@chrischall/gemini-mcp 2.3.4 → 2.4.1

package/dist/client.js

@@ -227,6 +227,8 @@ export class GeminiClient {
     explicitApiKey;
     apis = new Map();
     fetchImpl;
+    /** The fetch the caller injected (tests), if any — see fetchRemoteImage. */
+    injectedFetch;
     sleep;
     /**
      * The media destination for every tool this client is handed to. Public and
@@ -274,6 +276,7 @@ export class GeminiClient {
         // also why call sites must alias it to a local before calling (see
         // uploadToFilesApi). Guarded by tests/tools/hosted-reference-forms.test.ts.
         this.fetchImpl = opts.fetchImpl ?? ((...args) => fetch(...args));
+        this.injectedFetch = opts.fetchImpl;
         this.sleep = opts.sleep ?? ((ms) => new Promise((r) => setTimeout(r, ms)));
     }
     /**
@@ -346,14 +349,20 @@ export class GeminiClient {
     }
     /**
      * Fetch one `images_url` reference server-side. Routed through the client so
-     * it uses the SAME injected `fetchImpl` as every upstream call — which is
-     * what makes it mockable in tests and correct on the Worker.
+     * tests that inject a `fetchImpl` mock this call too. Without an injected
+     * fetch it is NOT the client's default fetch: fetch-image.ts pins the
+     * connection to public addresses itself (mcp-utils netguard,
+     * fleet-audit#1252), which the plain global fetch cannot do.
      */
     async fetchRemoteImage(url, opts = {}) {
         // Same timeout resolution as every other upstream call (per-call
         // `timeout_ms` → $GEMINI_TIMEOUT_MS → 60s), so a URL fetch cannot be the
         // one unbounded network operation in the server.
-        return fetchRemoteImage(url, { ...opts, fetchImpl: this.fetchImpl, timeoutMs: resolveTimeoutMs(opts.timeoutMs) });
+        return fetchRemoteImage(url, {
+            ...opts,
+            ...(this.injectedFetch ? { fetchImpl: this.injectedFetch } : {}),
+            timeoutMs: resolveTimeoutMs(opts.timeoutMs),
+        });
     }
     /**
      * Read back media this connector generated, straight out of its own store.

