@pan-sec/notebooklm-mcp 2026.3.3 → 2026.4.1

package/dist/tools/definitions/chat-history.d.ts

@@ -53,4 +53,3 @@ export declare const chatHistoryTools: {
     }[] | undefined;
     title?: string | undefined;
 }[];
-//# sourceMappingURL=chat-history.d.ts.map

package/dist/tools/definitions/chat-history.js

@@ -70,6 +70,7 @@ Paginate through history:
             },
             output_file: {
                 type: "string",
+                pattern: "^(?!.*\\.\\.)(?!~)/.+",
                 maxLength: 500,
                 description: "If provided, exports chat history to this JSON file instead of returning to context. Useful for large histories.",
             },
@@ -81,4 +82,3 @@ Paginate through history:
     },
 };
 export const chatHistoryTools = [getNotebookChatHistoryTool];
-//# sourceMappingURL=chat-history.js.map

package/dist/tools/definitions/data-tables.d.ts

@@ -8,4 +8,3 @@ import type { Tool } from "@modelcontextprotocol/sdk/types.js";
  * All data table tools
  */
 export declare const dataTableTools: Tool[];
-//# sourceMappingURL=data-tables.d.ts.map

package/dist/tools/definitions/data-tables.js

@@ -35,6 +35,8 @@ const generateDataTableTool = {
             },
             notebook_url: {
                 type: "string",
+                pattern: "^https://notebooklm\\.google\\.com/",
+                maxLength: 512,
                 description: "Or direct notebook URL (overrides notebook_id)",
             },
         },
@@ -76,6 +78,8 @@ const getDataTableTool = {
             },
             notebook_url: {
                 type: "string",
+                pattern: "^https://notebooklm\\.google\\.com/",
+                maxLength: 512,
                 description: "Or direct notebook URL (overrides notebook_id)",
             },
         },
@@ -88,4 +92,3 @@ export const dataTableTools = [
     generateDataTableTool,
     getDataTableTool,
 ];
-//# sourceMappingURL=data-tables.js.map

package/dist/tools/definitions/gemini.d.ts

@@ -9,4 +9,3 @@ import type { Tool } from "@modelcontextprotocol/sdk/types.js";
  * All Gemini tools
  */
 export declare const geminiTools: Tool[];
-//# sourceMappingURL=gemini.d.ts.map

package/dist/tools/definitions/gemini.js

@@ -128,14 +128,22 @@ Supports:
             },
             response_schema: {
                 type: "object",
-                description: "JSON schema for structured output. When provided, Gemini returns valid JSON matching this schema. Example: { type: 'object', properties: { name: { type: 'string' }, score: { type: 'number' } }, required: ['name'] }",
+                // L21: This is a user-supplied JSON Schema passed through to Gemini for
+                // structured output. Bound it so it can't be used as an unbounded
+                // arbitrary-object passthrough: cap the number of properties at each
+                // level. The nested `properties`/`items` maps still use
+                // additionalProperties (a JSON Schema's field names are open-ended) but
+                // are length-capped via maxProperties. The handler should additionally
+                // reject excessively deep/large schemas before forwarding to Gemini.
+                description: "JSON schema for structured output (max ~50 fields per level). When provided, Gemini returns valid JSON matching this schema. Example: { type: 'object', properties: { name: { type: 'string' }, score: { type: 'number' } }, required: ['name'] }",
+                maxProperties: 16,
                 properties: {
                     type: { type: "string", enum: ["object", "array", "string", "number", "boolean"] },
-                    properties: { type: "object", additionalProperties: true },
-                    items: { type: "object", additionalProperties: true },
-                    required: { type: "array", items: { type: "string" } },
-                    enum: { type: "array" },
-                    description: { type: "string" },
+                    properties: { type: "object", additionalProperties: true, maxProperties: 50 },
+                    items: { type: "object", additionalProperties: true, maxProperties: 50 },
+                    required: { type: "array", items: { type: "string" }, maxItems: 50 },
+                    enum: { type: "array", maxItems: 100 },
+                    description: { type: "string", maxLength: 500 },
                 },
                 additionalProperties: true,
             },
@@ -429,4 +437,3 @@ export const geminiTools = [
     // Chunked document tools (v1.10.0)
     queryChunkedDocumentTool,
 ];
-//# sourceMappingURL=gemini.js.map

