@chrischall/pickuppatrol-mcp 1.0.2 → 1.1.0

package/.claude-plugin/marketplace.json

@@ -6,7 +6,7 @@
   },
   "metadata": {
     "description": "PickUp Patrol school-dismissal tools for Claude Code",
-    "version": "1.0.2"
+    "version": "1.1.0"
   },
   "plugins": [
     {
@@ -14,7 +14,7 @@
       "displayName": "PickUp Patrol",
       "source": "./",
       "description": "Read and change your children's school dismissal plans in PickUp Patrol — defaults, day-by-day changes and school cutoff times — via MCP",
-      "version": "1.0.2",
+      "version": "1.1.0",
       "author": {
         "name": "Chris Chall"
       },

package/.claude-plugin/plugin.json

@@ -1,7 +1,7 @@
 {
   "name": "pickuppatrol",
   "displayName": "PickUp Patrol",
-  "version": "1.0.2",
+  "version": "1.1.0",
   "description": "Read and change your children's school dismissal plans in PickUp Patrol — defaults, day-by-day changes and school cutoff times — via MCP",
   "author": {
     "name": "Chris Chall"

package/README.md

@@ -60,8 +60,11 @@ and only reports the configuration error on the first tool call.
 | `pup_list_car_numbers` | Car numbers the school issued to this account |
 | `pup_healthcheck` | Credentials sign in and the API answers |
 
-**Writes** — every one requires `confirm: true`. Without it the tool makes no
-change and returns a dry-run of the exact payload it would send.
+**Writes** — every one asks you to confirm first. A client that can show a
+confirmation prompt (Claude Code) shows one. Otherwise the first call makes no
+change and returns a preview of the exact payload it would send plus a
+`confirmToken`, and only a repeat call with that token makes the change — see
+[Confirmations](#confirmations).
 
 | Tool | What it changes |
 |---|---|
@@ -69,6 +72,20 @@ change and returns a dry-run of the exact payload it would send.
 | `pup_set_default_plans` | The weekly default plan, or clears every default |
 | `pup_mark_defaults_reviewed` | The school's "defaults need review" prompt |
 
+### Confirmations
+
+| variable | default | |
+|---|---|---|
+| `MCP_CONFIRM_MODE` | `ask-user` | What a write does on a client that cannot show a confirmation prompt (claude.ai, Claude Desktop). `ask-user`: two steps — the first call does nothing and returns a preview plus a token, and the model must get your approval in chat before calling again with it. `auto`: the same two steps, but the model may use the token after reviewing the preview itself. `refuse`: writes are refused on such clients. A client that can show prompts (Claude Code) always gets the real prompt. An unrecognised value is treated as `refuse`. |
+| `MCP_CONFIRM_TTL_SECONDS` | `600` | How long a token stays valid. |
+| `MCP_CONFIRM_SECRET` | random per process | Signing key; set it only if tokens must survive a server restart. |
+
+A token is single-use and bound to the exact payload. The second call re-reads
+the student and rebuilds the payload, so if anything moved between the preview
+and the approval — a different date or option, or (for default plans, which
+round-trip the whole student record) a change made to the record meanwhile —
+nothing is sent and you get `DRAFT_CHANGED` with a fresh preview.
+
 ### Two things the tools do that the API does not
 
 **Rules are enforced before anything is sent.** Each dismissal option carries its

package/dist/bundle.js

@@ -23315,6 +23315,33 @@ var storage2 = new AsyncLocalStorage2();
 function withCallerCapabilities(capabilities, fn) {
   return capabilities ? storage2.run(capabilities, fn) : fn();
 }
+function currentCallerCapabilities() {
+  return storage2.getStore();
+}
+var ENVELOPE_CAPABILITIES_KEY = "io.modelcontextprotocol/clientCapabilities";
+var ELICITATION_MODES = ["form", "url"];
+function isRecord(value) {
+  return typeof value === "object" && value !== null && !Array.isArray(value);
+}
+function callerCapabilities(ctx) {
+  const envelope = isRecord(ctx) && isRecord(ctx.mcpReq) ? ctx.mcpReq.envelope : void 0;
+  if (isRecord(envelope)) {
+    const declared = envelope[ENVELOPE_CAPABILITIES_KEY];
+    if (isRecord(declared))
+      return declared;
+  }
+  return currentCallerCapabilities();
+}
+function callerAcceptsFormElicitation(ctx) {
+  const capabilities = callerCapabilities(ctx);
+  if (!capabilities)
+    return void 0;
+  const elicitation = capabilities.elicitation;
+  if (!isRecord(elicitation))
+    return false;
+  const namedModes = ELICITATION_MODES.filter((mode) => mode in elicitation);
+  return namedModes.length === 0 || namedModes.includes("form");
+}
 
 // node_modules/@modelcontextprotocol/server/dist/chunk-Br0eD_fh.mjs
 var __create2 = Object.create;
@@ -27713,6 +27740,37 @@ var inputRequired = Object.assign(buildInputRequired, {
     return { method: "roots/list" };
   }
 });
+function acceptedContent(responses, key, schema) {
+  const view = inputResponse(responses, key);
+  if (view.kind !== "elicit" || view.action !== "accept" || view.content === void 0) return void 0;
+  if (schema === void 0) return view.content;
+  const outcome = schema["~standard"].validate(view.content);
+  if (outcome instanceof Promise) throw new TypeError("acceptedContent(responses, key, schema) requires a synchronously-validating schema");
+  return outcome.issues === void 0 ? outcome.value : void 0;
+}
+function inputResponse(responses, key) {
+  if (responses === void 0 || typeof responses !== "object" || responses === null) return { kind: "missing" };
+  const entry = responses[key];
+  if (entry === null || typeof entry !== "object" || Array.isArray(entry)) return { kind: "missing" };
+  const candidate = entry;
+  if (candidate["action"] === "accept" || candidate["action"] === "decline" || candidate["action"] === "cancel") {
+    const content = candidate["content"];
+    return {
+      kind: "elicit",
+      action: candidate["action"],
+      ...content !== null && typeof content === "object" && !Array.isArray(content) && { content }
+    };
+  }
+  if (Array.isArray(candidate["roots"])) return {
+    kind: "roots",
+    roots: candidate["roots"]
+  };
+  if (typeof candidate["role"] === "string" && candidate["content"] !== void 0) return {
+    kind: "sampling",
+    result: candidate
+  };
+  return { kind: "missing" };
+}
 var REQUEST_STATE_ONLY_LEG_PACING_MS = 250;
 function inputRequiredRoundsExceededMessage(method, maxRounds) {
   return `Multi-round-trip request '${method}' still required input after ${maxRounds} rounds (inputRequired.maxRounds)`;
@@ -37760,14 +37818,14 @@ function serveStdio(factory, options = {}) {
     return false;
   };
   const answerLegacyRejection = (request, reason, requestedVersion) => {
-    const rejection2 = modernOnlyStrictRejection({
+    const rejection3 = modernOnlyStrictRejection({
       kind: "legacy",
       reason,
       ...requestedVersion !== void 0 && { requestedVersion }
     }, SUPPORTED_MODERN_PROTOCOL_VERSIONS);
-    if (rejection2 === void 0) return Promise.resolve();
-    reportError(/* @__PURE__ */ new Error(`Rejected 2025-era request on a modern-only stdio connection (${rejection2.cell}): ${rejection2.message}`));
-    return writeErrorResponse(request.id, rejection2.code, rejection2.message, rejection2.data);
+    if (rejection3 === void 0) return Promise.resolve();
+    reportError(/* @__PURE__ */ new Error(`Rejected 2025-era request on a modern-only stdio connection (${rejection3.cell}): ${rejection3.message}`));
+    return writeErrorResponse(request.id, rejection3.code, rejection3.message, rejection3.data);
   };
   const onInstanceClosed = (channel) => {
     if (closing || channel === discarding) return;
@@ -57699,6 +57757,11 @@ var MEDIA_QUALIFIER = "(?:primary|secondary|main|default|cover|hero|profile|mast
 var MEDIA_KEY = new RegExp(`^(?:(?:${MEDIA_QUALIFIER}|${MEDIA_NOUN})[_-]?)?${MEDIA_NOUN}s?(?:[_-]?(?:link|uri|url|src)s?)?$`, "i");
 