package/dist/fetch-image.js

@@ -1,4 +1,6 @@
-import { McpToolError } from '@chrischall/mcp-utils';
+import { McpToolError, readEnvVar } from '@chrischall/mcp-utils';
+import { createPublicOnlyDispatcher, isPublicAddress } from '@chrischall/mcp-utils/netguard';
+import { fetch as undiciFetch } from 'undici';
 import { formatMb } from './bytes.js';
 /**
  * Server-side fetching of `images_url` references.
@@ -16,7 +18,16 @@ import { formatMb } from './bytes.js';
  *
  *  - **https only.** `http:`, `file:`, `data:`, `gopher:` and friends are out.
  *  - **No private/loopback/link-local destinations** — including the cloud
- *    metadata address, the classic escalation target.
+ *    metadata address, the classic escalation target. Literals and private
+ *    names are refused up front (mcp-utils netguard `isPublicAddress`, the
+ *    fleet's one address table), and on a local install every connection goes
+ *    through netguard's public-only dispatcher, which resolves the name itself
+ *    and pins the socket to the addresses it vetted — so a public name that
+ *    resolves or REBINDS to a private address is refused at connect
+ *    (fleet-audit#1252). Behind an egress proxy (`HTTPS_PROXY`, which mcp-host
+ *    sets for its children) the global fetch is used instead: the child cannot
+ *    resolve names there at all, and the proxy resolves and applies the same
+ *    public-only table itself.
  *  - **Redirects are followed MANUALLY**, revalidating every hop. `redirect:
  *    'follow'` would let a public URL bounce to `http://169.254.169.254/` with
  *    no further check, which makes the origin check theatre.
@@ -43,134 +54,12 @@ export const MAX_REDIRECTS = 5;
  * override it with the same `timeout_ms` resolution (see `resolveTimeoutMs`).
  */
 const DEFAULT_FETCH_TIMEOUT_MS = 60_000;
-/** Parse an IPv4 literal into its four octets, or `undefined` if it isn't one. */
-function ipv4Octets(host) {
-    const parts = host.split('.');
-    if (parts.length !== 4)
-        return undefined;
-    const octets = parts.map((p) => (/^\d{1,3}$/.test(p) ? Number(p) : NaN));
-    return octets.every((n) => Number.isInteger(n) && n >= 0 && n <= 255) ? octets : undefined;
-}
-/** True for addresses that are not on the public internet. */
-function isPrivateIpv4([a, b]) {
-    if (a === 0 || a === 127)
-        return true; // this-host / loopback
-    if (a === 10)
-        return true; // RFC1918
-    if (a === 172 && b >= 16 && b <= 31)
-        return true; // RFC1918
-    if (a === 192 && b === 168)
-        return true; // RFC1918
-    if (a === 169 && b === 254)
-        return true; // link-local — includes 169.254.169.254
-    if (a === 100 && b >= 64 && b <= 127)
-        return true; // CGNAT
-    if (a === 192 && b === 0)
-        return true; // IETF protocol assignments
-    if (a === 198 && (b === 18 || b === 19))
-        return true; // benchmarking
-    if (a >= 224)
-        return true; // multicast + reserved
-    return false;
-}
-/**
- * Expand an IPv6 literal into its eight 16-bit groups, or `undefined` if it
- * isn't one. Handles `::` compression and a trailing dotted-quad
- * (`::ffff:127.0.0.1`) — the latter never comes out of `new URL`, which
- * re-serializes it as hex, but a redirect `Location` is parsed before
- * normalization and a human writes it that way.
- */
-function ipv6Groups(host) {
-    if (!host.includes(':'))
-        return undefined;
-    let text = host;
-    const tail = [];
-    // A trailing dotted-quad occupies the last two groups.
-    const dotted = /:((?:\d{1,3}\.){3}\d{1,3})$/.exec(text);
-    if (dotted) {
-        const octets = ipv4Octets(dotted[1]);
-        if (!octets)
-            return undefined;
-        tail.push((octets[0] << 8) | octets[1], (octets[2] << 8) | octets[3]);
-        text = text.slice(0, dotted.index);
-    }
-    const halves = text.split('::');
-    if (halves.length > 2)
-        return undefined;
-    const parse = (part) => {
-        if (part === '')
-            return [];
-        const out = [];
-        for (const piece of part.split(':')) {
-            if (!/^[0-9a-f]{1,4}$/.test(piece))
-                return undefined;
-            out.push(parseInt(piece, 16));
-        }
-        return out;
-    };
-    const head = parse(halves[0]);