package/dist/tools/definitions/notebook-management.d.ts

@@ -1,3 +1,2 @@
 import { Tool } from "@modelcontextprotocol/sdk/types.js";
 export declare const notebookManagementTools: Tool[];
-//# sourceMappingURL=notebook-management.d.ts.map

package/dist/tools/definitions/notebook-management.js

@@ -154,7 +154,7 @@ Tip: You may update multiple fields at once if requested.`,
                 content_types: {
                     type: "array",
                     items: { type: "string", maxLength: 100 },
-                    maxItems: 20,
+                    maxItems: 50,
                     description: "New content types",
                 },
                 use_cases: {
@@ -786,6 +786,8 @@ Summary with:
                 },
                 notebook_url: {
                     type: "string",
+                    pattern: "^https://notebooklm\\.google\\.com/",
+                    maxLength: 512,
                     description: "Or direct notebook URL (overrides notebook_id)",
                 },
             },
@@ -814,6 +816,8 @@ Summary with:
                 },
                 notebook_url: {
                     type: "string",
+                    pattern: "^https://notebooklm\\.google\\.com/",
+                    maxLength: 512,
                     description: "Or direct notebook URL (overrides notebook_id)",
                 },
             },
@@ -847,6 +851,8 @@ Downloads to specified path or ~/notebooklm-audio-{timestamp}.mp3
                 },
                 notebook_url: {
                     type: "string",
+                    pattern: "^https://notebooklm\\.google\\.com/",
+                    maxLength: 512,
                     description: "Or direct notebook URL (overrides notebook_id)",
                 },
                 output_path: {
@@ -859,4 +865,3 @@ Downloads to specified path or ~/notebooklm-audio-{timestamp}.mp3
         },
     },
 ];
-//# sourceMappingURL=notebook-management.js.map

package/dist/tools/definitions/query-history.d.ts

@@ -52,4 +52,3 @@ export declare const queryHistoryTools: {
     }[] | undefined;
     title?: string | undefined;
 }[];
-//# sourceMappingURL=query-history.d.ts.map

package/dist/tools/definitions/query-history.js

@@ -48,4 +48,3 @@ Returns query entries with question, answer, notebook, session, and timing info.
     },
 };
 export const queryHistoryTools = [queryHistoryTool];
-//# sourceMappingURL=query-history.js.map

package/dist/tools/definitions/session-management.d.ts

@@ -1,3 +1,2 @@
 import { Tool } from "@modelcontextprotocol/sdk/types.js";
 export declare const sessionManagementTools: Tool[];
-//# sourceMappingURL=session-management.d.ts.map

package/dist/tools/definitions/session-management.js

@@ -43,4 +43,3 @@ export const sessionManagementTools = [
         },
     },
 ];
-//# sourceMappingURL=session-management.js.map

package/dist/tools/definitions/system.d.ts

@@ -1,3 +1,2 @@
 import { Tool } from "@modelcontextprotocol/sdk/types.js";
 export declare const systemTools: Tool[];
-//# sourceMappingURL=system.d.ts.map