 // node_modules/@chrischall/mcp-utils/dist/response/index.js
+function textResult(data) {
+  return {
+    content: [{ type: "text", text: JSON.stringify(data, null, 2) }]
+  };
+}
 function errorResult(message) {
   return {
     content: [{ type: "text", text: redactSecrets(message) }],
@@ -57706,6 +57769,407 @@ function errorResult(message) {
   };
 }
 
+// node_modules/@chrischall/mcp-utils/dist/server/confirmation.js
+import { createHash, createHmac, timingSafeEqual } from "node:crypto";
+
+// node_modules/@chrischall/mcp-utils/dist/server/canonical.js
+function canonicalJson(value) {
+  if (value === null || typeof value === "string" || typeof value === "boolean")
+    return JSON.stringify(value);
+  if (value === void 0)
+    return "null";
+  if (typeof value === "number")
+    return Number.isFinite(value) ? JSON.stringify(value) : `{"$num":"${String(value)}"}`;
+  if (typeof value === "bigint")
+    return `{"$bigint":"${value.toString()}"}`;
+  if (typeof value === "function" || typeof value === "symbol") {
+    throw new TypeError(`confirmation: cannot bind a ${typeof value} argument value.`);
+  }
+  if (Array.isArray(value))
+    return `[${value.map(canonicalJson).join(",")}]`;
+  if (value instanceof Date) {
+    return `{"$date":${JSON.stringify(Number.isNaN(value.getTime()) ? "Invalid Date" : value.toISOString())}}`;
+  }
+  if (ArrayBuffer.isView(value)) {
+    const bytes = Buffer.from(value.buffer, value.byteOffset, value.byteLength);
+    return `{"$bytes":${JSON.stringify(bytes.toString("base64"))}}`;
+  }
+  if (value instanceof ArrayBuffer)
+    return `{"$bytes":${JSON.stringify(Buffer.from(value).toString("base64"))}}`;
+  if (value instanceof Map) {
+    const entries2 = [...value.entries()].map(([k, v]) => `[${canonicalJson(k)},${canonicalJson(v)}]`).sort();
+    return `{"$map":[${entries2.join(",")}]}`;
+  }
+  if (value instanceof Set) {
+    return `{"$set":[${[...value].map(canonicalJson).sort().join(",")}]}`;
+  }
+  const proto = Object.getPrototypeOf(value);
+  if (proto !== Object.prototype && proto !== null) {
+    throw new TypeError("confirmation: cannot bind a non-plain object argument value (class instance).");
+  }
+  const entries = Object.entries(value).filter(([, v]) => v !== void 0).sort(([a], [b]) => a < b ? -1 : a > b ? 1 : 0);
+  return `{${entries.map(([k, v]) => `${JSON.stringify(escapeKey(k))}:${canonicalJson(v)}`).join(",")}}`;
+}
+function escapeKey(key) {
+  return key.startsWith("$") ? `$${key}` : key;
+}
+
+// node_modules/@chrischall/mcp-utils/dist/server/confirmation.js
+var DEFAULT_REQUEST_KEY = "confirmation";
+var DEFAULT_CONFIRMATION_LABEL = "Confirm this action should proceed.";
+var UNSUPPORTED_NOTE = "Nothing was done because this client cannot show a confirmation prompt (it declares no MCP elicitation capability), and this action is never taken without one";
+var STATE_PREFIX = "mcpu.confirm.v1.";
+function bindingKey(binding) {
+  if (binding.ttlSeconds !== void 0 && !(Number.isFinite(binding.ttlSeconds) && binding.ttlSeconds > 0)) {
+    throw new RangeError("requireConfirmation: binding.ttlSeconds must be a finite number greater than 0.");
+  }
+  const key = typeof binding.key === "string" ? Buffer.from(binding.key, "utf8") : Buffer.from(binding.key);
+  if (key.length < 32) {
+    throw new RangeError("requireConfirmation: binding.key must be at least 32 bytes.");
+  }
+  return key;
+}
+function commitment(action, args) {
+  return createHash("sha256").update(`${action}\0${canonicalJson(args)}`).digest("base64url");
+}
+function mintState(key, action, binding) {
+  const exp = Math.floor(Date.now() / 1e3) + (binding.ttlSeconds ?? 600);
+  const body = Buffer.from(JSON.stringify({ c: commitment(action, binding.args), exp })).toString("base64url");
+  const mac3 = createHmac("sha256", key).update(`${STATE_PREFIX}${body}`).digest("base64url");
+  return `${STATE_PREFIX}${body}.${mac3}`;
+}
+function verifyState(key, action, binding, state) {
+  if (typeof state !== "string" || !state.startsWith(STATE_PREFIX))
+    return false;
+  const rest = state.slice(STATE_PREFIX.length);
+  const dot = rest.indexOf(".");
+  if (dot < 0)
+    return false;
+  const body = rest.slice(0, dot);
+  const mac3 = Buffer.from(rest.slice(dot + 1), "base64url");
+  const expected = createHmac("sha256", key).update(`${STATE_PREFIX}${body}`).digest();
+  if (mac3.length !== expected.length || !timingSafeEqual(mac3, expected))
+    return false;
+  let payload;
+  try {
+    payload = JSON.parse(Buffer.from(body, "base64url").toString("utf8"));
+  } catch {
+    return false;
+  }
+  if (typeof payload.exp !== "number" || payload.exp * 1e3 <= Date.now())
+    return false;
+  const want = Buffer.from(commitment(action, binding.args));
+  const got = Buffer.from(typeof payload.c === "string" ? payload.c : "");
+  return got.length === want.length && timingSafeEqual(got, want);
+}
+function echoedState(ctx) {
+  const accessor = ctx.mcpReq.requestState;
+  return typeof accessor === "function" ? accessor() : void 0;
+}
+function requireConfirmation(ctx, options) {
+  const requestKey = options.requestKey ?? DEFAULT_REQUEST_KEY;
+  const key = options.binding ? bindingKey(options.binding) : void 0;
+  const confirmationSchema = external_exports.object({
+    confirmed: external_exports.boolean().describe(options.confirmationLabel ?? DEFAULT_CONFIRMATION_LABEL)
+  });
+  const ask = () => {
+    const preview = {
+      action: options.action,
+      ...options.details === void 0 ? {} : { details: options.details }
+    };
+    return inputRequired({
+      inputRequests: {
+        [requestKey]: inputRequired.elicit({
+          message: `${options.message}
+${JSON.stringify(preview, null, 2)}`,
+          requestedSchema: confirmationSchema
+        })
+      },
+      ...key && options.binding ? { requestState: mintState(key, options.action, options.binding) } : {}
+    });
+  };
+  const response = inputResponse(ctx.mcpReq.inputResponses, requestKey);
+  const accepted = acceptedContent(ctx.mcpReq.inputResponses, requestKey, confirmationSchema);
