gogcli-mcp-drive 4.2.5 → 4.4.0

package/dist/index.js

@@ -37,6 +37,33 @@ var storage2 = new AsyncLocalStorage2();
 function withCallerCapabilities(capabilities, fn) {
   return capabilities ? storage2.run(capabilities, fn) : fn();
 }
+function currentCallerCapabilities() {
+  return storage2.getStore();
+}
+var ENVELOPE_CAPABILITIES_KEY = "io.modelcontextprotocol/clientCapabilities";
+var ELICITATION_MODES = ["form", "url"];
+function isRecord(value) {
+  return typeof value === "object" && value !== null && !Array.isArray(value);
+}
+function callerCapabilities(ctx) {
+  const envelope = isRecord(ctx) && isRecord(ctx.mcpReq) ? ctx.mcpReq.envelope : void 0;
+  if (isRecord(envelope)) {
+    const declared = envelope[ENVELOPE_CAPABILITIES_KEY];
+    if (isRecord(declared))
+      return declared;
+  }
+  return currentCallerCapabilities();
+}
+function callerAcceptsFormElicitation(ctx) {
+  const capabilities = callerCapabilities(ctx);
+  if (!capabilities)
+    return void 0;
+  const elicitation = capabilities.elicitation;
+  if (!isRecord(elicitation))
+    return false;
+  const namedModes = ELICITATION_MODES.filter((mode) => mode in elicitation);
+  return namedModes.length === 0 || namedModes.includes("form");
+}
 
 // ../../node_modules/@modelcontextprotocol/server/dist/chunk-Br0eD_fh.mjs
 var __create = Object.create;
@@ -2092,8 +2119,8 @@ function emoji() {
 }
 var ipv4 = /^(?:(?:25[0-5]|2[0-4][0-9]|1[0-9][0-9]|[1-9][0-9]|[0-9])\.){3}(?:25[0-5]|2[0-4][0-9]|1[0-9][0-9]|[1-9][0-9]|[0-9])$/;
 var ipv6 = /^(([0-9a-fA-F]{1,4}:){7}[0-9a-fA-F]{1,4}|([0-9a-fA-F]{1,4}:){1,7}:|([0-9a-fA-F]{1,4}:){1,6}:[0-9a-fA-F]{1,4}|([0-9a-fA-F]{1,4}:){1,5}(:[0-9a-fA-F]{1,4}){1,2}|([0-9a-fA-F]{1,4}:){1,4}(:[0-9a-fA-F]{1,4}){1,3}|([0-9a-fA-F]{1,4}:){1,3}(:[0-9a-fA-F]{1,4}){1,4}|([0-9a-fA-F]{1,4}:){1,2}(:[0-9a-fA-F]{1,4}){1,5}|[0-9a-fA-F]{1,4}:((:[0-9a-fA-F]{1,4}){1,6})|:((:[0-9a-fA-F]{1,4}){1,7}|:))$/;
-var mac = (delimiter2) => {
-  const escapedDelim = escapeRegex(delimiter2 ?? ":");
+var mac = (delimiter3) => {
+  const escapedDelim = escapeRegex(delimiter3 ?? ":");
   return new RegExp(`^(?:[0-9A-F]{2}${escapedDelim}){5}[0-9A-F]{2}$|^(?:[0-9a-f]{2}${escapedDelim}){5}[0-9a-f]{2}$`);
 };
 var cidrv4 = /^((25[0-5]|2[0-4][0-9]|1[0-9][0-9]|[1-9][0-9]|[0-9])\.){3}(25[0-5]|2[0-4][0-9]|1[0-9][0-9]|[1-9][0-9]|[0-9])\/([0-9]|[1-2][0-9]|3[0-2])$/;
@@ -5121,7 +5148,7 @@ var recursive = /* @__PURE__ */ new WeakMap();
 var NONE = 0;
 var ASSUMED = 1;
 var PROVEN = 2;
-function isRecursive(inst, stack, resolve) {
+function isRecursive(inst, stack, resolve4) {
   const cached2 = recursive.get(inst);
   if (cached2 !== void 0)
     return cached2 ? PROVEN : NONE;
@@ -5131,7 +5158,7 @@ function isRecursive(inst, stack, resolve) {
   let result = NONE;
   const check2 = (child) => {
     if (result !== PROVEN && child?._zod) {
-      const answer = isRecursive(child, stack, resolve);
+      const answer = isRecursive(child, stack, resolve4);
       if (answer > result)
         result = answer;
     }
@@ -5142,7 +5169,7 @@ function isRecursive(inst, stack, resolve) {
       const desc = Object.getOwnPropertyDescriptor(sh, key);
       if (spread && !desc.enumerable)
         continue;
-      const child = desc.get ? ASSUMED : desc.value?._zod ? isRecursive(desc.value, stack, resolve) : NONE;
+      const child = desc.get ? ASSUMED : desc.value?._zod ? isRecursive(desc.value, stack, resolve4) : NONE;
       if (child > answer)
         answer = child;
     }
@@ -5206,7 +5233,7 @@ function isRecursive(inst, stack, resolve) {
       break;
     // `$ZodLazy` caches its inner on the def, so a resolved edge is followed exactly
     case "lazy": {
-      const inner = def._cachedInner ?? (resolve ? inst._zod.innerType : void 0);
+      const inner = def._cachedInner ?? (resolve4 ? inst._zod.innerType : void 0);
       merge2(inner ? isRecursive(inner, stack, false) : ASSUMED);
       break;
     }
@@ -24101,19 +24128,50 @@ var inputRequired = Object.assign(buildInputRequired, {
     return { method: "roots/list" };
   }
 });
+function acceptedContent(responses, key, schema) {
+  const view = inputResponse(responses, key);
+  if (view.kind !== "elicit" || view.action !== "accept" || view.content === void 0) return void 0;
+  if (schema === void 0) return view.content;
+  const outcome = schema["~standard"].validate(view.content);
+  if (outcome instanceof Promise) throw new TypeError("acceptedContent(responses, key, schema) requires a synchronously-validating schema");
+  return outcome.issues === void 0 ? outcome.value : void 0;
+}
+function inputResponse(responses, key) {
+  if (responses === void 0 || typeof responses !== "object" || responses === null) return { kind: "missing" };
+  const entry = responses[key];
+  if (entry === null || typeof entry !== "object" || Array.isArray(entry)) return { kind: "missing" };
+  const candidate = entry;
+  if (candidate["action"] === "accept" || candidate["action"] === "decline" || candidate["action"] === "cancel") {
+    const content = candidate["content"];
+    return {
+      kind: "elicit",
+      action: candidate["action"],
+      ...content !== null && typeof content === "object" && !Array.isArray(content) && { content }
+    };
+  }
+  if (Array.isArray(candidate["roots"])) return {
+    kind: "roots",
+    roots: candidate["roots"]
+  };
+  if (typeof candidate["role"] === "string" && candidate["content"] !== void 0) return {
+    kind: "sampling",
+    result: candidate
+  };
+  return { kind: "missing" };
+}
 var REQUEST_STATE_ONLY_LEG_PACING_MS = 250;
 function inputRequiredRoundsExceededMessage(method, maxRounds) {
   return `Multi-round-trip request '${method}' still required input after ${maxRounds} rounds (inputRequired.maxRounds)`;
 }
 function sleep(ms, signal) {
-  return new Promise((resolve, reject) => {
+  return new Promise((resolve4, reject) => {
     if (signal?.aborted) {
       reject(signal.reason instanceof SdkError ? signal.reason : new SdkError(SdkErrorCode.RequestTimeout, String(signal.reason)));
       return;
     }
     const timer = setTimeout(() => {
       signal?.removeEventListener("abort", onAbort);
-      resolve();
+      resolve4();
     }, ms);
     const onAbort = () => {
       clearTimeout(timer);
@@ -24907,7 +24965,7 @@ var Protocol = class {
     const flowStartedAt = Date.now();
     let onAbort;
     let cleanupMessageId;
-    return new Promise((resolve, reject) => {
+    return new Promise((resolve4, reject) => {
       const earlyReject = (error62) => {
         reject(error62);
       };
@@ -24975,7 +25033,7 @@ var Protocol = class {
         }
         if (decoded.kind === "invalid") return reject(decoded.error);
         if (decoded.kind === "input_required") {
-          if (options?.allowInputRequired === true) return resolve(manualInputRequiredValue(decoded));
+          if (options?.allowInputRequired === true) return resolve4(manualInputRequiredValue(decoded));
           const flow = {
             codec: codec2,
             request,
@@ -24987,11 +25045,11 @@ var Protocol = class {
               params
             }, resultSchema, legOptions)
           };
-          return resolve(this._resolveNonCompleteResult(decoded, flow));
+          return resolve4(this._resolveNonCompleteResult(decoded, flow));
         }
         const result = decoded.result;
         validateStandardSchema(resultSchema, result).then((parseResult) => {
-          if (parseResult.success) resolve(parseResult.data);
+          if (parseResult.success) resolve4(parseResult.data);
           else reject(new SdkError(SdkErrorCode.InvalidResult, `Invalid result for ${request.method}: ${parseResult.error}`));
         }, reject);
       });
@@ -27903,7 +27961,7 @@ var require_compile = /* @__PURE__ */ __commonJSMin(((exports) => {
     ref = (0, resolve_1.resolveUrl)(this.opts.uriResolver, baseId, ref);
     const schOrFunc = root.refs[ref];
     if (schOrFunc) return schOrFunc;
-    let _sch = resolve.call(this, root, ref);
+    let _sch = resolve4.call(this, root, ref);
     if (_sch === void 0) {
       const schema = (_a3 = root.localRefs) === null || _a3 === void 0 ? void 0 : _a3[ref];
       const { schemaId } = this.opts;
@@ -27929,7 +27987,7 @@ var require_compile = /* @__PURE__ */ __commonJSMin(((exports) => {
   function sameSchemaEnv(s1, s2) {
     return s1.schema === s2.schema && s1.root === s2.root && s1.baseId === s2.baseId;
   }
-  function resolve(root, ref) {
+  function resolve4(root, ref) {
     let sch;
     while (typeof (sch = this.refs[ref]) == "string") ref = sch;
     return sch || this.schemas[ref] || resolveSchema.call(this, root, ref);
@@ -28379,47 +28437,47 @@ var require_fast_uri = /* @__PURE__ */ __commonJSMin(((exports, module) => {
     else if (typeof uri === "object") uri = parse3(serialize(uri, options), options);
     return uri;
   }
-  function resolve(baseURI, relativeURI, options) {
+  function resolve4(baseURI, relativeURI, options) {
     const schemelessOptions = options ? Object.assign({ scheme: "null" }, options) : { scheme: "null" };
     const resolved = resolveComponent(parse3(baseURI, schemelessOptions), parse3(relativeURI, schemelessOptions), schemelessOptions, true);
     schemelessOptions.skipEscape = true;
     return serialize(resolved, schemelessOptions);
   }
-  function resolveComponent(base, relative, options, skipNormalization) {
+  function resolveComponent(base, relative3, options, skipNormalization) {
     const target = {};
     if (!skipNormalization) {
       base = parse3(serialize(base, options), options);
