gogcli-mcp 4.2.5 → 4.4.0

package/src/tools/calendar.ts

@@ -3,6 +3,25 @@ import { z } from 'zod';
 import { viewParam, resolveView } from '@chrischall/mcp-utils';
 import { accountParam, runOrDiagnose, registerRunTool, pageTokenParam, pageAliasParam, resolvePageToken } from './utils.js';
 import { annotateTruncatedList } from '../pagination.js';
+import { pos } from '../argv.js';
+import type { GogArg } from '../runner.js';
+import { CONFIRM_FALLBACK_DESCRIPTION, confirmTokenParam, gatedElsewhere, requireDispatchConfirmation, resultText } from '../dispatch-confirmation.js';
+
+// gog's spellings (internal/cmd/calendar.go). The run tool cannot tell whether
+// an event has guests, so it refuses these outright; the dedicated tools ask
+// only when someone else would see the change.
+const CALENDAR_GATED: Record<string, string> = {
+  create: 'gog_calendar_create', add: 'gog_calendar_create', new: 'gog_calendar_create',
+  update: 'gog_calendar_update', edit: 'gog_calendar_update', set: 'gog_calendar_update',
+  respond: 'gog_calendar_respond', rsvp: 'gog_calendar_respond', reply: 'gog_calendar_respond',
+};
+
+/** gog_calendar_run must not make the changes gog_calendar_create/update/respond would ask about. */
+export function vetCalendarRun(subcommand: string, _args: readonly string[]): string | undefined {
+  const sub = subcommand.toLowerCase();
+  const tool = Object.hasOwn(CALENDAR_GATED, sub) ? CALENDAR_GATED[sub] : undefined;
+  return tool ? gatedElsewhere(`gog calendar ${sub}`, 'gog_calendar_run', 'can change what guests see', tool) : undefined;
+}
 
 // Reminder params, shared by create and update (gog >= 0.38.0 for
 // --no-reminders). An event's reminders are one of THREE states, and the two
@@ -18,6 +37,72 @@ import { annotateTruncatedList } from '../pagination.js';
 // the flag (leave whatever the event already has) and from --no-reminders
 // (override the calendar with silence). An empty array is how a JSON caller
 // says it, since there is no way to send a bare flag with no value.
+// ============================================================================
+// GUEST-VISIBLE CHANGES go through the dispatch rail. gog sends no invitation
+// email here (its --send-updates defaults to none and these tools never pass
+// it), but a guest still sees the event appear, move or change on their own
+// calendar, and an organizer sees a response. A change nobody else can see — a
+// guest-free event, or a reminder, which is per-user — is not gated.
+// ============================================================================
+
+/** The emails in an attendees flag value (`a@x.com;optional,b@y.com;resource`), resources excluded. */
+export function parseAttendees(value: string | undefined): string[] {
+  if (!value) return [];
+  return value.split(',')
+    .map((entry) => entry.split(';'))
+    .filter((parts) => !parts.slice(1).some((m) => m.trim().toLowerCase() === 'resource'))
+    .map((parts) => parts[0]!.trim())
+    .filter(Boolean);
+}
+
+type EventAttendee = { email?: unknown; self?: unknown; resource?: unknown };
+type EventTime = { dateTime?: unknown; date?: unknown };
+
+function timeOf(t: EventTime | undefined): string | undefined {
+  const v = t?.dateTime ?? t?.date;
+  return typeof v === 'string' ? v : undefined;
+}
+
+/** What a calendar dispatch's prompt shows about the event as it stands now. */
+export function eventSnapshot(raw: string): {
+  summary?: string;
+  start?: string;
+  end?: string;
+  organizer?: string;
+  guests: string[];
+  etag?: string;
+} {
+  let event: {
+    summary?: unknown; start?: EventTime; end?: EventTime; etag?: unknown;
+    organizer?: { email?: unknown }; attendees?: EventAttendee[];
+  } | undefined;
+  try {
+    event = (JSON.parse(raw) as { event?: typeof event } | null)?.event;
+  } catch {
+    event = undefined;
+  }
+  const str = (v: unknown) => (typeof v === 'string' ? v : undefined);
+  return {
+    summary: str(event?.summary),
+    start: timeOf(event?.start),
+    end: timeOf(event?.end),
+    organizer: str(event?.organizer?.email),
+    // Guests are the OTHER people: not this account's own attendee row, not rooms.
+    guests: (Array.isArray(event?.attendees) ? event.attendees : [])
+      .filter((a) => a.self !== true && a.resource !== true && typeof a.email === 'string')
+      .map((a) => a.email as string),
+    etag: str(event?.etag),
+  };
+}
+
+async function readEvent(calendarId: string, eventId: string, account: string | undefined) {
+  const got = await runOrDiagnose(['calendar', 'event', pos(calendarId), pos(eventId)], { account });
+  if (got.isError) return { error: got };
+  return { event: eventSnapshot(resultText(got)) };
+}
+
+const CALENDAR_CONFIRM_LABEL = 'Confirm that this change, which other people will see, should be made now.';
+
 const reminderParams = {
   reminders: z.array(z.string()).max(5).optional().describe(
     'Reminders as method:duration, e.g. ["popup:30m", "email:1d"]. Method is popup or email; duration accepts m/h/d '
@@ -33,7 +118,7 @@ const reminderParams = {
 // The one place the three states become argv. Kept together so create and
 // update cannot drift apart on the empty-array case.
 function pushReminderFlags(
-  args: string[],
+  args: GogArg[],
   p: { reminders?: string[]; noReminders?: boolean },
 ): void {
   if (p.noReminders) {
@@ -107,8 +192,8 @@ export function registerCalendarTools(server: McpServer): void {
       account: accountParam,
     }),
   }, async ({ calendarId, from, to, days, today, query, max, pageToken, page, all, eventTypes, timezone, view, account }) => {
-    const args = ['calendar', 'events'];
-    if (calendarId) args.push(calendarId);
+    const args: GogArg[] = ['calendar', 'events'];
+    if (calendarId) args.push(pos(calendarId));
     if (from) args.push(`--from=${from}`);
     if (to) args.push(`--to=${to}`);
     if (days !== undefined) args.push(`--days=${days}`);
@@ -141,13 +226,16 @@ export function registerCalendarTools(server: McpServer): void {
       account: accountParam,
     }),
   }, async ({ calendarId, eventId, timezone, account }) => {
-    const args = ['calendar', 'event', calendarId, eventId];
+    const args: GogArg[] = ['calendar', 'event', pos(calendarId), pos(eventId)];
     if (timezone) args.push(`--timezone=${timezone}`);
     return runOrDiagnose(args, { account });
   });
 
