gogcli-mcp 4.2.4 → 4.3.0

package/dist/lib.js

@@ -2001,8 +2001,8 @@ function emoji() {
 }
 var ipv4 = /^(?:(?:25[0-5]|2[0-4][0-9]|1[0-9][0-9]|[1-9][0-9]|[0-9])\.){3}(?:25[0-5]|2[0-4][0-9]|1[0-9][0-9]|[1-9][0-9]|[0-9])$/;
 var ipv6 = /^(([0-9a-fA-F]{1,4}:){7}[0-9a-fA-F]{1,4}|([0-9a-fA-F]{1,4}:){1,7}:|([0-9a-fA-F]{1,4}:){1,6}:[0-9a-fA-F]{1,4}|([0-9a-fA-F]{1,4}:){1,5}(:[0-9a-fA-F]{1,4}){1,2}|([0-9a-fA-F]{1,4}:){1,4}(:[0-9a-fA-F]{1,4}){1,3}|([0-9a-fA-F]{1,4}:){1,3}(:[0-9a-fA-F]{1,4}){1,4}|([0-9a-fA-F]{1,4}:){1,2}(:[0-9a-fA-F]{1,4}){1,5}|[0-9a-fA-F]{1,4}:((:[0-9a-fA-F]{1,4}){1,6})|:((:[0-9a-fA-F]{1,4}){1,7}|:))$/;
-var mac = (delimiter2) => {
-  const escapedDelim = escapeRegex(delimiter2 ?? ":");
+var mac = (delimiter3) => {
+  const escapedDelim = escapeRegex(delimiter3 ?? ":");
   return new RegExp(`^(?:[0-9A-F]{2}${escapedDelim}){5}[0-9A-F]{2}$|^(?:[0-9a-f]{2}${escapedDelim}){5}[0-9a-f]{2}$`);
 };
 var cidrv4 = /^((25[0-5]|2[0-4][0-9]|1[0-9][0-9]|[1-9][0-9]|[0-9])\.){3}(25[0-5]|2[0-4][0-9]|1[0-9][0-9]|[1-9][0-9]|[0-9])\/([0-9]|[1-2][0-9]|3[0-2])$/;
@@ -5030,7 +5030,7 @@ var recursive = /* @__PURE__ */ new WeakMap();
 var NONE = 0;
 var ASSUMED = 1;
 var PROVEN = 2;
-function isRecursive(inst, stack, resolve) {
+function isRecursive(inst, stack, resolve4) {
   const cached2 = recursive.get(inst);
   if (cached2 !== void 0)
     return cached2 ? PROVEN : NONE;
@@ -5040,7 +5040,7 @@ function isRecursive(inst, stack, resolve) {
   let result = NONE;
   const check2 = (child) => {
     if (result !== PROVEN && child?._zod) {
-      const answer = isRecursive(child, stack, resolve);
+      const answer = isRecursive(child, stack, resolve4);
       if (answer > result)
         result = answer;
     }
@@ -5051,7 +5051,7 @@ function isRecursive(inst, stack, resolve) {
       const desc = Object.getOwnPropertyDescriptor(sh, key);
       if (spread && !desc.enumerable)
         continue;
-      const child = desc.get ? ASSUMED : desc.value?._zod ? isRecursive(desc.value, stack, resolve) : NONE;
+      const child = desc.get ? ASSUMED : desc.value?._zod ? isRecursive(desc.value, stack, resolve4) : NONE;
       if (child > answer)
         answer = child;
     }
@@ -5115,7 +5115,7 @@ function isRecursive(inst, stack, resolve) {
       break;
     // `$ZodLazy` caches its inner on the def, so a resolved edge is followed exactly
     case "lazy": {
-      const inner = def._cachedInner ?? (resolve ? inst._zod.innerType : void 0);
+      const inner = def._cachedInner ?? (resolve4 ? inst._zod.innerType : void 0);
       merge2(inner ? isRecursive(inner, stack, false) : ASSUMED);
       break;
     }
@@ -23998,14 +23998,14 @@ function inputRequiredRoundsExceededMessage(method, maxRounds) {
   return `Multi-round-trip request '${method}' still required input after ${maxRounds} rounds (inputRequired.maxRounds)`;
 }
 function sleep(ms, signal) {
-  return new Promise((resolve, reject) => {
+  return new Promise((resolve4, reject) => {
     if (signal?.aborted) {
       reject(signal.reason instanceof SdkError ? signal.reason : new SdkError(SdkErrorCode.RequestTimeout, String(signal.reason)));
       return;
     }
     const timer = setTimeout(() => {
       signal?.removeEventListener("abort", onAbort);
-      resolve();
+      resolve4();
     }, ms);
     const onAbort = () => {
       clearTimeout(timer);
@@ -24796,7 +24796,7 @@ var Protocol = class {
     const flowStartedAt = Date.now();
     let onAbort;
     let cleanupMessageId;
-    return new Promise((resolve, reject) => {
+    return new Promise((resolve4, reject) => {
       const earlyReject = (error62) => {
         reject(error62);
       };
@@ -24864,7 +24864,7 @@ var Protocol = class {
         }
         if (decoded.kind === "invalid") return reject(decoded.error);
         if (decoded.kind === "input_required") {
-          if (options?.allowInputRequired === true) return resolve(manualInputRequiredValue(decoded));
+          if (options?.allowInputRequired === true) return resolve4(manualInputRequiredValue(decoded));
           const flow = {
             codec: codec2,
             request,
@@ -24876,11 +24876,11 @@ var Protocol = class {
               params
             }, resultSchema, legOptions)
           };
-          return resolve(this._resolveNonCompleteResult(decoded, flow));
+          return resolve4(this._resolveNonCompleteResult(decoded, flow));
         }
         const result = decoded.result;
         validateStandardSchema(resultSchema, result).then((parseResult) => {
-          if (parseResult.success) resolve(parseResult.data);
+          if (parseResult.success) resolve4(parseResult.data);
           else reject(new SdkError(SdkErrorCode.InvalidResult, `Invalid result for ${request.method}: ${parseResult.error}`));
         }, reject);
       });
@@ -27692,7 +27692,7 @@ var require_compile = /* @__PURE__ */ __commonJSMin(((exports) => {
     ref = (0, resolve_1.resolveUrl)(this.opts.uriResolver, baseId, ref);
     const schOrFunc = root.refs[ref];
     if (schOrFunc) return schOrFunc;
-    let _sch = resolve.call(this, root, ref);
+    let _sch = resolve4.call(this, root, ref);
     if (_sch === void 0) {
       const schema = (_a3 = root.localRefs) === null || _a3 === void 0 ? void 0 : _a3[ref];
       const { schemaId } = this.opts;
@@ -27718,7 +27718,7 @@ var require_compile = /* @__PURE__ */ __commonJSMin(((exports) => {
   function sameSchemaEnv(s1, s2) {
     return s1.schema === s2.schema && s1.root === s2.root && s1.baseId === s2.baseId;
   }
-  function resolve(root, ref) {
+  function resolve4(root, ref) {
     let sch;
     while (typeof (sch = this.refs[ref]) == "string") ref = sch;
     return sch || this.schemas[ref] || resolveSchema.call(this, root, ref);
@@ -28168,47 +28168,47 @@ var require_fast_uri = /* @__PURE__ */ __commonJSMin(((exports, module) => {
     else if (typeof uri === "object") uri = parse3(serialize(uri, options), options);
     return uri;
   }
-  function resolve(baseURI, relativeURI, options) {
+  function resolve4(baseURI, relativeURI, options) {
     const schemelessOptions = options ? Object.assign({ scheme: "null" }, options) : { scheme: "null" };
     const resolved = resolveComponent(parse3(baseURI, schemelessOptions), parse3(relativeURI, schemelessOptions), schemelessOptions, true);
     schemelessOptions.skipEscape = true;
     return serialize(resolved, schemelessOptions);
   }
-  function resolveComponent(base, relative, options, skipNormalization) {
+  function resolveComponent(base, relative3, options, skipNormalization) {
     const target = {};
     if (!skipNormalization) {
       base = parse3(serialize(base, options), options);
-      relative = parse3(serialize(relative, options), options);
+      relative3 = parse3(serialize(relative3, options), options);
     }
     options = options || {};
-    if (!options.tolerant && relative.scheme) {
-      target.scheme = relative.scheme;
-      target.userinfo = relative.userinfo;
-      target.host = relative.host;
-      target.port = relative.port;
-      target.path = removeDotSegments(relative.path || "");
-      target.query = relative.query;
+    if (!options.tolerant && relative3.scheme) {
+      target.scheme = relative3.scheme;
+      target.userinfo = relative3.userinfo;
+      target.host = relative3.host;
+      target.port = relative3.port;
+      target.path = removeDotSegments(relative3.path || "");
+      target.query = relative3.query;
     } else {
-      if (relative.userinfo !== void 0 || relative.host !== void 0 || relative.port !== void 0) {
-        target.userinfo = relative.userinfo;
-        target.host = relative.host;
-        target.port = relative.port;
-        target.path = removeDotSegments(relative.path || "");
-        target.query = relative.query;
+      if (relative3.userinfo !== void 0 || relative3.host !== void 0 || relative3.port !== void 0) {
+        target.userinfo = relative3.userinfo;
+        target.host = relative3.host;
+        target.port = relative3.port;
+        target.path = removeDotSegments(relative3.path || "");
+        target.query = relative3.query;
       } else {
-        if (!relative.path) {
+        if (!relative3.path) {
           target.path = base.path;
-          if (relative.query !== void 0) target.query = relative.query;
+          if (relative3.query !== void 0) target.query = relative3.query;
           else target.query = base.query;
         } else {
-          if (relative.path[0] === "/") target.path = removeDotSegments(relative.path);
+          if (relative3.path[0] === "/") target.path = removeDotSegments(relative3.path);
           else {
-            if ((base.userinfo !== void 0 || base.host !== void 0 || base.port !== void 0) && !base.path) target.path = "/" + relative.path;
-            else if (!base.path) target.path = relative.path;
-            else target.path = base.path.slice(0, base.path.lastIndexOf("/") + 1) + relative.path;
+            if ((base.userinfo !== void 0 || base.host !== void 0 || base.port !== void 0) && !base.path) target.path = "/" + relative3.path;
+            else if (!base.path) target.path = relative3.path;
+            else target.path = base.path.slice(0, base.path.lastIndexOf("/") + 1) + relative3.path;
             target.path = removeDotSegments(target.path);
           }
-          target.query = relative.query;
+          target.query = relative3.query;
         }
         target.userinfo = base.userinfo;
         target.host = base.host;
@@ -28216,7 +28216,7 @@ var require_fast_uri = /* @__PURE__ */ __commonJSMin(((exports, module) => {
       }
       target.scheme = base.scheme;
     }
-    target.fragment = relative.fragment;
+    target.fragment = relative3.fragment;
     return target;
   }
   function equal(uriA, uriB, options) {
@@ -28342,7 +28342,7 @@ var require_fast_uri = /* @__PURE__ */ __commonJSMin(((exports, module) => {
   const fastUri = {
     SCHEMES,
     normalize,
-    resolve,
+    resolve: resolve4,
     resolveComponent,
     equal,
     serialize,
@@ -29124,14 +29124,14 @@ var require_ucs2length = /* @__PURE__ */ __commonJSMin(((exports) => {
   function ucs2length(str) {
     const len = str.length;
     let length = 0;
-    let pos = 0;
+    let pos2 = 0;
     let value;
-    while (pos < len) {
+    while (pos2 < len) {
       length++;
-      value = str.charCodeAt(pos++);
-      if (value >= 55296 && value <= 56319 && pos < len) {
-        value = str.charCodeAt(pos);
-        if ((value & 64512) === 56320) pos++;
+      value = str.charCodeAt(pos2++);
+      if (value >= 55296 && value <= 56319 && pos2 < len) {
+        value = str.charCodeAt(pos2);
+        if ((value & 64512) === 56320) pos2++;
       }
     }
     return length;
@@ -32900,13 +32900,28 @@ var API_KEY_RE = new RegExp([
   "whsec_[A-Za-z0-9]{16,}\\b"
   // webhook signing secret (Stripe-style)
 ].map((p) => `\\b${p}`).join("|"), "g");
-var QUERY_SECRET_RE = /([?&](?:access_token|refresh_token|client_secret|api_?key|signature|token|key|sig)=)[^&#\s"'<>`]+/gi;
+var QUERY_SECRET_RE = /([?&](?:(?:access|refresh|id|auth|session|csrf|xsrf)[_-]?token|client[_-]?secret|api[_-]?secret|api[_-]?key|password|passwd|signature|token|key|sig)=)[^&#\s"'<>`]+/gi;
+var OAUTH_CODE_RE = /([?&]code=)(?=[^&#\s"'<>`]{16,})[^&#\s"'<>`]+/gi;
+var FORM_PASSWORD_RE = /((?:^|[\s,;:"'(\[{])(?:password|passwd)=)[^&#\s"'<>`]+/gim;
+var HEADER_SECRET_RE = /(\b(?:x[-_][a-z0-9_-]*?(?:api[-_]?key|token|secret|auth)[a-z0-9_-]*|api[-_]?key)\s*:\s*)[^\s,;"'<>`]+/gi;
 var AWS_SIGV4_RE = /([?&]X-Amz-(?:Signature|Security-Token|Credential)=)[^&#\s"'<>`]+/gi;
-var JSON_SECRET_KEYS = "access_token|refresh_token|client_secret|api_?key|password|passwd|secret|token";
-var JSON_SECRET_DQ_RE = new RegExp(`("(?:${JSON_SECRET_KEYS})"\\s*:\\s*")[^"]*(")`, "gi");
-var JSON_SECRET_SQ_RE = new RegExp(`('(?:${JSON_SECRET_KEYS})'\\s*:\\s*')[^']*(')`, "gi");
+var JSON_SECRET_KEYS = [
+  "(?:access|refresh|id|auth|session|bearer|csrf|xsrf)[_-]?token",
+  "client[_-]?secret",
+  "api[_-]?secret",
+  "(?:x[_-])?api[_-]?key",
+  "private[_-]?key",
+  "x[_-][a-z0-9_-]*?(?:api[_-]?key|token|secret|auth)[a-z0-9_-]*",
+  "(?:proxy-)?authorization",
+  "password",
+  "passwd",
+  "secret",
+  "token"
+].join("|");
+var JSON_SECRET_DQ_RE = new RegExp(`("(?:${JSON_SECRET_KEYS})"\\s*:\\s*")(?:[^"\\\\]|\\\\.)*(")`, "gi");
+var JSON_SECRET_SQ_RE = new RegExp(`('(?:${JSON_SECRET_KEYS})'\\s*:\\s*')(?:[^'\\\\]|\\\\.)*(')`, "gi");
 function redactSecrets(text) {
-  return text.replace(BEARER_RE, "$1[REDACTED]").replace(BASIC_AUTH_RE, "$1[REDACTED]").replace(SET_COOKIE_RE, "$1$2=[REDACTED]").replace(COOKIE_HEADER_RE, (_m, prefix, pairs) => `${prefix}${pairs.replace(/=[^;,\s]*/g, "=[REDACTED]")}`).replace(API_KEY_RE, "[REDACTED]").replace(QUERY_SECRET_RE, "$1[REDACTED]").replace(AWS_SIGV4_RE, "$1[REDACTED]").replace(JSON_SECRET_DQ_RE, "$1[REDACTED]$2").replace(JSON_SECRET_SQ_RE, "$1[REDACTED]$2").replace(JWT_RE, "[REDACTED]");
+  return text.replace(BEARER_RE, "$1[REDACTED]").replace(BASIC_AUTH_RE, "$1[REDACTED]").replace(SET_COOKIE_RE, "$1$2=[REDACTED]").replace(COOKIE_HEADER_RE, (_m, prefix, pairs) => `${prefix}${pairs.replace(/=[^;,\s]*/g, "=[REDACTED]")}`).replace(API_KEY_RE, "[REDACTED]").replace(HEADER_SECRET_RE, "$1[REDACTED]").replace(QUERY_SECRET_RE, "$1[REDACTED]").replace(OAUTH_CODE_RE, "$1[REDACTED]").replace(FORM_PASSWORD_RE, "$1[REDACTED]").replace(AWS_SIGV4_RE, "$1[REDACTED]").replace(JSON_SECRET_DQ_RE, "$1[REDACTED]$2").replace(JSON_SECRET_SQ_RE, "$1[REDACTED]$2").replace(JWT_RE, "[REDACTED]");
 }
 