-      relative = parse3(serialize(relative, options), options);
+      relative3 = parse3(serialize(relative3, options), options);
     }
     options = options || {};
-    if (!options.tolerant && relative.scheme) {
-      target.scheme = relative.scheme;
-      target.userinfo = relative.userinfo;
-      target.host = relative.host;
-      target.port = relative.port;
-      target.path = removeDotSegments(relative.path || "");
-      target.query = relative.query;
+    if (!options.tolerant && relative3.scheme) {
+      target.scheme = relative3.scheme;
+      target.userinfo = relative3.userinfo;
+      target.host = relative3.host;
+      target.port = relative3.port;
+      target.path = removeDotSegments(relative3.path || "");
+      target.query = relative3.query;
     } else {
-      if (relative.userinfo !== void 0 || relative.host !== void 0 || relative.port !== void 0) {
-        target.userinfo = relative.userinfo;
-        target.host = relative.host;
-        target.port = relative.port;
-        target.path = removeDotSegments(relative.path || "");
-        target.query = relative.query;
+      if (relative3.userinfo !== void 0 || relative3.host !== void 0 || relative3.port !== void 0) {
+        target.userinfo = relative3.userinfo;
+        target.host = relative3.host;
+        target.port = relative3.port;
+        target.path = removeDotSegments(relative3.path || "");
+        target.query = relative3.query;
       } else {
-        if (!relative.path) {
+        if (!relative3.path) {
           target.path = base.path;
-          if (relative.query !== void 0) target.query = relative.query;
+          if (relative3.query !== void 0) target.query = relative3.query;
           else target.query = base.query;
         } else {
-          if (relative.path[0] === "/") target.path = removeDotSegments(relative.path);
+          if (relative3.path[0] === "/") target.path = removeDotSegments(relative3.path);
           else {
-            if ((base.userinfo !== void 0 || base.host !== void 0 || base.port !== void 0) && !base.path) target.path = "/" + relative.path;
-            else if (!base.path) target.path = relative.path;
-            else target.path = base.path.slice(0, base.path.lastIndexOf("/") + 1) + relative.path;
+            if ((base.userinfo !== void 0 || base.host !== void 0 || base.port !== void 0) && !base.path) target.path = "/" + relative3.path;
+            else if (!base.path) target.path = relative3.path;
+            else target.path = base.path.slice(0, base.path.lastIndexOf("/") + 1) + relative3.path;
             target.path = removeDotSegments(target.path);
           }
-          target.query = relative.query;
+          target.query = relative3.query;
         }
         target.userinfo = base.userinfo;
         target.host = base.host;
@@ -28427,7 +28485,7 @@ var require_fast_uri = /* @__PURE__ */ __commonJSMin(((exports, module) => {
       }
       target.scheme = base.scheme;
     }
-    target.fragment = relative.fragment;
+    target.fragment = relative3.fragment;
     return target;
   }
   function equal(uriA, uriB, options) {
@@ -28553,7 +28611,7 @@ var require_fast_uri = /* @__PURE__ */ __commonJSMin(((exports, module) => {
   const fastUri = {
     SCHEMES,
     normalize,
-    resolve,
+    resolve: resolve4,
     resolveComponent,
     equal,
     serialize,
@@ -29335,14 +29393,14 @@ var require_ucs2length = /* @__PURE__ */ __commonJSMin(((exports) => {
   function ucs2length(str) {
     const len = str.length;
     let length = 0;
-    let pos = 0;
+    let pos2 = 0;
     let value;
-    while (pos < len) {
+    while (pos2 < len) {
       length++;
-      value = str.charCodeAt(pos++);
-      if (value >= 55296 && value <= 56319 && pos < len) {
-        value = str.charCodeAt(pos);
-        if ((value & 64512) === 56320) pos++;
+      value = str.charCodeAt(pos2++);
+      if (value >= 55296 && value <= 56319 && pos2 < len) {
+        value = str.charCodeAt(pos2);
+        if ((value & 64512) === 56320) pos2++;
       }
     }
     return length;
@@ -33926,7 +33984,7 @@ var StdioServerTransport = class {
   }
   send(message) {
     if (this._closed) return Promise.reject(/* @__PURE__ */ new Error("StdioServerTransport is closed"));
-    return new Promise((resolve, reject) => {
+    return new Promise((resolve4, reject) => {
       const json2 = serializeMessage(message);
       let settled = false;
       const onError = (error62) => {
@@ -33941,14 +33999,14 @@ var StdioServerTransport = class {
         settled = true;
         this._stdout.off("error", onError);
         this._stdout.off("drain", onDrain);
-        resolve();
+        resolve4();
       };
       this._stdout.once("error", onError);
       if (this._stdout.write(json2)) {
         if (settled) return;
         settled = true;
         this._stdout.off("error", onError);
-        resolve();
+        resolve4();
       } else if (!settled) this._stdout.once("drain", onDrain);
     });
   }
@@ -34002,14 +34060,14 @@ var StdioConnectionChannel = class {
   */
   async whenRequestsAnswered(timeoutMs) {
     if (this._closed || this._pendingRequests.size === 0) return true;
-    return await new Promise((resolve) => {
+    return await new Promise((resolve4) => {
       const waiter = () => {
         clearTimeout(timer);
-        resolve(true);
+        resolve4(true);
       };
       const timer = setTimeout(() => {
         this._drainWaiters = this._drainWaiters.filter((pending) => pending !== waiter);
-        resolve(false);
+        resolve4(false);
       }, timeoutMs);
       this._drainWaiters.push(waiter);
     });
@@ -34148,14 +34206,14 @@ function serveStdio(factory, options = {}) {
     return false;
   };
   const answerLegacyRejection = (request, reason, requestedVersion) => {
-    const rejection2 = modernOnlyStrictRejection({
+    const rejection3 = modernOnlyStrictRejection({
       kind: "legacy",
       reason,
       ...requestedVersion !== void 0 && { requestedVersion }
     }, SUPPORTED_MODERN_PROTOCOL_VERSIONS);
-    if (rejection2 === void 0) return Promise.resolve();
-    reportError(/* @__PURE__ */ new Error(`Rejected 2025-era request on a modern-only stdio connection (${rejection2.cell}): ${rejection2.message}`));
-    return writeErrorResponse(request.id, rejection2.code, rejection2.message, rejection2.data);
+    if (rejection3 === void 0) return Promise.resolve();
+    reportError(/* @__PURE__ */ new Error(`Rejected 2025-era request on a modern-only stdio connection (${rejection3.cell}): ${rejection3.message}`));
+    return writeErrorResponse(request.id, rejection3.code, rejection3.message, rejection3.data);
   };
   const onInstanceClosed = (channel) => {
     if (closing || channel === discarding) return;
@@ -34379,13 +34437,28 @@ var API_KEY_RE = new RegExp([
   "whsec_[A-Za-z0-9]{16,}\\b"
   // webhook signing secret (Stripe-style)
 ].map((p) => `\\b${p}`).join("|"), "g");
-var QUERY_SECRET_RE = /([?&](?:access_token|refresh_token|client_secret|api_?key|signature|token|key|sig)=)[^&#\s"'<>`]+/gi;
+var QUERY_SECRET_RE = /([?&](?:(?:access|refresh|id|auth|session|csrf|xsrf)[_-]?token|client[_-]?secret|api[_-]?secret|api[_-]?key|password|passwd|signature|token|key|sig)=)[^&#\s"'<>`]+/gi;
+var OAUTH_CODE_RE = /([?&]code=)(?=[^&#\s"'<>`]{16,})[^&#\s"'<>`]+/gi;
+var FORM_PASSWORD_RE = /((?:^|[\s,;:"'(\[{])(?:password|passwd)=)[^&#\s"'<>`]+/gim;
+var HEADER_SECRET_RE = /(\b(?:x[-_][a-z0-9_-]*?(?:api[-_]?key|token|secret|auth)[a-z0-9_-]*|api[-_]?key)\s*:\s*)[^\s,;"'<>`]+/gi;
 var AWS_SIGV4_RE = /([?&]X-Amz-(?:Signature|Security-Token|Credential)=)[^&#\s"'<>`]+/gi;
-var JSON_SECRET_KEYS = "access_token|refresh_token|client_secret|api_?key|password|passwd|secret|token";
-var JSON_SECRET_DQ_RE = new RegExp(`("(?:${JSON_SECRET_KEYS})"\\s*:\\s*")[^"]*(")`, "gi");
-var JSON_SECRET_SQ_RE = new RegExp(`('(?:${JSON_SECRET_KEYS})'\\s*:\\s*')[^']*(')`, "gi");
+var JSON_SECRET_KEYS = [
+  "(?:access|refresh|id|auth|session|bearer|csrf|xsrf)[_-]?token",
+  "client[_-]?secret",
+  "api[_-]?secret",
+  "(?:x[_-])?api[_-]?key",
+  "private[_-]?key",
+  "x[_-][a-z0-9_-]*?(?:api[_-]?key|token|secret|auth)[a-z0-9_-]*",
+  "(?:proxy-)?authorization",
+  "password",
+  "passwd",
+  "secret",
+  "token"
+].join("|");
+var JSON_SECRET_DQ_RE = new RegExp(`("(?:${JSON_SECRET_KEYS})"\\s*:\\s*")(?:[^"\\\\]|\\\\.)*(")`, "gi");
+var JSON_SECRET_SQ_RE = new RegExp(`('(?:${JSON_SECRET_KEYS})'\\s*:\\s*')(?:[^'\\\\]|\\\\.)*(')`, "gi");
 function redactSecrets(text) {
-  return text.replace(BEARER_RE, "$1[REDACTED]").replace(BASIC_AUTH_RE, "$1[REDACTED]").replace(SET_COOKIE_RE, "$1$2=[REDACTED]").replace(COOKIE_HEADER_RE, (_m, prefix, pairs) => `${prefix}${pairs.replace(/=[^;,\s]*/g, "=[REDACTED]")}`).replace(API_KEY_RE, "[REDACTED]").replace(QUERY_SECRET_RE, "$1[REDACTED]").replace(AWS_SIGV4_RE, "$1[REDACTED]").replace(JSON_SECRET_DQ_RE, "$1[REDACTED]$2").replace(JSON_SECRET_SQ_RE, "$1[REDACTED]$2").replace(JWT_RE, "[REDACTED]");
+  return text.replace(BEARER_RE, "$1[REDACTED]").replace(BASIC_AUTH_RE, "$1[REDACTED]").replace(SET_COOKIE_RE, "$1$2=[REDACTED]").replace(COOKIE_HEADER_RE, (_m, prefix, pairs) => `${prefix}${pairs.replace(/=[^;,\s]*/g, "=[REDACTED]")}`).replace(API_KEY_RE, "[REDACTED]").replace(HEADER_SECRET_RE, "$1[REDACTED]").replace(QUERY_SECRET_RE, "$1[REDACTED]").replace(OAUTH_CODE_RE, "$1[REDACTED]").replace(FORM_PASSWORD_RE, "$1[REDACTED]").replace(AWS_SIGV4_RE, "$1[REDACTED]").replace(JSON_SECRET_DQ_RE, "$1[REDACTED]$2").replace(JSON_SECRET_SQ_RE, "$1[REDACTED]$2").replace(JWT_RE, "[REDACTED]");
 }
 