+  if (response.kind === "missing") {
+    if (callerAcceptsFormElicitation(ctx) === false) {
+      return textResult({
+        confirmed: false,
+        dispatched: false,
+        action: options.action,
+        reason: "confirmation-unsupported",
+        note: options.unsupportedNote ? `${UNSUPPORTED_NOTE}. ${options.unsupportedNote}` : `${UNSUPPORTED_NOTE}.`
+      });
+    }
+    return ask();
+  }
+  if (response.kind === "elicit" && response.action === "accept" && accepted?.confirmed === true) {
+    if (key && options.binding) {
+      const state = echoedState(ctx);
+      if (state === void 0 || state === null) {
+        return errorResult(`Confirmation for ${options.action} was accepted, but the retry carried no requestState, so it cannot be checked against the prompt that was shown. Nothing was done. The likely cause is that the MCP client or host does not round-trip requestState (it must echo the requestState from the input_required result back on the retry); asking again would loop.`);
+      }
+      if (!verifyState(key, options.action, options.binding, state))
+        return ask();
+    }
+    return void 0;
+  }
+  return textResult({
+    confirmed: false,
+    cancelled: true,
+    action: options.action,
+    note: "Nothing was changed because the confirmation was declined, cancelled, or left unchecked."
+  });
+}
+
+// node_modules/@chrischall/mcp-utils/dist/server/confirm-token.js
+import { createHash as createHash2, createHmac as createHmac2, randomBytes, timingSafeEqual as timingSafeEqual2 } from "node:crypto";
+function createSpentTokenStore() {
+  const spent = /* @__PURE__ */ new Map();
+  return {
+    has: (nonce) => spent.has(nonce),
+    add: (nonce, exp) => {
+      spent.set(nonce, exp);
+    },
+    prune: (now) => {
+      for (const [nonce, exp] of spent)
+        if (exp < now)
+          spent.delete(nonce);
+    },
+    clear: () => spent.clear(),
+    get size() {
+      return spent.size;
+    }
+  };
+}
+var PROCESS_SPENT = createSpentTokenStore();
+var PREFIX = "mcpu.token.v1.";
+var DEFAULT_TTL_SECONDS = 600;
+function tokenKey(key) {
+  const bytes = typeof key === "string" ? Buffer.from(key, "utf8") : Buffer.from(key);
+  if (bytes.length < 32)
+    throw new RangeError("confirm token: key must be at least 32 bytes.");
+  return bytes;
+}
+function ttlOf(ttlSeconds) {
+  if (ttlSeconds === void 0)
+    return DEFAULT_TTL_SECONDS;
+  if (!(Number.isFinite(ttlSeconds) && ttlSeconds > 0)) {
+    throw new RangeError("confirm token: ttlSeconds must be a finite number greater than 0.");
+  }
+  return ttlSeconds;
+}
+function sign(key, body) {
+  return createHmac2("sha256", key).update(`${PREFIX}${body}`).digest();
+}
+function hashConfirmPayload(payload) {
+  return createHash2("sha256").update(canonicalJson(payload)).digest("base64url");
+}
+function issueConfirmToken(key, binding, options = {}) {
+  const k = tokenKey(key);
+  const now = options.now ?? Date.now();
+  const exp = now + ttlOf(options.ttlSeconds) * 1e3;
+  const claims = {
+    t: binding.tool,
+    ...binding.account === void 0 ? {} : { a: binding.account },
+    g: binding.target,
+    ...binding.revision === void 0 ? {} : { r: binding.revision },
+    h: binding.payloadHash,
+    exp,
+    n: randomBytes(16).toString("base64url")
+  };
+  const body = Buffer.from(JSON.stringify(claims), "utf8").toString("base64url");
+  return { token: `${PREFIX}${body}.${sign(k, body).toString("base64url")}`, expiresAt: new Date(exp).toISOString() };
+}
+function parseClaims(body) {
+  try {
+    const claims = JSON.parse(Buffer.from(body, "base64url").toString("utf8"));
+    return claims && typeof claims === "object" ? claims : void 0;
+  } catch {
+    return void 0;
+  }
+}
+function verifyConfirmToken(key, token, binding, options = {}) {
+  const k = tokenKey(key);
+  const now = options.now ?? Date.now();
+  const spent = options.spent ?? PROCESS_SPENT;
+  spent.prune(now);
+  if (!token.startsWith(PREFIX))
+    return { ok: false, error: "TOKEN_INVALID" };
+  const rest = token.slice(PREFIX.length);
+  const dot = rest.indexOf(".");
+  const body = dot < 0 ? "" : rest.slice(0, dot);
+  const mac3 = Buffer.from(dot < 0 ? "" : rest.slice(dot + 1), "base64url");
+  const expected = sign(k, body);
+  if (!body || mac3.length !== expected.length || !timingSafeEqual2(mac3, expected))
+    return { ok: false, error: "TOKEN_INVALID" };
+  const claims = parseClaims(body);
+  if (!claims)
+    return { ok: false, error: "TOKEN_INVALID" };
+  if (claims.t !== binding.tool || claims.a !== binding.account || claims.g !== binding.target) {
+    return { ok: false, error: "TOKEN_INVALID" };
+  }
+  if (spent.has(claims.n))
+    return { ok: false, error: "TOKEN_REUSED" };
+  if (now > claims.exp)
+    return { ok: false, error: "TOKEN_EXPIRED" };
+  if (claims.r !== binding.revision)
+    return { ok: false, error: "DRAFT_CHANGED", reason: "revision-changed" };
+  if (claims.h !== binding.payloadHash)
+    return { ok: false, error: "DRAFT_CHANGED", reason: "payload-changed" };
+  spent.add(claims.n, claims.exp);
+  return { ok: true };
+}
+var CONFIRM_TOKEN_INSTRUCTION = "Show this preview to the user verbatim and proceed only after they explicitly approve in chat. Then call again with confirmToken.";
+var confirmTokenParam = external_exports.string().optional().describe(`ONLY for the two-step confirmation fallback (a client without MCP elicitation). The confirmToken from this same tool's phase-1 "confirmation-required" response, passed back ONLY after the user has seen that preview and explicitly approved it in chat \u2014 never on the first call, never invented, never reused. Call again with the same arguments. Ignored when the client supports elicitation.`);
+var TOKEN_ERROR_NOTE = {
+  TOKEN_EXPIRED: "Nothing was sent or changed: the confirmToken expired. Call again WITHOUT confirmToken for a fresh preview, and ask the user to approve it again.",