 // ../../node_modules/@chrischall/mcp-utils/dist/response/view.js
@@ -33001,26 +33016,105 @@ function errorResult(message) {
 }
 
 // ../../node_modules/@chrischall/mcp-utils/dist/server/confirmation.js
+import { createHash, createHmac, timingSafeEqual } from "node:crypto";
 var DEFAULT_REQUEST_KEY = "confirmation";
 var DEFAULT_CONFIRMATION_LABEL = "Confirm this action should proceed.";
 var UNSUPPORTED_NOTE = "Nothing was done because this client cannot show a confirmation prompt (it declares no MCP elicitation capability), and this action is never taken without one";
+var STATE_PREFIX = "mcpu.confirm.v1.";
+function canonicalJson(value) {
+  if (value === null || typeof value === "string" || typeof value === "boolean")
+    return JSON.stringify(value);
+  if (value === void 0)
+    return "null";
+  if (typeof value === "number")
+    return Number.isFinite(value) ? JSON.stringify(value) : `{"$num":"${String(value)}"}`;
+  if (typeof value === "bigint")
+    return `{"$bigint":"${value.toString()}"}`;
+  if (typeof value === "function" || typeof value === "symbol") {
+    throw new TypeError(`requireConfirmation: cannot bind a ${typeof value} argument value.`);
+  }
+  if (Array.isArray(value))
+    return `[${value.map(canonicalJson).join(",")}]`;
+  if (value instanceof Date) {
+    return `{"$date":${JSON.stringify(Number.isNaN(value.getTime()) ? "Invalid Date" : value.toISOString())}}`;
+  }
+  if (ArrayBuffer.isView(value)) {
+    const bytes = Buffer.from(value.buffer, value.byteOffset, value.byteLength);
+    return `{"$bytes":${JSON.stringify(bytes.toString("base64"))}}`;
+  }
+  if (value instanceof ArrayBuffer)
+    return `{"$bytes":${JSON.stringify(Buffer.from(value).toString("base64"))}}`;
+  if (value instanceof Map) {
+    const entries2 = [...value.entries()].map(([k, v]) => `[${canonicalJson(k)},${canonicalJson(v)}]`).sort();
+    return `{"$map":[${entries2.join(",")}]}`;
+  }
+  if (value instanceof Set) {
+    return `{"$set":[${[...value].map(canonicalJson).sort().join(",")}]}`;
+  }
+  const proto = Object.getPrototypeOf(value);
+  if (proto !== Object.prototype && proto !== null) {
+    throw new TypeError("requireConfirmation: cannot bind a non-plain object argument value (class instance).");
+  }
+  const entries = Object.entries(value).filter(([, v]) => v !== void 0).sort(([a], [b]) => a < b ? -1 : a > b ? 1 : 0);
+  return `{${entries.map(([k, v]) => `${JSON.stringify(escapeKey(k))}:${canonicalJson(v)}`).join(",")}}`;
+}
+function escapeKey(key) {
+  return key.startsWith("$") ? `$${key}` : key;
+}
+function bindingKey(binding) {
+  if (binding.ttlSeconds !== void 0 && !(Number.isFinite(binding.ttlSeconds) && binding.ttlSeconds > 0)) {
+    throw new RangeError("requireConfirmation: binding.ttlSeconds must be a finite number greater than 0.");
+  }
+  const key = typeof binding.key === "string" ? Buffer.from(binding.key, "utf8") : Buffer.from(binding.key);
+  if (key.length < 32) {
+    throw new RangeError("requireConfirmation: binding.key must be at least 32 bytes.");
+  }
+  return key;
+}
+function commitment(action, args) {
+  return createHash("sha256").update(`${action}\0${canonicalJson(args)}`).digest("base64url");
+}
+function mintState(key, action, binding) {
+  const exp = Math.floor(Date.now() / 1e3) + (binding.ttlSeconds ?? 600);
+  const body = Buffer.from(JSON.stringify({ c: commitment(action, binding.args), exp })).toString("base64url");
+  const mac3 = createHmac("sha256", key).update(`${STATE_PREFIX}${body}`).digest("base64url");
+  return `${STATE_PREFIX}${body}.${mac3}`;
+}
+function verifyState(key, action, binding, state) {
+  if (typeof state !== "string" || !state.startsWith(STATE_PREFIX))
+    return false;
+  const rest = state.slice(STATE_PREFIX.length);
+  const dot = rest.indexOf(".");
+  if (dot < 0)
+    return false;
+  const body = rest.slice(0, dot);
+  const mac3 = Buffer.from(rest.slice(dot + 1), "base64url");
+  const expected = createHmac("sha256", key).update(`${STATE_PREFIX}${body}`).digest();
+  if (mac3.length !== expected.length || !timingSafeEqual(mac3, expected))
+    return false;
+  let payload;
+  try {
+    payload = JSON.parse(Buffer.from(body, "base64url").toString("utf8"));
+  } catch {
+    return false;
+  }
+  if (typeof payload.exp !== "number" || payload.exp * 1e3 <= Date.now())
+    return false;
+  const want = Buffer.from(commitment(action, binding.args));
+  const got = Buffer.from(typeof payload.c === "string" ? payload.c : "");
+  return got.length === want.length && timingSafeEqual(got, want);
+}
+function echoedState(ctx) {
+  const accessor = ctx.mcpReq.requestState;
+  return typeof accessor === "function" ? accessor() : void 0;
+}
 function requireConfirmation(ctx, options) {
   const requestKey = options.requestKey ?? DEFAULT_REQUEST_KEY;
+  const key = options.binding ? bindingKey(options.binding) : void 0;
   const confirmationSchema = external_exports.object({
     confirmed: external_exports.boolean().describe(options.confirmationLabel ?? DEFAULT_CONFIRMATION_LABEL)
   });
-  const response = inputResponse(ctx.mcpReq.inputResponses, requestKey);
-  const accepted = acceptedContent(ctx.mcpReq.inputResponses, requestKey, confirmationSchema);
-  if (response.kind === "missing") {
-    if (callerAcceptsFormElicitation(ctx) === false) {
-      return textResult({
-        confirmed: false,
-        dispatched: false,
-        action: options.action,
-        reason: "confirmation-unsupported",
-        note: options.unsupportedNote ? `${UNSUPPORTED_NOTE}. ${options.unsupportedNote}` : `${UNSUPPORTED_NOTE}.`
-      });
-    }
+  const ask = () => {
     const preview = {
       action: options.action,
       ...options.details === void 0 ? {} : { details: options.details }
@@ -33032,10 +33126,33 @@ function requireConfirmation(ctx, options) {
 ${JSON.stringify(preview, null, 2)}`,
           requestedSchema: confirmationSchema
         })
-      }
+      },
+      ...key && options.binding ? { requestState: mintState(key, options.action, options.binding) } : {}
     });
+  };
+  const response = inputResponse(ctx.mcpReq.inputResponses, requestKey);
+  const accepted = acceptedContent(ctx.mcpReq.inputResponses, requestKey, confirmationSchema);
+  if (response.kind === "missing") {
+    if (callerAcceptsFormElicitation(ctx) === false) {
+      return textResult({
+        confirmed: false,
+        dispatched: false,
+        action: options.action,
+        reason: "confirmation-unsupported",
+        note: options.unsupportedNote ? `${UNSUPPORTED_NOTE}. ${options.unsupportedNote}` : `${UNSUPPORTED_NOTE}.`
+      });
+    }
+    return ask();
   }
   if (response.kind === "elicit" && response.action === "accept" && accepted?.confirmed === true) {
+    if (key && options.binding) {
+      const state = echoedState(ctx);
+      if (state === void 0 || state === null) {
+        return errorResult(`Confirmation for ${options.action} was accepted, but the retry carried no requestState, so it cannot be checked against the prompt that was shown. Nothing was done. The likely cause is that the MCP client or host does not round-trip requestState (it must echo the requestState from the input_required result back on the retry); asking again would loop.`);
+      }
+      if (!verifyState(key, options.action, options.binding, state))
+        return ask();
+    }
     return void 0;
   }
   return textResult({
@@ -33053,6 +33170,8 @@ var SERVER_PROTOCOL_VERSIONS = Object.freeze([
 ]);
 
 // ../../node_modules/@chrischall/mcp-utils/dist/config/index.js
+import { homedir } from "node:os";
+import { isAbsolute, join, resolve } from "node:path";
 var PLACEHOLDER_RE = /^\$\{[^}]*\}$/;
 function readEnvVar(key, opts = {}) {
   const env = opts.env ?? process.env;
@@ -33079,6 +33198,50 @@ function parseBoolEnv(key, opts = {}) {
     return false;
   return fallback;
 }
+function expandPath(p) {
+  let expanded = p;
+  if (p === "~") {
+    expanded = homedir();
+  } else if (p.startsWith("~/")) {
+    expanded = join(homedir(), p.slice(2));
+  }
+  return isAbsolute(expanded) ? expanded : resolve(expanded);
+}
+
+// ../../node_modules/@chrischall/mcp-utils/dist/fs/confine.js
+import { existsSync, realpathSync } from "node:fs";
+import { dirname, isAbsolute as isAbsolute2, relative, resolve as resolve2, sep } from "node:path";
+function isInside(root, target) {
+  const rel = relative(root, target);
+  return rel === "" || !rel.startsWith(`..${sep}`) && rel !== ".." && !isAbsolute2(rel);
+}
+function realPathAllowingMissing(p) {
+  const abs = resolve2(p);
+  let existing = abs;
+  const tail = [];
+  while (!existsSync(existing)) {
+    const parent = dirname(existing);
+    if (parent === existing)
+      break;
+    tail.unshift(existing.slice(parent.length).replace(/^[/\\]+/, ""));
+    existing = parent;
+  }
+  let real;
+  try {
+    real = realpathSync(existing);
+  } catch {
+    real = existing;
+  }
+  return tail.length > 0 ? resolve2(real, ...tail) : real;
+}
+function assertPathWithinRoots(path, roots) {
+  const target = realPathAllowingMissing(expandPath(path));
+  for (const root of roots) {
+    if (isInside(realPathAllowingMissing(expandPath(root)), target))
+      return target;
+  }
+  throw new Error(`Path is outside the allowed directories: ${path}`);
+}
 
 // ../../node_modules/@chrischall/mcp-utils/dist/zod/index.js
 var PositiveInt = external_exports.number().int().positive();
@@ -33100,7 +33263,7 @@ var pageSchema = {
 };
 
 // src/runner.ts
-import { delimiter, join } from "node:path";
+import { delimiter, join as join2 } from "node:path";
 
 // src/timestamps.ts
 var DEFAULT_DISPLAY_TZ = "America/New_York";
@@ -33301,12 +33464,51 @@ function normalizeTimestamps(text, tz = displayTimeZone(), naiveTz = naiveSource
   return JSON.stringify(parsed, null, detectIndent(text));
 }
 