 // ../../node_modules/@chrischall/mcp-utils/dist/response/view.js
@@ -34464,6 +34537,11 @@ function walk(value, keep, drop) {
 }
 
 // ../../node_modules/@chrischall/mcp-utils/dist/response/index.js
+function textResult(data) {
+  return {
+    content: [{ type: "text", text: JSON.stringify(data, null, 2) }]
+  };
+}
 function rawTextResult(text) {
   return { content: [{ type: "text", text }] };
 }
@@ -34474,6 +34552,154 @@ function errorResult(message) {
   };
 }
 
+// ../../node_modules/@chrischall/mcp-utils/dist/server/confirmation.js
+import { createHash, createHmac, timingSafeEqual } from "node:crypto";
+var DEFAULT_REQUEST_KEY = "confirmation";
+var DEFAULT_CONFIRMATION_LABEL = "Confirm this action should proceed.";
+var UNSUPPORTED_NOTE = "Nothing was done because this client cannot show a confirmation prompt (it declares no MCP elicitation capability), and this action is never taken without one";
+var STATE_PREFIX = "mcpu.confirm.v1.";
+function canonicalJson(value) {
+  if (value === null || typeof value === "string" || typeof value === "boolean")
+    return JSON.stringify(value);
+  if (value === void 0)
+    return "null";
+  if (typeof value === "number")
+    return Number.isFinite(value) ? JSON.stringify(value) : `{"$num":"${String(value)}"}`;
+  if (typeof value === "bigint")
+    return `{"$bigint":"${value.toString()}"}`;
+  if (typeof value === "function" || typeof value === "symbol") {
+    throw new TypeError(`requireConfirmation: cannot bind a ${typeof value} argument value.`);
+  }
+  if (Array.isArray(value))
+    return `[${value.map(canonicalJson).join(",")}]`;
+  if (value instanceof Date) {
+    return `{"$date":${JSON.stringify(Number.isNaN(value.getTime()) ? "Invalid Date" : value.toISOString())}}`;
+  }
+  if (ArrayBuffer.isView(value)) {
+    const bytes = Buffer.from(value.buffer, value.byteOffset, value.byteLength);
+    return `{"$bytes":${JSON.stringify(bytes.toString("base64"))}}`;
+  }
+  if (value instanceof ArrayBuffer)
+    return `{"$bytes":${JSON.stringify(Buffer.from(value).toString("base64"))}}`;
+  if (value instanceof Map) {
+    const entries2 = [...value.entries()].map(([k, v]) => `[${canonicalJson(k)},${canonicalJson(v)}]`).sort();
+    return `{"$map":[${entries2.join(",")}]}`;
+  }
+  if (value instanceof Set) {
+    return `{"$set":[${[...value].map(canonicalJson).sort().join(",")}]}`;
+  }
+  const proto = Object.getPrototypeOf(value);
+  if (proto !== Object.prototype && proto !== null) {
+    throw new TypeError("requireConfirmation: cannot bind a non-plain object argument value (class instance).");
+  }
+  const entries = Object.entries(value).filter(([, v]) => v !== void 0).sort(([a], [b]) => a < b ? -1 : a > b ? 1 : 0);
+  return `{${entries.map(([k, v]) => `${JSON.stringify(escapeKey(k))}:${canonicalJson(v)}`).join(",")}}`;
+}
+function escapeKey(key) {
+  return key.startsWith("$") ? `$${key}` : key;
+}
+function bindingKey(binding) {
+  if (binding.ttlSeconds !== void 0 && !(Number.isFinite(binding.ttlSeconds) && binding.ttlSeconds > 0)) {
+    throw new RangeError("requireConfirmation: binding.ttlSeconds must be a finite number greater than 0.");
+  }
+  const key = typeof binding.key === "string" ? Buffer.from(binding.key, "utf8") : Buffer.from(binding.key);
+  if (key.length < 32) {
+    throw new RangeError("requireConfirmation: binding.key must be at least 32 bytes.");
+  }
+  return key;
+}
+function commitment(action, args) {
+  return createHash("sha256").update(`${action}\0${canonicalJson(args)}`).digest("base64url");
+}
+function mintState(key, action, binding) {
+  const exp = Math.floor(Date.now() / 1e3) + (binding.ttlSeconds ?? 600);
+  const body = Buffer.from(JSON.stringify({ c: commitment(action, binding.args), exp })).toString("base64url");
+  const mac3 = createHmac("sha256", key).update(`${STATE_PREFIX}${body}`).digest("base64url");
+  return `${STATE_PREFIX}${body}.${mac3}`;
+}
+function verifyState(key, action, binding, state) {
+  if (typeof state !== "string" || !state.startsWith(STATE_PREFIX))
+    return false;
+  const rest = state.slice(STATE_PREFIX.length);
+  const dot = rest.indexOf(".");
+  if (dot < 0)
+    return false;
+  const body = rest.slice(0, dot);
+  const mac3 = Buffer.from(rest.slice(dot + 1), "base64url");
+  const expected = createHmac("sha256", key).update(`${STATE_PREFIX}${body}`).digest();
+  if (mac3.length !== expected.length || !timingSafeEqual(mac3, expected))
+    return false;
+  let payload;
+  try {
+    payload = JSON.parse(Buffer.from(body, "base64url").toString("utf8"));
+  } catch {
+    return false;
+  }
+  if (typeof payload.exp !== "number" || payload.exp * 1e3 <= Date.now())
+    return false;
+  const want = Buffer.from(commitment(action, binding.args));
+  const got = Buffer.from(typeof payload.c === "string" ? payload.c : "");
+  return got.length === want.length && timingSafeEqual(got, want);
+}
+function echoedState(ctx) {
+  const accessor = ctx.mcpReq.requestState;
+  return typeof accessor === "function" ? accessor() : void 0;
+}
+function requireConfirmation(ctx, options) {
+  const requestKey = options.requestKey ?? DEFAULT_REQUEST_KEY;
+  const key = options.binding ? bindingKey(options.binding) : void 0;
+  const confirmationSchema = external_exports.object({
+    confirmed: external_exports.boolean().describe(options.confirmationLabel ?? DEFAULT_CONFIRMATION_LABEL)
+  });
+  const ask = () => {
+    const preview = {
+      action: options.action,
+      ...options.details === void 0 ? {} : { details: options.details }
+    };
+    return inputRequired({
+      inputRequests: {
+        [requestKey]: inputRequired.elicit({
+          message: `${options.message}
+${JSON.stringify(preview, null, 2)}`,
+          requestedSchema: confirmationSchema
+        })
+      },
+      ...key && options.binding ? { requestState: mintState(key, options.action, options.binding) } : {}
+    });
+  };
+  const response = inputResponse(ctx.mcpReq.inputResponses, requestKey);
+  const accepted = acceptedContent(ctx.mcpReq.inputResponses, requestKey, confirmationSchema);
+  if (response.kind === "missing") {
+    if (callerAcceptsFormElicitation(ctx) === false) {
+      return textResult({
+        confirmed: false,
+        dispatched: false,
+        action: options.action,
+        reason: "confirmation-unsupported",
+        note: options.unsupportedNote ? `${UNSUPPORTED_NOTE}. ${options.unsupportedNote}` : `${UNSUPPORTED_NOTE}.`
+      });
+    }
+    return ask();
+  }
+  if (response.kind === "elicit" && response.action === "accept" && accepted?.confirmed === true) {
+    if (key && options.binding) {
+      const state = echoedState(ctx);
+      if (state === void 0 || state === null) {
+        return errorResult(`Confirmation for ${options.action} was accepted, but the retry carried no requestState, so it cannot be checked against the prompt that was shown. Nothing was done. The likely cause is that the MCP client or host does not round-trip requestState (it must echo the requestState from the input_required result back on the retry); asking again would loop.`);
+      }
+      if (!verifyState(key, options.action, options.binding, state))
+        return ask();
+    }
+    return void 0;
+  }
+  return textResult({
+    confirmed: false,
+    cancelled: true,
+    action: options.action,
+    note: "Nothing was changed because the confirmation was declined, cancelled, or left unchecked."
+  });
+}
+
 // ../../node_modules/@chrischall/mcp-utils/dist/server/index.js
 var SERVER_PROTOCOL_VERSIONS = Object.freeze([
   "2026-07-28",
@@ -34568,13 +34794,47 @@ async function createMcpServer(opts) {
   }
   return server;
 }
+var DEFAULT_SHUTDOWN_TIMEOUT_MS = 5e3;
+var DEFAULT_REPEAT_SIGNAL_GRACE_MS = 500;
 function withGracefulShutdown(target, opts = {}) {
   const shouldExit = opts.exit ?? true;
+  if (opts.timeoutMs !== void 0 && !(Number.isFinite(opts.timeoutMs) && opts.timeoutMs > 0)) {
+    throw new RangeError("withGracefulShutdown: timeoutMs must be a finite number greater than 0.");
+  }
+  const timeoutMs = opts.timeoutMs ?? DEFAULT_SHUTDOWN_TIMEOUT_MS;
+  if (opts.repeatSignalGraceMs !== void 0 && !(Number.isFinite(opts.repeatSignalGraceMs) && opts.repeatSignalGraceMs >= 0)) {
+    throw new RangeError("withGracefulShutdown: repeatSignalGraceMs must be a finite number >= 0.");
+  }
+  const repeatGraceMs = opts.repeatSignalGraceMs ?? DEFAULT_REPEAT_SIGNAL_GRACE_MS;
   let shuttingDown = false;
+  let firstSignalAt = 0;
+  let exited = false;
+  const exitOnce = () => {
+    if (exited)
+      return;
+    exited = true;
+    process.exit(0);
+  };
   const handler = (signal) => {
-    if (shuttingDown)
+    if (shuttingDown) {
+      if (Date.now() - firstSignalAt < repeatGraceMs)
+        return;
+      if (shouldExit) {
+        console.error(`[mcp-utils] second ${signal} during shutdown \u2014 exiting now`);
+        exitOnce();
+      }
       return;
+    }
     shuttingDown = true;
+    firstSignalAt = Date.now();
+    let timer;
+    if (shouldExit) {
+      timer = setTimeout(() => {
+        console.error(`[mcp-utils] graceful shutdown on ${signal} did not finish in ${timeoutMs}ms \u2014 exiting`);
+        exitOnce();
+      }, timeoutMs);
+      timer.unref?.();
+    }
     void (async () => {
       try {
         if (opts.onSignal)
@@ -34583,8 +34843,10 @@ function withGracefulShutdown(target, opts = {}) {
       } catch (err) {
         console.error(`[mcp-utils] error during graceful shutdown on ${signal}: ${err instanceof Error ? err.message : String(err)}`);
       } finally {
+        if (timer !== void 0)
+          clearTimeout(timer);
         if (shouldExit)
-          process.exit(0);
+          exitOnce();
       }
     })();
   };
@@ -34614,6 +34876,8 @@ function runMcp(opts) {
 }
 
 // ../../node_modules/@chrischall/mcp-utils/dist/config/index.js
+import { homedir } from "node:os";
+import { isAbsolute, join, resolve } from "node:path";
 var PLACEHOLDER_RE = /^\$\{[^}]*\}$/;
 function readEnvVar(key, opts = {}) {
   const env = opts.env ?? process.env;
@@ -34640,6 +34904,50 @@ function parseBoolEnv(key, opts = {}) {
     return false;
   return fallback;
 }
+function expandPath(p) {
+  let expanded = p;
+  if (p === "~") {
+    expanded = homedir();
+  } else if (p.startsWith("~/")) {
+    expanded = join(homedir(), p.slice(2));
+  }
+  return isAbsolute(expanded) ? expanded : resolve(expanded);
+}
+
+// ../../node_modules/@chrischall/mcp-utils/dist/fs/confine.js
+import { existsSync, realpathSync } from "node:fs";
+import { dirname, isAbsolute as isAbsolute2, relative, resolve as resolve2, sep } from "node:path";
+function isInside(root, target) {
+  const rel = relative(root, target);
+  return rel === "" || !rel.startsWith(`..${sep}`) && rel !== ".." && !isAbsolute2(rel);
+}
+function realPathAllowingMissing(p) {
+  const abs = resolve2(p);
+  let existing = abs;
+  const tail = [];
+  while (!existsSync(existing)) {
+    const parent = dirname(existing);
+    if (parent === existing)
+      break;
+    tail.unshift(existing.slice(parent.length).replace(/^[/\\]+/, ""));
+    existing = parent;
+  }
+  let real;
+  try {
+    real = realpathSync(existing);
+  } catch {
+    real = existing;
+  }
+  return tail.length > 0 ? resolve2(real, ...tail) : real;
+}
+function assertPathWithinRoots(path, roots) {
+  const target = realPathAllowingMissing(expandPath(path));
+  for (const root of roots) {
+    if (isInside(realPathAllowingMissing(expandPath(root)), target))
+      return target;
+  }
+  throw new Error(`Path is outside the allowed directories: ${path}`);
+}
 
 // ../../node_modules/@chrischall/mcp-utils/dist/zod/index.js
 var PositiveInt = external_exports.number().int().positive();
@@ -34661,7 +34969,7 @@ var pageSchema = {
 };
 
 // ../gogcli-mcp/src/runner.ts
-import { delimiter, join } from "node:path";
+import { delimiter, join as join2 } from "node:path";
 