+  TOKEN_REUSED: "Nothing was sent or changed by this call: this confirmToken was already used, and one approval acts once. If doing it again is really intended, call again WITHOUT confirmToken and get a new approval.",
+  TOKEN_INVALID: "Nothing was sent or changed: this confirmToken was not issued by this server for this tool, account and target (or the server has restarted since). Call again WITHOUT confirmToken for a fresh preview and approval."
+};
+var CHANGED_NOTE = {
+  "revision-changed": "Nothing was sent or changed: the target was edited since the user approved it (its version rotated), so what would happen is not what they saw.",
+  "payload-changed": "Nothing was sent or changed: what would happen no longer matches what the user approved."
+};
+function isToolResult(value) {
+  return Array.isArray(value.content);
+}
+function rejection2(data) {
+  return { ...textResult({ status: "confirmation-rejected", confirmed: false, dispatched: false, ...data }), isError: true };
+}
+async function tokenConfirmation(action, fb) {
+  const subject = await fb.subject();
+  if (isToolResult(subject))
+    return subject;
+  const binding = {
+    tool: fb.tool,
+    ...fb.account === void 0 ? {} : { account: fb.account },
+    target: subject.target,
+    ...subject.revision === void 0 ? {} : { revision: subject.revision },
+    payloadHash: hashConfirmPayload(subject.payload)
+  };
+  const phaseOne = () => {
+    const { token, expiresAt } = issueConfirmToken(fb.key, binding, { ttlSeconds: fb.ttlSeconds });
+    return {
+      action,
+      preview: subject.preview,
+      confirmToken: token,
+      expiresAt,
+      ttlSeconds: ttlOf(fb.ttlSeconds),
+      instruction: fb.instruction ?? CONFIRM_TOKEN_INSTRUCTION
+    };
+  };
+  if (!fb.confirmToken) {
+    return textResult({ status: "confirmation-required", confirmed: false, dispatched: false, ...phaseOne() });
+  }
+  const verdict = verifyConfirmToken(fb.key, fb.confirmToken, binding, { spent: fb.spent });
+  if (verdict.ok)
+    return void 0;
+  if (verdict.error === "DRAFT_CHANGED") {
+    return rejection2({
+      error: "DRAFT_CHANGED",
+      reason: verdict.reason,
+      note: `${CHANGED_NOTE[verdict.reason]} The current preview and a fresh confirmToken are below.`,
+      ...phaseOne()
+    });
+  }
+  return rejection2({ error: verdict.error, action, note: TOKEN_ERROR_NOTE[verdict.error] });
+}
+async function requireConfirmationWithFallback(ctx, options) {
+  const { tokenFallback, ...confirmation } = options;
+  if (tokenFallback && callerAcceptsFormElicitation(ctx) === false) {
+    return tokenConfirmation(options.action, tokenFallback);
+  }
+  return requireConfirmation(ctx, confirmation);
+}
+
+// node_modules/@chrischall/mcp-utils/dist/server/confirm-env.js
+import { createHash as createHash3, randomBytes as randomBytes2 } from "node:crypto";
+
+// node_modules/@chrischall/mcp-utils/dist/config/index.js
+var PLACEHOLDER_RE = /^\$\{[^}]*\}$/;
+function readEnvVar(key, opts = {}) {
+  const env = opts.env ?? process.env;
+  const raw = env[key];
+  if (typeof raw === "string") {
+    const trimmed = raw.trim();
+    if (trimmed.length > 0 && trimmed !== "undefined" && trimmed !== "null" && !PLACEHOLDER_RE.test(trimmed)) {
+      return trimmed;
+    }
+  }
+  return opts.default;
+}
+async function loadDotenvSafely(opts = {}) {
+  try {
+    const mod = await import(
+      /* @vite-ignore */
+      "dotenv"
+    );
+    const result = mod.config({
+      ...opts.path !== void 0 ? { path: opts.path } : {},
+      override: opts.override ?? false,
+      quiet: true
+    });
+    return result.error === void 0;
+  } catch {
+    return false;
+  }
+}
+
+// node_modules/@chrischall/mcp-utils/dist/server/confirm-env.js
+var MODES = /* @__PURE__ */ new Set(["ask-user", "auto", "refuse"]);
+var DEFAULT_TTL_SECONDS2 = 600;
+var warned = /* @__PURE__ */ new Set();
+function readConfirmMode(env = process.env) {
+  const raw = readEnvVar("MCP_CONFIRM_MODE", { env })?.trim().toLowerCase();
+  if (!raw)
+    return "ask-user";
+  if (MODES.has(raw))
+    return raw;
+  if (!warned.has(raw)) {
+    warned.add(raw);
+    process.stderr.write(`MCP_CONFIRM_MODE="${raw}" is not one of ask-user, auto, refuse; treating it as refuse.
+`);
+  }
+  return "refuse";
+}
+function confirmTtlFromEnv(env = process.env) {
+  const raw = readEnvVar("MCP_CONFIRM_TTL_SECONDS", { env })?.trim();
+  return raw && /^[1-9]\d*$/.test(raw) ? Number(raw) : DEFAULT_TTL_SECONDS2;
+}
+var processKey;
+function confirmKeyFromEnv(env = process.env) {
+  const secret = readEnvVar("MCP_CONFIRM_SECRET", { env });
+  if (secret)
+    return createHash3("sha256").update(secret, "utf8").digest();
+  processKey ??= randomBytes2(32);
+  return processKey;
+}
+var CONFIRM_TOKEN_AUTO_INSTRUCTION = "Nothing has been done yet. Review this preview; if it is what was intended, call again with the same arguments plus confirmToken. (This server runs with MCP_CONFIRM_MODE=auto, so the user's approval in chat is not required.)";
+var REFUSE_HINT = "Set MCP_CONFIRM_MODE=ask-user on the server to allow two-step confirmation instead.";
+function confirmationFromEnv(options) {
+  const { tool, account, confirmToken, subject, instruction, spent, env = process.env, ...confirmation } = options;
+  const mode = readConfirmMode(env);
+  if (mode === "refuse") {
+    return {
+      ...confirmation,
+      unsupportedNote: confirmation.unsupportedNote ? `${confirmation.unsupportedNote} ${REFUSE_HINT}` : REFUSE_HINT
+    };
+  }
+  return {
+    ...confirmation,
+    tokenFallback: {
+      key: confirmKeyFromEnv(env),
+      tool,
+      ...account === void 0 ? {} : { account },
+      ...confirmToken === void 0 ? {} : { confirmToken },
+      subject,
+      ttlSeconds: confirmTtlFromEnv(env),
+      instruction: mode === "auto" ? CONFIRM_TOKEN_AUTO_INSTRUCTION : instruction ?? CONFIRM_TOKEN_INSTRUCTION,
+      ...spent === void 0 ? {} : { spent }
+    }
+  };
+}
+
 // node_modules/@chrischall/mcp-utils/dist/server/index.js
 var SERVER_PROTOCOL_VERSIONS = Object.freeze([
   "2026-07-28",
@@ -57881,36 +58345,6 @@ function runMcp(opts) {
   return handle;
 }
 