   server.registerTool('gog_calendar_create', {
-    description: 'Create a calendar event. Set withZoom=true to attach a Zoom meeting (requires Zoom S2S OAuth setup via gog_zoom_auth_setup; the join URL + meeting ID + passcode are appended to the event description — Google rejects native conference card writes from non-Workspace-Marketplace OAuth clients).',
+    description: 'Create a calendar event. Set withZoom=true to attach a Zoom meeting (requires Zoom S2S OAuth setup via gog_zoom_auth_setup; the join URL + meeting ID + passcode are appended to the event description — Google rejects native conference card writes from non-Workspace-Marketplace OAuth clients). '
+      + 'With attendees, the event lands on other people\'s calendars (no invitation email is sent), so the MCP host is '
+      + 'asked to show the user a confirmation prompt with the guests, time and details first; a guest-free event is '
+      + 'created without asking.' + CONFIRM_FALLBACK_DESCRIPTION,
     annotations: { destructiveHint: false },
     inputSchema: z.object({
       calendarId: z.string().describe('Calendar ID (use "primary" for the default calendar)'),
@@ -162,9 +250,10 @@ export function registerCalendarTools(server: McpServer): void {
       withZoom: z.boolean().optional().describe('Create a Zoom video conference for this event (requires Zoom S2S OAuth setup)'),
       ...reminderParams,
       account: accountParam,
+      confirmToken: confirmTokenParam,
     }),
-  }, async ({ calendarId, summary, from, to, description, location, attendees, allDay, timezone, withZoom, reminders, noReminders, account }) => {
-    const args = ['calendar', 'create', calendarId, `--summary=${summary}`, `--from=${from}`, `--to=${to}`];
+  }, async ({ calendarId, summary, from, to, description, location, attendees, allDay, timezone, withZoom, reminders, noReminders, account, confirmToken }, ctx) => {
+    const args: GogArg[] = ['calendar', 'create', pos(calendarId), `--summary=${summary}`, `--from=${from}`, `--to=${to}`];
     if (description) args.push(`--description=${description}`);
     if (location) args.push(`--location=${location}`);
     if (attendees) args.push(`--attendees=${attendees}`);
@@ -172,11 +261,33 @@ export function registerCalendarTools(server: McpServer): void {
     if (timezone) args.push(`--timezone=${timezone}`);
     if (withZoom) args.push('--with-zoom');
     pushReminderFlags(args, { reminders, noReminders });
+    const guests = parseAttendees(attendees);
+    if (guests.length > 0) {
+      const event = { calendarId, summary, from, to, allDay: Boolean(allDay), timezone, location, description, guests, attendees, withZoom: Boolean(withZoom) };
+      const confirmation = await requireDispatchConfirmation(ctx, {
+        action: 'calendar.create',
+        message: 'Review and confirm this event, which will appear on the guests\' calendars:',
+        confirmationLabel: CALENDAR_CONFIRM_LABEL,
+        details: event,
+        unsupportedNote: 'Create it without attendees instead; the user can add the guests in Google Calendar.',
+        fallback: {
+          tool: 'gog_calendar_create',
+          account,
+          confirmToken,
+          subject: () => ({ target: calendarId, payload: event, preview: event }),
+        },
+      });
+      if (confirmation) return confirmation;
+    }
     return runOrDiagnose(args, { account });
   });
 