+// src/arg-guard.ts
+var FORBIDDEN_LONG_FLAG = /^--(readonly|enable-commands|enable-commands-exact|disable-commands|access-token|home|account|acct|client|gmail-no-send|no-input|non-interactive|noninteractive)(=|$)/i;
+var SHORT_ACCOUNT_CLUSTER = /^-(?!-)[A-Za-z]*a/;
+function forbiddenArgReason(arg) {
+  if (arg === "--") {
+    return 'The argument "--" is not allowed: it ends flag parsing and would disable safety flags appended after it.';
+  }
+  const match = FORBIDDEN_LONG_FLAG.exec(arg);
+  if (match) {
+    return `The flag ${arg} is not allowed here: --${match[1].toLowerCase()} is a safety/credential control set by the server operator, not a per-call option.`;
+  }
+  if (SHORT_ACCOUNT_CLUSTER.test(arg)) {
+    return `The flag ${arg} is not allowed here: -a selects the account. Use the tool's account parameter instead.`;
+  }
+  return void 0;
+}
+function assertSafeForwardedArgs(args) {
+  for (const arg of args) {
+    const reason = forbiddenArgReason(arg);
+    if (reason) throw new Error(reason);
+  }
+}
+var SUBCOMMAND_SHAPE = /^[a-z][a-z0-9-]*$/;
+function assertSafeSubcommand(subcommand) {
+  if (!SUBCOMMAND_SHAPE.test(subcommand)) {
+    throw new Error(
+      `Invalid subcommand ${JSON.stringify(subcommand)}: pass a single gog subcommand name such as "list" or "mark-read", and put its arguments in args.`
+    );
+  }
+}
+
+// src/argv.ts
+function pos(value) {
+  return { kind: "positional", value };
+}
+function isGogPositional(arg) {
+  return typeof arg === "object" && arg !== null && arg.kind === "positional";
+}
+
 // src/runner.ts
 function isGogFileArg(arg) {
-  return typeof arg !== "string";
+  return typeof arg !== "string" && arg.kind === "file";
 }
 var TIMEOUT_MS = 3e4;
-var MIN_GOG_VERSION = "0.40.0";
+var MIN_GOG_VERSION = "0.41.0";
 function readonlyEnvEnabled() {
   return readEnvVar("GOG_READONLY") !== void 0 && parseBoolEnv("GOG_READONLY", { default: true });
 }
@@ -33388,8 +33590,8 @@ function formatTimeout(ms) {
 }
 async function spawnWithTempFiles(args, opts) {
   const { mkdtemp, mkdir, writeFile, rm } = await import("node:fs/promises");
-  const { tmpdir } = await import("node:os");
-  const dir = await mkdtemp(join(tmpdir(), "gogcli-mcp-"));
+  const { tmpdir: tmpdir2 } = await import("node:os");
+  const dir = await mkdtemp(join2(tmpdir2(), "gogcli-mcp-"));
   try {
     const argv = [];
     let seq = 0;
@@ -33398,10 +33600,10 @@ async function spawnWithTempFiles(args, opts) {
         argv.push(arg);
         continue;
       }
-      const sub = join(dir, String(seq));
+      const sub = join2(dir, String(seq));
       seq += 1;
       await mkdir(sub, { recursive: true, mode: 448 });
-      const path = join(sub, arg.filename ?? `${arg.flag}.${arg.ext ?? "txt"}`);
+      const path = join2(sub, arg.filename ?? `${arg.flag}.${arg.ext ?? "txt"}`);
       const data = arg.encoding === "base64" ? Buffer.from(arg.contents, "base64") : Buffer.from(arg.contents, "utf8");
       await writeFile(path, data, { mode: 384 });
       argv.push(arg.positional ? path : `--${arg.flag}=${path}`);
@@ -33419,10 +33621,10 @@ function spawnExecutor(args, opts) {
   return spawnGog(args, opts);
 }
 async function spawnGog(fullArgs, opts) {
-  const { timeout, interactive = false, spawner, binary = false } = opts;
+  const { timeout, interactive = false, spawner, binary = false, maxOutputBytes } = opts;
   const spawn = spawner ?? (await import("node:child_process")).spawn;
   const effectiveTimeout = timeout ?? TIMEOUT_MS;
-  return new Promise((resolve, reject) => {
+  return new Promise((resolve4, reject) => {
     const childEnv = { ...sanitizedEnv(), GOG_TIMEZONE: naiveSourceTimeZone(), PATH: augmentedPath() };
     const child = spawn(readEnvVar("GOG_PATH") ?? "gog", fullArgs, { env: childEnv });
     const stdoutChunks = [];
@@ -33440,7 +33642,17 @@ async function spawnGog(fullArgs, opts) {
       child.kill();
       reject(new Error(`gog timed out after ${formatTimeout(effectiveTimeout)}`));
     }, effectiveTimeout);
+    let stdoutBytes = 0;
     child.stdout.on("data", (chunk) => {
+      if (settled) return;
+      stdoutBytes += chunk.length;
+      if (maxOutputBytes !== void 0 && stdoutBytes > maxOutputBytes) {
+        settled = true;
+        stopWatching();
+        child.kill();
+        reject(new Error(`gog output exceeded the limit: more than ${maxOutputBytes} bytes`));
+        return;
+      }
       stdoutChunks.push(chunk);
     });
     child.stderr.on("data", (chunk) => {
@@ -33457,14 +33669,14 @@ async function spawnGog(fullArgs, opts) {
       const stderr = Buffer.concat(stderrChunks).toString().trim();
       if (code === 0) {
         if (binary) {
-          resolve(Buffer.concat(stdoutChunks).toString("base64"));
+          resolve4(Buffer.concat(stdoutChunks).toString("base64"));
           return;
         }
         const stdout = Buffer.concat(stdoutChunks).toString();
         if (interactive && stderr) {
-          resolve(stdout + "\n" + stderr);
+          resolve4(stdout + "\n" + stderr);
         } else {
-          resolve(stdout);
+          resolve4(stdout);
         }
       } else {
         reject(new Error(stderr || `gog exited with code ${code}`));
@@ -33484,7 +33696,33 @@ async function spawnGog(fullArgs, opts) {
     });
   });
 }
+function placePositionals(args) {
+  const flags = [];
+  const positionals = [];
+  let afterSeparator = false;
+  for (const arg of args) {
+    if (arg === "--") {
+      afterSeparator = true;
+    } else if (isGogPositional(arg)) {
+      positionals.push(arg.value);
+    } else if (afterSeparator || isGogFileArg(arg) && arg.positional) {
+      positionals.push(arg);
+    } else {
+      flags.push(arg);
+    }
+  }
+  return { flags, positionals };
+}
+function assertNoSafetyOverrides(flags) {
+  for (const arg of flags) {
+    if (typeof arg !== "string") continue;
+    const reason = forbiddenArgReason(arg);
+    if (reason) throw new Error(reason);
+  }
+}
 function assembleArgs(args, opts) {
+  const { flags, positionals } = placePositionals(args);
+  assertNoSafetyOverrides(flags);
   const effectiveAccount = opts.account ?? readEnvVar("GOG_ACCOUNT");
   const fullArgs = ["--json", "--color=never"];
   if (!opts.interactive) {
@@ -33493,17 +33731,21 @@ function assembleArgs(args, opts) {
   if (opts.readonly || readonlyEnvEnabled()) {
     fullArgs.push("--readonly");
   }
+  if (opts.gmailNoSend) {
+    fullArgs.push("--gmail-no-send");
+  }
   if (effectiveAccount) {
     fullArgs.push("--account", effectiveAccount);
   }
-  fullArgs.push(...args);
+  fullArgs.push(...flags);
+  if (positionals.length > 0) fullArgs.push("--", ...positionals);
   return fullArgs;
 }
 async function run(args, options = {}) {
-  const { account, spawner, interactive = false, timeout, readonly: readonly2 = false, redactMode = "full", opaqueFields } = options;
+  const { account, spawner, interactive = false, timeout, readonly: readonly2 = false, redactMode = "full", opaqueFields, gmailNoSend = false } = options;
   const base = redactMode === "tokens" ? redactGoogleTokens : redactSecrets2;
   const redact = opaqueFields?.length ? (text) => redactPreservingOpaqueFields(text, opaqueFields, base) : base;
-  const fullArgs = assembleArgs(args, { account, interactive, readonly: readonly2 });
+  const fullArgs = assembleArgs(args, { account, interactive, readonly: readonly2, gmailNoSend });
   try {
     return redact(await spawnExecutor(fullArgs, { timeout, interactive, spawner }));
   } catch (err) {
@@ -33511,9 +33753,9 @@ async function run(args, options = {}) {
   }
 }
 async function runBinary(args, options = {}) {
-  const { account, spawner, timeout, readonly: readonly2 = false } = options;
-  const fullArgs = assembleArgs(args, { account, interactive: false, readonly: readonly2 });
-  return spawnExecutor(fullArgs, { timeout, interactive: false, spawner, binary: true });
+  const { account, spawner, timeout, readonly: readonly2 = false, gmailNoSend = false, maxOutputBytes } = options;
+  const fullArgs = assembleArgs(args, { account, interactive: false, readonly: readonly2, gmailNoSend });
+  return spawnExecutor(fullArgs, { timeout, interactive: false, spawner, binary: true, maxOutputBytes });
 }
 
 // src/pagination.ts
@@ -33565,6 +33807,175 @@ function annotateTruncatedList(result, itemsKey) {
   return rawTextResult(JSON.stringify(out));
 }
 
+// src/file-roots.ts
+import { homedir as homedir2 } from "node:os";
+import { delimiter as delimiter2, join as join4 } from "node:path";
+
+// src/attachment-root.ts
+import { tmpdir, userInfo } from "node:os";
+import { dirname as dirname2, join as join3, relative as relative2, resolve as resolve3, isAbsolute as isAbsolute3, sep as sep2 } from "node:path";
+var ATTACHMENT_DOWNLOAD_ROOT = join3(tmpdir(), `gogcli-mcp-attachments-${userInfo().uid}`);
+var ATTACHMENT_TTL_MS = 24 * 60 * 60 * 1e3;
+function isInside2(root, target) {
+  const rel = relative2(root, target);
+  return rel !== "" && !rel.startsWith(`..${sep2}`) && rel !== ".." && !isAbsolute3(rel);
+}
+async function ensurePrivateDir(dir, opts = {}) {
+  const { mkdir, lstat, chmod } = await import("node:fs/promises");
+  try {
+    await mkdir(dir, { mode: 448 });
+  } catch (err) {
+    if (err.code !== "EEXIST") throw err;
+  }
+  const info = await lstat(dir);
+  if (info.isSymbolicLink() || !info.isDirectory()) {
+    throw new Error(`refusing to use ${dir} for attachment downloads: it is not a real directory`);
+  }
+  const uid = opts.uid ?? userInfo().uid;
+  if (info.uid !== uid) {
+    throw new Error(`refusing to use ${dir} for attachment downloads: it is owned by another user`);
+  }
+  if ((info.mode & 63) !== 0) await chmod(dir, 448);
+}
+async function sweepExpiredDownloads(root = ATTACHMENT_DOWNLOAD_ROOT, ttlMs = ATTACHMENT_TTL_MS, now = Date.now()) {
+  const { readdir, lstat, rm } = await import("node:fs/promises");
+  let entries;
+  try {
+    entries = await readdir(root);
+  } catch {
+    return 0;
+  }
+  let removed = 0;
+  for (const name of entries) {
+    const path = join3(root, name);
+    try {
+      const info = await lstat(path);
+      if (now - info.mtimeMs > ttlMs) {
+        await rm(path, { recursive: true, force: true });
+        removed += 1;
+      }
+    } catch {
+    }
+  }
+  return removed;
+}
+async function removeDownload(path, root = ATTACHMENT_DOWNLOAD_ROOT) {
+  const { rm, rmdir } = await import("node:fs/promises");
+  const base = resolve3(root);
+  const target = resolve3(base, path);
+  if (!isInside2(base, target)) return;
+  await rm(target, { force: true });
+  for (let dir = dirname2(target); isInside2(base, dir); dir = dirname2(dir)) {
+    try {
+      await rmdir(dir);
+    } catch {
+      break;
+    }
+  }
+}
+async function prepareDownloadRoot(root = ATTACHMENT_DOWNLOAD_ROOT) {
+  await ensurePrivateDir(root);
+  await sweepExpiredDownloads(root);
+}
+
+// src/file-roots.ts
+var FILE_ROOTS_ENV = "GOG_FILE_ROOTS";
+function defaultFileRoot() {
+  return join4(homedir2(), "gogcli-mcp-files");
+}
+function fileRoots() {
+  const raw = readEnvVar(FILE_ROOTS_ENV);
+  const roots = (raw ?? "").split(delimiter2).map((r) => r.trim()).filter(Boolean);
+  return roots.length > 0 ? roots : [defaultFileRoot()];
+}
+function confinePath(path, param, opts = {}) {
+  if (opts.allowDash && path === "-") return path;
+  const roots = [...fileRoots(), ATTACHMENT_DOWNLOAD_ROOT];
+  try {
+    assertPathWithinRoots(path, roots);
+  } catch {
+    throw new Error(
+      `${param} ${JSON.stringify(path)} is outside the directories this server may read or write (${roots.join(", ")}). Put the file in one of them, or ask the server operator to widen ${FILE_ROOTS_ENV}.`
+    );
+  }
+  return path;
+}
+function confinePaths(paths, param) {
+  for (const path of paths ?? []) confinePath(path, param);
+}
+function confineAtFile(value, param) {
+  if (value.startsWith("@")) confinePath(value.slice(1), param);
+  return value;
+}
+
+// src/run-path-guard.ts
+var POSITIONAL_PATH_SUBCOMMANDS = {
+  appscript: { pull: "gog_appscript_pull" },
+  drive: { upload: "gog_drive_upload", sync: "gog_drive_sync_push" },
+  gmail: { import: "gog_gmail_import" },
+  slides: {
+    "add-slide": "gog_slides_add_slide",
+    "insert-image": "gog_slides_insert_image",
+    "replace-slide": "gog_slides_replace_slide"
+  }
+};
+var PATH_FLAGS = /* @__PURE__ */ new Set(["out", "output", "out-dir", "output-dir", "dir", "worker-dir", "attach", "file", "key", "cert", "replacements"]);
+var ID_FLAGS = {
+  drive: /* @__PURE__ */ new Set(["file", "filter-file"])
+};
+var EXEC_FLAGS = /* @__PURE__ */ new Set(["on-change", "on-new", "mmdc"]);
+var SHORT_PATH_CLUSTER = /^-(?!-)[A-Za-z]*[of]/;
+var LONG_FLAG = /^--([A-Za-z0-9][A-Za-z0-9-]*)(?:=([\s\S]*))?$/;
+function isPathFlag(service, name) {
+  if (ID_FLAGS[service]?.has(name)) return false;
+  return PATH_FLAGS.has(name) || name.endsWith("-file");
+}
+function confineFlagValue(flag, value) {
+  if (value === "-") return;
+  confinePath(value, flag);
+  for (const part of value.split(",")) {
+    if (part !== "" && part !== "-") confinePath(part, flag);
+  }
+}
+function positionalPathTool(service, subcommand) {
+  return POSITIONAL_PATH_SUBCOMMANDS[service]?.[subcommand];
+}
+function assertRunPathsConfined(service, subcommand, args) {
+  const dedicated = positionalPathTool(service, subcommand);
+  if (dedicated) {
+    throw new Error(
+      `gog ${service} ${subcommand} reads or writes a local path given as a positional argument, so it is not available through gog_${service}_run. Use ${dedicated}, which confines the path to GOG_FILE_ROOTS.`
+    );
+  }
+  for (let i = 0; i < args.length; i++) {
+    const arg = args[i];
+    if (SHORT_PATH_CLUSTER.test(arg)) {
+      throw new Error(
+        `The flag ${arg} is not allowed here: spell a path flag out as --out or --file (e.g. --out=<path>) so its path can be checked against GOG_FILE_ROOTS.`
+      );
+    }
+    const match = LONG_FLAG.exec(arg);
+    if (!match) continue;
+    const name = match[1].toLowerCase();
+    if (EXEC_FLAGS.has(name)) {
+      throw new Error(`The flag --${name} is not allowed here: it runs a local program chosen by the caller.`);
+    }
+    const isJson = name.endsWith("-json");
+    if (!isJson && !isPathFlag(service, name)) continue;
+    let value = match[2];
+    if (value === void 0) {
+      value = args[i + 1];
+      if (value === void 0) continue;
+      i++;
+    }
+    if (isJson) {
+      if (value.startsWith("@")) confineFlagValue(`--${name}`, value.slice(1));
+      continue;
+    }
+    confineFlagValue(`--${name}`, value);
+  }
+}
+
 // src/tools/utils.ts
 var PAYLOAD_INLINE_MAX = 4096;
 function payloadArg(inlineFlag, fileFlag, value, ext) {
@@ -33622,9 +34033,17 @@ function pushPaginationFlags(args, p) {
   if (p.all) args.push("--all");
 }
 function registerRunTool(server, options) {
-  const { service, examples, omitAccount = false, note } = options;
+  const { service, examples, omitAccount = false, note, allowedSubcommands, vet, gmailNoSend = false } = options;
+  for (const [, example] of examples.matchAll(/"([^"]+)"/g)) {
+    const refused = allowedSubcommands && !allowedSubcommands.includes(example) || vet?.(example, []) || positionalPathTool(service, example);
+    if (refused) {
+      throw new Error(`gog_${service}_run example "${example}" is refused by the tool itself; list a subcommand it runs.`);
+    }
+  }
   const baseDescription = `Run any gog ${service} subcommand not covered by the other tools. Run \`gog ${service} --help\` for the full list of subcommands, or \`gog ${service} <subcommand> --help\` for flags on a specific subcommand.`;
-  const description = note ? `${baseDescription} ${note}` : baseDescription;
+  const restriction = allowedSubcommands ? ` Only these subcommands are available: ${allowedSubcommands.join(", ")}.` : "";
+  const safety = ' Flags that override server safety controls (--readonly, --enable-commands, --disable-commands, --account, --access-token, --home, --client, --gmail-no-send, --no-input) and a bare "--" are refused. Local file paths (--out, --out-dir, --attach, --file, --*-file, @file JSON) must be inside GOG_FILE_ROOTS; subcommands that take a local path positionally (e.g. drive upload) are refused in favour of their dedicated tools.';
+  const description = `${baseDescription}${restriction}${safety}${note ? ` ${note}` : ""}`;
   const inputSchema = {
     subcommand: external_exports.string().describe(`The gog ${service} subcommand to run, e.g. ${examples}`),
     args: external_exports.array(external_exports.string()).describe("Additional positional args and flags")
@@ -33638,7 +34057,21 @@ function registerRunTool(server, options) {
     inputSchema: external_exports.object(inputSchema)
   }, async (rawArgs) => {
     const { subcommand, args, account } = rawArgs;
-    return runOrDiagnose([service, subcommand, ...args], { account });
+    try {
+      assertSafeSubcommand(subcommand);
+      assertSafeForwardedArgs(args);
+      if (allowedSubcommands && !allowedSubcommands.includes(subcommand)) {
+        throw new Error(
+          `gog ${service} ${subcommand} is not available through gog_${service}_run. Allowed: ${allowedSubcommands.join(", ")}.`
+        );
+      }
+      const refusal = vet?.(subcommand, args);
+      if (refusal) throw new Error(refusal);
+      assertRunPathsConfined(service, subcommand, args);
+    } catch (err) {
+      return errorResult(errorText(err));
+    }
+    return runOrDiagnose([service, subcommand, ...args], gmailNoSend ? { account, gmailNoSend } : { account });
   });
 }
 function errorText(err) {
@@ -33767,6 +34200,13 @@ function assertNotBoth(inlineParam, fileParam, inlineValue, fileValue) {
 }
 