-    const rest = halves.length === 2 ? parse(halves[1]) : [];
-    if (!head || !rest)
-        return undefined;
-    const explicit = [...head, ...rest, ...tail];
-    if (halves.length === 2) {
-        if (explicit.length > 7)
-            return undefined;
-        return [...head, ...Array(8 - explicit.length).fill(0), ...rest, ...tail];
-    }
-    return explicit.length === 8 ? explicit : undefined;
-}
-/**
- * The /96 prefixes that carry an IPv4 address in their final 32 bits, as the
- * first six groups. A literal matching any of them is judged on the v4 address
- * it embeds, not on the prefix.
- *
- * `::ffff:0:0/96` is the one that matters operationally — stacks really do
- * resolve `[::ffff:7f00:1]` to loopback, and `new URL` normalizes
- * `[::ffff:127.0.0.1]` into exactly that hex spelling, which is how a guard
- * that pattern-matched the dotted form came to never fire.
- *
- * The rest are defense in depth: `::/96` is deprecated IPv4-compatible,
- * `::ffff:0:0:0/96` is deprecated SIIT (RFC 2765), and `64:ff9b::/96` is the
- * NAT64 well-known prefix (RFC 6052), which needs a translator on the network
- * to route at all — and whose §3.1 already forbids embedding non-global v4.
- * They are listed anyway because a function that understands one v4-carrying
- * prefix and not its siblings is precisely the shape the original bypass had.
- */
-const V4_BEARING_PREFIXES = [
-    [0, 0, 0, 0, 0, 0xffff], // ::ffff:0:0/96   — IPv4-mapped
-    [0, 0, 0, 0, 0, 0], //      ::/96           — IPv4-compatible (deprecated)
-    [0, 0, 0, 0, 0xffff, 0], // ::ffff:0:0:0/96 — IPv4-translated (deprecated SIIT)
-    [0x64, 0xff9b, 0, 0, 0, 0], // 64:ff9b::/96 — NAT64 well-known (RFC 6052)
-];
-/**
- * True for IPv6 addresses that are not on the public internet.
- *
- * Anything carrying an IPv4 address (see {@link V4_BEARING_PREFIXES}) is
- * decided by running that address through the same {@link isPrivateIpv4} table
- * as a bare v4 literal — so the two guards can never disagree about whether
- * 10.0.0.5 is private.
- */
-function isPrivateIpv6(groups) {
-    if (groups.every((g) => g === 0))
-        return true; // ::
-    if (groups.slice(0, 7).every((g) => g === 0) && groups[7] === 1)
-        return true; // ::1
-    if ((groups[0] & 0xffc0) === 0xfe80)
-        return true; // fe80::/10 link-local
-    if ((groups[0] & 0xfe00) === 0xfc00)
-        return true; // fc00::/7 unique-local
-    if (V4_BEARING_PREFIXES.some((prefix) => prefix.every((g, i) => groups[i] === g))) {
-        return isPrivateIpv4([groups[6] >> 8, groups[6] & 0xff, groups[7] >> 8, groups[7] & 0xff]);
-    }
-    return false;
-}
 /**
- * Reject a URL that isn't a plain public https endpoint. Hostname-based, so it
- * cannot catch a public name that RESOLVES to a private address (DNS rebinding)
- * — closing that needs resolve-then-pin, which neither Node's nor workerd's
- * fetch exposes. It does close the direct-literal and redirect-to-metadata
- * cases, which is what a prompt-injected URL actually reaches for.
+ * Reject a URL that isn't a plain public https endpoint: a private name
+ * (`localhost`, `*.local`, `*.internal`) or a non-public IP literal, judged by
+ * mcp-utils netguard `isPublicAddress` (which fails closed on a literal it
+ * cannot parse). A public NAME that resolves inward is caught later, at
+ * connect, by the pinned dispatcher (see the module header).
  */
 function assertPublicHttpsUrl(raw, requested) {
     let url;
@@ -195,20 +84,18 @@ function assertPublicHttpsUrl(raw, requested) {
     // keeps it, and `localhost.` still resolves to loopback, so the suffix
     // checks below must see the name without it (chrischall/fleet-audit#472).
     const host = isIpv6Literal ? rawHost.slice(1, -1) : rawHost.replace(/\.+$/, '');
-    const v4 = isIpv6Literal ? undefined : ipv4Octets(host);
-    const v6 = isIpv6Literal ? ipv6Groups(host) : undefined;
-    const blocked = isIpv6Literal
-        // Fail CLOSED on an IPv6 literal we cannot parse: a guard that allows what
-        // it does not understand is the wrong default for this control.
-        ? (v6 === undefined || isPrivateIpv6(v6))
+    const ipv4Literal = /^[0-9.]+$/.test(host);
+    const blocked = isIpv6Literal || ipv4Literal
+        // isPublicAddress fails CLOSED on a literal it cannot parse: a guard that