 // ../gogcli-mcp/src/timestamps.ts
 var DEFAULT_DISPLAY_TZ = "America/New_York";
@@ -34687,9 +34995,9 @@ function offsetAt(instant, tz) {
   const w = wallPartsIn(instant, tz);
   const asUTC = Date.UTC(w.year, w.month - 1, w.day, w.hour, w.minute, w.second, instant.getUTCMilliseconds());
   const minutes = Math.round((asUTC - instant.getTime()) / 6e4);
-  const sign = minutes < 0 ? "-" : "+";
+  const sign2 = minutes < 0 ? "-" : "+";
   const abs = Math.abs(minutes);
-  return `${sign}${pad(Math.floor(abs / 60))}:${pad(abs % 60)}`;
+  return `${sign2}${pad(Math.floor(abs / 60))}:${pad(abs % 60)}`;
 }
 function wallPartsIn(instant, tz) {
   const parts = new Intl.DateTimeFormat("en-US", {
@@ -34862,9 +35170,48 @@ function normalizeTimestamps(text, tz = displayTimeZone(), naiveTz = naiveSource
   return JSON.stringify(parsed, null, detectIndent(text));
 }
 
+// ../gogcli-mcp/src/arg-guard.ts
+var FORBIDDEN_LONG_FLAG = /^--(readonly|enable-commands|enable-commands-exact|disable-commands|access-token|home|account|acct|client|gmail-no-send|no-input|non-interactive|noninteractive)(=|$)/i;
+var SHORT_ACCOUNT_CLUSTER = /^-(?!-)[A-Za-z]*a/;
+function forbiddenArgReason(arg) {
+  if (arg === "--") {
+    return 'The argument "--" is not allowed: it ends flag parsing and would disable safety flags appended after it.';
+  }
+  const match = FORBIDDEN_LONG_FLAG.exec(arg);
+  if (match) {
+    return `The flag ${arg} is not allowed here: --${match[1].toLowerCase()} is a safety/credential control set by the server operator, not a per-call option.`;
+  }
+  if (SHORT_ACCOUNT_CLUSTER.test(arg)) {
+    return `The flag ${arg} is not allowed here: -a selects the account. Use the tool's account parameter instead.`;
+  }
+  return void 0;
+}
+function assertSafeForwardedArgs(args) {
+  for (const arg of args) {
+    const reason = forbiddenArgReason(arg);
+    if (reason) throw new Error(reason);
+  }
+}
+var SUBCOMMAND_SHAPE = /^[a-z][a-z0-9-]*$/;
+function assertSafeSubcommand(subcommand) {
+  if (!SUBCOMMAND_SHAPE.test(subcommand)) {
+    throw new Error(
+      `Invalid subcommand ${JSON.stringify(subcommand)}: pass a single gog subcommand name such as "list" or "mark-read", and put its arguments in args.`
+    );
+  }
+}
+
+// ../gogcli-mcp/src/argv.ts
+function pos(value) {
+  return { kind: "positional", value };
+}
+function isGogPositional(arg) {
+  return typeof arg === "object" && arg !== null && arg.kind === "positional";
+}
+
 // ../gogcli-mcp/src/runner.ts
 function isGogFileArg(arg) {
-  return typeof arg !== "string";
+  return typeof arg !== "string" && arg.kind === "file";
 }
 var TIMEOUT_MS = 3e4;
 function readonlyEnvEnabled() {
@@ -34948,8 +35295,8 @@ function formatTimeout(ms) {
 }
 async function spawnWithTempFiles(args, opts) {
   const { mkdtemp, mkdir, writeFile, rm } = await import("node:fs/promises");
-  const { tmpdir } = await import("node:os");
-  const dir = await mkdtemp(join(tmpdir(), "gogcli-mcp-"));
+  const { tmpdir: tmpdir2 } = await import("node:os");
+  const dir = await mkdtemp(join2(tmpdir2(), "gogcli-mcp-"));
   try {
     const argv = [];
     let seq = 0;
@@ -34958,10 +35305,10 @@ async function spawnWithTempFiles(args, opts) {
         argv.push(arg);
         continue;
       }
-      const sub = join(dir, String(seq));
+      const sub = join2(dir, String(seq));
       seq += 1;
       await mkdir(sub, { recursive: true, mode: 448 });
-      const path = join(sub, arg.filename ?? `${arg.flag}.${arg.ext ?? "txt"}`);
+      const path = join2(sub, arg.filename ?? `${arg.flag}.${arg.ext ?? "txt"}`);
       const data = arg.encoding === "base64" ? Buffer.from(arg.contents, "base64") : Buffer.from(arg.contents, "utf8");
       await writeFile(path, data, { mode: 384 });
       argv.push(arg.positional ? path : `--${arg.flag}=${path}`);
@@ -34979,10 +35326,10 @@ function spawnExecutor(args, opts) {
   return spawnGog(args, opts);
 }
 async function spawnGog(fullArgs, opts) {
-  const { timeout, interactive = false, spawner, binary = false } = opts;
+  const { timeout, interactive = false, spawner, binary = false, maxOutputBytes } = opts;
   const spawn = spawner ?? (await import("node:child_process")).spawn;
   const effectiveTimeout = timeout ?? TIMEOUT_MS;
-  return new Promise((resolve, reject) => {
+  return new Promise((resolve4, reject) => {
     const childEnv = { ...sanitizedEnv(), GOG_TIMEZONE: naiveSourceTimeZone(), PATH: augmentedPath() };
     const child = spawn(readEnvVar("GOG_PATH") ?? "gog", fullArgs, { env: childEnv });
     const stdoutChunks = [];
@@ -35000,7 +35347,17 @@ async function spawnGog(fullArgs, opts) {
       child.kill();
       reject(new Error(`gog timed out after ${formatTimeout(effectiveTimeout)}`));
     }, effectiveTimeout);
+    let stdoutBytes = 0;
     child.stdout.on("data", (chunk) => {
+      if (settled) return;
+      stdoutBytes += chunk.length;
+      if (maxOutputBytes !== void 0 && stdoutBytes > maxOutputBytes) {
+        settled = true;
+        stopWatching();
+        child.kill();
+        reject(new Error(`gog output exceeded the limit: more than ${maxOutputBytes} bytes`));
+        return;
+      }
       stdoutChunks.push(chunk);
     });
     child.stderr.on("data", (chunk) => {
@@ -35017,14 +35374,14 @@ async function spawnGog(fullArgs, opts) {
       const stderr = Buffer.concat(stderrChunks).toString().trim();
       if (code === 0) {
         if (binary) {
-          resolve(Buffer.concat(stdoutChunks).toString("base64"));
+          resolve4(Buffer.concat(stdoutChunks).toString("base64"));
           return;
         }
         const stdout = Buffer.concat(stdoutChunks).toString();
         if (interactive && stderr) {
-          resolve(stdout + "\n" + stderr);
+          resolve4(stdout + "\n" + stderr);
         } else {
-          resolve(stdout);
+          resolve4(stdout);
         }
       } else {
         reject(new Error(stderr || `gog exited with code ${code}`));
@@ -35044,7 +35401,33 @@ async function spawnGog(fullArgs, opts) {
     });
   });
 }
+function placePositionals(args) {
+  const flags = [];
+  const positionals = [];
+  let afterSeparator = false;
+  for (const arg of args) {
+    if (arg === "--") {
+      afterSeparator = true;
+    } else if (isGogPositional(arg)) {
+      positionals.push(arg.value);
+    } else if (afterSeparator || isGogFileArg(arg) && arg.positional) {
+      positionals.push(arg);
+    } else {
+      flags.push(arg);
+    }
+  }
+  return { flags, positionals };
+}
+function assertNoSafetyOverrides(flags) {
+  for (const arg of flags) {
+    if (typeof arg !== "string") continue;
+    const reason = forbiddenArgReason(arg);
+    if (reason) throw new Error(reason);
+  }
+}
 function assembleArgs(args, opts) {
+  const { flags, positionals } = placePositionals(args);
+  assertNoSafetyOverrides(flags);
   const effectiveAccount = opts.account ?? readEnvVar("GOG_ACCOUNT");
   const fullArgs = ["--json", "--color=never"];
   if (!opts.interactive) {
@@ -35053,17 +35436,21 @@ function assembleArgs(args, opts) {
   if (opts.readonly || readonlyEnvEnabled()) {
     fullArgs.push("--readonly");
   }
+  if (opts.gmailNoSend) {
+    fullArgs.push("--gmail-no-send");
+  }
   if (effectiveAccount) {
     fullArgs.push("--account", effectiveAccount);
   }
-  fullArgs.push(...args);
+  fullArgs.push(...flags);
+  if (positionals.length > 0) fullArgs.push("--", ...positionals);
   return fullArgs;
 }
 async function run(args, options = {}) {
-  const { account, spawner, interactive = false, timeout, readonly: readonly2 = false, redactMode = "full", opaqueFields } = options;
+  const { account, spawner, interactive = false, timeout, readonly: readonly2 = false, redactMode = "full", opaqueFields, gmailNoSend = false } = options;
   const base = redactMode === "tokens" ? redactGoogleTokens : redactSecrets2;
   const redact = opaqueFields?.length ? (text) => redactPreservingOpaqueFields(text, opaqueFields, base) : base;
-  const fullArgs = assembleArgs(args, { account, interactive, readonly: readonly2 });
+  const fullArgs = assembleArgs(args, { account, interactive, readonly: readonly2, gmailNoSend });
   try {
     return redact(await spawnExecutor(fullArgs, { timeout, interactive, spawner }));
   } catch (err) {
@@ -35071,9 +35458,9 @@ async function run(args, options = {}) {
   }
 }
 async function runBinary(args, options = {}) {
-  const { account, spawner, timeout, readonly: readonly2 = false } = options;
-  const fullArgs = assembleArgs(args, { account, interactive: false, readonly: readonly2 });
-  return spawnExecutor(fullArgs, { timeout, interactive: false, spawner, binary: true });
+  const { account, spawner, timeout, readonly: readonly2 = false, gmailNoSend = false, maxOutputBytes } = options;
+  const fullArgs = assembleArgs(args, { account, interactive: false, readonly: readonly2, gmailNoSend });
+  return spawnExecutor(fullArgs, { timeout, interactive: false, spawner, binary: true, maxOutputBytes });
 }
 
 // ../gogcli-mcp/src/pagination.ts
@@ -35096,6 +35483,107 @@ function stripConsumedPageToken(text) {
   return JSON.stringify(obj, null, detectIndent2(text));
 }
 