 // src/tools/api.ts
+var GMAIL_API_BLOCKED = /(?:\.send$|forwarding|filters\.create|filters\.update|delegates\.create)/i;
+function refusedApiCall(api, method) {
+  if (api.trim().toLowerCase() === "gmail" && GMAIL_API_BLOCKED.test(method.trim())) {
+    return `gmail ${method} is not available through gog_api_call: it sends or forwards mail. Use gog_gmail_send / gog_gmail_drafts_send (which ask the user to confirm) or the dedicated gog_gmail_* tool.`;
+  }
+  return void 0;
+}
 function registerApiTools(server) {
   server.registerTool("gog_api_list", {
     description: "List the Google Discovery APIs available for gog_api_call / gog_api_describe (name + version + title).",
@@ -33790,12 +34230,12 @@ function registerApiTools(server) {
       account: accountParam
     })
   }, async ({ api, version: version2, method, account }) => {
-    const args = ["api", "describe", api, version2];
-    if (method) args.push(method);
+    const args = ["api", "describe", pos(api), pos(version2)];
+    if (method) args.push(pos(method));
     return runOrDiagnose(args, { account });
   });
   server.registerTool("gog_api_call", {
-    description: "Call any Discovery-described Google API method directly \u2014 an escape hatch for endpoints gog has no dedicated tool for. Find the exact api/version/method/params with gog_api_describe first. Read methods (GET/LIST) run as-is. Mutating methods (POST/PUT/PATCH/DELETE) are refused unless you set allowWrite=true \u2014 keep it false to preview, or set dryRun=true to print the intended request without sending it.",
+    description: "Call any Discovery-described Google API method directly \u2014 an escape hatch for endpoints gog has no dedicated tool for. Find the exact api/version/method/params with gog_api_describe first. Read methods (GET/LIST) run as-is. Mutating methods (POST/PUT/PATCH/DELETE) are refused unless you set allowWrite=true \u2014 keep it false to preview, or set dryRun=true to print the intended request without sending it. Gmail send and forwarding methods (users.messages.send, users.drafts.send, forwarding/auto-forwarding, filters, delegates) are refused \u2014 use the dedicated gog_gmail_* tools, which ask the user to confirm.",
     annotations: { destructiveHint: true },
     inputSchema: external_exports.object({
       api: external_exports.string().describe("Discovery API name (e.g. drive, gmail, calendar)"),
@@ -33809,14 +34249,23 @@ function registerApiTools(server) {
       account: accountParam
     })
   }, async ({ api, version: version2, method, params, body, scope, allowWrite, dryRun, account }) => {
-    const args = ["api", "call", api, version2, method];
+    try {
+      assertSafeForwardedArgs([api, version2, method]);
+      const refusal = refusedApiCall(api, method);
+      if (refusal) throw new Error(refusal);
+      if (body) confineAtFile(body, "body");
+      if (params) confineAtFile(params, "params");
+    } catch (err) {
+      return errorResult(errorText(err));
+    }
+    const args = ["api", "call", pos(api), pos(version2), pos(method)];
     if (params) args.push(`--params=${params}`);
     if (body) args.push(`--body=${body}`);
     if (scope) args.push(`--scope=${scope}`);
     if (allowWrite) args.push("--allow-write");
     if (dryRun) args.push("--dry-run");
     if (allowWrite) args.push("--force");
-    return runOrDiagnose(args, { account });
+    return runOrDiagnose(args, { account, gmailNoSend: true });
   });
 }
 
@@ -33834,7 +34283,7 @@ function registerAppScriptTools(server) {
       account: accountParam
     })
   }, async ({ scriptId, account }) => {
-    return runOrDiagnose(["appscript", "get", scriptId], { account });
+    return runOrDiagnose(["appscript", "get", pos(scriptId)], { account });
   });
   server.registerTool("gog_appscript_content", {
     description: `Read a project's source \u2014 every .gs file and its appsscript.json manifest \u2014 INLINE in the response. This is the tool to reach for when the question is "what does this script do"; it needs no filesystem, so it works the same on a hosted deployment as it does locally, unlike gog_appscript_pull.` + apiEnableNote,
@@ -33844,19 +34293,20 @@ function registerAppScriptTools(server) {
       account: accountParam
     })
   }, async ({ scriptId, account }) => {
-    return runOrDiagnose(["appscript", "content", scriptId], { account });
+    return runOrDiagnose(["appscript", "content", pos(scriptId)], { account });
   });
   server.registerTool("gog_appscript_pull", {
     description: "Write a project's files into a local directory, for editing a script as ordinary files. THE DIRECTORY IS RESOLVED WHERE GOG RUNS, which is the caller's own machine only on a local (stdio) deployment: on a hosted deployment (e.g. mcp-host) the files land on that server where the caller cannot reach them. Use gog_appscript_content there instead \u2014 it returns the same source in the response. Existing files are left alone unless overwrite is set. Read-only as far as Google is concerned: nothing is pushed back." + apiEnableNote,
     annotations: { destructiveHint: true },
     inputSchema: external_exports.object({
       scriptId: scriptIdParam,
-      dir: external_exports.string().describe("Destination directory, resolved on the machine where gog runs"),
+      dir: external_exports.string().describe("Destination directory, resolved on the machine where gog runs; must be inside the server's GOG_FILE_ROOTS directories"),
       overwrite: external_exports.boolean().optional().describe("Overwrite files that already exist in dir"),
       account: accountParam
     })
   }, async ({ scriptId, dir, overwrite, account }) => {
-    const args = ["appscript", "pull", scriptId, dir];
+    confinePath(dir, "dir");
+    const args = ["appscript", "pull", pos(scriptId), pos(dir)];
     if (overwrite) args.push("--overwrite");
     return runOrDiagnose(args, { account });
   });
@@ -33882,7 +34332,7 @@ function registerAppScriptTools(server) {
       account: accountParam
     })
   }, async ({ scriptId, max, pageToken, page, all, account }) => {
-    const args = ["appscript", "deployments", scriptId];
+    const args = ["appscript", "deployments", pos(scriptId)];
     pushPaginationFlags(args, { max, pageToken, page, all });
     return runOrDiagnose(args, { account });
   });
@@ -33895,7 +34345,7 @@ function registerAppScriptTools(server) {
       account: accountParam
     })
   }, async ({ scriptId, max, pageToken, page, all, account }) => {
-    const args = ["appscript", "versions", scriptId];
+    const args = ["appscript", "versions", pos(scriptId)];
     pushPaginationFlags(args, { max, pageToken, page, all });
     return runOrDiagnose(args, { account });
   });
@@ -33921,7 +34371,7 @@ function registerAppScriptTools(server) {
         throw new Error(`params must be a JSON ARRAY of positional arguments, e.g. '["a", 1]' \u2014 Apps Script takes positional arguments, not named ones. Received: ${params}`);
       }
     }
-    const args = ["appscript", "run", scriptId, functionName];
+    const args = ["appscript", "run", pos(scriptId), pos(functionName)];
     if (params !== void 0) args.push(`--params=${params}`);
     if (devMode) args.push("--dev-mode");
     return runOrDiagnose(args, { account });
@@ -33934,6 +34384,7 @@ function registerAppScriptTools(server) {
 }
 