+        // allows what it does not understand is the wrong default for this control.
+        ? !isPublicAddress(host)
         : host === 'localhost' ||
             host.endsWith('.localhost') ||
             host.endsWith('.local') ||
             // Private-network names: Fly's 6PN (`<app>.internal`, where the hosted
             // build runs) and GCP's metadata server (`metadata.google.internal`).
             host === 'internal' ||
-            host.endsWith('.internal') ||
-            (v4 ? isPrivateIpv4(v4) : false);
+            host.endsWith('.internal');
     if (blocked) {
         throw new McpToolError(`Refusing to fetch ${describeUrl(raw, requested)}: "${url.hostname}" is a private, loopback or link-local address, not a public host.`, { hint: 'images_url is fetched by the server, so it must point at a publicly reachable https:// image.' });
     }
@@ -285,6 +172,16 @@ export async function readCapped(res, maxBytes, url, requested, subject) {
 }
 /** A transport-level failure, told apart from a plain unreachable host. */
 function fetchFailure(err, current, requested, timeoutMs) {
+    if (refusedAtConnect(err)) {
+        let host = current;
+        try {
+            host = new URL(current).hostname;
+        }
+        catch {
+            /* keep the raw URL */
+        }
+        return new McpToolError(`Refusing to fetch ${describeUrl(current, requested)}: "${host}" resolves to a private, loopback or link-local address, not a public host.`, { hint: 'images_url is fetched by the server, so it must point at a publicly reachable https:// image.' });
+    }
     const name = err?.name;
     if (name === 'TimeoutError' || name === 'AbortError') {
         return new McpToolError(`Fetching ${describeUrl(current, requested)} timed out after ${timeoutMs}ms.`, {
@@ -293,6 +190,24 @@ function fetchFailure(err, current, requested, timeoutMs) {
     }
     return new McpToolError(`Could not fetch ${describeUrl(current, requested)}: ${err instanceof Error ? err.message : String(err)}`, { hint: 'Check the URL is reachable from the server and serves the image without authentication.' });
 }
+/** True when netguard's pinned dispatcher refused the connection (anywhere in the cause chain). */
+function refusedAtConnect(err) {
+    let e = err;
+    for (let i = 0; i < 8 && e; i += 1) {
+        if (e.name === 'UrlNotAllowedError')
+            return true;
+        e = e.cause;
+    }
+    return false;
+}
+/**
+ * Is this process behind an egress proxy? mcp-host hands its children
+ * `HTTPS_PROXY` (+ `NODE_USE_ENV_PROXY=1`); the child cannot resolve names
+ * there, and the proxy applies the public-only table itself.
+ */
+function egressProxied() {
+    return Boolean(readEnvVar('HTTPS_PROXY') ?? readEnvVar('https_proxy'));
+}
 /**
  * `subject` names what was too big and how to act on it. It defaults to the
  * `images_url` wording because that is where the cap started, but the reader is
@@ -315,10 +230,27 @@ const IMAGE_CAP_SUBJECT = {
  * is useless when a call carried four of them.
  */
 export async function fetchRemoteImage(requestedUrl, opts = {}) {
-    const doFetch = opts.fetchImpl ?? fetch;
     const maxBytes = opts.maxBytes ?? IMAGE_URL_MAX_BYTES;
     const accept = opts.accept ?? ['image/'];
     const timeoutMs = opts.timeoutMs ?? DEFAULT_FETCH_TIMEOUT_MS;
+    // An injected fetch (tests) is used as-is. Otherwise: pinned to public
+    // addresses on a local install; the global fetch behind an egress proxy.
+    const dispatcher = opts.fetchImpl === undefined && !egressProxied()
+        ? createPublicOnlyDispatcher(opts.resolve ? { resolve: opts.resolve } : {})
+        : undefined;
+    const doFetch = opts.fetchImpl ??
+        (dispatcher
+            ? ((input, init) => undiciFetch(input, { ...init, dispatcher }))
+            : (...args) => fetch(...args));
+    try {
+        return await fetchHops(requestedUrl, doFetch, { maxBytes, accept, timeoutMs });
+    }
+    finally {
+        await dispatcher?.destroy().catch(() => { });
+    }
+}
+/** The redirect loop of {@link fetchRemoteImage}, over the chosen fetch. */
+async function fetchHops(requestedUrl, doFetch, { maxBytes, accept, timeoutMs }) {
     let current = requestedUrl;
     for (let hop = 0;; hop++) {
         const url = assertPublicHttpsUrl(current, requestedUrl);