package/dist/tools/definitions/system.js

@@ -44,7 +44,7 @@ export const systemTools = [
             "This catches stale sessions where cookies exist but the UI won't load. " +
             "Returns `chat_ui_accessible: true/false`.\n\n" +
             "If authenticated=false and having persistent issues:\n" +
-            "Consider running cleanup_data(preserve_library=true) + setup_auth for fresh start with clean browser session.",
+            "Suggest to the user that a fresh start (cleanup_data with preserve_library=true, followed by setup_auth) may help, and ask for their confirmation before running any cleanup, since cleanup_data deletes browser/session data.",
         inputSchema: {
             type: "object",
             additionalProperties: false,
@@ -66,10 +66,10 @@ export const systemTools = [
         "Use this for first-time authentication or when auto-login credentials are not available. " +
         "For switching accounts or rate-limit workarounds, use 're_auth' tool instead.\n\n" +
         "TROUBLESHOOTING for persistent auth issues:\n" +
-        "If setup_auth fails or you encounter browser/session issues:\n" +
-        "1. Ask user to close ALL Chrome/Chromium instances\n" +
-        "2. Run cleanup_data(confirm=true, preserve_library=true) to clean old data\n" +
-        "3. Run setup_auth again for fresh start\n" +
+        "If setup_auth fails or you encounter browser/session issues, suggest these steps to the user and get their confirmation before running any cleanup (cleanup_data deletes browser/session data):\n" +
+        "1. Ask the user to close ALL Chrome/Chromium instances\n" +
+        "2. Ask the user before running cleanup_data(confirm=true, preserve_library=true) to clean old data\n" +
+        "3. Run setup_auth again for a fresh start\n" +
         "This helps resolve conflicts from old browser sessions and installation data."),
     buildAuthTool("re_auth", "Switch to a different Google account or re-authenticate. " +
         "Use this when:\n" +
@@ -82,11 +82,11 @@ export const systemTools = [
         "3. Open browser for fresh Google login\n\n" +
         "After completion, use 'get_health' to verify authentication.\n\n" +
         "TROUBLESHOOTING for persistent auth issues:\n" +
-        "If re_auth fails repeatedly:\n" +
-        "1. Ask user to close ALL Chrome/Chromium instances\n" +
-        "2. Run cleanup_data(confirm=false, preserve_library=true) to preview old files\n" +
-        "3. Run cleanup_data(confirm=true, preserve_library=true) to clean everything except library\n" +
-        "4. Run re_auth again for completely fresh start\n" +
+        "If re_auth fails repeatedly, suggest these steps to the user and ask for their confirmation before running any cleanup (cleanup_data deletes browser/session and installation data):\n" +
+        "1. Ask the user to close ALL Chrome/Chromium instances\n" +
+        "2. Run cleanup_data(confirm=false, preserve_library=true) to preview the files that would be removed\n" +
+        "3. Only after the user reviews the preview and confirms, run cleanup_data(confirm=true, preserve_library=true) to clean everything except the library\n" +
+        "4. Run re_auth again for a completely fresh start\n" +
         "This removes old installation data and browser sessions that can cause conflicts."),
     {
         name: "cleanup_data",
@@ -232,7 +232,28 @@ export const systemTools = [
                 },
                 events: {
                     type: "array",
-                    items: { type: "string" },
+                    // Restrict to known EventType values (see src/events/event-types.ts)
+                    // plus "*"; cap length to prevent unbounded subscription storage (H7).
+                    items: {
+                        type: "string",
+                        enum: [
+                            "question_answered",
+                            "notebook_created",
+                            "notebook_deleted",
+                            "source_added",
+                            "source_removed",
+                            "session_created",
+                            "session_expired",
+                            "auth_required",
+                            "rate_limit_hit",
+                            "security_incident",
+                            "quota_warning",
+                            "audio_generated",
+                            "batch_complete",
+                            "*",
+                        ],
+                    },
+                    maxItems: 20,
                     description: 'Events to subscribe to. Use ["*"] for all events.',
                 },
                 format: {
@@ -290,4 +311,3 @@ export const systemTools = [
         },
     },
 ];
-//# sourceMappingURL=system.js.map

package/dist/tools/definitions/video.d.ts

@@ -8,4 +8,3 @@ import type { Tool } from "@modelcontextprotocol/sdk/types.js";
  * All video tools
  */
 export declare const videoTools: Tool[];
-//# sourceMappingURL=video.d.ts.map

package/dist/tools/definitions/video.js

@@ -40,7 +40,7 @@ const generateVideoOverviewTool = {
 
 ## Example
 \`\`\`json
-{ "notebook_id": "my-research", "style": "documentary", "format": "brief" }
+{ "notebook_id": "my-research", "style": "whiteboard", "format": "brief" }
 \`\`\``,
     inputSchema: {
         type: "object",
@@ -52,11 +52,13 @@ const generateVideoOverviewTool = {
             },
             notebook_url: {
                 type: "string",
+                pattern: "^https://notebooklm\\.google\\.com/",
+                maxLength: 512,
                 description: "Or direct notebook URL (overrides notebook_id)",
             },
             style: {
                 type: "string",
-                enum: ["auto-select", "custom", "classic", "whiteboard", "kawaii", "anime", "watercolour", "retro-print", "heritage", "paper-craft", "documentary"],
+                enum: ["auto-select", "custom", "classic", "whiteboard", "kawaii", "anime", "watercolour", "retro-print", "heritage", "paper-craft"],
                 default: "auto-select",
                 description: "Visual style for the video overview",
             },
@@ -95,6 +97,8 @@ const getVideoStatusTool = {
             },
             notebook_url: {
                 type: "string",
+                pattern: "^https://notebooklm\\.google\\.com/",
+                maxLength: 512,
                 description: "Or direct notebook URL (overrides notebook_id)",
             },
         },
@@ -107,4 +111,3 @@ export const videoTools = [
     generateVideoOverviewTool,
     getVideoStatusTool,
 ];
-//# sourceMappingURL=video.js.map