 // src/tools/auth.ts
+var AUTH_RUN_SUBCOMMANDS = ["list", "status", "services", "remove", "alias"];
 function registerAuthToolsWith(server, defaultServices) {
   const servicesDescribe = `Services to authorize: "all" or comma-separated list (e.g. "sheets,gmail,calendar"). Default: "${defaultServices}". Prefer the narrowest set you need \u2014 requesting a service whose Google API is not enabled on the OAuth client's project makes Google reject the WHOLE request with invalid_scope.`;
   const extraScopesDescribe = "Additional raw OAuth scope URIs to request, comma-separated, on top of the ones `services` implies. Use for scopes no service covers \u2014 e.g. https://www.googleapis.com/auth/bigquery.readonly, required before gog_sheets_datasource_* can read BigQuery-backed Connected Sheets. Leave unset otherwise: an extra scope whose API is not enabled on the OAuth client project makes Google reject the WHOLE authorization with invalid_scope.";
@@ -33991,7 +34442,7 @@ function registerAuthToolsWith(server, defaultServices) {
     })
   }, async ({ email: email3, services = defaultServices, extraScopes }) => {
     try {
-      const args = ["auth", "add", email3, "--services", services];
+      const args = ["auth", "add", pos(email3), "--services", services];
       if (extraScopes) args.push(`--extra-scopes=${extraScopes}`, "--force-consent");
       return rawTextResult(await run(args, {
         interactive: true,
@@ -34011,7 +34462,7 @@ function registerAuthToolsWith(server, defaultServices) {
     })
   }, async ({ email: email3, services = defaultServices, extraScopes }) => {
     try {
-      const args = ["auth", "add", email3, "--remote", "--step", "1", "--services", services, "--force-consent"];
+      const args = ["auth", "add", pos(email3), "--remote", "--step", "1", "--services", services, "--force-consent"];
       if (extraScopes) args.push(`--extra-scopes=${extraScopes}`);
       return rawTextResult(await run(args, { redactMode: "tokens" }));
     } catch (err) {
@@ -34038,7 +34489,7 @@ function registerAuthToolsWith(server, defaultServices) {
       const args = [
         "auth",
         "add",
-        email3,
+        pos(email3),
         "--remote",
         "--step",
         "2",
@@ -34058,6 +34509,7 @@ function registerAuthToolsWith(server, defaultServices) {
     service: "auth",
     examples: '"remove", "alias", "list"',
     omitAccount: true,
+    allowedSubcommands: AUTH_RUN_SUBCOMMANDS,
     note: "For browser-based authorization, use gog_auth_add instead."
   });
 }
@@ -34122,7 +34574,7 @@ function registerCalendarTools(server) {
     })
   }, async ({ calendarId, from, to, days, today, query, max, pageToken, page, all, eventTypes, timezone, view, account }) => {
     const args = ["calendar", "events"];
-    if (calendarId) args.push(calendarId);
+    if (calendarId) args.push(pos(calendarId));
     if (from) args.push(`--from=${from}`);
     if (to) args.push(`--to=${to}`);
     if (days !== void 0) args.push(`--days=${days}`);
@@ -34151,7 +34603,7 @@ function registerCalendarTools(server) {
       account: accountParam
     })
   }, async ({ calendarId, eventId, timezone, account }) => {
-    const args = ["calendar", "event", calendarId, eventId];
+    const args = ["calendar", "event", pos(calendarId), pos(eventId)];
     if (timezone) args.push(`--timezone=${timezone}`);
     return runOrDiagnose(args, { account });
   });
@@ -34173,7 +34625,7 @@ function registerCalendarTools(server) {
       account: accountParam
     })
   }, async ({ calendarId, summary, from, to, description, location, attendees, allDay, timezone, withZoom, reminders, noReminders, account }) => {
-    const args = ["calendar", "create", calendarId, `--summary=${summary}`, `--from=${from}`, `--to=${to}`];
+    const args = ["calendar", "create", pos(calendarId), `--summary=${summary}`, `--from=${from}`, `--to=${to}`];
     if (description) args.push(`--description=${description}`);
     if (location) args.push(`--location=${location}`);
     if (attendees) args.push(`--attendees=${attendees}`);
@@ -34205,7 +34657,7 @@ function registerCalendarTools(server) {
       account: accountParam
     })
   }, async ({ calendarId, eventId, summary, from, to, description, location, attendees, addAttendees, attachments, withZoom, regenerateZoom, removeZoom, removeMeet, reminders, noReminders, account }) => {
-    const args = ["calendar", "update", calendarId, eventId];
+    const args = ["calendar", "update", pos(calendarId), pos(eventId)];
     if (summary !== void 0) args.push(`--summary=${summary}`);
     if (from !== void 0) args.push(`--from=${from}`);
     if (to !== void 0) args.push(`--to=${to}`);
@@ -34230,7 +34682,7 @@ function registerCalendarTools(server) {
       account: accountParam
     })
   }, async ({ calendarId, eventId, account }) => {
-    return runOrDiagnose(["calendar", "delete", calendarId, eventId, "--force"], { account });
+    return runOrDiagnose(["calendar", "delete", pos(calendarId), pos(eventId), "--force"], { account });
   });
   server.registerTool("gog_calendar_respond", {
     description: "Respond to a calendar event invitation.",
@@ -34243,7 +34695,7 @@ function registerCalendarTools(server) {
       account: accountParam
     })
   }, async ({ calendarId, eventId, status, comment, account }) => {
-    const args = ["calendar", "respond", calendarId, eventId, `--status=${status}`];
+    const args = ["calendar", "respond", pos(calendarId), pos(eventId), `--status=${status}`];
     if (comment) args.push(`--comment=${comment}`);
     return runOrDiagnose(args, { account });
   });
@@ -34258,6 +34710,7 @@ var MAX_REQUEST_PAYLOAD_WIRE_BYTES = REQUEST_MAX_BODY_BYTES - REQUEST_BODY_JSON_
 var MAX_INLINE_ATTACHMENT_TOTAL_BYTES = Math.floor(MAX_REQUEST_PAYLOAD_WIRE_BYTES * 3 / 4);
 function wireBytesOf(arg) {
   if (typeof arg === "string") return Buffer.byteLength(arg, "utf8");
+  if (arg.kind === "positional") return Buffer.byteLength(arg.value, "utf8");
   return arg.encoding === "base64" ? arg.contents.length : Buffer.byteLength(arg.contents, "utf8");
 }
 var formatMiB = (bytes) => `${Math.floor(bytes / (1024 * 1024))} MiB`;
@@ -34360,7 +34813,7 @@ function registerChatTools(server) {
       account: accountParam
     })
   }, async ({ displayName, exact, max, account }) => {
-    const args = ["chat", "spaces", "find", displayName];
+    const args = ["chat", "spaces", "find", pos(displayName)];
     if (exact) args.push("--exact");
     if (max !== void 0) args.push(`--max=${max}`);
     return runOrDiagnose(args, { account });
@@ -34374,7 +34827,7 @@ function registerChatTools(server) {
       account: accountParam
     })
   }, async ({ displayName, members: members2, account }) => {
-    const args = ["chat", "spaces", "create", displayName];
+    const args = ["chat", "spaces", "create", pos(displayName)];
     if (members2) for (const member of members2) args.push(`--member=${member}`);
     return runOrDiagnose(args, { account });
   });
@@ -34387,7 +34840,7 @@ function registerChatTools(server) {
       account: accountParam
     })
   }, async ({ space, max, pageToken, page, all, account }) => {
-    const args = ["chat", "threads", "list", space];
+    const args = ["chat", "threads", "list", pos(space)];
     pushPaginationFlags(args, { max, pageToken, page, all });
     return runOrDiagnose(args, { account });
   });
@@ -34403,7 +34856,7 @@ function registerChatTools(server) {
       account: accountParam
     })
   }, async ({ space, thread, unread, order, max, pageToken, page, all, account }) => {
-    const args = ["chat", "messages", "list", space];
+    const args = ["chat", "messages", "list", pos(space)];
     if (thread) args.push(`--thread=${thread}`);
     if (unread) args.push("--unread");
     if (order) args.push(`--order=${order}`);
@@ -34427,7 +34880,7 @@ function registerChatTools(server) {
       account: accountParam
     })
   }, async ({ query, order, view, markup, max, pageToken, page, all, account }) => {
-    const args = ["chat", "messages", "search", query];
+    const args = ["chat", "messages", "search", pos(query)];
     if (order) args.push(`--order=${order}`);
     if (view) args.push(`--view=${view}`);
     if (markup) args.push(`--markup=${markup}`);
@@ -34442,16 +34895,17 @@ function registerChatTools(server) {
       text: external_exports.string().optional().describe("Message text. Optional only when an attachment is supplied."),
       thread: threadParam,
       attach: external_exports.array(external_exports.string()).optional().describe(
-        "Attachment file paths, read WHERE GOG RUNS. On a hosted or remote deployment that is not your machine \u2014 use attachInline there instead."
+        "Attachment file paths, read WHERE GOG RUNS. On a hosted or remote deployment that is not your machine \u2014 use attachInline there instead. Must be inside the server's GOG_FILE_ROOTS directories (default ~/gogcli-mcp-files)."
       ),
       attachInline: attachInlineParam,
       account: accountParam
     })
   }, async ({ space, text, thread, attach, attachInline, account }) => {
+    confinePaths(attach, "attach");
     if (text === void 0 && !attach?.length && !attachInline?.length) {
       throw new Error("A Chat message needs text, an attachment, or both.");
     }
-    const args = ["chat", "messages", "send", space];
+    const args = ["chat", "messages", "send", pos(space)];
     if (text !== void 0) args.push(`--text=${text}`);
     if (thread) args.push(`--thread=${thread}`);
     if (attach) for (const path of attach) args.push(`--attach=${path}`);
@@ -34468,7 +34922,7 @@ function registerChatTools(server) {
       account: accountParam
     })
   }, async ({ email: email3, text, thread, account }) => {
-    const args = ["chat", "dm", "send", email3, `--text=${text}`];
+    const args = ["chat", "dm", "send", pos(email3), `--text=${text}`];
     if (thread) args.push(`--thread=${thread}`);
     return runOrDiagnose(args, { account });
   });
@@ -34480,7 +34934,7 @@ function registerChatTools(server) {
       account: accountParam
     })
   }, async ({ email: email3, account }) => {
-    return runOrDiagnose(["chat", "dm", "space", email3], { account });
+    return runOrDiagnose(["chat", "dm", "space", pos(email3)], { account });
   });
   server.registerTool("gog_chat_reactions_list", {
     description: "List the emoji reactions on one message, with who reacted. gog_chat_messages_list already returns a reaction SUMMARY per message; come here when you need the individual reactors, or the reaction resource names that gog_chat_reactions_delete takes." + workspaceOnlyNote,
@@ -34492,7 +34946,7 @@ function registerChatTools(server) {
       account: accountParam
     })
   }, async ({ message, space, max, pageToken, page, all, account }) => {
-    const args = ["chat", "messages", "reactions", "list", message];
+    const args = ["chat", "messages", "reactions", "list", pos(message)];
     if (space) args.push(`--space=${space}`);
     pushPaginationFlags(args, { max, pageToken, page, all });
     return runOrDiagnose(args, { account });
@@ -34507,7 +34961,7 @@ function registerChatTools(server) {
       account: accountParam
     })
   }, async ({ message, emoji: emoji3, space, account }) => {
-    const args = ["chat", "messages", "reactions", "create", message, emoji3];
+    const args = ["chat", "messages", "reactions", "create", pos(message), pos(emoji3)];
     if (space) args.push(`--space=${space}`);
     return runOrDiagnose(args, { account });
   });
@@ -34519,7 +34973,7 @@ function registerChatTools(server) {
       account: accountParam
     })
   }, async ({ reaction, account }) => {
-    return runOrDiagnose(["chat", "messages", "reactions", "delete", reaction], { account });
+    return runOrDiagnose(["chat", "messages", "reactions", "delete", pos(reaction)], { account });
   });
   registerRunTool(server, {
     service: "chat",
@@ -34562,7 +35016,7 @@ function registerClassroomTools(server) {
       account: accountParam
     })
   }, async ({ courseId, account }) => {
-    return runOrDiagnose(["classroom", "courses", "get", courseId], { account });
+    return runOrDiagnose(["classroom", "courses", "get", pos(courseId)], { account });
   });
   server.registerTool("gog_classroom_students_list", {
     description: "List students enrolled in a Google Classroom course.",
@@ -34576,7 +35030,7 @@ function registerClassroomTools(server) {
       account: accountParam
     })
   }, async ({ courseId, max, pageToken, page, all, account }) => {
-    const args = ["classroom", "students", "list", courseId];
+    const args = ["classroom", "students", "list", pos(courseId)];
     if (max !== void 0) args.push(`--max=${max}`);
     const token = resolvePageToken({ pageToken, page });
     if (token) args.push(`--page=${token}`);
@@ -34592,7 +35046,7 @@ function registerClassroomTools(server) {
       account: accountParam
     })
   }, async ({ courseId, userId, account }) => {
-    return runOrDiagnose(["classroom", "students", "get", courseId, userId], { account });
+    return runOrDiagnose(["classroom", "students", "get", pos(courseId), pos(userId)], { account });
   });
   server.registerTool("gog_classroom_teachers_list", {
     description: "List teachers in a Google Classroom course.",
@@ -34606,7 +35060,7 @@ function registerClassroomTools(server) {
       account: accountParam
     })
   }, async ({ courseId, max, pageToken, page, all, account }) => {
-    const args = ["classroom", "teachers", "list", courseId];
+    const args = ["classroom", "teachers", "list", pos(courseId)];
     if (max !== void 0) args.push(`--max=${max}`);
     const token = resolvePageToken({ pageToken, page });
     if (token) args.push(`--page=${token}`);
@@ -34622,7 +35076,7 @@ function registerClassroomTools(server) {
       account: accountParam
     })
   }, async ({ courseId, userId, account }) => {
-    return runOrDiagnose(["classroom", "teachers", "get", courseId, userId], { account });
+    return runOrDiagnose(["classroom", "teachers", "get", pos(courseId), pos(userId)], { account });
   });
   server.registerTool("gog_classroom_roster", {
     description: "List the full roster (students and/or teachers) of a Google Classroom course. Omit both flags to return both groups.",
@@ -34638,7 +35092,7 @@ function registerClassroomTools(server) {
       account: accountParam
     })
   }, async ({ courseId, students, teachers, max, pageToken, page, all, account }) => {
-    const args = ["classroom", "roster", courseId];
+    const args = ["classroom", "roster", pos(courseId)];
     if (students) args.push("--students");
     if (teachers) args.push("--teachers");
     if (max !== void 0) args.push(`--max=${max}`);
@@ -34663,7 +35117,7 @@ function registerClassroomTools(server) {
       account: accountParam
     })
   }, async ({ courseId, state, topic, orderBy, max, pageToken, page, all, scanPages, account }) => {
-    const args = ["classroom", "coursework", "list", courseId];
+    const args = ["classroom", "coursework", "list", pos(courseId)];
     if (state) args.push(`--state=${state}`);
     if (topic) args.push(`--topic=${topic}`);
     if (orderBy) args.push(`--order-by=${orderBy}`);
@@ -34683,7 +35137,7 @@ function registerClassroomTools(server) {
       account: accountParam
     })
   }, async ({ courseId, courseworkId, account }) => {
-    return runOrDiagnose(["classroom", "coursework", "get", courseId, courseworkId], { account });
+    return runOrDiagnose(["classroom", "coursework", "get", pos(courseId), pos(courseworkId)], { account });
   });
   server.registerTool("gog_classroom_submissions_list", {
     description: "List student submissions for a coursework item.",
@@ -34701,7 +35155,7 @@ function registerClassroomTools(server) {
       account: accountParam
     })
   }, async ({ courseId, courseworkId, state, late, user, max, pageToken, page, all, account }) => {
-    const args = ["classroom", "submissions", "list", courseId, courseworkId];
+    const args = ["classroom", "submissions", "list", pos(courseId), pos(courseworkId)];
     if (state) args.push(`--state=${state}`);
     if (late) args.push(`--late=${late}`);
     if (user) args.push(`--user=${user}`);
@@ -34721,7 +35175,7 @@ function registerClassroomTools(server) {
       account: accountParam
     })
   }, async ({ courseId, courseworkId, submissionId, account }) => {
-    return runOrDiagnose(["classroom", "submissions", "get", courseId, courseworkId, submissionId], { account });
+    return runOrDiagnose(["classroom", "submissions", "get", pos(courseId), pos(courseworkId), pos(submissionId)], { account });
   });
   server.registerTool("gog_classroom_submissions_grade", {
     description: "Grade a student submission. Set draft and/or assigned grade values.",
@@ -34735,7 +35189,7 @@ function registerClassroomTools(server) {
       account: accountParam
     })
   }, async ({ courseId, courseworkId, submissionId, draft, assigned, account }) => {
-    const args = ["classroom", "submissions", "grade", courseId, courseworkId, submissionId];
+    const args = ["classroom", "submissions", "grade", pos(courseId), pos(courseworkId), pos(submissionId)];
     if (draft) args.push(`--draft=${draft}`);
     if (assigned) args.push(`--assigned=${assigned}`);
     return runOrDiagnose(args, { account });
@@ -34750,7 +35204,7 @@ function registerClassroomTools(server) {
       account: accountParam
     })
   }, async ({ courseId, courseworkId, submissionId, account }) => {
-    return runOrDiagnose(["classroom", "submissions", "return", courseId, courseworkId, submissionId], { account });
+    return runOrDiagnose(["classroom", "submissions", "return", pos(courseId), pos(courseworkId), pos(submissionId)], { account });
   });
   server.registerTool("gog_classroom_submissions_turn_in", {
     description: "Turn in a student submission (student action).",
@@ -34762,7 +35216,7 @@ function registerClassroomTools(server) {
       account: accountParam
     })
   }, async ({ courseId, courseworkId, submissionId, account }) => {
-    return runOrDiagnose(["classroom", "submissions", "turn-in", courseId, courseworkId, submissionId], { account });
+    return runOrDiagnose(["classroom", "submissions", "turn-in", pos(courseId), pos(courseworkId), pos(submissionId)], { account });
   });
   server.registerTool("gog_classroom_submissions_reclaim", {
     description: "Reclaim a turned-in submission (student action to edit a submission).",
@@ -34774,7 +35228,7 @@ function registerClassroomTools(server) {
       account: accountParam
     })
   }, async ({ courseId, courseworkId, submissionId, account }) => {
-    return runOrDiagnose(["classroom", "submissions", "reclaim", courseId, courseworkId, submissionId], { account });
+    return runOrDiagnose(["classroom", "submissions", "reclaim", pos(courseId), pos(courseworkId), pos(submissionId)], { account });
   });
   server.registerTool("gog_classroom_announcements_list", {
     description: "List announcements in a Google Classroom course.",
@@ -34790,7 +35244,7 @@ function registerClassroomTools(server) {
       account: accountParam
     })
   }, async ({ courseId, state, orderBy, max, pageToken, page, all, account }) => {
-    const args = ["classroom", "announcements", "list", courseId];
+    const args = ["classroom", "announcements", "list", pos(courseId)];
     if (state) args.push(`--state=${state}`);
     if (orderBy) args.push(`--order-by=${orderBy}`);
     if (max !== void 0) args.push(`--max=${max}`);
@@ -34808,7 +35262,7 @@ function registerClassroomTools(server) {
       account: accountParam
     })
   }, async ({ courseId, announcementId, account }) => {
-    return runOrDiagnose(["classroom", "announcements", "get", courseId, announcementId], { account });
+    return runOrDiagnose(["classroom", "announcements", "get", pos(courseId), pos(announcementId)], { account });
   });
   server.registerTool("gog_classroom_announcements_create", {
     description: "Create an announcement in a Google Classroom course.",
@@ -34821,7 +35275,7 @@ function registerClassroomTools(server) {
       account: accountParam
     })
   }, async ({ courseId, text, state, scheduled, account }) => {
-    const args = ["classroom", "announcements", "create", courseId, `--text=${text}`];
+    const args = ["classroom", "announcements", "create", pos(courseId), `--text=${text}`];
     if (state) args.push(`--state=${state}`);
     if (scheduled) args.push(`--scheduled=${scheduled}`);
     return runOrDiagnose(args, { account });
@@ -34838,7 +35292,7 @@ function registerClassroomTools(server) {
       account: accountParam
     })
   }, async ({ courseId, max, pageToken, page, all, account }) => {
-    const args = ["classroom", "topics", "list", courseId];
+    const args = ["classroom", "topics", "list", pos(courseId)];
     if (max !== void 0) args.push(`--max=${max}`);
     const token = resolvePageToken({ pageToken, page });
     if (token) args.push(`--page=${token}`);
@@ -34854,7 +35308,7 @@ function registerClassroomTools(server) {
       account: accountParam
     })
   }, async ({ courseId, topicId, account }) => {
-    return runOrDiagnose(["classroom", "topics", "get", courseId, topicId], { account });
+    return runOrDiagnose(["classroom", "topics", "get", pos(courseId), pos(topicId)], { account });
   });
   server.registerTool("gog_classroom_invitations_list", {
     description: "List Google Classroom invitations.",
@@ -34886,7 +35340,7 @@ function registerClassroomTools(server) {
       account: accountParam
     })
   }, async ({ invitationId, account }) => {
-    return runOrDiagnose(["classroom", "invitations", "get", invitationId], { account });
+    return runOrDiagnose(["classroom", "invitations", "get", pos(invitationId)], { account });
   });
   server.registerTool("gog_classroom_invitations_accept", {
     description: "Accept a Google Classroom invitation.",
@@ -34896,7 +35350,7 @@ function registerClassroomTools(server) {
       account: accountParam
     })
   }, async ({ invitationId, account }) => {
-    return runOrDiagnose(["classroom", "invitations", "accept", invitationId], { account });
+    return runOrDiagnose(["classroom", "invitations", "accept", pos(invitationId)], { account });
   });
   server.registerTool("gog_classroom_profile_get", {
     description: "Get a Google Classroom user profile. Omit userId to fetch the authenticated user.",
@@ -34907,7 +35361,7 @@ function registerClassroomTools(server) {
     })
   }, async ({ userId, account }) => {
     const args = ["classroom", "profile", "get"];
-    if (userId) args.push(userId);
+    if (userId) args.push(pos(userId));
     return runOrDiagnose(args, { account });
   });
   registerRunTool(server, {
@@ -34927,7 +35381,7 @@ function registerContactsTools(server) {
       account: accountParam
     })
   }, async ({ query, account }) => {
-    return runOrDiagnose(["contacts", "search", query], { account });
+    return runOrDiagnose(["contacts", "search", pos(query)], { account });
   });
   server.registerTool("gog_contacts_list", {
     description: "List all Google Contacts.",
@@ -34946,7 +35400,7 @@ function registerContactsTools(server) {
       account: accountParam
     })
   }, async ({ resourceName, account }) => {
-    return runOrDiagnose(["contacts", "get", resourceName], { account });
+    return runOrDiagnose(["contacts", "get", pos(resourceName)], { account });
   });
   server.registerTool("gog_contacts_create", {
     description: "Create a new Google Contact.",
@@ -34982,7 +35436,7 @@ function registerDocsTools(server) {
       account: accountParam
     })
   }, async ({ docId, account }) => {
-    return runOrDiagnose(["docs", "info", docId], { account });
+    return runOrDiagnose(["docs", "info", pos(docId)], { account });
   });
   server.registerTool("gog_docs_cat", {
     description: "Read a Google Doc as plain text.",
@@ -34993,7 +35447,7 @@ function registerDocsTools(server) {
       account: accountParam
     })
   }, async ({ docId, chips, account }) => {
-    const args = ["docs", "cat", docId];
+    const args = ["docs", "cat", pos(docId)];
     if (chips) args.push("--chips");
     return runOrDiagnose(args, { account });
   });
@@ -35005,7 +35459,7 @@ function registerDocsTools(server) {
       account: accountParam
     })
   }, async ({ title, account }) => {
-    return runOrDiagnose(["docs", "create", title], { account });
+    return runOrDiagnose(["docs", "create", pos(title)], { account });
   });
   server.registerTool("gog_docs_write", {
     description: "Write text content to a Google Doc, replacing existing body content by default. Set append=true to add after existing content.",
@@ -35030,7 +35484,7 @@ function registerDocsTools(server) {
       account: accountParam
     })
   }, async ({ docId, text, append, checkOrphans, bullets, bulletPreset, ordered, noBullets, indentStart, indentEnd, indentFirstLine, spaceAbove, spaceBelow, keepLinesTogether, keepWithNext, batch, account }) => {
-    const args = ["docs", "write", docId, `--text=${text}`];
+    const args = ["docs", "write", pos(docId), `--text=${text}`];
     if (append) args.push("--append");
     if (checkOrphans) args.push("--check-orphans");
     if (bullets) args.push("--bullets");
@@ -35057,7 +35511,7 @@ function registerDocsTools(server) {
       account: accountParam
     })
   }, async ({ docId, find, replace, account }) => {
-    return runOrDiagnose(["docs", "find-replace", docId, find, replace], { account });
+    return runOrDiagnose(["docs", "find-replace", pos(docId), pos(find), pos(replace)], { account });
   });
   server.registerTool("gog_docs_structure", {
     description: "Show a Google Doc's structure with numbered paragraphs. Useful for understanding the document layout before making index-based edits.",
@@ -35067,7 +35521,7 @@ function registerDocsTools(server) {
       account: accountParam
     })
   }, async ({ docId, account }) => {
-    return runOrDiagnose(["docs", "structure", docId], { account });
+    return runOrDiagnose(["docs", "structure", pos(docId)], { account });
   });
   registerRunTool(server, { service: "docs", examples: '"copy", "clear", "insert", "sed", "export"' });
 }
@@ -35077,8 +35531,10 @@ var GOOGLE_DOC_MIME = "application/vnd.google-apps.document";
 function fileMeta(raw) {
   const parsed = JSON.parse(raw);
   const f = parsed.file ?? parsed;
-  return { name: f.name, mimeType: f.mimeType };
+  const size = f.size === void 0 ? void 0 : Number(f.size);
+  return { name: f.name, mimeType: f.mimeType, size: Number.isFinite(size) ? size : void 0 };
 }
+var MAX_DRIVE_READ_BYTES = MAX_INLINE_ATTACHMENT_BYTES;
 var DRIVE_LS_COMPACT_FIELDS = "nextPageToken,files(id,name,mimeType,modifiedTime,size,webViewLink)";
 function registerDriveTools(server) {
   server.registerTool("gog_drive_ls", {
@@ -35122,7 +35578,7 @@ function registerDriveTools(server) {
       account: accountParam
     })
   }, async ({ query, view, account }) => {
-    return runOrDiagnose(["drive", "search", query], {
+    return runOrDiagnose(["drive", "search", pos(query)], {
       account,
       stripMedia: resolveView(view, ["compact", "full"]) === "compact"
     });
@@ -35142,7 +35598,7 @@ function registerDriveTools(server) {
       account: accountParam
     })
   }, async ({ fileId, view, account }) => {
-    return runOrDiagnose(["drive", "get", fileId], {
+    return runOrDiagnose(["drive", "get", pos(fileId)], {
       account,
       stripMedia: resolveView(view, ["compact", "full"]) === "compact"
     });
@@ -35155,7 +35611,7 @@ function registerDriveTools(server) {
       account: accountParam
     })
   }, async ({ name, account }) => {
-    return runOrDiagnose(["drive", "mkdir", name], { account });
+    return runOrDiagnose(["drive", "mkdir", pos(name)], { account });
   });
   server.registerTool("gog_drive_rename", {
     description: "Rename a file or folder in Google Drive.",
@@ -35166,7 +35622,7 @@ function registerDriveTools(server) {
       account: accountParam
     })
   }, async ({ fileId, newName, account }) => {
-    return runOrDiagnose(["drive", "rename", fileId, newName], { account });
+    return runOrDiagnose(["drive", "rename", pos(fileId), pos(newName)], { account });
   });
   server.registerTool("gog_drive_move", {
     description: "Move a file to a different folder in Google Drive.",
@@ -35177,7 +35633,7 @@ function registerDriveTools(server) {
       account: accountParam
     })
   }, async ({ fileId, parentId, account }) => {
-    return runOrDiagnose(["drive", "move", fileId, `--parent=${parentId}`], { account });
+    return runOrDiagnose(["drive", "move", pos(fileId), `--parent=${parentId}`], { account });
   });
   server.registerTool("gog_drive_delete", {
     description: "Move a Google Drive file to trash, or permanently delete it with permanent=true (irreversible).",
@@ -35188,7 +35644,7 @@ function registerDriveTools(server) {
       account: accountParam
     })
   }, async ({ fileId, permanent, account }) => {
-    const args = ["drive", "delete", fileId];
+    const args = ["drive", "delete", pos(fileId)];
     if (permanent) args.push("--permanent");
     args.push("--force");
     return runOrDiagnose(args, { account });
@@ -35205,7 +35661,7 @@ function registerDriveTools(server) {
       account: accountParam
     })
   }, async ({ fileId, to, email: email3, domain: domain2, role, account }) => {
-    const args = ["drive", "share", fileId, `--to=${to}`];
+    const args = ["drive", "share", pos(fileId), `--to=${to}`];
     if (email3) args.push(`--email=${email3}`);
     if (domain2) args.push(`--domain=${domain2}`);
     if (role) args.push(`--role=${role}`);
@@ -35228,7 +35684,7 @@ function registerDriveTools(server) {
   }, async ({ fileId, ocrLanguage, offset = 0, maxChars, account }) => {
     let tempDocId;
     try {
-      const { name, mimeType } = fileMeta(await run(["drive", "get", fileId], { account }));
+      const { name, mimeType } = fileMeta(await run(["drive", "get", pos(fileId)], { account }));
       let sourceId = fileId;
       if (mimeType !== GOOGLE_DOC_MIME) {
         const params = JSON.stringify({ fileId, ...ocrLanguage ? { ocrLanguage } : {} });
@@ -35273,13 +35729,13 @@ function registerDriveTools(server) {
       return diagnose(err);
     } finally {
       if (tempDocId) {
-        await run(["drive", "delete", tempDocId, "--permanent", "--force"], { account }).catch(() => {
+        await run(["drive", "delete", pos(tempDocId), "--permanent", "--force"], { account }).catch(() => {
         });
       }
     }
   });
   server.registerTool("gog_drive_read_bytes", {
-    description: "Fetch a Drive file's raw bytes and return them base64-encoded as an embedded resource \u2014 the generic fallback for callers that want the file itself (to parse locally) rather than extracted text. For readable text from a PDF, prefer gog_drive_extract_text.",
+    description: "Fetch a Drive file's raw bytes and return them base64-encoded as an embedded resource \u2014 the generic fallback for callers that want the file itself (to parse locally) rather than extracted text. Files over 8 MiB are refused (checked before downloading). For readable text from a PDF, prefer gog_drive_extract_text.",
     annotations: { readOnlyHint: true },
     inputSchema: external_exports.object({
       fileId: external_exports.string().describe("Drive file ID"),
@@ -35287,9 +35743,17 @@ function registerDriveTools(server) {
     })
   }, async ({ fileId, account }) => {
     try {
-      const { name, mimeType } = fileMeta(await run(["drive", "get", fileId], { account }));
+      const { name, mimeType, size } = fileMeta(await run(["drive", "get", pos(fileId)], { account }));
+      if (size !== void 0 && size > MAX_DRIVE_READ_BYTES) {
+        return errorResult(
+          `${name ?? fileId} is ${size} bytes, over the 8 MiB this tool returns inline. Use gog_drive_extract_text for its text, or share its webViewLink (gog_drive_get) instead.`
+        );
+      }
       const params = JSON.stringify({ fileId, alt: "media" });
-      const blob = await runBinary(["api", "call", "drive", "v3", "files.get", `--params=${params}`], { account });
+      const blob = await runBinary(
+        ["api", "call", "drive", "v3", "files.get", `--params=${params}`],
+        { account, maxOutputBytes: MAX_DRIVE_READ_BYTES }
+      );
       const type = mimeType ?? "application/octet-stream";
       const unrenderableHint = type.startsWith("image/") ? "" : ` If your client does not render a ${type} resource, gog_drive_extract_text returns the same file as text (PDFs included, via OCR).`;
       return {
@@ -35309,7 +35773,7 @@ function registerDriveTools(server) {
       return diagnose(err);
     }
   });
-  registerRunTool(server, { service: "drive", examples: '"copy", "upload", "download", "permissions"' });
+  registerRunTool(server, { service: "drive", examples: '"copy", "download", "permissions"' });
 }
 