+// ../gogcli-mcp/src/file-roots.ts
+import { homedir as homedir2 } from "node:os";
+import { delimiter as delimiter2, join as join4 } from "node:path";
+
+// ../gogcli-mcp/src/attachment-root.ts
+import { tmpdir, userInfo } from "node:os";
+import { dirname as dirname2, join as join3, relative as relative2, resolve as resolve3, isAbsolute as isAbsolute3, sep as sep2 } from "node:path";
+var ATTACHMENT_DOWNLOAD_ROOT = join3(tmpdir(), `gogcli-mcp-attachments-${userInfo().uid}`);
+var ATTACHMENT_TTL_MS = 24 * 60 * 60 * 1e3;
+
+// ../gogcli-mcp/src/file-roots.ts
+var FILE_ROOTS_ENV = "GOG_FILE_ROOTS";
+function defaultFileRoot() {
+  return join4(homedir2(), "gogcli-mcp-files");
+}
+function fileRoots() {
+  const raw = readEnvVar(FILE_ROOTS_ENV);
+  const roots = (raw ?? "").split(delimiter2).map((r) => r.trim()).filter(Boolean);
+  return roots.length > 0 ? roots : [defaultFileRoot()];
+}
+function confinePath(path, param, opts = {}) {
+  if (opts.allowDash && path === "-") return path;
+  const roots = [...fileRoots(), ATTACHMENT_DOWNLOAD_ROOT];
+  try {
+    assertPathWithinRoots(path, roots);
+  } catch {
+    throw new Error(
+      `${param} ${JSON.stringify(path)} is outside the directories this server may read or write (${roots.join(", ")}). Put the file in one of them, or ask the server operator to widen ${FILE_ROOTS_ENV}.`
+    );
+  }
+  return path;
+}
+
+// ../gogcli-mcp/src/run-path-guard.ts
+var POSITIONAL_PATH_SUBCOMMANDS = {
+  appscript: { pull: "gog_appscript_pull" },
+  drive: { upload: "gog_drive_upload", sync: "gog_drive_sync_push" },
+  gmail: { import: "gog_gmail_import" },
+  slides: {
+    "add-slide": "gog_slides_add_slide",
+    "insert-image": "gog_slides_insert_image",
+    "replace-slide": "gog_slides_replace_slide"
+  }
+};
+var PATH_FLAGS = /* @__PURE__ */ new Set(["out", "output", "out-dir", "output-dir", "dir", "worker-dir", "attach", "file", "key", "cert", "replacements"]);
+var ID_FLAGS = {
+  drive: /* @__PURE__ */ new Set(["file", "filter-file"])
+};
+var EXEC_FLAGS = /* @__PURE__ */ new Set(["on-change", "on-new", "mmdc"]);
+var SHORT_PATH_CLUSTER = /^-(?!-)[A-Za-z]*[of]/;
+var LONG_FLAG = /^--([A-Za-z0-9][A-Za-z0-9-]*)(?:=([\s\S]*))?$/;
+function isPathFlag(service, name) {
+  if (ID_FLAGS[service]?.has(name)) return false;
+  return PATH_FLAGS.has(name) || name.endsWith("-file");
+}
+function confineFlagValue(flag, value) {
+  if (value === "-") return;
+  confinePath(value, flag);
+  for (const part of value.split(",")) {
+    if (part !== "" && part !== "-") confinePath(part, flag);
+  }
+}
+function positionalPathTool(service, subcommand) {
+  return POSITIONAL_PATH_SUBCOMMANDS[service]?.[subcommand];
+}
+function assertRunPathsConfined(service, subcommand, args) {
+  const dedicated = positionalPathTool(service, subcommand);
+  if (dedicated) {
+    throw new Error(
+      `gog ${service} ${subcommand} reads or writes a local path given as a positional argument, so it is not available through gog_${service}_run. Use ${dedicated}, which confines the path to GOG_FILE_ROOTS.`
+    );
+  }
+  for (let i = 0; i < args.length; i++) {
+    const arg = args[i];
+    if (SHORT_PATH_CLUSTER.test(arg)) {
+      throw new Error(
+        `The flag ${arg} is not allowed here: spell a path flag out as --out or --file (e.g. --out=<path>) so its path can be checked against GOG_FILE_ROOTS.`
+      );
+    }
+    const match = LONG_FLAG.exec(arg);
+    if (!match) continue;
+    const name = match[1].toLowerCase();
+    if (EXEC_FLAGS.has(name)) {
+      throw new Error(`The flag --${name} is not allowed here: it runs a local program chosen by the caller.`);
+    }
+    const isJson = name.endsWith("-json");
+    if (!isJson && !isPathFlag(service, name)) continue;
+    let value = match[2];
+    if (value === void 0) {
+      value = args[i + 1];
+      if (value === void 0) continue;
+      i++;
+    }
+    if (isJson) {
+      if (value.startsWith("@")) confineFlagValue(`--${name}`, value.slice(1));
+      continue;
+    }
+    confineFlagValue(`--${name}`, value);
+  }
+}
+
 // ../gogcli-mcp/src/tools/utils.ts
 var accountParam = external_exports.string().optional().describe(
   "Google account email to use, e.g. you@gmail.com \u2014 must be the full address, not a bare username. Overrides the GOG_ACCOUNT env var. Omit to use the single configured account."
@@ -35146,9 +35634,17 @@ function pushPaginationFlags(args, p) {
   if (p.all) args.push("--all");
 }
 function registerRunTool(server, options) {
-  const { service, examples, omitAccount = false, note } = options;
+  const { service, examples, omitAccount = false, note, allowedSubcommands, vet, gmailNoSend = false } = options;
+  for (const [, example] of examples.matchAll(/"([^"]+)"/g)) {
+    const refused = allowedSubcommands && !allowedSubcommands.includes(example) || vet?.(example, []) || positionalPathTool(service, example);
+    if (refused) {
+      throw new Error(`gog_${service}_run example "${example}" is refused by the tool itself; list a subcommand it runs.`);
+    }
+  }
   const baseDescription = `Run any gog ${service} subcommand not covered by the other tools. Run \`gog ${service} --help\` for the full list of subcommands, or \`gog ${service} <subcommand> --help\` for flags on a specific subcommand.`;
-  const description = note ? `${baseDescription} ${note}` : baseDescription;
+  const restriction = allowedSubcommands ? ` Only these subcommands are available: ${allowedSubcommands.join(", ")}.` : "";
+  const safety = ' Flags that override server safety controls (--readonly, --enable-commands, --disable-commands, --account, --access-token, --home, --client, --gmail-no-send, --no-input) and a bare "--" are refused. Local file paths (--out, --out-dir, --attach, --file, --*-file, @file JSON) must be inside GOG_FILE_ROOTS; subcommands that take a local path positionally (e.g. drive upload) are refused in favour of their dedicated tools.';
+  const description = `${baseDescription}${restriction}${safety}${note ? ` ${note}` : ""}`;
   const inputSchema = {
     subcommand: external_exports.string().describe(`The gog ${service} subcommand to run, e.g. ${examples}`),
     args: external_exports.array(external_exports.string()).describe("Additional positional args and flags")
@@ -35162,7 +35658,21 @@ function registerRunTool(server, options) {
     inputSchema: external_exports.object(inputSchema)
   }, async (rawArgs) => {
     const { subcommand, args, account } = rawArgs;
-    return runOrDiagnose([service, subcommand, ...args], { account });
+    try {
+      assertSafeSubcommand(subcommand);
+      assertSafeForwardedArgs(args);
+      if (allowedSubcommands && !allowedSubcommands.includes(subcommand)) {
+        throw new Error(
+          `gog ${service} ${subcommand} is not available through gog_${service}_run. Allowed: ${allowedSubcommands.join(", ")}.`
+        );
+      }
+      const refusal = vet?.(subcommand, args);
+      if (refusal) throw new Error(refusal);
+      assertRunPathsConfined(service, subcommand, args);
+    } catch (err) {
+      return errorResult(errorText(err));
+    }
+    return runOrDiagnose([service, subcommand, ...args], gmailNoSend ? { account, gmailNoSend } : { account });
   });
 }
 function errorText(err) {
@@ -35283,7 +35793,176 @@ function formatAuthHealth(raw, now) {
   return accounts.map((a) => formatOneAccountHealth(a, now)).join("\n\n");
 }
 