-// node_modules/@chrischall/mcp-utils/dist/config/index.js
-var PLACEHOLDER_RE = /^\$\{[^}]*\}$/;
-function readEnvVar(key, opts = {}) {
-  const env = opts.env ?? process.env;
-  const raw = env[key];
-  if (typeof raw === "string") {
-    const trimmed = raw.trim();
-    if (trimmed.length > 0 && trimmed !== "undefined" && trimmed !== "null" && !PLACEHOLDER_RE.test(trimmed)) {
-      return trimmed;
-    }
-  }
-  return opts.default;
-}
-async function loadDotenvSafely(opts = {}) {
-  try {
-    const mod = await import(
-      /* @vite-ignore */
-      "dotenv"
-    );
-    const result = mod.config({
-      ...opts.path !== void 0 ? { path: opts.path } : {},
-      override: opts.override ?? false,
-      quiet: true
-    });
-    return result.error === void 0;
-  } catch {
-    return false;
-  }
-}
-
 // node_modules/@chrischall/mcp-utils/dist/http/index.js
 function buildQueryString(params) {
   const parts = [];
@@ -58316,7 +58750,7 @@ var PickUpPatrolClient = class {
 var client = new PickUpPatrolClient();
 
 // src/version.ts
-var VERSION = "1.0.2";
+var VERSION = "1.1.0";
 
 // src/dates.ts
 var WEEKDAY_NAMES = [
@@ -58662,16 +59096,26 @@ function clearDefaultPlans(student) {
 }
 
 // src/tools/_confirm.ts
-function previewUnlessConfirmed(confirm, action, method, dto, body) {
-  if (confirm === true) return null;
-  return minifiedResult({
-    dryRun: true,
-    action,
-    method,
-    dto,
-    ...body !== void 0 ? { willSend: body } : {},
-    note: "Re-run with confirm: true to execute."
-  });
+var CONFIRM_FLOW = "Asks the user to confirm first: a confirmation prompt where the client supports one; otherwise the first call returns a preview and a confirmToken, and only a repeat call with that token proceeds (see MCP_CONFIRM_MODE).";
+function confirmWrite(ctx, options) {
+  const { tool, action, summary, method, dto, target, revision, payload, willSend, confirmToken } = options;
+  const preview = { action: summary, method, dto, willSend: willSend ?? payload };
+  return requireConfirmationWithFallback(
+    ctx,
+    confirmationFromEnv({
+      action,
+      message: `Review and confirm this change: ${summary}`,
+      details: preview,
+      tool,
+      confirmToken,
+      subject: () => ({
+        target,
+        ...revision ? { revision } : {},
+        payload,
+        preview
+      })
+    })
+  );
 }
 