package/dist/tools/definitions.d.ts

@@ -13,4 +13,3 @@ import { NotebookLibrary } from "../library/notebook-library.js";
  * Includes enhanced metadata (icons, annotations, titles) for better UX
  */
 export declare function buildToolDefinitions(library: NotebookLibrary): Tool[];
-//# sourceMappingURL=definitions.d.ts.map

package/dist/tools/definitions.js

@@ -64,4 +64,3 @@ export function buildToolDefinitions(library) {
     // Apply enhanced metadata to all tools
     return allTools.map(enhanceTool);
 }
-//# sourceMappingURL=definitions.js.map

package/dist/tools/handlers/ask-question.d.ts

@@ -15,4 +15,3 @@ export declare function handleAskQuestion(ctx: HandlerContext, args: {
     show_browser?: boolean;
     browser_options?: BrowserOptions;
 }, sendProgress?: ProgressCallback): Promise<ToolResult<AskQuestionResult>>;
-//# sourceMappingURL=ask-question.d.ts.map

package/dist/tools/handlers/ask-question.js

@@ -83,19 +83,6 @@ export async function handleAskQuestion(ctx, args, sendProgress) {
                 error: `Rate limit exceeded. Please wait before making more requests. Remaining: ${ctx.rateLimiter.getRemaining(rateLimitKey)}`,
             };
         }
-        // === QUOTA CHECK ===
-        const quotaManager = getQuotaManager();
-        const canQuery = quotaManager.canMakeQuery();
-        if (!canQuery.allowed) {
-            log.warning(`⚠️ Quota limit: ${canQuery.reason}`);
-            const quotaError = canQuery.reason || "Query quota exceeded";
-            await audit.tool("ask_question", getErrorAuditArgs("ask_question", quotaError), false, Date.now() - startTime, quotaError);
-            return {
-                success: false,
-                data: null,
-                error: quotaError || "Daily query limit reached. Try again tomorrow or upgrade your plan.",
-            };
-        }
         const browserOptionError = validateBrowserOptionRanges(browser_options);
         if (browserOptionError) {
             await audit.tool("ask_question", getErrorAuditArgs("ask_question", browserOptionError), false, Date.now() - startTime, browserOptionError);
@@ -123,6 +110,31 @@ export async function handleAskQuestion(ctx, args, sendProgress) {
         }
         throw error;
     }
+    // === QUOTA CHECK-AND-RESERVE (TOCTOU-safe) ===
+    // Atomically reserve a quota slot BEFORE running the (slow) browser query.
+    // This closes the race where concurrent sessions all pass a stale check and
+    // then increment afterwards, collectively exceeding the daily limit.
+    //
+    // This runs AFTER all up-front validation (so we never reserve a slot only to
+    // bail out on a validation error and leak it) and immediately before the
+    // query's try/catch — whose catch releases the slot if the query fails.
+    const quotaManager = getQuotaManager();
+    const canQuery = await quotaManager.checkAndReserveQuery();
+    if (!canQuery.allowed) {
+        log.warning(`⚠️ Quota limit: ${canQuery.reason}`);
+        const quotaError = canQuery.reason || "Query quota exceeded";
+        await audit.tool("ask_question", getErrorAuditArgs("ask_question", quotaError), false, Date.now() - startTime, quotaError);
+        return {
+            success: false,
+            data: null,
+            error: quotaError || "Daily query limit reached. Try again tomorrow or upgrade your plan.",
+        };
+    }
+    // Tracks whether the reserved quota slot has been consumed by a query that
+    // actually ran. Once the query returns, the slot is legitimately spent and
+    // must NOT be released even if later post-success bookkeeping (logging/audit)
+    // throws — otherwise we'd under-count and report a successful query as failed.
+    let querySlotConsumed = false;
     try {
         // Resolve notebook URL (using validated values)
         let resolvedNotebookUrl = safeNotebookUrl;
@@ -165,6 +177,10 @@ export async function handleAskQuestion(ctx, args, sendProgress) {
         await sendProgress?.("Asking question to NotebookLM...", 2, 5);