package/dist/images.js

@@ -2,7 +2,7 @@ import { readFile, stat } from 'node:fs/promises';
 import { existsSync } from 'node:fs';
 import { homedir } from 'node:os';
 import { delimiter, join, resolve, isAbsolute } from 'node:path';
-import { assertPathWithinRoots, expandPath, fileBlob, readEnvVar, McpToolError, readFileHead, resolveOutputDir as resolveSharedOutputDir, sniffMimeBytes as sniffSharedMime, writeFileSafe, writeUniqueFile, } from '@chrischall/mcp-utils';
+import { extensionForMime, assertPathWithinRoots, expandPath, fileBlob, readEnvVar, McpToolError, readFileHead, resolveOutputDir as resolveSharedOutputDir, sniffMimeBytes as sniffSharedMime, writeFileSafe, writeUniqueFile, } from '@chrischall/mcp-utils';
 /**
  * `GEMINI_UPLOAD_DIR` — the optional allow-list for local files streamed to
  * the Files API (`gemini_upload_file` `path`, `video_path`). One or more
@@ -127,29 +127,22 @@ function sniffImageMime(buf) {
     const mime = sniffSharedMime(buf);
     return mime !== undefined && REFERENCE_IMAGE_MIMES.has(mime) ? mime : undefined;
 }
-/** File extension for a media MIME (image/video/audio). Falls back to the MIME
- * subtype, so an unforeseen preview type still writes with a sane extension. */
+/**
+ * Gemini MIME types the shared table does not know. Music can come back as
+ * `audio/ogg_opus`, whose subtype is not a plain word, so it would otherwise
+ * be named `.bin`.
+ */
+const GEMINI_MIME_EXT = { 'audio/ogg_opus': 'ogg' };
+/**
+ * File extension for a media MIME (image/video/audio): mcp-utils
+ * `extensionForMime` (the fleet's one MIME table, fleet-audit#1301), plus
+ * {@link GEMINI_MIME_EXT}. The result always passes `isSafeExtension`, so a
+ * strange upstream Content-Type can never reach `writeUniqueFile` as an
+ * extension it refuses (an unknown type becomes `bin`).
+ */
 export function mediaExt(mimeType) {
-    const m = mimeType.toLowerCase();
-    if (m.includes('jpeg'))
-        return 'jpg';
-    if (m.includes('webp'))
-        return 'webp';
-    if (m.includes('png'))
-        return 'png';
-    if (m.includes('mp4'))
-        return 'mp4';
-    if (m.includes('quicktime'))
-        return 'mov';
-    if (m.includes('webm'))
-        return 'webm';
-    if (m.includes('wav'))
-        return 'wav';
-    if (m.includes('mpeg') || m.includes('mp3'))
-        return 'mp3';
-    if (m.includes('ogg'))
-        return 'ogg';
-    return m.split('/')[1]?.split(';')[0]?.replace(/^x-/, '') || 'bin';
+    const base = mimeType.split(';', 1)[0].trim().toLowerCase();
+    return GEMINI_MIME_EXT[base] ?? extensionForMime(mimeType);
 }
 /** Decode base64 media bytes (image/video/audio) and write to disk (creating
  * dir), picking the extension from the MIME. Returns the absolute path.

package/dist/media-url.js

@@ -18,8 +18,6 @@
 import { signedLinks } from './signed-url.js';
 /** How long a freshly minted media URL stays valid. Matches Files API retention. */
 export const MEDIA_URL_TTL_MS = 48 * 60 * 60 * 1000;
-/** KV key holding the lazily-generated signing secret (zero-config path). */
-export const SIGNING_SECRET_KV_KEY = 'media:url-signing-secret';
 export function base64UrlEncode(bytes) {
     const view = bytes instanceof Uint8Array ? bytes : new Uint8Array(bytes);
     let binary = '';
@@ -35,63 +33,10 @@ export function base64UrlDecode(text) {
         out[i] = binary.charCodeAt(i);
     return out;
 }
-/** Import raw secret material as an HMAC key. */
-async function importKey(material) {
-    return crypto.subtle.importKey('raw', new TextEncoder().encode(material), { name: 'HMAC', hash: 'SHA-256' }, false, [
-        'sign',
-        'verify',
-    ]);
-}
-/**
- * The HMAC key for **signing**, creating one if this deployment has never
- * signed anything.
- *
- * `MEDIA_URL_SECRET` wins when an operator sets one. Otherwise a random 32-byte
- * secret is generated once and persisted in KV — which is what makes the whole
- * feature work with **zero configuration**, the entire point of this change.
- *
- * Creating is confined to this function, and this function is called only when
- * minting a URL. {@link loadSigningKey} is what the verify path uses. That
- * split is load-bearing, not stylistic — see the warning there.
- *
- * Deliberately NOT cached in a module-level variable: `src/` holds no
- * module-scope mutable state (see session.ts), and a KV read per sign is cheap
- * next to an image generation. There is a narrow first-use race — two isolates
- * generating simultaneously — so the value is re-read after writing and the
- * stored one wins, collapsing the window to URLs minted in that same instant.
- */
-export async function resolveSigningKey(secret, store) {
-    let material = secret?.trim();
-    if (!material) {
-        material = (await store.get(SIGNING_SECRET_KV_KEY)) ?? undefined;
-        if (!material) {
-            const generated = base64UrlEncode(crypto.getRandomValues(new Uint8Array(32)));
-            await store.put(SIGNING_SECRET_KV_KEY, generated);
-            // Re-read so a concurrent generator's value wins consistently for both.
-            material = (await store.get(SIGNING_SECRET_KV_KEY)) ?? generated;
-        }
-    }
-    return importKey(material);
-}
-/**
- * The HMAC key for **verifying**. Read-only: returns `undefined` when no secret
- * is stored, and never creates one.
- *
- * This is not a stylistic split. KV is eventually consistent — a `put` on one
- * isolate is not immediately visible to another — so the verify path can and
- * will see a miss for a secret that exists. If verification created-on-miss
- * (as it did originally), that transient miss would mint a NEW secret and
- * overwrite the one every outstanding link was signed with, permanently 403ing
- * media that had been signed perfectly correctly. A self-inflicted denial of
- * service, triggered by ordinary traffic, and irreversible once the old secret
- * is gone.
- *
- * No secret stored ⇒ nothing was ever legitimately signed ⇒ refuse.
- */
-export async function loadSigningKey(secret, store) {
-    const material = secret?.trim() || (await store.get(SIGNING_SECRET_KV_KEY));
-    return material ? importKey(material) : undefined;
-}
+// The KV-backed signing-secret helpers (`resolveSigningKey` /
+// `loadSigningKey` / `SecretStore`) went with the Cloudflare Worker: on
+// mcp-host the signing key is `MCP_BLOB_SIGNING_KEY`, injected by the host and
+// used by `blob-store.ts` (fleet-audit#1251).
 /** The bytes covered by a signature: the object key and the expiry, nothing else. */
 function payload(key, expiresAtMs) {
     return new TextEncoder().encode(`${key}\n${expiresAtMs}`);