   server.registerTool('gog_calendar_update', {
-    description: 'Update an existing calendar event. Zoom: withZoom adds a Zoom meeting, regenerateZoom replaces the existing one, removeZoom strips it. removeMeet clears the event\'s Google Meet conference data (e.g. before attaching another provider). Conference flags are independent — use one per call.',
+    description: 'Update an existing calendar event. Zoom: withZoom adds a Zoom meeting, regenerateZoom replaces the existing one, removeZoom strips it. removeMeet clears the event\'s Google Meet conference data (e.g. before attaching another provider). Conference flags are independent — use one per call. '
+      + 'A change guests can see (time, title, place, description, attendees, attachments, conferencing) on an event '
+      + 'that has guests — or gains them — reads the event and asks the MCP host to show the user a confirmation prompt '
+      + 'with the event as it stands and the change; no invitation email is sent. Reminder-only changes and guest-free '
+      + 'events are updated without asking.' + CONFIRM_FALLBACK_DESCRIPTION,
     annotations: { destructiveHint: false },
     inputSchema: z.object({
       calendarId: z.string().describe('Calendar ID'),
@@ -195,9 +306,10 @@ export function registerCalendarTools(server: McpServer): void {
       removeMeet: z.boolean().optional().describe('Remove the event\'s Google Meet video conference (clears conference data only)'),
       ...reminderParams,
       account: accountParam,
+      confirmToken: confirmTokenParam,
     }),
-  }, async ({ calendarId, eventId, summary, from, to, description, location, attendees, addAttendees, attachments, withZoom, regenerateZoom, removeZoom, removeMeet, reminders, noReminders, account }) => {
-    const args = ['calendar', 'update', calendarId, eventId];
+  }, async ({ calendarId, eventId, summary, from, to, description, location, attendees, addAttendees, attachments, withZoom, regenerateZoom, removeZoom, removeMeet, reminders, noReminders, account, confirmToken }, ctx) => {
+    const args: GogArg[] = ['calendar', 'update', pos(calendarId), pos(eventId)];
     if (summary !== undefined) args.push(`--summary=${summary}`);
     if (from !== undefined) args.push(`--from=${from}`);
     if (to !== undefined) args.push(`--to=${to}`);
@@ -211,6 +323,36 @@ export function registerCalendarTools(server: McpServer): void {
     if (removeZoom) args.push('--remove-zoom');
     if (removeMeet) args.push('--remove-meet');
     pushReminderFlags(args, { reminders, noReminders });
+    // Every field guests can see; reminders are per-user and are not on it.
+    const changes = Object.fromEntries(Object.entries({
+      summary, from, to, description, location, attendees, addAttendees, attachments,
+      withZoom, regenerateZoom, removeZoom, removeMeet,
+    }).filter(([, v]) => v !== undefined && v !== false));
+    if (Object.keys(changes).length > 0) {
+      const read = await readEvent(calendarId, eventId, account);
+      if (read.error) return read.error;
+      const { etag, ...current } = read.event;
+      const added = [...parseAttendees(attendees), ...parseAttendees(addAttendees)];
+      if (current.guests.length > 0 || added.length > 0) {
+        const view = { calendarId, eventId, current, changes };
+        const confirmation = await requireDispatchConfirmation(ctx, {
+          action: 'calendar.update',
+          message: 'Review and confirm this change to an event other people are on:',
+          confirmationLabel: CALENDAR_CONFIRM_LABEL,
+          details: view,
+          unsupportedNote: 'Ask the user to make this change in Google Calendar.',
+          fallback: {
+            tool: 'gog_calendar_update',
+            account,
+            confirmToken,
+            // The etag rotates on any edit, so an event changed elsewhere between
+            // the two phases is DRAFT_CHANGED rather than edited over.
+            subject: () => ({ target: `${calendarId}/${eventId}`, revision: etag, payload: view, preview: view }),
+          },
+        });
+        if (confirmation) return confirmation;
+      }
+    }
     return runOrDiagnose(args, { account });
   });
 