+// ../gogcli-mcp/src/send-confirm-token.ts
+import { createHash as createHash2, createHmac as createHmac2, randomBytes, timingSafeEqual as timingSafeEqual2 } from "node:crypto";
+var CONFIRM_TOKEN_TTL_DEFAULT_SECONDS = 600;
+var PREFIX = "gct1";
+var secret;
+var spent = /* @__PURE__ */ new Map();
+function sendConfirmFallbackEnabled() {
+  return readEnvVar("GOG_SEND_CONFIRM_FALLBACK")?.trim().toLowerCase() === "token";
+}
+function confirmTokenTtlSeconds() {
+  const raw = readEnvVar("GOG_CONFIRM_TTL_SECONDS")?.trim();
+  if (raw && /^\d+$/.test(raw)) {
+    const n = Number(raw);
+    if (n > 0) return n;
+  }
+  return CONFIRM_TOKEN_TTL_DEFAULT_SECONDS;
+}
+function hmacKey() {
+  if (!secret) {
+    const configured = readEnvVar("GOG_CONFIRM_SECRET");
+    secret = configured ? Buffer.from(configured, "utf8") : randomBytes(32);
+  }
+  return secret;
+}
+function canonicalize(value) {
+  if (Array.isArray(value)) return value.map(canonicalize);
+  if (value && typeof value === "object") {
+    const out = {};
+    for (const key of Object.keys(value).sort()) {
+      const v = value[key];
+      if (v !== void 0) out[key] = canonicalize(v);
+    }
+    return out;
+  }
+  return value;
+}
+function hashSendPayload(payload) {
+  return createHash2("sha256").update(JSON.stringify(canonicalize(payload))).digest("hex");
+}
+function sign(body) {
+  return createHmac2("sha256", hmacKey()).update(`${PREFIX}.${body}`).digest("base64url");
+}
+function issueConfirmToken(binding, now = Date.now()) {
+  const exp = now + confirmTokenTtlSeconds() * 1e3;
+  const claims = {
+    t: binding.tool,
+    a: binding.account,
+    g: binding.target,
+    ...binding.revision === void 0 ? {} : { r: binding.revision },
+    h: binding.payloadHash,
+    iat: now,
+    exp,
+    n: randomBytes(16).toString("base64url")
+  };
+  const body = Buffer.from(JSON.stringify(claims), "utf8").toString("base64url");
+  return { token: `${PREFIX}.${body}.${sign(body)}`, expiresAt: new Date(exp).toISOString() };
+}
+function signatureMatches(body, sig) {
+  const expected = Buffer.from(sign(body), "utf8");
+  const actual = Buffer.from(sig, "utf8");
+  return expected.length === actual.length && timingSafeEqual2(expected, actual);
+}
+function parseClaims(body) {
+  try {
+    return JSON.parse(Buffer.from(body, "base64url").toString("utf8"));
+  } catch {
+    return void 0;
+  }
+}
+function verifyConfirmToken(token, binding, now = Date.now()) {
+  for (const [nonce, exp] of spent) if (exp < now) spent.delete(nonce);
+  const parts = token.split(".");
+  if (parts.length !== 3 || parts[0] !== PREFIX || !parts[1] || !parts[2]) return { ok: false, error: "TOKEN_INVALID" };
+  const [, body, sig] = parts;
+  if (!signatureMatches(body, sig)) return { ok: false, error: "TOKEN_INVALID" };
+  const claims = parseClaims(body);
+  if (!claims) return { ok: false, error: "TOKEN_INVALID" };
+  if (claims.t !== binding.tool || claims.a !== binding.account || claims.g !== binding.target) {
+    return { ok: false, error: "TOKEN_INVALID" };
+  }
+  if (spent.has(claims.n)) return { ok: false, error: "TOKEN_REUSED" };
+  if (now > claims.exp) return { ok: false, error: "TOKEN_EXPIRED" };
+  if (claims.r !== binding.revision) return { ok: false, error: "DRAFT_CHANGED", reason: "message-id-rotated" };
+  if (claims.h !== binding.payloadHash) return { ok: false, error: "DRAFT_CHANGED", reason: "payload-changed" };
+  spent.set(claims.n, claims.exp);
+  return { ok: true };
+}
+
+// ../gogcli-mcp/src/dispatch-confirmation.ts
+var CONFIRM_ACTION_INSTRUCTION = "Show this preview to the user verbatim and proceed only after they explicitly approve in chat. Then call again with confirmToken.";
+var FALLBACK_HINT = "Or set GOG_SEND_CONFIRM_FALLBACK=token to enable two-step confirmation.";
+var CONFIRM_FALLBACK_DESCRIPTION = ' If the client cannot show that prompt (no MCP elicitation, e.g. claude.ai) and the server sets GOG_SEND_CONFIRM_FALLBACK=token, a two-step flow applies instead: call WITHOUT confirmToken and nothing is sent or changed \u2014 the result has status "confirmation-required", the full preview and a confirmToken. Show that preview to the user verbatim; only after they explicitly approve it in chat, call again with the SAME arguments plus confirmToken. The tool re-reads what it would act on and refuses (DRAFT_CHANGED, with a fresh preview and token) if it changed; TOKEN_EXPIRED / TOKEN_REUSED / TOKEN_INVALID also do nothing.';
+var confirmTokenParam = external_exports.string().optional().describe(
+  `ONLY for the two-step fallback (client without MCP elicitation, server with GOG_SEND_CONFIRM_FALLBACK=token). The confirmToken from this same tool's phase-1 "confirmation-required" response, passed back ONLY after the user has seen that preview and explicitly approved it in chat \u2014 never on the first call, never invented, never reused. Call again with the same arguments. Ignored when the client supports elicitation.`
+);
+var TOKEN_ERROR_NOTE = {
+  TOKEN_EXPIRED: "Nothing was sent or changed: the confirmToken expired. Call again WITHOUT confirmToken for a fresh preview, and ask the user to approve it again.",
+  TOKEN_REUSED: "Nothing was sent or changed by this call: this confirmToken was already used, and one approval acts once. If doing it again is really intended, call again WITHOUT confirmToken and get a new approval.",
+  TOKEN_INVALID: "Nothing was sent or changed: this confirmToken was not issued by this server for this tool, account and target (or the server has restarted since). Call again WITHOUT confirmToken for a fresh preview and approval."
+};
+var DRAFT_CHANGED_NOTE = {
+  "message-id-rotated": "Nothing was sent or changed: the target was edited since the user approved it (a draft's messageId or an event's version rotated), so what would happen is not what they saw.",
+  "payload-changed": "Nothing was sent or changed: what would happen no longer matches what the user approved."
+};
+function isToolResult(value) {
+  return Array.isArray(value.content);
+}
+function rejection2(data) {
+  return { ...textResult({ status: "confirmation-rejected", confirmed: false, dispatched: false, ...data }), isError: true };
+}
+async function tokenConfirmation(op, fallback) {
+  const subject = await fallback.subject();
+  if (isToolResult(subject)) return subject;
+  const binding = {
+    tool: fallback.tool,
+    account: fallback.account ?? readEnvVar("GOG_ACCOUNT") ?? "",
+    target: subject.target,
+    ...subject.revision === void 0 ? {} : { revision: subject.revision },
+    payloadHash: hashSendPayload(subject.payload)
+  };
+  const phaseOne = () => {
+    const { token, expiresAt } = issueConfirmToken(binding);
+    return {
+      action: op,
+      preview: subject.preview,
+      confirmToken: token,
+      expiresAt,
+      ttlSeconds: confirmTokenTtlSeconds(),
+      instruction: fallback.instruction ?? CONFIRM_ACTION_INSTRUCTION
+    };
+  };
+  if (!fallback.confirmToken) {
+    return textResult({ status: "confirmation-required", confirmed: false, dispatched: false, ...phaseOne() });
+  }
+  const verdict = verifyConfirmToken(fallback.confirmToken, binding);
+  if (verdict.ok) return void 0;
+  if (verdict.error === "DRAFT_CHANGED") {
+    return rejection2({
+      error: "DRAFT_CHANGED",
+      reason: verdict.reason,
+      note: `${DRAFT_CHANGED_NOTE[verdict.reason]} The current preview and a fresh confirmToken are below.`,
+      ...phaseOne()
+    });
+  }
+  return rejection2({ error: verdict.error, action: op, note: TOKEN_ERROR_NOTE[verdict.error] });
+}
+function gatedElsewhere(what, via, does, tool) {
+  return `${what} ${does} and is not available through ${via}. Use ${tool}, which asks the user to confirm.`;
+}
+async function requireDispatchConfirmation(ctx, options) {
+  const { action, fallback } = options;
+  if (fallback && callerAcceptsFormElicitation(ctx) === false && sendConfirmFallbackEnabled()) {
+    return tokenConfirmation(action, fallback);
+  }
+  const note = fallback ? [options.unsupportedNote, FALLBACK_HINT].filter(Boolean).join(" ") : options.unsupportedNote;
+  return requireConfirmation(ctx, {
+    action,
+    message: options.message,
+    details: options.details,
+    confirmationLabel: options.confirmationLabel,
+    ...note ? { unsupportedNote: note } : {}
+  });
+}
+function resultText(result) {
+  const first = result.content[0];
+  return first && first.type === "text" && typeof first.text === "string" ? first.text : "{}";
+}
+
 // ../gogcli-mcp/src/tools/auth.ts
+var AUTH_RUN_SUBCOMMANDS = ["list", "status", "services", "remove", "alias"];
 function registerAuthToolsWith(server, defaultServices) {
   const servicesDescribe = `Services to authorize: "all" or comma-separated list (e.g. "sheets,gmail,calendar"). Default: "${defaultServices}". Prefer the narrowest set you need \u2014 requesting a service whose Google API is not enabled on the OAuth client's project makes Google reject the WHOLE request with invalid_scope.`;
   const extraScopesDescribe = "Additional raw OAuth scope URIs to request, comma-separated, on top of the ones `services` implies. Use for scopes no service covers \u2014 e.g. https://www.googleapis.com/auth/bigquery.readonly, required before gog_sheets_datasource_* can read BigQuery-backed Connected Sheets. Leave unset otherwise: an extra scope whose API is not enabled on the OAuth client project makes Google reject the WHOLE authorization with invalid_scope.";
@@ -35341,7 +36020,7 @@ function registerAuthToolsWith(server, defaultServices) {
     })
   }, async ({ email: email3, services = defaultServices, extraScopes }) => {
     try {
-      const args = ["auth", "add", email3, "--services", services];
+      const args = ["auth", "add", pos(email3), "--services", services];
       if (extraScopes) args.push(`--extra-scopes=${extraScopes}`, "--force-consent");
       return rawTextResult(await run(args, {
         interactive: true,
@@ -35361,7 +36040,7 @@ function registerAuthToolsWith(server, defaultServices) {
     })
   }, async ({ email: email3, services = defaultServices, extraScopes }) => {
     try {
-      const args = ["auth", "add", email3, "--remote", "--step", "1", "--services", services, "--force-consent"];
+      const args = ["auth", "add", pos(email3), "--remote", "--step", "1", "--services", services, "--force-consent"];
       if (extraScopes) args.push(`--extra-scopes=${extraScopes}`);
       return rawTextResult(await run(args, { redactMode: "tokens" }));
     } catch (err) {
@@ -35388,7 +36067,7 @@ function registerAuthToolsWith(server, defaultServices) {
       const args = [
         "auth",
         "add",
-        email3,
+        pos(email3),
         "--remote",
         "--step",
         "2",
@@ -35408,6 +36087,7 @@ function registerAuthToolsWith(server, defaultServices) {
     service: "auth",
     examples: '"remove", "alias", "list"',
     omitAccount: true,
+    allowedSubcommands: AUTH_RUN_SUBCOMMANDS,
     note: "For browser-based authorization, use gog_auth_add instead."
   });
 }
@@ -35481,12 +36161,25 @@ function inlineFileArg(flag, attachment, opts = {}) {
 }
 
 // ../gogcli-mcp/src/tools/drive.ts
+function vetDriveRun(subcommand, _args) {
+  return subcommand.toLowerCase() === "share" ? gatedElsewhere("gog drive share", "gog_drive_run", "grants access to a file", "gog_drive_share") : void 0;
+}
 var GOOGLE_DOC_MIME = "application/vnd.google-apps.document";
+function shareTargetMeta(raw) {
+  try {
+    const { name, mimeType } = fileMeta(raw);
+    return { name, mimeType };
+  } catch {
+    return {};
+  }
+}
 function fileMeta(raw) {
   const parsed = JSON.parse(raw);
   const f = parsed.file ?? parsed;
-  return { name: f.name, mimeType: f.mimeType };
+  const size = f.size === void 0 ? void 0 : Number(f.size);
+  return { name: f.name, mimeType: f.mimeType, size: Number.isFinite(size) ? size : void 0 };
 }
+var MAX_DRIVE_READ_BYTES = MAX_INLINE_ATTACHMENT_BYTES;
 var DRIVE_LS_COMPACT_FIELDS = "nextPageToken,files(id,name,mimeType,modifiedTime,size,webViewLink)";
 function registerDriveTools(server) {
   server.registerTool("gog_drive_ls", {
@@ -35530,7 +36223,7 @@ function registerDriveTools(server) {
       account: accountParam
     })
   }, async ({ query, view, account }) => {
-    return runOrDiagnose(["drive", "search", query], {
+    return runOrDiagnose(["drive", "search", pos(query)], {
       account,
       stripMedia: resolveView(view, ["compact", "full"]) === "compact"
     });
@@ -35550,7 +36243,7 @@ function registerDriveTools(server) {
       account: accountParam
     })
   }, async ({ fileId, view, account }) => {
-    return runOrDiagnose(["drive", "get", fileId], {
+    return runOrDiagnose(["drive", "get", pos(fileId)], {
       account,
       stripMedia: resolveView(view, ["compact", "full"]) === "compact"
     });
@@ -35563,7 +36256,7 @@ function registerDriveTools(server) {
       account: accountParam
     })
   }, async ({ name, account }) => {
-    return runOrDiagnose(["drive", "mkdir", name], { account });
+    return runOrDiagnose(["drive", "mkdir", pos(name)], { account });
   });
   server.registerTool("gog_drive_rename", {
     description: "Rename a file or folder in Google Drive.",
@@ -35574,7 +36267,7 @@ function registerDriveTools(server) {
       account: accountParam
     })
   }, async ({ fileId, newName, account }) => {
-    return runOrDiagnose(["drive", "rename", fileId, newName], { account });
+    return runOrDiagnose(["drive", "rename", pos(fileId), pos(newName)], { account });
   });
   server.registerTool("gog_drive_move", {
     description: "Move a file to a different folder in Google Drive.",
@@ -35585,7 +36278,7 @@ function registerDriveTools(server) {
       account: accountParam
     })
   }, async ({ fileId, parentId, account }) => {
-    return runOrDiagnose(["drive", "move", fileId, `--parent=${parentId}`], { account });
+    return runOrDiagnose(["drive", "move", pos(fileId), `--parent=${parentId}`], { account });
   });
   server.registerTool("gog_drive_delete", {
     description: "Move a Google Drive file to trash, or permanently delete it with permanent=true (irreversible).",
@@ -35596,13 +36289,13 @@ function registerDriveTools(server) {
       account: accountParam
     })
   }, async ({ fileId, permanent, account }) => {
-    const args = ["drive", "delete", fileId];
+    const args = ["drive", "delete", pos(fileId)];
     if (permanent) args.push("--permanent");
     args.push("--force");
     return runOrDiagnose(args, { account });
   });
   server.registerTool("gog_drive_share", {
-    description: "Share a Google Drive file or folder.",
+    description: "Share a Google Drive file or folder. Granting access is the risk even though no email is sent (gog does not notify by default), so this reads the file and asks the MCP host to show the user a confirmation prompt naming it, who gets access and with what role; nothing is shared unless they accept." + CONFIRM_FALLBACK_DESCRIPTION,
     annotations: { destructiveHint: true },
     inputSchema: external_exports.object({
       fileId: external_exports.string().describe("File or folder ID"),
@@ -35610,10 +36303,36 @@ function registerDriveTools(server) {
       email: external_exports.string().optional().describe("User email (required when to=user)"),
       domain: external_exports.string().optional().describe("Domain (required when to=domain)"),
       role: external_exports.enum(["reader", "writer"]).optional().describe("Permission role (default: reader)"),
-      account: accountParam
+      account: accountParam,
+      confirmToken: confirmTokenParam
     })
-  }, async ({ fileId, to, email: email3, domain: domain2, role, account }) => {
-    const args = ["drive", "share", fileId, `--to=${to}`];
+  }, async ({ fileId, to, email: email3, domain: domain2, role, account, confirmToken }, ctx) => {
+    const got = await runOrDiagnose(["drive", "get", pos(fileId)], { account });
+    if (got.isError) return got;
+    const file2 = { id: fileId, ...shareTargetMeta(resultText(got)) };
+    const grant = {
+      file: file2,
+      to,
+      ...email3 ? { email: email3 } : {},
+      ...domain2 ? { domain: domain2 } : {},
+      role: role ?? "reader",
+      publicLink: to === "anyone"
+    };
+    const confirmation = await requireDispatchConfirmation(ctx, {
+      action: "drive.share",
+      message: to === "anyone" ? "Review and confirm making this file available to ANYONE with the link:" : "Review and confirm this Drive share:",
+      confirmationLabel: "Confirm that this access should be granted now.",
+      details: grant,
+      unsupportedNote: "Ask the user to share it themselves from Google Drive.",
+      fallback: {
+        tool: "gog_drive_share",
+        account,
+        confirmToken,
+        subject: () => ({ target: fileId, payload: grant, preview: grant })
+      }
+    });
+    if (confirmation) return confirmation;
+    const args = ["drive", "share", pos(fileId), `--to=${to}`];
     if (email3) args.push(`--email=${email3}`);
     if (domain2) args.push(`--domain=${domain2}`);
     if (role) args.push(`--role=${role}`);
@@ -35636,7 +36355,7 @@ function registerDriveTools(server) {
   }, async ({ fileId, ocrLanguage, offset = 0, maxChars, account }) => {
     let tempDocId;
     try {
-      const { name, mimeType } = fileMeta(await run(["drive", "get", fileId], { account }));
+      const { name, mimeType } = fileMeta(await run(["drive", "get", pos(fileId)], { account }));
       let sourceId = fileId;
       if (mimeType !== GOOGLE_DOC_MIME) {
         const params = JSON.stringify({ fileId, ...ocrLanguage ? { ocrLanguage } : {} });
@@ -35681,13 +36400,13 @@ function registerDriveTools(server) {
       return diagnose(err);
     } finally {
       if (tempDocId) {
-        await run(["drive", "delete", tempDocId, "--permanent", "--force"], { account }).catch(() => {
+        await run(["drive", "delete", pos(tempDocId), "--permanent", "--force"], { account }).catch(() => {
         });
       }
     }
   });
   server.registerTool("gog_drive_read_bytes", {
-    description: "Fetch a Drive file's raw bytes and return them base64-encoded as an embedded resource \u2014 the generic fallback for callers that want the file itself (to parse locally) rather than extracted text. For readable text from a PDF, prefer gog_drive_extract_text.",
+    description: "Fetch a Drive file's raw bytes and return them base64-encoded as an embedded resource \u2014 the generic fallback for callers that want the file itself (to parse locally) rather than extracted text. Files over 8 MiB are refused (checked before downloading). For readable text from a PDF, prefer gog_drive_extract_text.",
     annotations: { readOnlyHint: true },
     inputSchema: external_exports.object({
       fileId: external_exports.string().describe("Drive file ID"),
@@ -35695,9 +36414,17 @@ function registerDriveTools(server) {
     })
   }, async ({ fileId, account }) => {
     try {
-      const { name, mimeType } = fileMeta(await run(["drive", "get", fileId], { account }));
+      const { name, mimeType, size } = fileMeta(await run(["drive", "get", pos(fileId)], { account }));
+      if (size !== void 0 && size > MAX_DRIVE_READ_BYTES) {
+        return errorResult(
+          `${name ?? fileId} is ${size} bytes, over the 8 MiB this tool returns inline. Use gog_drive_extract_text for its text, or share its webViewLink (gog_drive_get) instead.`
+        );
+      }
       const params = JSON.stringify({ fileId, alt: "media" });
-      const blob = await runBinary(["api", "call", "drive", "v3", "files.get", `--params=${params}`], { account });
+      const blob = await runBinary(
+        ["api", "call", "drive", "v3", "files.get", `--params=${params}`],
+        { account, maxOutputBytes: MAX_DRIVE_READ_BYTES }
+      );
       const type = mimeType ?? "application/octet-stream";
       const unrenderableHint = type.startsWith("image/") ? "" : ` If your client does not render a ${type} resource, gog_drive_extract_text returns the same file as text (PDFs included, via OCR).`;
       return {
@@ -35717,7 +36444,7 @@ function registerDriveTools(server) {
       return diagnose(err);
     }
   });
-  registerRunTool(server, { service: "drive", examples: '"copy", "upload", "download", "permissions"' });
+  registerRunTool(server, { service: "drive", examples: '"copy", "download", "permissions"', vet: vetDriveRun });
 }
 