         // Ask the question (pass progress callback) - using validated question
         const rawAnswer = await session.ask(safeQuestion, sendProgress);
+        // The query ran: the reserved quota slot is now legitimately consumed.
+        // Anything that throws after this point is post-success bookkeeping and
+        // must NOT release the slot.
+        querySlotConsumed = true;
         // === SECURITY: Validate response for prompt injection & malicious content ===
         await sendProgress?.("Validating response security...", 4, 5);
         const validationResult = await validateResponse(rawAnswer);
@@ -216,8 +232,10 @@ export async function handleAskQuestion(ctx, args, sendProgress) {
         // Progress: Complete
         await sendProgress?.("Question answered successfully!", 5, 5);
         log.success(`✅ [TOOL] ask_question completed successfully`);
-        // Update quota tracking (atomic for concurrent session safety)
-        await getQuotaManager().incrementQueryCountAtomic();
+        // NOTE: the quota slot was already reserved (incremented) up front by
+        // checkAndReserveQuery(), so we do NOT increment again here — doing so
+        // would double-count. quotaStatus (from getDetailedStatus above) already
+        // reflects the reserved count.
         // Log query for research history (Phase 1)
         const queryLogger = getQueryLogger();
         const resolvedNotebook = safeNotebookId ? ctx.library.getNotebook(safeNotebookId) : null;
@@ -231,9 +249,10 @@ export async function handleAskQuestion(ctx, args, sendProgress) {
             answerLength: finalAnswer.length,
             durationMs: Date.now() - startTime,
             quotaInfo: {
-                used: quotaStatus.queries.used + 1, // +1 because we just incremented
+                // Reservation already counted; no +1/-1 adjustment needed.
+                used: quotaStatus.queries.used,
                 limit: quotaStatus.queries.limit,
-                remaining: quotaStatus.queries.remaining - 1,
+                remaining: quotaStatus.queries.remaining,
                 tier: quotaStatus.tier,
             },
         });
@@ -250,6 +269,17 @@ export async function handleAskQuestion(ctx, args, sendProgress) {
     }
     catch (error) {
         const errorMessage = getSanitizedErrorMessage(error);
+        // The quota slot was reserved up front. Release it ONLY if the failure
+        // happened before/during the query (the slot was never consumed). If the
+        // query already ran, the slot is legitimately spent and is kept.
+        if (!querySlotConsumed) {
+            try {
+                await getQuotaManager().releaseReservation();
+            }
+            catch (releaseError) {
+                log.warning(`⚠️ Failed to release reserved quota slot: ${releaseError instanceof Error ? releaseError.message : String(releaseError)}`);
+            }
+        }
         // Special handling for rate limit errors
         if (error instanceof RateLimitError) {
             log.error(`🚫 [TOOL] Rate limit detected`);
@@ -277,4 +307,3 @@ export async function handleAskQuestion(ctx, args, sendProgress) {
         };
     }
 }
-//# sourceMappingURL=ask-question.js.map

package/dist/tools/handlers/audio-video.d.ts

@@ -39,4 +39,3 @@ export declare function handleGetDataTable(ctx: HandlerContext, args: {
     notebook_id?: string;
     notebook_url?: string;
 }): Promise<ToolResult<GetDataTableResult>>;
-//# sourceMappingURL=audio-video.d.ts.map

package/dist/tools/handlers/audio-video.js

@@ -214,4 +214,3 @@ export async function handleGetDataTable(ctx, args) {
         };
     }
 }
-//# sourceMappingURL=audio-video.js.map

package/dist/tools/handlers/auth.d.ts

@@ -33,4 +33,3 @@ export declare function handleSetupAuth(ctx: HandlerContext, args: AuthHandlerAr
  */
 export declare function handleReAuth(ctx: HandlerContext, args: AuthHandlerArgs, sendProgress?: ProgressCallback): Promise<ToolResult<AuthResult>>;
 export {};
-//# sourceMappingURL=auth.d.ts.map