package/dist/models.js

@@ -1,10 +1,13 @@
 /**
- * The generalist workhorse (Nano Banana 2) — overridable per-call and via
- * GEMINI_IMAGE_MODEL. The premium gemini-3-pro-image is a deliberate opt-in:
- * it costs more and needs a funded account, so callers reach for it via the
- * `model` param when the task warrants it (see MODEL_CHOICE_GUIDE).
+ * The generalist workhorse (Nano Banana 2.1) — overridable per-call and via
+ * GEMINI_IMAGE_MODEL. Replaced gemini-3.1-flash-image (Nano Banana 2), which
+ * Google deprecated 2026-10-06 with no shutdown date yet; 2.1 is also half the
+ * per-image price ($0.0336 vs $0.067 at 1K). The premium gemini-3-pro-image
+ * is a deliberate opt-in: it costs more and needs a funded account, so callers
+ * reach for it via the `model` param when the task warrants it (see
+ * MODEL_CHOICE_GUIDE).
  */
-export const DEFAULT_IMAGE_MODEL = 'gemini-3.1-flash-image';
+export const DEFAULT_IMAGE_MODEL = 'gemini-nano-banana-2.1';
 /**
  * Default video model (omni, Interactions API) — overridable per-call.
  *
@@ -28,10 +31,12 @@ export function resolveModel(perCall, envOverride) {
  * Keep only Gemini image-generation models (the Nano Banana family) and strip
  * the `models/` prefix. Excludes `imagen-*` — those contain the substring
  * "image" but use a different `:predict` API this server doesn't implement.
+ * `nano-banana` is matched too: `gemini-nano-banana-2.1`, the default, has no
+ * "image" in its id and would otherwise be invisible to gemini_list_models.
  */
 export function filterImageModels(raw) {
     return raw
-        .filter((m) => /image/i.test(m.name ?? '') && !/imagen/i.test(m.name ?? ''))
+        .filter((m) => /image|nano-banana/i.test(m.name ?? '') && !/imagen/i.test(m.name ?? ''))
         .map((m) => ({
         id: (m.name ?? '').replace(/^models\//, ''),
         displayName: m.displayName ?? '',

package/dist/pricing.js

@@ -57,6 +57,10 @@ export const PRICED_AT = '2026-09-09';
 export const RATE_CARD = Object.freeze({
     'gemini-3-pro-image': { input: 2.0, text_output: 12.0, image_output: 120.0 },
     'gemini-3.1-flash-image': { input: 0.5, text_output: 3.0, image_output: 60.0 },
+    // Nano Banana 2.1 (GA 2026-10-06; rates read 2026-10-14, after PRICED_AT):
+    // a pricier input and text rate than 2 but half the image rate, so a 1K
+    // image is $0.0336 rather than $0.067.
+    'gemini-nano-banana-2.1': { input: 1.5, text_output: 7.5, image_output: 30.0 },
     'gemini-3.1-flash-lite-image': { input: 0.25, text_output: 1.5, image_output: 30.0 },
     // Google publishes 2.5-flash-image's output as $0.039 PER IMAGE at 1290
     // tokens, not as a per-1M rate. 0.039 / 1290 * 1e6 = 30.23 — a back-derived