 // src/tools/plans.ts
@@ -58738,7 +59182,7 @@ function registerPlanTools(server, client2) {
   server.registerTool(
     "pup_set_plan",
     {
-      description: "Change how a student is dismissed on one or more specific dates, or clear those dates back to the student's weekly default. This changes how a child actually leaves school, so it requires confirm: true; without it you get a dry-run of the exact payload. Read pup_list_transportations first \u2014 options differ in whether they require a note, a car number or an early-dismissal time.",
+      description: `Change how a student is dismissed on one or more specific dates, or clear those dates back to the student's weekly default. This changes how a child actually leaves school. ${CONFIRM_FLOW} The preview shows the exact payload. Read pup_list_transportations first \u2014 options differ in whether they require a note, a car number or an early-dismissal time.`,
       inputSchema: external_exports.object({
         student_id: external_exports.number().int().describe("Student id, from pup_list_students"),
         dates: external_exports.array(external_exports.string()).min(1).describe("One or more YYYY-MM-DD dates to apply this plan to"),
@@ -58748,10 +59192,10 @@ function registerPlanTools(server, client2) {
         note: external_exports.string().optional().describe("Note for the school; required by some options"),
         early_dismissal_time: external_exports.string().optional().describe("HH:MM, required when the option is an early dismissal"),
         car_number: external_exports.string().optional().describe("Car number, for options where usesCarNumbers is true"),
-        confirm: schemaConfirm
+        confirmToken: confirmTokenParam
       })
     },
-    (async ({ student_id, dates, transportation_id, note, early_dismissal_time, car_number, confirm }) => {
+    (async ({ student_id, dates, transportation_id, note, early_dismissal_time, car_number, confirmToken }, ctx) => {
       const student = await client2.getStudent(student_id);
       const transportation = transportation_id === null ? null : await resolveTransportation(client2, student.SchoolId, transportation_id);
       const plans = buildPlanUpdates({
@@ -58763,7 +59207,16 @@ function registerPlanTools(server, client2) {
         carNumber: car_number
       });
       const action = transportation === null ? `Clear ${dates.length} date(s) back to ${student.FirstName ?? "the student"}'s default plan` : `Set ${dates.length} date(s) for ${student.FirstName ?? "the student"} to "${transportation.Name}"`;
-      const gate = previewUnlessConfirmed(confirm, action, "PUT", "UpdatePlans", { Plans: plans });
+      const gate = await confirmWrite(ctx, {
+        tool: "pup_set_plan",
+        action: "plans.set",
+        summary: action,
+        method: "PUT",
+        dto: "UpdatePlans",
+        target: String(student_id),
+        payload: { Plans: plans },
+        confirmToken
+      });
       if (gate) return gate;
       await client2.updatePlans(plans);
       const expected = expectedPlanState({
@@ -58857,7 +59310,7 @@ function registerDefaultPlanTools(server, client2) {
   server.registerTool(
     "pup_set_default_plans",
     {
-      description: "Change a student's weekly default dismissal plan for one or more weekdays, or clear every default. This is how the child leaves school on any date without a specific plan, so it requires confirm: true; without it you get a dry-run. Read pup_list_transportations first.",
+      description: `Change a student's weekly default dismissal plan for one or more weekdays, or clear every default. This is how the child leaves school on any date without a specific plan. ${CONFIRM_FLOW} Read pup_list_transportations first.`,
       inputSchema: external_exports.object({
         student_id: external_exports.number().int().describe("Student id, from pup_list_students"),
         days: external_exports.array(external_exports.union([external_exports.string(), external_exports.number().int()])).optional().describe('Weekdays to change, as names ("Monday") or ids (1 = Sunday \u2026 7 = Saturday)'),
@@ -58865,20 +59318,25 @@ function registerDefaultPlanTools(server, client2) {
         note: external_exports.string().optional().describe("Note for the school; required by some options"),
         early_dismissal_time: external_exports.string().optional().describe("HH:MM, required when the option is an early dismissal"),
         clear_all: external_exports.boolean().optional().describe("Remove every weekday default instead of setting one (days is ignored)"),
-        confirm: schemaConfirm
+        confirmToken: confirmTokenParam
       })
     },
-    (async ({ student_id, days, transportation_id, note, early_dismissal_time, clear_all, confirm }) => {
+    (async ({ student_id, days, transportation_id, note, early_dismissal_time, clear_all, confirmToken }, ctx) => {
       const student = await client2.getStudent(student_id);
       if (clear_all === true) {
         const payload2 = clearDefaultPlans(student);
-        const gate2 = previewUnlessConfirmed(
-          confirm,
-          `Clear every weekday default for ${student.FirstName ?? "the student"}`,
-          "PUT",
-          "Student",
-          { StudentId: student.StudentId, DefaultPlans: [] }
-        );
+        const gate2 = await confirmWrite(ctx, {
+          tool: "pup_set_default_plans",
+          action: "default_plans.clear",
+          summary: `Clear every weekday default for ${student.FirstName ?? "the student"}`,
+          method: "PUT",
+          dto: "Student",
+          target: String(student_id),
+          revision: student.ModifiedDate,
+          payload: payload2,
+          willSend: { StudentId: student.StudentId, DefaultPlans: [] },
+          confirmToken
+        });
         if (gate2) return gate2;
         await client2.updateStudent(payload2);
         const after2 = await client2.getStudent(student_id);
@@ -58910,10 +59368,21 @@ function registerDefaultPlanTools(server, client2) {
       });
       const dayNames = dayIds.map((id) => dayIdToName(id)).join(", ");
       const action = `Set ${student.FirstName ?? "the student"}'s default plan on ${dayNames} to "${transportation.Name}"`;
-      const gate = previewUnlessConfirmed(confirm, action, "PUT", "Student", {
-        StudentId: student.StudentId,
-        DefaultPlans: payload.DefaultPlans,
-        note: "The whole student record is sent back with only DefaultPlans changed."
+      const gate = await confirmWrite(ctx, {
+        tool: "pup_set_default_plans",
+        action: "default_plans.set",
+        summary: action,
+        method: "PUT",
+        dto: "Student",
+        target: String(student_id),
+        revision: student.ModifiedDate,
+        payload,
+        willSend: {
+          StudentId: student.StudentId,
+          DefaultPlans: payload.DefaultPlans,
+          note: "The whole student record is sent back with only DefaultPlans changed."
+        },
+        confirmToken
       });
       if (gate) return gate;
       await client2.updateStudent(payload);
@@ -58949,22 +59418,25 @@ function registerDefaultPlanTools(server, client2) {
   server.registerTool(
     "pup_mark_defaults_reviewed",
     {
-      description: "Mark a student's default plans as reviewed, clearing the school's 'needs review' prompt. Requires confirm: true.",
+      description: `Mark a student's default plans as reviewed, clearing the school's 'needs review' prompt. ${CONFIRM_FLOW}`,
       inputSchema: external_exports.object({
         student_id: external_exports.number().int().describe("Student id, from pup_list_students"),
         reviewed: external_exports.boolean().optional().describe("Defaults to true"),
-        confirm: schemaConfirm
+        confirmToken: confirmTokenParam
       })
     },
-    async ({ student_id, reviewed, confirm }) => {
+    async ({ student_id, reviewed, confirmToken }, ctx) => {
       const value = reviewed ?? true;
-      const gate = previewUnlessConfirmed(
-        confirm,
-        `Mark student ${student_id}'s defaults as ${value ? "reviewed" : "not reviewed"}`,
-        "PUT",
-        "SetDefaultsReviewed",
-        { StudentId: student_id, Reviewed: value }
-      );
+      const gate = await confirmWrite(ctx, {
+        tool: "pup_mark_defaults_reviewed",
+        action: "default_plans.mark_reviewed",
+        summary: `Mark student ${student_id}'s defaults as ${value ? "reviewed" : "not reviewed"}`,
+        method: "PUT",
+        dto: "SetDefaultsReviewed",
+        target: String(student_id),
+        payload: { StudentId: student_id, Reviewed: value },
+        confirmToken
+      });
       if (gate) return gate;
       await client2.setDefaultsReviewed(student_id, value);
       const review = await client2.getDefaultPlansReviewNeeded();

package/dist/tools/_confirm.d.ts

@@ -1,13 +1,37 @@
-import type { CallToolResult } from '@modelcontextprotocol/server';
-import { schemaConfirm } from '@chrischall/mcp-utils';
-export { schemaConfirm };
+import type { CallToolResult, InputRequiredResult, ServerContext } from '@modelcontextprotocol/server';
+import { confirmTokenParam } from '@chrischall/mcp-utils';
+export { confirmTokenParam };
+/** What every gated tool's description says about the confirmation step. */
+export declare const CONFIRM_FLOW = "Asks the user to confirm first: a confirmation prompt where the client supports one; otherwise the first call returns a preview and a confirmToken, and only a repeat call with that token proceeds (see MCP_CONFIRM_MODE).";
+export interface ConfirmWriteOptions {
+    /** The tool name the token is bound to. */
+    tool: string;
+    /** `<service>.<verb>` identifier for the operation. */
+    action: string;
+    /** Human-readable sentence describing what will change. */
+    summary: string;
+    method: string;
+    dto: string;
+    /** The primary id acted on. */
+    target: string;
+    /** A version of the target that rotates on edit, when the API has one. */
+    revision?: string | null | undefined;
+    /** EXACTLY what the write will send — hashed into the token. */
+    payload: unknown;
+    /** What the preview shows as `willSend`; defaults to `payload`. */
+    willSend?: unknown;
+    /** The phase-2 token from the tool's input. */
+    confirmToken: string | undefined;
+}
 /**
- * Confirm-gate for a mutating tool (the fleet convention). Without
- * `confirm: true` the tool makes **no** network call and returns a dry-run
- * preview of exactly what would be sent.
+ * Confirm-gate for a mutating tool. A client that can show a prompt gets one;
+ * one that cannot gets the two-step token flow (MCP_CONFIRM_MODE): phase 1
+ * makes **no** write and returns the preview plus a token, phase 2 proceeds
+ * only if the freshly rebuilt payload still matches what was previewed.
+ * `undefined` means proceed; anything else is the result to return.
  *
  * The gate matters more here than in most of the fleet: these writes change
  * how a child leaves school. A hallucinated call must not silently put a
  * student on a different bus.
  */
-export declare function previewUnlessConfirmed(confirm: boolean | undefined, action: string, method: string, dto: string, body?: unknown): CallToolResult | null;
+export declare function confirmWrite(ctx: ServerContext, options: ConfirmWriteOptions): Promise<InputRequiredResult | CallToolResult | undefined>;