package/dist/tools/handlers/auth.js

@@ -124,4 +124,3 @@ export async function handleSetupAuth(ctx, args, sendProgress) {
 export async function handleReAuth(ctx, args, sendProgress) {
     return authenticate(ctx, args, "re_auth", sendProgress);
 }
-//# sourceMappingURL=auth.js.map

package/dist/tools/handlers/error-utils.d.ts

@@ -13,4 +13,3 @@ export declare function resolveNotebookUrl(ctx: HandlerContext, args: {
 export declare function sanitizeErrorMessage(errorMsg: string): string;
 export declare function getSanitizedErrorMessage(error: unknown): string;
 export declare function getErrorAuditArgs(tool: string, error: unknown): Record<string, string>;
-//# sourceMappingURL=error-utils.d.ts.map

package/dist/tools/handlers/error-utils.js

@@ -36,4 +36,3 @@ export function getErrorAuditArgs(tool, error) {
         error: getSanitizedErrorMessage(error),
     };
 }
-//# sourceMappingURL=error-utils.js.map

package/dist/tools/handlers/gemini.d.ts

@@ -141,4 +141,3 @@ export declare function handleGetNotebookChatHistory(ctx: HandlerContext, args:
         index: number;
     }>;
 }>>;
-//# sourceMappingURL=gemini.d.ts.map

package/dist/tools/handlers/gemini.js

@@ -660,4 +660,3 @@ export async function handleGetNotebookChatHistory(ctx, args) {
         };
     }
 }
-//# sourceMappingURL=gemini.js.map

package/dist/tools/handlers/index.d.ts

@@ -284,4 +284,3 @@ export declare class ToolHandlers {
     }>>;
     cleanup(): Promise<void>;
 }
-//# sourceMappingURL=index.d.ts.map

package/dist/tools/handlers/index.js

@@ -205,4 +205,3 @@ export class ToolHandlers {
         log.info("Tool handlers cleanup complete");
     }
 }
-//# sourceMappingURL=index.js.map

package/dist/tools/handlers/notebook-creation.d.ts

@@ -72,4 +72,3 @@ export declare function handleRemoveSource(ctx: HandlerContext, args: {
     notebook_url?: string;
     source_id: string;
 }): Promise<ToolResult<RemoveSourceResult>>;
-//# sourceMappingURL=notebook-creation.d.ts.map

package/dist/tools/handlers/notebook-creation.js

@@ -68,6 +68,22 @@ export async function handleCreateNotebook(ctx, args, sendProgress) {
             sendProgress,
             browserOptions: args.browser_options || (args.show_browser ? { show: true } : undefined),
         });
+        // A notebook where sources were requested but NONE succeeded is discarded
+        // by the creator (which throws), so we never reach here for that case.
+        // Guard defensively anyway: never persist a library entry or count quota
+        // for a notebook that requested sources yet added none. (An empty `sources`
+        // request — e.g. an overflow shell notebook that gets populated later — is
+        // a legitimate zero-source case and is still added.)
+        const requestedSources = args.sources.length;
+        const addedNone = requestedSources > 0 && result.sourceCount === 0;
+        if (addedNone) {
+            log.warning(`⚠️ Notebook had no successful sources — not adding to library: ${args.name}`);
+            return {
+                success: false,
+                data: null,
+                error: "Notebook creation failed: no sources could be added",
+            };
+        }
         // Auto-add to library if requested (default: true)
         if (args.auto_add_to_library !== false) {
             try {
@@ -608,4 +624,3 @@ export async function handleRemoveSource(ctx, args) {
         };
     }
 }
-//# sourceMappingURL=notebook-creation.js.map

package/dist/tools/handlers/notebook-management.d.ts

@@ -61,4 +61,3 @@ export declare function handleSearchNotebooks(ctx: HandlerContext, args: {
  * Handle get_library_stats tool
  */
 export declare function handleGetLibraryStats(ctx: HandlerContext): Promise<ToolResult<LibraryStats>>;
-//# sourceMappingURL=notebook-management.d.ts.map