 // ../gogcli-mcp/src/tools/gmail.ts
@@ -35732,7 +36459,7 @@ var replySchema = {
   remove: external_exports.array(external_exports.string()).optional().describe("Remove these recipients from all fields (repeatable) \u2014 e.g. to drop someone from a reply-all."),
   subject: external_exports.string().optional().describe('Override reply subject (default: "Re: <original>"). A changed subject starts a NEW Gmail thread.'),
   noQuote: external_exports.boolean().optional().describe("Do not include the original message quoted below the reply (default: the original is quoted)"),
-  attach: external_exports.array(external_exports.string()).optional().describe(`File paths to attach (repeatable), resolved ON THE GOG SERVER's filesystem \u2014 NOT this client's. Only usable when gog runs on the same machine you do (local stdio); on a hosted deployment (e.g. mcp-host) these paths do not exist and the call fails with "no such file or directory" \u2014 use attachInline there. Read on the server, base64-encoded with a MIME type inferred from the extension.`),
+  attach: external_exports.array(external_exports.string()).optional().describe(`File paths to attach (repeatable), resolved ON THE GOG SERVER's filesystem \u2014 NOT this client's. Only usable when gog runs on the same machine you do (local stdio); on a hosted deployment (e.g. mcp-host) these paths do not exist and the call fails with "no such file or directory" \u2014 use attachInline there. Read on the server, base64-encoded with a MIME type inferred from the extension. Must be inside the server's GOG_FILE_ROOTS directories (default ~/gogcli-mcp-files).`),
   attachInline: attachInlineParam,
   from: external_exports.string().optional().describe("Send from this email address (must be a verified send-as alias)"),
   autoFromAddressedAlias: external_exports.boolean().optional().describe("When from is omitted, send from the verified send-as alias the original message was addressed TO, instead of the account's primary address \u2014 so a reply to mail sent to an alias goes back out from that alias. Ignored when from is set."),
@@ -35741,7 +36468,7 @@ var replySchema = {
   signatureFile: external_exports.string().optional().describe("Append a local signature file (plain text or HTML), read on the gog server"),
   account: accountParam
 };
-var sendReplySchema = external_exports.object(replySchema);
+var sendReplySchema = external_exports.object({ ...replySchema, confirmToken: confirmTokenParam });
 
 // ../gogcli-mcp/src/tools/sheets.ts
 var cellValueParam = external_exports.union([external_exports.string(), external_exports.number(), external_exports.boolean(), external_exports.null()]);
@@ -35753,10 +36480,10 @@ var failIfNotEmptyParam = external_exports.boolean().optional().describe(
 );
 
 // ../gogcli-mcp/src/server.ts
-var VERSION = true ? "4.2.5" : "0.0.0";
+var VERSION = true ? "4.4.0" : "0.0.0";
 