 // src/gmail-results.ts
@@ -35337,7 +35801,7 @@ async function countMatches(method, itemsKey, query, account) {
       maxResults: COUNT_PROBE_PAGE_SIZE,
       fields: `${itemsKey}/id,nextPageToken`
     });
-    const raw = await run(["api", "call", "gmail", "v1", method, `--params=${params}`], { account });
+    const raw = await run(["api", "call", "gmail", "v1", pos(method), `--params=${params}`], { account });
     const parsed = JSON.parse(raw);
     const items = parsed[itemsKey];
     if (!Array.isArray(items)) return {};
@@ -35376,7 +35840,7 @@ async function fetchGmailPages(runPage, itemsKey, maxPages, startToken) {
     const result = await runPage(token);
     const parsed = parsePage(result, itemsKey);
     if (parsed === void 0) {
-      return base === void 0 ? result : finish(base, itemsKey, merged, token);
+      return base === void 0 ? result : finish(base, itemsKey, merged, token, pageErrorText(result, itemsKey, pages + 1));
     }
     base = parsed;
     merged.push(...parsed[itemsKey]);
@@ -35407,10 +35871,18 @@ function parsePage(result, itemsKey) {
   const obj = parsed;
   return Array.isArray(obj[itemsKey]) ? obj : void 0;
 }
-function finish(base, itemsKey, merged, token) {
+var PAGE_ERROR_MAX = 2e3;
+function pageErrorText(result, itemsKey, n) {
+  const first = result.content[0];
+  const text = first?.type === "text" ? first.text.slice(0, PAGE_ERROR_MAX) : "";
+  if (result.isError) return `page ${n} failed${text ? `: ${text}` : ""}`;
+  return `page ${n} returned output that is not a ${itemsKey} list`;
+}
+function finish(base, itemsKey, merged, token, pageError) {
   const out = { ...base, [itemsKey]: merged };
   if (token === void 0) delete out.nextPageToken;
   else out.nextPageToken = token;
+  if (pageError !== void 0) out.pageError = pageError;
   return rawTextResult(JSON.stringify(out));
 }
 