@@ -225,11 +367,13 @@ export function registerCalendarTools(server: McpServer): void {
   }, async ({ calendarId, eventId, account }) => {
     // gog gates this delete behind a confirmation; the runner injects
     // --no-input, so without --force it refuses at runtime.
-    return runOrDiagnose(['calendar', 'delete', calendarId, eventId, '--force'], { account });
+    return runOrDiagnose(['calendar', 'delete', pos(calendarId), pos(eventId), '--force'], { account });
   });
 
   server.registerTool('gog_calendar_respond', {
-    description: 'Respond to a calendar event invitation.',
+    description: 'Respond to a calendar event invitation. The organizer sees the response, so this reads the event and '
+      + 'asks the MCP host to show the user a confirmation prompt with the event, organizer, response and comment; '
+      + 'nothing is recorded unless they accept.' + CONFIRM_FALLBACK_DESCRIPTION,
     annotations: { destructiveHint: true },
     inputSchema: z.object({
       calendarId: z.string().describe('Calendar ID'),
@@ -237,12 +381,31 @@ export function registerCalendarTools(server: McpServer): void {
       status: z.enum(['accepted', 'declined', 'tentative']).describe('Response status'),
       comment: z.string().optional().describe('Optional comment to include with response'),
       account: accountParam,
+      confirmToken: confirmTokenParam,
     }),
-  }, async ({ calendarId, eventId, status, comment, account }) => {
-    const args = ['calendar', 'respond', calendarId, eventId, `--status=${status}`];
+  }, async ({ calendarId, eventId, status, comment, account, confirmToken }, ctx) => {
+    const args: GogArg[] = ['calendar', 'respond', pos(calendarId), pos(eventId), `--status=${status}`];
     if (comment) args.push(`--comment=${comment}`);
+    const read = await readEvent(calendarId, eventId, account);
+    if (read.error) return read.error;
+    const { etag, ...event } = read.event;
+    const view = { calendarId, eventId, event, response: status, ...(comment ? { comment } : {}) };
+    const confirmation = await requireDispatchConfirmation(ctx, {
+      action: 'calendar.respond',
+      message: 'Review and confirm this response, which the organizer will see:',
+      confirmationLabel: 'Confirm that this response should be recorded now.',
+      details: view,
+      unsupportedNote: 'Ask the user to respond from Google Calendar.',
+      fallback: {
+        tool: 'gog_calendar_respond',
+        account,
+        confirmToken,
+        subject: () => ({ target: `${calendarId}/${eventId}`, revision: etag, payload: view, preview: view }),
+      },
+    });
+    if (confirmation) return confirmation;
     return runOrDiagnose(args, { account });
   });
 
-  registerRunTool(server, { service: 'calendar', examples: '"calendars", "freebusy"' });
+  registerRunTool(server, { service: 'calendar', examples: '"calendars", "freebusy"', vet: vetCalendarRun });
 }