 // ../gogcli-mcp/src/bootstrap-auth.ts
-import { join as join2 } from "node:path";
+import { join as join5 } from "node:path";
 var AUTH_BOOTSTRAP_MARKER = "auth-bootstrap.sha256";
 var VARS = ["GOG_CLIENT_ID", "GOG_CLIENT_SECRET", "GOG_REFRESH_TOKEN", "GOG_ACCOUNT"];
 var log = (line) => {
@@ -35790,12 +36517,12 @@ async function bootstrapGogAuth(env = process.env, options = {}) {
   const [clientId, clientSecret, refreshToken, account] = values;
   const { spawner } = options;
   try {
-    const { createHash } = await import("node:crypto");
+    const { createHash: createHash3 } = await import("node:crypto");
     const { mkdir, readFile, writeFile, chmod } = await import("node:fs/promises");
     const home = options.home ?? (await import("node:os")).homedir();
-    const dir = join2(home, ".gogcli-mcp");
-    const marker = join2(dir, AUTH_BOOTSTRAP_MARKER);
-    const fingerprint = createHash("sha256").update(values.join("\0")).digest("hex");
+    const dir = join5(home, ".gogcli-mcp");
+    const marker = join5(dir, AUTH_BOOTSTRAP_MARKER);
+    const fingerprint = createHash3("sha256").update(values.join("\0")).digest("hex");
     const previous = await readFile(marker, "utf8").catch(() => void 0);
     if (previous === fingerprint && await accountListed(account, spawner)) return "present";
     await run(
@@ -35831,7 +36558,8 @@ var MAX_BLOB_UPLOAD_BYTES = 100 * 1024 * 1024;
 function registerExtraDriveTools(server) {
   server.registerTool("gog_drive_download", {
     description: "Download a Drive file to the local filesystem. For Google Docs formats, specify an export format (pdf, csv, xlsx, pptx, txt, png, docx, md).",
-    annotations: { readOnlyHint: true },
+    // Writes a file on the gog host and can overwrite one: not read-only (audit SEC-4).
+    annotations: { readOnlyHint: false, destructiveHint: true },
     inputSchema: external_exports.object({
       fileId: external_exports.string().describe("File ID to download"),
       out: external_exports.string().optional().describe("Output file path (default: gogcli config dir)"),
@@ -35840,7 +36568,8 @@ function registerExtraDriveTools(server) {
       account: accountParam
     })
   }, async ({ fileId, out, format, overwrite, account }) => {
-    const args = ["drive", "download", fileId];
+    if (out) confinePath(out, "out");
+    const args = ["drive", "download", pos(fileId)];
     if (out) args.push(`--out=${out}`);
     if (format) args.push(`--format=${format}`);
     if (overwrite) args.push("--overwrite");
@@ -35850,7 +36579,7 @@ function registerExtraDriveTools(server) {
     description: `Upload a file to Drive. Supply it EITHER as localPath (a path on the gog server's own filesystem \u2014 local stdio deployments only) OR as content (the bytes, base64-encoded, carried with the request), which is what works when this server runs remotely from you and no path you can name exists on it. Use replace to replace the content of an existing file (preserves link/permissions), or convert to auto-convert to a Google format. Pair replace with ifVersion to make the overwrite conditional: gog sends an atomic If-Match precondition and reports a conflict \u2014 applying nothing \u2014 if the file changed since you read it, instead of silently clobbering a concurrent edit. No read tool surfaces the version number: fetch it immediately before uploading with gog_drive_run { subcommand: "raw", args: ["<fileId>", "--fields=version"] } \u2014 it comes back as a JSON string, so pass it on as a number. Conditional replacement refuses Google Workspace files (Docs/Sheets/Slides), which have no replaceable binary content.`,
     annotations: { destructiveHint: false },
     inputSchema: external_exports.object({
-      localPath: external_exports.string().optional().describe(`Path to the file to upload, resolved ON THE GOG SERVER's filesystem \u2014 NOT this client's. Only usable when gog runs on the same machine you do (local stdio); on a hosted deployment (e.g. mcp-host) this path does not exist and the call fails with "no such file or directory" \u2014 use content there. Exactly one of localPath / content is required.`),
+      localPath: external_exports.string().optional().describe(`Path to the file to upload, resolved ON THE GOG SERVER's filesystem \u2014 NOT this client's. Only usable when gog runs on the same machine you do (local stdio); on a hosted deployment (e.g. mcp-host) this path does not exist and the call fails with "no such file or directory" \u2014 use content there. Exactly one of localPath / content is required. Must be inside the server's GOG_FILE_ROOTS directories (default ~/gogcli-mcp-files).`),
       content: external_exports.string().optional().describe("The file's bytes, base64-encoded (standard alphabet, with padding) \u2014 upload a file you hold without it existing anywhere on the gog server. This is the only route that works when the caller and gog share no filesystem. Requires name (there is no path to take a filename from). Max 8 MiB; for anything larger use localPath from a local deployment. Exactly one of localPath / content is required \u2014 supplying both is an error, not a precedence rule."),
       name: external_exports.string().optional().describe("Override filename (create) or rename target (replace)"),
       parent: external_exports.string().optional().describe("Destination folder ID (create only)"),
@@ -35875,7 +36604,7 @@ function registerExtraDriveTools(server) {
     }
     let pathArg;
     if (localPath !== void 0) {
-      pathArg = localPath;
+      pathArg = confinePath(localPath, "localPath");
     } else {
       if (!name) {
         throw new Error("content requires name: there is no path to derive the Drive filename from.");
@@ -35886,7 +36615,7 @@ function registerExtraDriveTools(server) {
         { positional: true, where: "content" }
       ).arg;
     }
-    const args = ["drive", "upload", pathArg];
+    const args = ["drive", "upload", typeof pathArg === "string" ? pos(pathArg) : pathArg];
     if (name) args.push(`--name=${name}`);
     if (parent) args.push(`--parent=${parent}`);
     if (replace) args.push(`--replace=${replace}`);
@@ -35901,14 +36630,15 @@ function registerExtraDriveTools(server) {
     description: "Recursively push a local directory's contents into an existing Drive folder \u2014 uploads new files, updates changed ones (matched by name + MD5), and creates missing subfolders. One-way and additive: it never deletes anything on Drive. Use dryRun to preview the planned actions first.",
     annotations: { destructiveHint: true },
     inputSchema: external_exports.object({
-      localPath: external_exports.string().describe("Local directory to push (its contents are mirrored into the parent folder)"),
+      localPath: external_exports.string().describe("Local directory to push (its contents are mirrored into the parent folder). Must be inside the server's GOG_FILE_ROOTS directories (default ~/gogcli-mcp-files)."),
       parent: external_exports.string().describe("Existing destination Drive folder ID"),
       dryRun: external_exports.boolean().optional().describe("Preview the planned actions without making any changes"),
       allDrives: external_exports.boolean().optional().describe("Include shared drives (default: true; set false for My Drive only)"),
       account: accountParam
     })
   }, async ({ localPath, parent, dryRun, allDrives, account }) => {
-    const args = ["drive", "sync", "push", localPath, `--parent=${parent}`];
+    confinePath(localPath, "localPath");
+    const args = ["drive", "sync", "push", pos(localPath), `--parent=${parent}`];
     if (dryRun) args.push("--dry-run");
     if (allDrives === false) args.push("--no-all-drives");
     return runOrDiagnose(args, { account });
@@ -35923,7 +36653,7 @@ function registerExtraDriveTools(server) {
       account: accountParam
     })
   }, async ({ fileId, name, parent, account }) => {
-    const args = ["drive", "copy", fileId, name];
+    const args = ["drive", "copy", pos(fileId), pos(name)];
     if (parent) args.push(`--parent=${parent}`);
     return runOrDiagnose(args, { account });
   });
@@ -35935,7 +36665,7 @@ function registerExtraDriveTools(server) {
       account: accountParam
     })
   }, async ({ fileIds, account }) => {
-    return runOrDiagnose(["drive", "url", ...fileIds], { account });
+    return runOrDiagnose(["drive", "url", ...fileIds.map(pos)], { account });
   });
   server.registerTool("gog_drive_permissions", {
     description: "List permissions on a Drive file.",
@@ -35948,7 +36678,7 @@ function registerExtraDriveTools(server) {
       account: accountParam
     })
   }, async ({ fileId, max, pageToken, page, account }) => {
-    const args = ["drive", "permissions", fileId];
+    const args = ["drive", "permissions", pos(fileId)];
     if (max !== void 0) args.push(`--max=${max}`);
     const token = resolvePageToken({ pageToken, page });
     if (token) args.push(`--page=${token}`);
@@ -35963,7 +36693,7 @@ function registerExtraDriveTools(server) {
       account: accountParam
     })
   }, async ({ fileId, permissionId, account }) => {
-    return runOrDiagnose(["drive", "unshare", fileId, permissionId, "--force"], { account });
+    return runOrDiagnose(["drive", "unshare", pos(fileId), pos(permissionId), "--force"], { account });
   });
   server.registerTool("gog_drive_drives_list", {
     description: "List shared drives (Team Drives) accessible to the account.",
@@ -35996,7 +36726,7 @@ function registerExtraDriveTools(server) {
       account: accountParam
     })
   }, async ({ fileId, since, includeQuoted, max, page, all, account }) => {
-    const args = ["drive", "comments", "list", fileId];
+    const args = ["drive", "comments", "list", pos(fileId)];
     if (since) args.push(`--since=${since}`);
     if (includeQuoted) args.push("--include-quoted");
     pushPaginationFlags(args, { max, page, all });
@@ -36011,7 +36741,7 @@ function registerExtraDriveTools(server) {
       account: accountParam
     })
   }, async ({ fileId, commentId, account }) => {
-    return runOrDiagnose(["drive", "comments", "get", fileId, commentId], { account });
+    return runOrDiagnose(["drive", "comments", "get", pos(fileId), pos(commentId)], { account });
   });
   server.registerTool("gog_drive_comments_add", {
     description: "Add a new comment to a Drive file.",
@@ -36022,7 +36752,7 @@ function registerExtraDriveTools(server) {
       account: accountParam
     })
   }, async ({ fileId, content, account }) => {
-    return runOrDiagnose(["drive", "comments", "create", fileId, content], { account });
+    return runOrDiagnose(["drive", "comments", "create", pos(fileId), pos(content)], { account });
   });
   server.registerTool("gog_drive_comments_update", {
     description: "Update the text of an existing comment.",
@@ -36034,7 +36764,7 @@ function registerExtraDriveTools(server) {
       account: accountParam
     })
   }, async ({ fileId, commentId, content, account }) => {
-    return runOrDiagnose(["drive", "comments", "update", fileId, commentId, content], { account });
+    return runOrDiagnose(["drive", "comments", "update", pos(fileId), pos(commentId), pos(content)], { account });
   });
   server.registerTool("gog_drive_comments_delete", {
     description: "Delete a comment from a Drive file.",
@@ -36045,7 +36775,7 @@ function registerExtraDriveTools(server) {
       account: accountParam
     })
   }, async ({ fileId, commentId, account }) => {
-    return runOrDiagnose(["drive", "comments", "delete", fileId, commentId, "--force"], { account });
+    return runOrDiagnose(["drive", "comments", "delete", pos(fileId), pos(commentId), "--force"], { account });
   });
   server.registerTool("gog_drive_comments_reply", {
     description: 'Reply to an existing comment on a Drive file. Pass `action: "resolve"` or `"reopen"` to atomically flip the parent comment\'s resolved state via the Drive API\'s Reply.action field \u2014 avoids the older workaround of deleting the comment (which destroys review-thread context).',
@@ -36058,7 +36788,7 @@ function registerExtraDriveTools(server) {
       account: accountParam
     })
   }, async ({ fileId, commentId, content, action, account }) => {
-    const args = ["drive", "comments", "reply", fileId, commentId, content];
+    const args = ["drive", "comments", "reply", pos(fileId), pos(commentId), pos(content)];
     if (action) args.push(`--action=${action}`);
     return runOrDiagnose(args, { account });
   });
@@ -36071,7 +36801,7 @@ function registerExtraDriveTools(server) {
       account: accountParam
     })
   }, async ({ fileId, commentId, account }) => {
-    return runOrDiagnose(["drive", "comments", "resolve", fileId, commentId], { account });
+    return runOrDiagnose(["drive", "comments", "resolve", pos(fileId), pos(commentId)], { account });
   });
   server.registerTool("gog_drive_comments_reopen", {
     description: 'Reopen a previously resolved comment on a Drive file. To reopen while replying, use gog_drive_comments_reply with action: "reopen".',
@@ -36082,7 +36812,7 @@ function registerExtraDriveTools(server) {
       account: accountParam
     })
   }, async ({ fileId, commentId, account }) => {
-    return runOrDiagnose(["drive", "comments", "reopen", fileId, commentId], { account });
+    return runOrDiagnose(["drive", "comments", "reopen", pos(fileId), pos(commentId)], { account });
   });
   server.registerTool("gog_drive_du", {
     description: "Summarize Drive folder sizes (disk-usage style) starting from a folder.",
@@ -36168,7 +36898,7 @@ function registerExtraDriveTools(server) {
       account: accountParam
     })
   }, async ({ fileId, max, page, all, account }) => {
-    const args = ["drive", "revisions", "list", fileId];
+    const args = ["drive", "revisions", "list", pos(fileId)];
     pushPaginationFlags(args, { max, page, all });
     return runOrDiagnose(args, { account });
   });
@@ -36181,7 +36911,7 @@ function registerExtraDriveTools(server) {
       account: accountParam
     })
   }, async ({ fileId, revisionId, account }) => {
-    return runOrDiagnose(["drive", "revisions", "get", fileId, revisionId], { account });
+    return runOrDiagnose(["drive", "revisions", "get", pos(fileId), pos(revisionId)], { account });
   });
   server.registerTool("gog_drive_shortcut_create", {
     description: "Create a Drive shortcut to a file or folder inside a destination folder. Shortcuts are classified distinctly in listing/tree output and are never followed by tree scans.",
@@ -36193,7 +36923,7 @@ function registerExtraDriveTools(server) {
       account: accountParam
     })
   }, async ({ targetId, parent, name, account }) => {
-    const args = ["drive", "shortcut", "create", targetId, `--parent=${parent}`];
+    const args = ["drive", "shortcut", "create", pos(targetId), `--parent=${parent}`];
     if (name) args.push(`--name=${name}`);
     return runOrDiagnose(args, { account });
   });
@@ -36234,7 +36964,7 @@ function registerExtraDriveTools(server) {
       account: accountParam
     })
   }, async ({ name, language, view, adminAccess, account }) => {
-    const args = ["drive", "labels", "get", name];
+    const args = ["drive", "labels", "get", pos(name)];
     if (language) args.push(`--language=${language}`);
     if (view) args.push(`--view=${view}`);
     if (adminAccess) args.push("--admin-access");
@@ -36251,7 +36981,7 @@ function registerExtraDriveTools(server) {
       account: accountParam
     })
   }, async ({ fileId, max, pageToken, page, account }) => {
-    const args = ["drive", "labels", "file", "list", fileId];
+    const args = ["drive", "labels", "file", "list", pos(fileId)];
     if (max !== void 0) args.push(`--max=${max}`);
     const token = resolvePageToken({ pageToken, page });
     if (token) args.push(`--page=${token}`);
@@ -36273,7 +37003,7 @@ function registerExtraDriveTools(server) {
       account: accountParam
     })
   }, async ({ fileId, labelId, text, selection, integer: integer2, date: date5, user, unset, fieldsJson, account }) => {
-    const args = ["drive", "labels", "file", "apply", fileId, labelId];
+    const args = ["drive", "labels", "file", "apply", pos(fileId), pos(labelId)];
     if (text) for (const t of text) args.push(`--text=${t}`);
     if (selection) for (const s of selection) args.push(`--selection=${s}`);
     if (integer2) for (const i of integer2) args.push(`--integer=${i}`);
@@ -36292,7 +37022,7 @@ function registerExtraDriveTools(server) {
       account: accountParam
     })
   }, async ({ fileId, labelId, account }) => {
-    return runOrDiagnose(["drive", "labels", "file", "remove", fileId, labelId, "--force"], { account });
+    return runOrDiagnose(["drive", "labels", "file", "remove", pos(fileId), pos(labelId), "--force"], { account });
   });
   server.registerTool("gog_drive_activity", {
     description: "Query the Drive Activity API for audit events (edits, creates, deletes, moves, shares, etc.) scoped to a file or folder and/or time range.",
@@ -36365,7 +37095,7 @@ function registerExtraDriveTools(server) {
       account: accountParam
     })
   }, async ({ user, file: file2, parent, depth, max, noAllDrives, account }) => {
-    const args = ["drive", "audit", "user", user];
+    const args = ["drive", "audit", "user", pos(user)];
     if (file2) args.push(`--file=${file2}`);
     if (parent) args.push(`--parent=${parent}`);
     if (depth !== void 0) args.push(`--depth=${depth}`);