@@ -35424,16 +35896,27 @@ var STAGING_TWIN = {
   "gmail.reply-all": "gog_gmail_drafts_reply_all",
   "gmail.send": "gog_gmail_drafts_create"
 };
+var UNSUPPORTED_NOTE2 = {
+  "gmail.drafts-send": "The draft is still saved: ask the user to review it and send it from Gmail."
+};
+var BODY_PREVIEW_MAX = 2048;
+function bodyPreview(text) {
+  if (!text) return void 0;
+  if (text.length <= BODY_PREVIEW_MAX) return text;
+  return `${text.slice(0, BODY_PREVIEW_MAX)}\u2026 [${text.length - BODY_PREVIEW_MAX} more characters not shown]`;
+}
+function attachmentNames(paths, inline) {
+  return [...paths ?? [], ...(inline ?? []).map((a) => a.filename)];
+}
 function requireGmailDispatchConfirmation(ctx, op, details) {
   const twin = STAGING_TWIN[op];
+  const note = twin ? `Stage it with ${twin} instead; the user can review the draft and send it from Gmail (gog_gmail_drafts_send also asks for confirmation).` : UNSUPPORTED_NOTE2[op];
   return requireConfirmation(ctx, {
     action: op,
-    message: "Review and confirm this email dispatch:",
+    message: op === "gmail.filter-forward" ? "Review and confirm this mail-forwarding filter:" : "Review and confirm this email dispatch:",
     details,
-    confirmationLabel: "Confirm that this email should be sent now.",
-    ...twin ? {
-      unsupportedNote: `Stage it with ${twin} instead, review the draft, and send it with gog_gmail_drafts_send.`
-    } : {}
+    confirmationLabel: op === "gmail.filter-forward" ? "Confirm that matching mail should be forwarded automatically from now on." : "Confirm that this email should be sent now.",
+    ...note ? { unsupportedNote: note } : {}
   });
 }
 var EMAIL_PATTERN = /[a-z0-9!#$%&'*+/=?^_`{|}~.-]+@[a-z0-9-]+(?:\.[a-z0-9-]+)+/gi;
@@ -35504,7 +35987,7 @@ var replySchema = {
   remove: external_exports.array(external_exports.string()).optional().describe("Remove these recipients from all fields (repeatable) \u2014 e.g. to drop someone from a reply-all."),
   subject: external_exports.string().optional().describe('Override reply subject (default: "Re: <original>"). A changed subject starts a NEW Gmail thread.'),
   noQuote: external_exports.boolean().optional().describe("Do not include the original message quoted below the reply (default: the original is quoted)"),
-  attach: external_exports.array(external_exports.string()).optional().describe(`File paths to attach (repeatable), resolved ON THE GOG SERVER's filesystem \u2014 NOT this client's. Only usable when gog runs on the same machine you do (local stdio); on a hosted deployment (e.g. mcp-host) these paths do not exist and the call fails with "no such file or directory" \u2014 use attachInline there. Read on the server, base64-encoded with a MIME type inferred from the extension.`),
+  attach: external_exports.array(external_exports.string()).optional().describe(`File paths to attach (repeatable), resolved ON THE GOG SERVER's filesystem \u2014 NOT this client's. Only usable when gog runs on the same machine you do (local stdio); on a hosted deployment (e.g. mcp-host) these paths do not exist and the call fails with "no such file or directory" \u2014 use attachInline there. Read on the server, base64-encoded with a MIME type inferred from the extension. Must be inside the server's GOG_FILE_ROOTS directories (default ~/gogcli-mcp-files).`),
   attachInline: attachInlineParam,
   from: external_exports.string().optional().describe("Send from this email address (must be a verified send-as alias)"),
   autoFromAddressedAlias: external_exports.boolean().optional().describe("When from is omitted, send from the verified send-as alias the original message was addressed TO, instead of the account's primary address \u2014 so a reply to mail sent to an alias goes back out from that alias. Ignored when from is set."),
@@ -35513,8 +35996,14 @@ var replySchema = {
   signatureFile: external_exports.string().optional().describe("Append a local signature file (plain text or HTML), read on the gog server"),
   account: accountParam
 };
+function confineReplyPaths(f) {
+  confinePaths(f.attach, "attach");
+  if (f.bodyHtmlFile) confinePath(f.bodyHtmlFile, "bodyHtmlFile");
+  if (f.signatureFile) confinePath(f.signatureFile, "signatureFile");
+}
 function appendReplyFlags(args, f) {
   assertNotBoth("bodyHtml", "bodyHtmlFile", f.bodyHtml, f.bodyHtmlFile);
+  confineReplyPaths(f);
   if (f.body) args.push(payloadArg("body", "body-file", f.body));
   if (f.bodyHtml) args.push(payloadArg("body-html", "body-html-file", f.bodyHtml, "html"));
   else if (f.bodyHtmlFile) args.push(`--body-html-file=${f.bodyHtmlFile}`);
@@ -35558,7 +36047,7 @@ function computeReplyRecipients(kind, headers, flags) {
   return emails;
 }
 async function sendReply(kind, toolName, messageId, account, flags, ctx) {
-  const metaResult = await runOrDiagnose(["gmail", "get", messageId, "--format=metadata"], { account });
+  const metaResult = await runOrDiagnose(["gmail", "get", pos(messageId), "--format=metadata"], { account });
   if (metaResult.isError) return metaResult;
   const headers = parseMetadataHeaders(resultText(metaResult));
   const recipients = computeReplyRecipients(kind, headers, flags);
@@ -35569,15 +36058,34 @@ async function sendReply(kind, toolName, messageId, account, flags, ctx) {
     subject: flags.subject || (headers.subject ? `Re: ${headers.subject}` : void 0),
     quoting: !flags.noQuote,
     bodyLength: (flags.body ?? flags.bodyHtml ?? "").length,
-    attachmentCount: (flags.attach?.length ?? 0) + (flags.attachInline?.length ?? 0)
+    bodyPreview: bodyPreview(flags.body ?? flags.bodyHtml),
+    bodyHtmlFile: flags.bodyHtmlFile,
+    attachmentCount: (flags.attach?.length ?? 0) + (flags.attachInline?.length ?? 0),
+    attachments: attachmentNames(flags.attach, flags.attachInline)
   });
   if (confirmation) return confirmation;
-  const args = ["gmail", kind, messageId];
+  const args = ["gmail", kind, pos(messageId)];
   appendReplyFlags(args, flags);
   const result = await runOrDiagnose(args, { account });
   if (!result.isError) logGmailDispatch(toolName, recipients, account);
   return result;
 }
+var GMAIL_RUN_BLOCKED_SETTINGS = /* @__PURE__ */ new Set(["forwarding", "autoforward", "filters", "delegates"]);
+function vetGmailRun(subcommand, args) {
+  if (subcommand === "autoreply") {
+    return "gog gmail autoreply sends mail and is not available through gog_gmail_run. Use gog_gmail_autoreply, which asks the user to confirm.";
+  }
+  if (GMAIL_RUN_BLOCKED_SETTINGS.has(subcommand)) {
+    return `gog gmail ${subcommand} can forward or hand over mail and is not available through gog_gmail_run. Use the dedicated gog_gmail_* tool instead.`;
+  }
+  if (subcommand === "settings") {
+    const blocked = args.find((a) => GMAIL_RUN_BLOCKED_SETTINGS.has(a.toLowerCase()));
+    if (blocked) {
+      return `gog gmail settings ${blocked} can forward or hand over mail and is not available through gog_gmail_run. Use the dedicated gog_gmail_* tool instead.`;
+    }
+  }
+  return void 0;
+}
 function registerGmailTools(server) {
   server.registerTool("gog_gmail_search", {
     description: 'Search Gmail threads using Gmail query syntax (e.g. "from:alice subject:invoice is:unread"). The query is passed verbatim to Gmail; a bare name token (from:alison) matches per Gmail\'s own heuristics, a full address (from:alison@example.com) is exact. To match a contact across several addresses, OR them: from:(a@x.com OR b@y.com). Results are ALWAYS newest-first by Gmail\'s internalDate \u2014 the wrapper sorts them, so the first result is the most recent match and a recent message can never be buried below older ones. IMPORTANT \u2014 a response carrying "truncated": true is an INCOMPLETE view of the matches: NEVER report that a message does not exist, or that there is no such mail, on the strength of one. Page through it (pass nextPageToken back as `pageToken`), set maxPages to walk several pages in one call, or narrow the query, and only then draw a conclusion. If you already know the thread, do not search for it at all \u2014 read it directly with gog_gmail_thread_get, which returns the whole thread and cannot be truncated or mis-ranked.',
@@ -35593,7 +36101,7 @@ function registerGmailTools(server) {
       account: accountParam
     })
   }, async ({ query, max, pageToken, page, maxPages, all, fromContact, account }) => {
-    const args = ["gmail", "search", query];
+    const args = ["gmail", "search", pos(query)];
     if (max !== void 0) args.push(`--max=${max}`);
     if (all) args.push("--all");
     if (fromContact) args.push(`--from-contact=${fromContact}`);
@@ -35624,13 +36132,13 @@ function registerGmailTools(server) {
       account: accountParam
     })
   }, async ({ messageId, format, sanitizeContent, account }) => {
-    const args = ["gmail", "get", messageId];
+    const args = ["gmail", "get", pos(messageId)];
     if (format) args.push(`--format=${format}`);
     if (sanitizeContent) args.push("--sanitize-content");
     return runOrDiagnose(args, { account });
   });
   server.registerTool("gog_gmail_send", {
-    description: 'SENDS MAIL \u2014 asks the MCP host to show a confirmation prompt with the recipients, subject, and body size. Mail is sent only after the user accepts that prompt. Two ways to attach a file: `attach` takes paths READ ON THE GOG SERVER, and `attachInline` takes the bytes themselves. Use attachInline unless you know the file exists on the same machine gog runs on \u2014 on the hosted connector and any remote deployment there is no shared filesystem, so no path you can name resolves there and `attach` will fail with "no such file or directory". When either is used, the JSON result echoes the attached filenames and byte sizes \u2014 check it to confirm the files were embedded. NOT the tool for answering a message: replyToMessageId only files this in the right thread \u2014 the subject, recipients and body are entirely yours, and the original is not quoted unless you set quote. Use gog_gmail_reply / gog_gmail_reply_all instead, which inherit all three.',
+    description: 'SENDS MAIL \u2014 asks the MCP host to show a confirmation prompt with the recipients, subject, a preview of the body and the attachment names. Mail is sent only after the user accepts that prompt. Two ways to attach a file: `attach` takes paths READ ON THE GOG SERVER, and `attachInline` takes the bytes themselves. Use attachInline unless you know the file exists on the same machine gog runs on \u2014 on the hosted connector and any remote deployment there is no shared filesystem, so no path you can name resolves there and `attach` will fail with "no such file or directory". When either is used, the JSON result echoes the attached filenames and byte sizes \u2014 check it to confirm the files were embedded. NOT the tool for answering a message: replyToMessageId only files this in the right thread \u2014 the subject, recipients and body are entirely yours, and the original is not quoted unless you set quote. Use gog_gmail_reply / gog_gmail_reply_all instead, which inherit all three.',
     annotations: { destructiveHint: true },
     inputSchema: external_exports.object({
       to: external_exports.string().describe("Recipient(s), comma-separated"),
@@ -35641,11 +36149,12 @@ function registerGmailTools(server) {
       replyToMessageId: external_exports.string().optional().describe('Message ID to thread this message against \u2014 sets In-Reply-To/References only. It does NOT quote the original (pass quote for that), inherit its recipients, or prefix the subject with "Re:". For an actual reply use gog_gmail_reply.'),
       threadId: external_exports.string().optional().describe("Thread ID to thread this message within. Same caveat as replyToMessageId: threading only, no quote and no inherited subject or recipients."),
       quote: external_exports.boolean().optional().describe("Include the original message quoted below the body. Requires replyToMessageId or threadId. gog quotes by DEFAULT on gmail reply but never on gmail send, so without this a threaded send arrives with the original nowhere in it."),
-      attach: external_exports.array(external_exports.string()).optional().describe(`File paths to attach (repeatable), resolved ON THE GOG SERVER's filesystem \u2014 NOT this client's. Only usable when gog runs on the same machine you do (local stdio); on a hosted deployment (e.g. mcp-host) these paths do not exist and the call fails with "no such file or directory" \u2014 use attachInline there. Each file is read on the server, base64-encoded with a MIME type inferred from its extension, and added as a multipart attachment.`),
+      attach: external_exports.array(external_exports.string()).optional().describe(`File paths to attach (repeatable), resolved ON THE GOG SERVER's filesystem \u2014 NOT this client's. Only usable when gog runs on the same machine you do (local stdio); on a hosted deployment (e.g. mcp-host) these paths do not exist and the call fails with "no such file or directory" \u2014 use attachInline there. Each file is read on the server, base64-encoded with a MIME type inferred from its extension, and added as a multipart attachment. Must be inside the server's GOG_FILE_ROOTS directories (default ~/gogcli-mcp-files).`),
       attachInline: attachInlineParam,
       account: accountParam
     })
   }, async ({ to, subject, body, cc, bcc, replyToMessageId, threadId, quote, attach, attachInline, account }, ctx) => {
+    confinePaths(attach, "attach");
     const args = ["gmail", "send", `--to=${to}`, `--subject=${subject}`, payloadArg("body", "body-file", body)];
     if (cc) args.push(`--cc=${cc}`);
     if (bcc) args.push(`--bcc=${bcc}`);
@@ -35664,9 +36173,11 @@ function registerGmailTools(server) {
       recipientCount: recipients.length,
       subject,
       bodyLength: body.length,
+      bodyPreview: bodyPreview(body),
       threaded: Boolean(replyToMessageId || threadId),
       quoting: Boolean(quote),
-      attachmentCount: (attach?.length ?? 0) + (attachInline?.length ?? 0)
+      attachmentCount: (attach?.length ?? 0) + (attachInline?.length ?? 0),
+      attachments: attachmentNames(attach, attachInline)
     });
     if (confirmation) return confirmation;
     const result = await runOrDiagnose(args, { account });
@@ -35674,22 +36185,32 @@ function registerGmailTools(server) {
     return result;
   });
   server.registerTool("gog_gmail_reply", {
-    description: 'SENDS MAIL \u2014 asks the MCP host to show a confirmation prompt with the resolved recipient, subject, and body size. Mail is sent only after the user accepts that prompt. To STAGE a reply instead of sending it, use gog_gmail_drafts_reply (gogcli-mcp-gmail only), which never needs confirmation. Reply to a Gmail message (goes to the original sender only). USE THIS, not gog_gmail_send, whenever you are answering a message: it threads off the original AND inherits its "Re:" subject and quotes its body below yours, which gog_gmail_send does not \u2014 a send with replyToMessageId lands in the right thread but reads as a brand-new message, with the original nowhere in it. To answer every participant use gog_gmail_reply_all. The gogcli-mcp-gmail package adds two more routes with the same composition: gog_gmail_autoreply to reply across every message matching a query, and gog_gmail_drafts_reply to stage this exact reply as a draft instead of sending it.',
+    description: 'SENDS MAIL \u2014 asks the MCP host to show a confirmation prompt with the resolved recipient, subject, a preview of the body and the attachment names. Mail is sent only after the user accepts that prompt. To STAGE a reply instead of sending it, use gog_gmail_drafts_reply (gogcli-mcp-gmail only), which never needs confirmation. Reply to a Gmail message (goes to the original sender only). USE THIS, not gog_gmail_send, whenever you are answering a message: it threads off the original AND inherits its "Re:" subject and quotes its body below yours, which gog_gmail_send does not \u2014 a send with replyToMessageId lands in the right thread but reads as a brand-new message, with the original nowhere in it. To answer every participant use gog_gmail_reply_all. The gogcli-mcp-gmail package adds two more routes with the same composition: gog_gmail_autoreply to reply across every message matching a query, and gog_gmail_drafts_reply to stage this exact reply as a draft instead of sending it.',
     annotations: { destructiveHint: true },
     inputSchema: sendReplySchema
   }, async ({ messageId, account, ...flags }, ctx) => {
     assertNotBoth("bodyHtml", "bodyHtmlFile", flags.bodyHtml, flags.bodyHtmlFile);
+    confineReplyPaths(flags);
     return sendReply("reply", "gog_gmail_reply", messageId, account, flags, ctx);
   });
   server.registerTool("gog_gmail_reply_all", {
-    description: 'SENDS MAIL \u2014 asks the MCP host to show a confirmation prompt with the resolved recipients, subject, and body size. Mail is sent only after the user accepts that prompt. To STAGE a reply-all instead of sending it, use gog_gmail_drafts_reply_all (gogcli-mcp-gmail only), which never needs confirmation. Reply to all participants of a Gmail message (the sender plus every To/Cc recipient). Same inherited "Re:" subject and quoted original as gog_gmail_reply. Use the remove flag to drop specific recipients from the reply-all.',
+    description: 'SENDS MAIL \u2014 asks the MCP host to show a confirmation prompt with the resolved recipients, subject, a preview of the body and the attachment names. Mail is sent only after the user accepts that prompt. To STAGE a reply-all instead of sending it, use gog_gmail_drafts_reply_all (gogcli-mcp-gmail only), which never needs confirmation. Reply to all participants of a Gmail message (the sender plus every To/Cc recipient). Same inherited "Re:" subject and quoted original as gog_gmail_reply. Use the remove flag to drop specific recipients from the reply-all.',
     annotations: { destructiveHint: true },
     inputSchema: sendReplySchema
   }, async ({ messageId, account, ...flags }, ctx) => {
     assertNotBoth("bodyHtml", "bodyHtmlFile", flags.bodyHtml, flags.bodyHtmlFile);
+    confineReplyPaths(flags);
     return sendReply("reply-all", "gog_gmail_reply_all", messageId, account, flags, ctx);
   });
-  registerRunTool(server, { service: "gmail", examples: '"archive", "mark-read", "labels"' });
+  registerRunTool(server, {
+    service: "gmail",
+    examples: '"archive", "mark-read", "labels"',
+    // gog's --gmail-no-send blocks send/reply/forward/drafts send and all of
+    // their aliases at runtime (verified on gog 0.41.0). Sending goes through the
+    // confirmed tools, never this escape hatch.
+    gmailNoSend: true,
+    vet: vetGmailRun
+  });
 }
 
