}
 /**
  * All parseable sidecars in `dir`, newest first. Never throws: a missing dir,
  * an unreadable file, malformed JSON, or a record with no `interaction_id` is
@@ -31,10 +45,15 @@ export async function readSidecars(dir) {
     catch {
         return [];
     }
+    // The outputs this directory has sidecars for. A recorded image path is
+    // only trusted when it is one of these: an output file this server wrote,
+    // sitting in this directory beside its own sidecar. That is what keeps a
+    // planted sidecar from naming an arbitrary local file for the chain
+    // re-anchor to read and send upstream without the confirm gate.
+    const sidecarNames = entries.filter((e) => SIDECAR_NAME.test(e));
+    const outputs = new Set(sidecarNames.map((e) => resolve(dir, e.slice(0, -SIDECAR_SUFFIX.length))));
     const records = [];
-    for (const entry of entries) {
-        if (!entry.endsWith(SIDECAR_SUFFIX))
-            continue;
+    for (const entry of sidecarNames) {
         const sidecarPath = join(dir, entry);
         try {
             const parsed = JSON.parse(await readFile(sidecarPath, 'utf8'));
@@ -44,10 +63,15 @@ export async function readSidecars(dir) {
             if (typeof interactionId !== 'string' || !interactionId)
                 continue;
             const paths = Array.isArray(images) ? images.filter((p) => typeof p === 'string') : [];
+            const kept = [];
+            for (const p of paths) {
+                if (outputs.has(resolve(p)) && (await isRegularFile(p)))
+                    kept.push(p);
+            }
             records.push({
                 sidecarPath,
                 interactionId,
-                images: paths.filter((p) => existsSync(p)),
+                images: kept,
                 mtimeMs: (await stat(sidecarPath)).mtimeMs,
             });
         }

package/dist/tenant.js

@@ -32,21 +32,16 @@ async function readPin(bucket) {
         return undefined;
     }
 }
-/**
- * A memoised tenant resolver for the hosted stores.
- *
- * Only a fully successful resolution is cached: a failed read rejects and is
- * retried on the next call, and a failed pin WRITE still returns the derived
- * tenant (so a transient blob hiccup does not fail the tool call) but leaves
- * the pin to be written next time.
- */
 export function pinnedTenant(bucket, derive) {
     let cached;
     async function resolve() {
         const pinned = await readPin(bucket);
         if (pinned)
             return { tenant: pinned, pinned: true };
-        const tenant = await derive();
+        const derived = await derive();
+        if (typeof derived !== 'string')
+            return { tenant: derived.tenant, pinned: false };
+        const tenant = derived;
         try {
             await bucket.put(TENANT_PIN_KEY, JSON.stringify({ tenant }), {
                 httpMetadata: { contentType: 'application/json' },

package/dist/tools/_confirm.js

@@ -27,10 +27,18 @@ export async function confirmWrite(ctx, o) {
         message: o.message,
         details: preview,
         tool: o.tool,
+        // One API key per process (a hosted deployment runs one child per
+        // account), so there is no in-process principal to bind.
+        account: undefined,
+        args: withoutConfirmToken(o.args),
         confirmToken: o.confirmToken,
         subject: () => ({ target: o.target, payload: o.payload, preview }),
     }));
 }
+function withoutConfirmToken(args) {
+    const { confirmToken: _omit, ...rest } = args;
+    return rest;
+}
 /**
  * Confirm-gate for a Gemini tool that ships LOCAL input files (image/video
  * paths) to Google. Proceeds straight away when the call has no local file
@@ -58,6 +66,7 @@ export async function confirmLocalInputs(ctx, o) {
         body: { inputs },
         target: '',
         payload: { request: o.request, inputs },
+        args: o.request,
         confirmToken: o.confirmToken,
     });
 }