package/dist/storage/media.js

@@ -12,6 +12,7 @@
  * is a thin wrapper over the pre-existing `resolveOutputDir` + `writeMedia`
  * behaviour and must stay byte-for-byte equivalent to it.
  */
+import { mapWithConcurrency } from '@chrischall/mcp-utils';
 import { base64ToBytes } from '../bytes.js';
 import { signedLinks } from '../signed-url.js';
 import { tenantResolver } from '../tenant.js';
@@ -115,19 +116,6 @@ const MAX_SIDECAR_READS = 40;
 const SIDECAR_PROMPT_MAX = 500;
 /** How many record reads a single listing will have open at once. */
 const DECORATE_CONCURRENCY = 8;
-/** `Promise.all` with a ceiling on how many run at once, preserving order. */
-async function mapLimit(items, limit, fn) {
-    const out = new Array(items.length);
-    let next = 0;
-    const workers = Array.from({ length: Math.min(limit, items.length) }, async () => {
-        while (next < items.length) {
-            const i = next++;
-            out[i] = await fn(items[i]);
-        }
-    });
-    await Promise.all(workers);
-    return out;
-}
 /**
  * The hosted-connector sink: one R2 object per generated item.
  *
@@ -267,7 +255,7 @@ export function createR2Sink(bucket, opts) {
                     'They expire (see media[].expires_at), and the objects behind them are cleaned up on a retention schedule. ' +
                     'This connector has no filesystem, so `output_dir` is ignored — but the interaction id is recorded beside each image, so continue_last and chain recovery still work.'
                 : 'Generated media was stored, but this connector has no public media URL configured and no signing route available, so the values above are bare object keys rather than fetchable links. ' +
-                    'Set MEDIA_PUBLIC_BASE_URL on the Worker, or pass inline: true to receive the bytes directly.',
+                    'The host did not provide a blob store (mcp-host injects MCP_BLOB_BASE_URL and MCP_BLOB_SIGNING_KEY) — ask the server operator, or pass inline: true to receive the bytes directly.',
     };
     /**
      * List this account's objects, newest-first, splitting media from the sidecar
@@ -334,7 +322,7 @@ export function createR2Sink(bucket, opts) {
         // a hundred concurrent store reads while the id lookups were carefully
         // budgeted. One tool call should not open a hundred connections to
         // decorate a page.
-        return mapLimit(entries, DECORATE_CONCURRENCY, async (entry) => {
+        return mapWithConcurrency(entries, DECORATE_CONCURRENCY, async (entry) => {
             const link = await describe(entry.key, expiresAtMs);
             // Only where the walk actually saw a record — media with none (anything
             // generated before sidecars existed, and anything whose write failed)