 // src/tools/sheets-a1.ts
@@ -35758,7 +36279,7 @@ function registerSheetsTools(server) {
       account: accountParam
     })
   }, async ({ spreadsheetId, range, account }) => {
-    return runOrDiagnose(["sheets", "get", spreadsheetId, range], { account });
+    return runOrDiagnose(["sheets", "get", pos(spreadsheetId), pos(range)], { account });
   });
   server.registerTool("gog_sheets_update", {
     description: 'Write values to a Google Sheets range, overwriting existing content. Values may be strings, numbers, booleans, or null. Strings starting with "=" are interpreted as formulas (e.g. "=SUM(A1:A10)").',
@@ -35778,7 +36299,7 @@ function registerSheetsTools(server) {
       const readRange = expandAnchorRange(range, values.length, cols);
       let existing;
       try {
-        existing = await run(["sheets", "get", spreadsheetId, readRange], { account });
+        existing = await run(["sheets", "get", pos(spreadsheetId), pos(readRange)], { account });
       } catch (err) {
         return diagnose(err);
       }
@@ -35790,7 +36311,7 @@ function registerSheetsTools(server) {
         );
       }
     }
-    const args = ["sheets", "update", spreadsheetId, range, `--values-json=${JSON.stringify(values)}`];
+    const args = ["sheets", "update", pos(spreadsheetId), pos(range), `--values-json=${JSON.stringify(values)}`];
     if (dry_run) args.push("--dry-run");
     if (fail_on_formula_error) args.push("--fail-on-formula-error");
     return runOrDiagnose(args, { account });
@@ -35806,7 +36327,7 @@ function registerSheetsTools(server) {
       account: accountParam
     })
   }, async ({ spreadsheetId, range, values, account, dry_run }) => {
-    const args = ["sheets", "append", spreadsheetId, range, `--values-json=${JSON.stringify(values)}`];
+    const args = ["sheets", "append", pos(spreadsheetId), pos(range), `--values-json=${JSON.stringify(values)}`];
     if (dry_run) args.push("--dry-run");
     return runOrDiagnose(args, { account });
   });
@@ -35820,7 +36341,7 @@ function registerSheetsTools(server) {
       account: accountParam
     })
   }, async ({ spreadsheetId, range, account, dry_run }) => {
-    const args = ["sheets", "clear", spreadsheetId, range];
+    const args = ["sheets", "clear", pos(spreadsheetId), pos(range)];
     if (dry_run) args.push("--dry-run");
     return runOrDiagnose(args, { account });
   });
@@ -35832,7 +36353,7 @@ function registerSheetsTools(server) {
       account: accountParam
     })
   }, async ({ spreadsheetId, account }) => {
-    return runOrDiagnose(["sheets", "metadata", spreadsheetId], { account });
+    return runOrDiagnose(["sheets", "metadata", pos(spreadsheetId)], { account });
   });
   server.registerTool("gog_sheets_create", {
     description: "Create a new Google Spreadsheet. Returns JSON with the new spreadsheetId and URL.",
@@ -35842,7 +36363,7 @@ function registerSheetsTools(server) {
       account: accountParam
     })
   }, async ({ title, account }) => {
-    return runOrDiagnose(["sheets", "create", title], { account });
+    return runOrDiagnose(["sheets", "create", pos(title)], { account });
   });
   server.registerTool("gog_sheets_find_replace", {
     description: "Find and replace text across an entire Google Spreadsheet.",
@@ -35854,7 +36375,7 @@ function registerSheetsTools(server) {
       account: accountParam
     })
   }, async ({ spreadsheetId, find, replace, account }) => {
-    return runOrDiagnose(["sheets", "find-replace", spreadsheetId, find, replace], { account });
+    return runOrDiagnose(["sheets", "find-replace", pos(spreadsheetId), pos(find), pos(replace)], { account });
   });
   registerRunTool(server, { service: "sheets", examples: '"freeze", "add-tab", "rename-tab"' });
 }
@@ -35862,8 +36383,9 @@ function registerSheetsTools(server) {
 // src/tools/slides.ts
 function registerSlidesTools(server) {
   server.registerTool("gog_slides_export", {
-    description: "Export a Google Slides presentation to a local file (pdf or pptx).",
-    annotations: { readOnlyHint: true },
+    description: "Export a Google Slides presentation to a local file (pdf or pptx). The out path must be inside the server's GOG_FILE_ROOTS directories.",
+    // Writes a file on the gog host and can overwrite one: not read-only.
+    annotations: { readOnlyHint: false, destructiveHint: true },
     inputSchema: external_exports.object({
       presentationId: external_exports.string().describe("Presentation ID"),
       out: external_exports.string().optional().describe("Output file path"),
@@ -35872,7 +36394,8 @@ function registerSlidesTools(server) {
       account: accountParam
     })
   }, async ({ presentationId, out, format, overwrite, account }) => {
-    const args = ["slides", "export", presentationId];
+    if (out) confinePath(out, "out");
+    const args = ["slides", "export", pos(presentationId)];
     if (out) args.push(`--out=${out}`);
     if (format) args.push(`--format=${format}`);
     if (overwrite) args.push("--overwrite");
@@ -35886,7 +36409,7 @@ function registerSlidesTools(server) {
       account: accountParam
     })
   }, async ({ presentationId, account }) => {
-    return runOrDiagnose(["slides", "info", presentationId], { account });
+    return runOrDiagnose(["slides", "info", pos(presentationId)], { account });
   });
   server.registerTool("gog_slides_create", {
     description: "Create a new Google Slides presentation, optionally in a folder or copying from a template.",
@@ -35898,7 +36421,7 @@ function registerSlidesTools(server) {
       account: accountParam
     })
   }, async ({ title, parent, template, account }) => {
-    const args = ["slides", "create", title];
+    const args = ["slides", "create", pos(title)];
     if (parent) args.push(`--parent=${parent}`);
     if (template) args.push(`--template=${template}`);
     return runOrDiagnose(args, { account });
@@ -35913,7 +36436,7 @@ function registerSlidesTools(server) {
       account: accountParam
     })
   }, async ({ presentationId, title, parent, account }) => {
-    const args = ["slides", "copy", presentationId, title];
+    const args = ["slides", "copy", pos(presentationId), pos(title)];
     if (parent) args.push(`--parent=${parent}`);
     return runOrDiagnose(args, { account });
   });
@@ -35925,7 +36448,7 @@ function registerSlidesTools(server) {
       account: accountParam
     })
   }, async ({ presentationId, account }) => {
-    return runOrDiagnose(["slides", "list-slides", presentationId], { account });
+    return runOrDiagnose(["slides", "list-slides", pos(presentationId)], { account });
   });
   server.registerTool("gog_slides_read_slide", {
     description: "Read the content of a slide (text, shapes, speaker notes). Set detail=true to also include normalized element geometry, styled text runs, paragraphs, table-cell content, and image source URLs.",
@@ -35937,11 +36460,11 @@ function registerSlidesTools(server) {
       account: accountParam
     })
   }, async ({ presentationId, slideId, detail, account }) => {
-    const args = ["slides", "read-slide", presentationId, slideId];
+    const args = ["slides", "read-slide", pos(presentationId), pos(slideId)];
     if (detail) args.push("--detail");
     return runOrDiagnose(args, { account });
   });
-  registerRunTool(server, { service: "slides", examples: '"add-slide", "delete-slide", "update-notes"' });
+  registerRunTool(server, { service: "slides", examples: '"delete-slide", "update-notes"' });
 }
 
 // src/tools/tasks.ts
@@ -35963,7 +36486,7 @@ function registerTasksTools(server) {
       account: accountParam
     })
   }, async ({ tasklistId, account }) => {
-    return runOrDiagnose(["tasks", "list", tasklistId], { account });
+    return runOrDiagnose(["tasks", "list", pos(tasklistId)], { account });
   });
   server.registerTool("gog_tasks_get", {
     description: "Get a specific task by ID.",
@@ -35974,7 +36497,7 @@ function registerTasksTools(server) {
       account: accountParam
     })
   }, async ({ tasklistId, taskId, account }) => {
-    return runOrDiagnose(["tasks", "get", tasklistId, taskId], { account });
+    return runOrDiagnose(["tasks", "get", pos(tasklistId), pos(taskId)], { account });
   });
   server.registerTool("gog_tasks_add", {
     description: "Add a task to a Google Task list.",
@@ -35987,7 +36510,7 @@ function registerTasksTools(server) {
       account: accountParam
     })
   }, async ({ tasklistId, title, notes, due, account }) => {
-    const args = ["tasks", "add", tasklistId, `--title=${title}`];
+    const args = ["tasks", "add", pos(tasklistId), `--title=${title}`];
     if (notes) args.push(`--notes=${notes}`);
     if (due) args.push(`--due=${due}`);
     return runOrDiagnose(args, { account });
@@ -36001,7 +36524,7 @@ function registerTasksTools(server) {
       account: accountParam
     })
   }, async ({ tasklistId, taskId, account }) => {
-    return runOrDiagnose(["tasks", "done", tasklistId, taskId], { account });
+    return runOrDiagnose(["tasks", "done", pos(tasklistId), pos(taskId)], { account });
   });
   server.registerTool("gog_tasks_delete", {
     description: "Delete a task.",
@@ -36012,13 +36535,13 @@ function registerTasksTools(server) {
       account: accountParam
     })
   }, async ({ tasklistId, taskId, account }) => {
-    return runOrDiagnose(["tasks", "delete", tasklistId, taskId, "--force"], { account });
+    return runOrDiagnose(["tasks", "delete", pos(tasklistId), pos(taskId), "--force"], { account });
   });
   registerRunTool(server, { service: "tasks", examples: '"update", "undo", "clear"' });
 }
 
 // src/server.ts
-var VERSION = true ? "4.2.4" : "0.0.0";
+var VERSION = true ? "4.3.0" : "0.0.0";
 var BASE_TOOL_REGISTRARS = [
   registerApiTools,
   registerAppScriptTools,
@@ -36036,7 +36559,7 @@ var BASE_TOOL_REGISTRARS = [
 ];
 
 // src/bootstrap-auth.ts
-import { join as join2 } from "node:path";
+import { join as join5 } from "node:path";
 var AUTH_BOOTSTRAP_MARKER = "auth-bootstrap.sha256";
 var VARS = ["GOG_CLIENT_ID", "GOG_CLIENT_SECRET", "GOG_REFRESH_TOKEN", "GOG_ACCOUNT"];
 var log = (line) => {
@@ -36070,12 +36593,12 @@ async function bootstrapGogAuth(env = process.env, options = {}) {
   const [clientId, clientSecret, refreshToken, account] = values;
   const { spawner } = options;
   try {
-    const { createHash } = await import("node:crypto");
+    const { createHash: createHash2 } = await import("node:crypto");
     const { mkdir, readFile, writeFile, chmod } = await import("node:fs/promises");
     const home = options.home ?? (await import("node:os")).homedir();
-    const dir = join2(home, ".gogcli-mcp");
-    const marker = join2(dir, AUTH_BOOTSTRAP_MARKER);
-    const fingerprint = createHash("sha256").update(values.join("\0")).digest("hex");
+    const dir = join5(home, ".gogcli-mcp");
+    const marker = join5(dir, AUTH_BOOTSTRAP_MARKER);
+    const fingerprint = createHash2("sha256").update(values.join("\0")).digest("hex");
     const previous = await readFile(marker, "utf8").catch(() => void 0);
     if (previous === fingerprint && await accountListed(account, spawner)) return "present";
     await run(
@@ -36100,7 +36623,7 @@ async function bootstrapGogAuth(env = process.env, options = {}) {
 }
 
 // src/blob-urls.ts
-import { createHmac } from "node:crypto";
+import { createHmac as createHmac2 } from "node:crypto";
 var BLOB_URL_MAX_TTL_MS = 24 * 60 * 60 * 1e3;
 var BLOB_URL_CEILING_MARGIN_MS = 60 * 1e3;
 var BLOB_URL_DEFAULT_TTL_MS = 60 * 60 * 1e3;
@@ -36113,7 +36636,7 @@ function writePayload(objectKey, contentType, exp) {
   return `put\0${objectKey}\0${contentType}\0${exp}`;
 }
 function sign(signingKey, payload) {
-  return createHmac("sha256", signingKey).update(payload, "utf8").digest("base64url");
+  return createHmac2("sha256", signingKey).update(payload, "utf8").digest("base64url");
 }
 function objectPathSegments(rest) {
   const segments = rest.split("/");
@@ -36175,7 +36698,6 @@ function blobStoreFromEnv() {
 }
 
 // src/blob-upload.ts
-var ATTACHMENT_DOWNLOAD_ROOT = "/tmp/gog-attachments";
 var MAX_BLOB_UPLOAD_BYTES = 100 * 1024 * 1024;
 var BLOB_UPLOAD_TIMEOUT_MS = 12e4;
 var ERROR_BODY_SNIPPET = 512;
@@ -36190,10 +36712,10 @@ var UploadError = class extends Error {
 async function resolveConfined(root, requested) {
   const path = await import("node:path");
   const { realpath, stat } = await import("node:fs/promises");
-  const isInside = (base, candidate2) => candidate2 === base || candidate2.startsWith(base + path.sep);
+  const isInside3 = (base, candidate2) => candidate2 === base || candidate2.startsWith(base + path.sep);
   const lexicalRoot = path.resolve(root);
   const candidate = path.resolve(lexicalRoot, requested);
-  if (!isInside(lexicalRoot, candidate)) {
+  if (!isInside3(lexicalRoot, candidate)) {
     throw new UploadError(`the attachment path must be inside ${lexicalRoot}`);
   }
   let realFile;
@@ -36204,7 +36726,7 @@ async function resolveConfined(root, requested) {
   } catch (err) {
     throw new UploadError(`the downloaded attachment could not be found: ${err.message}`);
   }
-  if (!isInside(realRoot, realFile)) {
+  if (!isInside3(realRoot, realFile)) {
     throw new UploadError(`the attachment path must be inside ${realRoot}`);
   }
   const info = await stat(realFile);
@@ -36231,7 +36753,7 @@ async function putFile(target, file2, bytes, contentType, timeoutMs) {
   const { createReadStream } = await import("node:fs");
   const { pipeline } = await import("node:stream");
   const transport = target.protocol === "https:" ? await import("node:https") : await import("node:http");
-  return new Promise((resolve, reject) => {
+  return new Promise((resolve4, reject) => {
     let settled = false;
     const source = createReadStream(file2);
     const req = transport.request(target, {
@@ -36261,7 +36783,7 @@ async function putFile(target, file2, bytes, contentType, timeoutMs) {
         held += chunk.length;
       });
       res.on("error", fail);
-      res.on("end", () => finish2(() => resolve({
+      res.on("end", () => finish2(() => resolve4({
         status: res.statusCode,
         body: Buffer.concat(chunks).toString().slice(0, ERROR_BODY_SNIPPET)
       })));
@@ -36293,11 +36815,13 @@ async function uploadToBlobStore(request, options = {}) {
 }
 export {
   ATTACHMENT_DOWNLOAD_ROOT,
+  ATTACHMENT_TTL_MS,
   AUTH_BOOTSTRAP_MARKER,
   BASE_TOOL_REGISTRARS,
   BLOB_UPLOAD_TIMEOUT_MS,
   BLOB_URL_DEFAULT_TTL_MS,
   BLOB_URL_MAX_TTL_MS,
+  FILE_ROOTS_ENV,
   INLINE_ATTACHMENT_LIMITS_TEXT,
   MAX_BLOB_UPLOAD_BYTES,
   MAX_INLINE_ATTACHMENT_BYTES,
@@ -36311,14 +36835,21 @@ export {
   appendReplyFlags,
   assertNotBoth,
   attachInlineParam,
+  attachmentNames,
   authToolsFor,
   blobStoreFromEnv,
+  bodyPreview,
   bootstrapGogAuth,
+  confineAtFile,
+  confinePath,
+  confinePaths,
   createBlobUrlMinter,
+  defaultFileRoot,
   diagnose,
   errorText,
   extractEmails,
   fetchGmailPages,
+  fileRoots,
   finalizeGmailSearch,
   ids,
   inlineAttachmentArgs,
@@ -36331,6 +36862,8 @@ export {
   pageTokenParam,
   paginationParams,
   payloadArg,
+  pos,
+  prepareDownloadRoot,
   pushPaginationFlags,
   registerApiTools,
   registerAppScriptTools,
@@ -36346,6 +36879,7 @@ export {
   registerSheetsTools,
   registerSlidesTools,
   registerTasksTools,
+  removeDownload,
   replySchema,
   requireGmailDispatchConfirmation,
   resolvePageToken,