package/dist/tools/handlers/notebook-management.js

@@ -4,6 +4,7 @@
  * Standalone handler functions for notebook CRUD and library operations.
  */
 import { log } from "../../utils/logger.js";
+import { validateNotebookUrl } from "../../utils/security.js";
 import { getSanitizedErrorMessage } from "./error-utils.js";
 async function withNotebookHandler(toolName, fn) {
     try {
@@ -93,7 +94,12 @@ export async function handleUpdateNotebook(ctx, args) {
     log.info(`🔧 [TOOL] update_notebook called`);
     log.info(`  ID: ${args.id}`);
     return withNotebookHandler("update_notebook", () => {
-        const notebook = ctx.library.updateNotebook(args);
+        // Validate/normalize the URL through the canonical NotebookLM validator
+        // before storing (matches create_notebook / add_source handlers).
+        const safeArgs = args.url !== undefined
+            ? { ...args, url: validateNotebookUrl(args.url) }
+            : args;
+        const notebook = ctx.library.updateNotebook(safeArgs);
         log.success(`✅ [TOOL] update_notebook completed: ${notebook.name}`);
         return {
             success: true,
@@ -165,4 +171,3 @@ export async function handleGetLibraryStats(ctx) {
         };
     });
 }
-//# sourceMappingURL=notebook-management.js.map

package/dist/tools/handlers/session-management.d.ts

@@ -63,4 +63,3 @@ export declare function handleGetHealth(ctx: HandlerContext, args?: {
     troubleshooting_tip?: string;
 }>>;
 export {};
-//# sourceMappingURL=session-management.d.ts.map

package/dist/tools/handlers/session-management.js

@@ -206,4 +206,3 @@ export async function handleGetHealth(ctx, args) {
         };
     }
 }
-//# sourceMappingURL=session-management.js.map

package/dist/tools/handlers/system.d.ts

@@ -99,4 +99,3 @@ export declare function handleCleanupData(_ctx: HandlerContext, args: {
         }>;
     };
 }>>;
-//# sourceMappingURL=system.d.ts.map

package/dist/tools/handlers/system.js

@@ -307,4 +307,3 @@ export async function handleCleanupData(_ctx, args) {
         };
     }
 }
-//# sourceMappingURL=system.js.map

package/dist/tools/handlers/types.d.ts

@@ -16,4 +16,3 @@ export interface HandlerContext {
     rateLimiter: RateLimiter;
     getGeminiClient: () => GeminiClient | null;
 }
-//# sourceMappingURL=types.d.ts.map

package/dist/tools/handlers/types.js

@@ -2,4 +2,3 @@
  * Shared types for handler domain modules
  */
 export {};
-//# sourceMappingURL=types.js.map

package/dist/tools/handlers/webhooks.d.ts

@@ -31,4 +31,3 @@ export declare function handleRemoveWebhook(_ctx: HandlerContext, args: {
     removed: boolean;
     id: string;
 }>>;
-//# sourceMappingURL=webhooks.d.ts.map

package/dist/tools/handlers/webhooks.js

@@ -121,4 +121,3 @@ export async function handleRemoveWebhook(_ctx, args) {
         return { success: false, data: null, error: errorMessage };
     }
 }
-//# sourceMappingURL=webhooks.js.map

package/dist/tools/icons.d.ts

@@ -15,4 +15,3 @@ export declare const toolIcons: Record<string, Icon[]>;
  * Get icons for a tool by name
  */
 export declare function getToolIcons(toolName: string): Icon[] | undefined;
-//# sourceMappingURL=icons.d.ts.map

package/dist/tools/icons.js

@@ -144,4 +144,3 @@ export const toolIcons = {
 export function getToolIcons(toolName) {
     return toolIcons[toolName];
 }
-//# sourceMappingURL=icons.js.map

package/dist/tools/index.d.ts

@@ -8,4 +8,3 @@ export { ToolHandlers } from "./handlers/index.js";
 export { getToolIcons, toolIcons } from "./icons.js";
 export { getToolMetadata, toolMetadata } from "./annotations.js";
 export type { ToolMetadata } from "./annotations.js";
-//# sourceMappingURL=index.d.ts.map

package/dist/tools/index.js

@@ -7,4 +7,3 @@ export { buildToolDefinitions } from "./definitions.js";
 export { ToolHandlers } from "./handlers/index.js";
 export { getToolIcons, toolIcons } from "./icons.js";
 export { getToolMetadata, toolMetadata } from "./annotations.js";
-//# sourceMappingURL=index.js.map

package/dist/types.d.ts

@@ -82,4 +82,3 @@ export interface ServerState {
     sessionManager: SessionManager;
     authManager: AuthManager;
 }
-//# sourceMappingURL=types.d.ts.map