package/dist/tools/_confirm.js

@@ -1,23 +1,32 @@
-import { minifiedResult, schemaConfirm } from '@chrischall/mcp-utils';
-export { schemaConfirm };
+import { confirmationFromEnv, confirmTokenParam, requireConfirmationWithFallback, } from '@chrischall/mcp-utils';
+export { confirmTokenParam };
+/** What every gated tool's description says about the confirmation step. */
+export const CONFIRM_FLOW = 'Asks the user to confirm first: a confirmation prompt where the client supports one; otherwise the first call returns a preview and a confirmToken, and only a repeat call with that token proceeds (see MCP_CONFIRM_MODE).';
 /**
- * Confirm-gate for a mutating tool (the fleet convention). Without
- * `confirm: true` the tool makes **no** network call and returns a dry-run
- * preview of exactly what would be sent.
+ * Confirm-gate for a mutating tool. A client that can show a prompt gets one;
+ * one that cannot gets the two-step token flow (MCP_CONFIRM_MODE): phase 1
+ * makes **no** write and returns the preview plus a token, phase 2 proceeds
+ * only if the freshly rebuilt payload still matches what was previewed.
+ * `undefined` means proceed; anything else is the result to return.
  *
  * The gate matters more here than in most of the fleet: these writes change
  * how a child leaves school. A hallucinated call must not silently put a
  * student on a different bus.
  */
-export function previewUnlessConfirmed(confirm, action, method, dto, body) {
-    if (confirm === true)
-        return null;
-    return minifiedResult({
-        dryRun: true,
+export function confirmWrite(ctx, options) {
+    const { tool, action, summary, method, dto, target, revision, payload, willSend, confirmToken } = options;
+    const preview = { action: summary, method, dto, willSend: willSend ?? payload };
+    return requireConfirmationWithFallback(ctx, confirmationFromEnv({
         action,
-        method,
-        dto,
-        ...(body !== undefined ? { willSend: body } : {}),
-        note: 'Re-run with confirm: true to execute.',
-    });
+        message: `Review and confirm this change: ${summary}`,
+        details: preview,
+        tool,
+        confirmToken,
+        subject: () => ({
+            target,
+            ...(revision ? { revision } : {}),
+            payload,
+            preview,
+        }),
+    }));
 }

package/dist/tools/defaults.js

@@ -4,7 +4,7 @@ import { applyDefaultPlans, clearDefaultPlans } from '../plans.js';
 import { dayIdToName, nameToDayId } from '../dates.js';
 import { summarizeDefaultPlans } from './account.js';
 import { proofsMatch, resolveTransportation } from './plans.js';
-import { previewUnlessConfirmed, schemaConfirm } from './_confirm.js';
+import { CONFIRM_FLOW, confirmTokenParam, confirmWrite } from './_confirm.js';
 /**
  * Accept weekdays as names ("Monday") or ids (1 = Sunday … 7 = Saturday).
  * A name that is not a weekday is rejected rather than coerced — silently
@@ -54,7 +54,7 @@ export function registerDefaultPlanTools(server, client) {
         });
     });
     server.registerTool('pup_set_default_plans', {
-        description: "Change a student's weekly default dismissal plan for one or more weekdays, or clear every default. This is how the child leaves school on any date without a specific plan, so it requires confirm: true; without it you get a dry-run. Read pup_list_transportations first.",
+        description: `Change a student's weekly default dismissal plan for one or more weekdays, or clear every default. This is how the child leaves school on any date without a specific plan. ${CONFIRM_FLOW} Read pup_list_transportations first.`,
         inputSchema: z.object({
             student_id: z.number().int().describe('Student id, from pup_list_students'),
             days: z
@@ -75,17 +75,30 @@ export function registerDefaultPlanTools(server, client) {
                 .boolean()
                 .optional()
                 .describe('Remove every weekday default instead of setting one (days is ignored)'),
-            confirm: schemaConfirm,
+            confirmToken: confirmTokenParam,
         }),
-    }, (async ({ student_id, days, transportation_id, note, early_dismissal_time, clear_all, confirm }) => {
+    }, (async ({ student_id, days, transportation_id, note, early_dismissal_time, clear_all, confirmToken }, ctx) => {
         // Read-modify-write: PickUp Patrol has no default-plans endpoint, so the
         // whole student record round-trips. Reading it here (before the confirm
-        // gate) is what makes the dry-run show the real payload; it mutates
-        // nothing.
+        // gate, on every call) is what makes the preview show the real payload;
+        // it mutates nothing. The whole record is the token's payload, so a
+        // change to it between preview and approval — which this write would
+        // otherwise silently overwrite — is refused as DRAFT_CHANGED.
         const student = await client.getStudent(student_id);
         if (clear_all === true) {
             const payload = clearDefaultPlans(student);
-            const gate = previewUnlessConfirmed(confirm, `Clear every weekday default for ${student.FirstName ?? 'the student'}`, 'PUT', 'Student', { StudentId: student.StudentId, DefaultPlans: [] });
+            const gate = await confirmWrite(ctx, {
+                tool: 'pup_set_default_plans',
+                action: 'default_plans.clear',
+                summary: `Clear every weekday default for ${student.FirstName ?? 'the student'}`,
+                method: 'PUT',
+                dto: 'Student',
+                target: String(student_id),
+                revision: student.ModifiedDate,
+                payload,
+                willSend: { StudentId: student.StudentId, DefaultPlans: [] },
+                confirmToken,
+            });
             if (gate)
                 return gate;
             await client.updateStudent(payload);
@@ -116,10 +129,21 @@ export function registerDefaultPlanTools(server, client) {
         });
         const dayNames = dayIds.map((id) => dayIdToName(id)).join(', ');
         const action = `Set ${student.FirstName ?? 'the student'}'s default plan on ${dayNames} to "${transportation.Name}"`;
-        const gate = previewUnlessConfirmed(confirm, action, 'PUT', 'Student', {
-            StudentId: student.StudentId,
-            DefaultPlans: payload.DefaultPlans,
-            note: 'The whole student record is sent back with only DefaultPlans changed.',
+        const gate = await confirmWrite(ctx, {
+            tool: 'pup_set_default_plans',
+            action: 'default_plans.set',
+            summary: action,
+            method: 'PUT',
+            dto: 'Student',
+            target: String(student_id),
+            revision: student.ModifiedDate,
+            payload,
+            willSend: {
+                StudentId: student.StudentId,
+                DefaultPlans: payload.DefaultPlans,
+                note: 'The whole student record is sent back with only DefaultPlans changed.',
+            },
+            confirmToken,
         });
         if (gate)
             return gate;
@@ -161,15 +185,24 @@ export function registerDefaultPlanTools(server, client) {
         });
     }));
     server.registerTool('pup_mark_defaults_reviewed', {
-        description: "Mark a student's default plans as reviewed, clearing the school's 'needs review' prompt. Requires confirm: true.",
+        description: `Mark a student's default plans as reviewed, clearing the school's 'needs review' prompt. ${CONFIRM_FLOW}`,
         inputSchema: z.object({
             student_id: z.number().int().describe('Student id, from pup_list_students'),
             reviewed: z.boolean().optional().describe('Defaults to true'),
-            confirm: schemaConfirm,
+            confirmToken: confirmTokenParam,
         }),
-    }, async ({ student_id, reviewed, confirm }) => {
+    }, async ({ student_id, reviewed, confirmToken }, ctx) => {
         const value = reviewed ?? true;
-        const gate = previewUnlessConfirmed(confirm, `Mark student ${student_id}'s defaults as ${value ? 'reviewed' : 'not reviewed'}`, 'PUT', 'SetDefaultsReviewed', { StudentId: student_id, Reviewed: value });
+        const gate = await confirmWrite(ctx, {
+            tool: 'pup_mark_defaults_reviewed',
+            action: 'default_plans.mark_reviewed',
+            summary: `Mark student ${student_id}'s defaults as ${value ? 'reviewed' : 'not reviewed'}`,
+            method: 'PUT',
+            dto: 'SetDefaultsReviewed',
+            target: String(student_id),
+            payload: { StudentId: student_id, Reviewed: value },
+            confirmToken,
+        });
         if (gate)
             return gate;
         await client.setDefaultsReviewed(student_id, value);