package/dist/tools/_confirm.js

@@ -1,4 +1,4 @@
-import { confirmationFromEnv, confirmTokenParam, requireConfirmationWithFallback } from '@chrischall/mcp-utils';
+import { confirmTokenParam, confirmWrite } from '@chrischall/mcp-utils';
 import { previewImageInput, previewVideoInput } from '../images.js';
 export { confirmTokenParam };
 /**
@@ -10,35 +10,15 @@ export function confirmNote(lead = 'Asks the user to confirm first') {
         'and a confirmToken, and only a repeat call with that token proceeds (see MCP_CONFIRM_MODE).';
 }
 /**
- * Confirm a mutating call before it runs: an elicitation prompt where the
- * client supports one, otherwise the preview-plus-token fallback governed by
- * MCP_CONFIRM_MODE. The preview is the same method/path/willSend shape the old
- * dry-run returned.
+ * The gate itself is the fleet's shared `confirmWrite` from
+ * `@chrischall/mcp-utils` (fleet-audit#1376 — this file used to carry its own
+ * adapter over `requireConfirmationWithFallback` + `confirmationFromEnv`). It
+ * binds the request, the payload, the displayed preview and the validated
+ * args into both the token and the elicitation acceptance. One API key per
+ * process (a hosted deployment runs one child per account), so every call
+ * passes `account: undefined`.
  */
-export async function confirmWrite(ctx, o) {
-    const preview = {
-        action: o.description,
-        method: o.method,
-        path: o.path,
-        ...(o.body !== undefined ? { willSend: o.body } : {}),
-    };
-    return requireConfirmationWithFallback(ctx, confirmationFromEnv({
-        action: o.action,
-        message: o.message,
-        details: preview,
-        tool: o.tool,
-        // One API key per process (a hosted deployment runs one child per
-        // account), so there is no in-process principal to bind.
-        account: undefined,
-        args: withoutConfirmToken(o.args),
-        confirmToken: o.confirmToken,
-        subject: () => ({ target: o.target, payload: o.payload, preview }),
-    }));
-}
-function withoutConfirmToken(args) {
-    const { confirmToken: _omit, ...rest } = args;
-    return rest;
-}
+export { confirmWrite };
 /**
  * Confirm-gate for a Gemini tool that ships LOCAL input files (image/video
  * paths) to Google. Proceeds straight away when the call has no local file
@@ -60,12 +40,12 @@ export async function confirmLocalInputs(ctx, o) {
         tool: o.tool,
         action: o.action,
         message: 'Review and confirm sending these local files to Google:',
-        description: o.description,
-        method: 'POST',
-        path: o.endpoint,
-        body: { inputs },
+        summary: o.description,
+        account: undefined,
         target: '',
+        request: { method: 'POST', path: o.endpoint },
         payload: { request: o.request, inputs },
+        willSend: { inputs },
         args: o.request,
         confirmToken: o.confirmToken,
     });

package/dist/tools/files.js

@@ -162,12 +162,12 @@ export function registerFileTools(server, client) {
                 tool: 'gemini_upload_file',
                 action: 'file.upload',
                 message: 'Review and confirm uploading this local file to Google:',
-                description: 'Upload a local file to the Gemini Files API',
-                method: 'POST',
-                path: '/upload/v1beta/files',
-                body: { inputs },
+                summary: 'Upload a local file to the Gemini Files API',
+                account: undefined,
                 target: resolved,
+                request: { method: 'POST', path: '/upload/v1beta/files' },
                 payload: { inputs, display_name: args.display_name },
+                willSend: { inputs },
                 args,
                 confirmToken: args.confirmToken,
             });
@@ -255,7 +255,7 @@ export function registerFileTools(server, client) {
             const fresh = await sink.resign(args.r2_key.trim());
             if (!fresh) {
                 // Remediation goes in the MESSAGE: MCP serialization drops hints.
-                throw new McpToolError(`No stored media for r2_key "${args.r2_key}" — it has probably passed its retention window. Re-run the generation to get a new one.`, { hint: 'Objects are swept on a retention schedule (MEDIA_TTL_DAYS, default 7 days).' });
+                throw new McpToolError(`No stored media for r2_key "${args.r2_key}" — it has probably passed its retention window. Re-run the generation to get a new one.`, { hint: "Objects are swept on the host's blob-store retention schedule; signed links last at most 24h." });
             }
             return minifiedResult({
                 url: fresh.ref,
@@ -376,10 +376,10 @@ export function registerFileTools(server, client) {
             tool: 'gemini_delete_file',
             action: 'file.delete',
             message: 'Review and confirm this deletion:',
-            description: 'Delete an uploaded Gemini file',
-            method: 'DELETE',
-            path: `/v1beta/${args.file_uri}`,
+            summary: 'Delete an uploaded Gemini file',
+            account: undefined,
             target: args.file_uri,
+            request: { method: 'DELETE', path: `/v1beta/${args.file_uri}` },
             payload: { file_uri: args.file_uri },
             args,
             confirmToken: args.confirmToken,

package/dist/tools/interact.js

@@ -121,7 +121,7 @@ export function registerInteractTools(server, client) {
             image_size: z
                 .enum(IMAGE_SIZES)
                 .optional()
-                .describe('Output resolution (512 = 0.5K, Flash-only)'),
+                .describe('Output resolution (512 = 0.5K, gemini-3.1-flash-image only)'),
             thinking_level: z
                 .enum(['minimal', 'high'])
                 .optional()