package/dist/tools/plans.js

@@ -2,7 +2,7 @@ import { z } from 'zod';
 import { McpToolError, minifiedResult } from '@chrischall/mcp-utils';
 import { buildPlanUpdates } from '../plans.js';
 import { weekdayOf } from '../dates.js';
-import { previewUnlessConfirmed, schemaConfirm } from './_confirm.js';
+import { CONFIRM_FLOW, confirmTokenParam, confirmWrite } from './_confirm.js';
 /**
  * Reduce a time of day to `HH:MM:SS` so a read-back can be compared with what
  * was sent. Accepts `H:MM`, `HH:MM:SS`, an ISO date-time, and the XSD duration
@@ -90,7 +90,7 @@ export function registerPlanTools(server, client) {
         }),
     }, async ({ student_id, date }) => minifiedResult(await client.getPlanEdit(date, student_id)));
     server.registerTool('pup_set_plan', {
-        description: "Change how a student is dismissed on one or more specific dates, or clear those dates back to the student's weekly default. This changes how a child actually leaves school, so it requires confirm: true; without it you get a dry-run of the exact payload. Read pup_list_transportations first — options differ in whether they require a note, a car number or an early-dismissal time.",
+        description: `Change how a student is dismissed on one or more specific dates, or clear those dates back to the student's weekly default. This changes how a child actually leaves school. ${CONFIRM_FLOW} The preview shows the exact payload. Read pup_list_transportations first — options differ in whether they require a note, a car number or an early-dismissal time.`,
         inputSchema: z.object({
             student_id: z.number().int().describe('Student id, from pup_list_students'),
             dates: z
@@ -111,14 +111,15 @@ export function registerPlanTools(server, client) {
                 .string()
                 .optional()
                 .describe('Car number, for options where usesCarNumbers is true'),
-            confirm: schemaConfirm,
+            confirmToken: confirmTokenParam,
         }),
-    }, (async ({ student_id, dates, transportation_id, note, early_dismissal_time, car_number, confirm }) => {
+    }, (async ({ student_id, dates, transportation_id, note, early_dismissal_time, car_number, confirmToken }, ctx) => {
         // The reads below resolve and validate the payload; they mutate nothing.
-        // Running them before the confirm gate is deliberate: it makes the
-        // dry-run show the exact bytes that would be sent, already checked
-        // against this school's rules, instead of an unvalidated echo of the
-        // arguments.
+        // Running them before the confirm gate — on every call, both phases — is
+        // deliberate: it makes the preview show the exact bytes that would be
+        // sent, already checked against this school's rules, and phase 2 hashes
+        // a freshly rebuilt payload, so anything that moved since the preview is
+        // refused as DRAFT_CHANGED.
         const student = await client.getStudent(student_id);
         const transportation = transportation_id === null
             ? null
@@ -134,7 +135,16 @@ export function registerPlanTools(server, client) {
         const action = transportation === null
             ? `Clear ${dates.length} date(s) back to ${student.FirstName ?? 'the student'}'s default plan`
             : `Set ${dates.length} date(s) for ${student.FirstName ?? 'the student'} to "${transportation.Name}"`;
-        const gate = previewUnlessConfirmed(confirm, action, 'PUT', 'UpdatePlans', { Plans: plans });
+        const gate = await confirmWrite(ctx, {
+            tool: 'pup_set_plan',
+            action: 'plans.set',
+            summary: action,
+            method: 'PUT',
+            dto: 'UpdatePlans',
+            target: String(student_id),
+            payload: { Plans: plans },
+            confirmToken,
+        });
         if (gate)
             return gate;
         await client.updatePlans(plans);

package/dist/version.d.ts

@@ -7,4 +7,4 @@
  * annotation, so there is exactly one line to keep in sync and
  * `versionSyncTest` has exactly one line to check.
  */
-export declare const VERSION = "1.0.2";
+export declare const VERSION = "1.1.0";

package/dist/version.js

@@ -7,4 +7,4 @@
  * annotation, so there is exactly one line to keep in sync and
  * `versionSyncTest` has exactly one line to check.
  */
-export const VERSION = '1.0.2'; // x-release-please-version
+export const VERSION = '1.1.0'; // x-release-please-version

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "@chrischall/pickuppatrol-mcp",
-  "version": "1.0.2",
+  "version": "1.1.0",
   "license": "MIT",
   "mcpName": "io.github.chrischall/pickuppatrol-mcp",
   "description": "PickUp Patrol MCP server for Claude — developed and maintained by AI (Claude Code)",
@@ -57,7 +57,7 @@
     "test:watch": "vitest"
   },
   "dependencies": {
-    "@chrischall/mcp-utils": "^2.4.0",
+    "@chrischall/mcp-utils": "^2.6.0",
     "@modelcontextprotocol/server": "^2.0.0",
     "dotenv": "^17.4.0",
     "zod": "^4.6.5"

package/server.json

@@ -6,12 +6,12 @@
     "url": "https://github.com/chrischall/pickuppatrol-mcp",
     "source": "github"
   },
-  "version": "1.0.2",
+  "version": "1.1.0",
   "packages": [
     {
       "registryType": "npm",
       "identifier": "@chrischall/pickuppatrol-mcp",
-      "version": "1.0.2",
+      "version": "1.1.0",
       "transport": {
         "type": "stdio"
       }