package/src/tools/chat.ts

@@ -9,6 +9,40 @@ import {
 } from './utils.js';
 import type { GogArg } from '../runner.js';
 import { attachInlineParam, inlineAttachmentArgs } from '../attachments.js';
+import { pos } from '../argv.js';
+import { confinePaths } from '../file-roots.js';
+import {
+  attachmentDetails,
+  attachmentNames,
+  attachmentPreview,
+  bodyPreview,
+  CONFIRM_FALLBACK_DESCRIPTION,
+  confirmTokenParam,
+  gatedElsewhere,
+  hasCommandWord,
+  requireDispatchConfirmation,
+  senderPreview,
+} from '../dispatch-confirmation.js';
+
+// gog's spellings of `send` under `messages` and `dm` (internal/cmd/chat_messages.go, chat_dm.go).
+const CHAT_SEND_WORDS = new Set(['send', 'create', 'post']);
+
+/** gog_chat_run must not post what gog_chat_messages_send / gog_chat_dm_send would ask about. */
+export function vetChatRun(subcommand: string, args: readonly string[]): string | undefined {
+  const sub = subcommand.toLowerCase();
+  if (sub !== 'messages' && sub !== 'dm') return undefined;
+  const word = hasCommandWord(args, CHAT_SEND_WORDS);
+  if (!word) return undefined;
+  return gatedElsewhere(`gog chat ${sub} ${word.toLowerCase()}`, 'gog_chat_run', 'posts a message',
+    sub === 'dm' ? 'gog_chat_dm_send' : 'gog_chat_messages_send');
+}
+
+// A Chat post lands in other people's view the moment it is sent and cannot be
+// unsent here, so both send tools go through the dispatch rail like Gmail does.
+const CHAT_CONFIRM = {
+  message: 'Review and confirm this Google Chat message:',
+  confirmationLabel: 'Confirm that this Chat message should be posted now.',
+} as const;
 
 // Google Chat (gog >= 0.38.0 for the mention/reaction metadata in
 // `messages list`, >= 0.39.0 for `messages search`; the rest is older).
@@ -54,7 +88,7 @@ export function registerChatTools(server: McpServer): void {
       account: accountParam,
     }),
   }, async ({ max, pageToken, page, all, account }) => {
-    const args = ['chat', 'spaces', 'list'];
+    const args: GogArg[] = ['chat', 'spaces', 'list'];
     pushPaginationFlags(args, { max, pageToken, page, all });
     return runOrDiagnose(args, { account });
   });
@@ -72,7 +106,7 @@ export function registerChatTools(server: McpServer): void {
       account: accountParam,
     }),
   }, async ({ displayName, exact, max, account }) => {
-    const args = ['chat', 'spaces', 'find', displayName];
+    const args: GogArg[] = ['chat', 'spaces', 'find', pos(displayName)];
     if (exact) args.push('--exact');
     if (max !== undefined) args.push(`--max=${max}`);
     return runOrDiagnose(args, { account });
@@ -89,7 +123,7 @@ export function registerChatTools(server: McpServer): void {
       account: accountParam,
     }),
   }, async ({ displayName, members, account }) => {
-    const args = ['chat', 'spaces', 'create', displayName];
+    const args: GogArg[] = ['chat', 'spaces', 'create', pos(displayName)];
     if (members) for (const member of members) args.push(`--member=${member}`);
     return runOrDiagnose(args, { account });
   });
@@ -105,7 +139,7 @@ export function registerChatTools(server: McpServer): void {
       account: accountParam,
     }),
   }, async ({ space, max, pageToken, page, all, account }) => {
-    const args = ['chat', 'threads', 'list', space];
+    const args: GogArg[] = ['chat', 'threads', 'list', pos(space)];
     pushPaginationFlags(args, { max, pageToken, page, all });
     return runOrDiagnose(args, { account });
   });
@@ -128,7 +162,7 @@ export function registerChatTools(server: McpServer): void {
       account: accountParam,
     }),
   }, async ({ space, thread, unread, order, max, pageToken, page, all, account }) => {
-    const args = ['chat', 'messages', 'list', space];
+    const args: GogArg[] = ['chat', 'messages', 'list', pos(space)];
     if (thread) args.push(`--thread=${thread}`);
     if (unread) args.push('--unread');
     if (order) args.push(`--order=${order}`);
@@ -163,7 +197,7 @@ export function registerChatTools(server: McpServer): void {
       account: accountParam,
     }),
   }, async ({ query, order, view, markup, max, pageToken, page, all, account }) => {
-    const args = ['chat', 'messages', 'search', query];
+    const args: GogArg[] = ['chat', 'messages', 'search', pos(query)];
     if (order) args.push(`--order=${order}`);
     if (view) args.push(`--view=${view}`);
     if (markup) args.push(`--markup=${markup}`);
@@ -176,7 +210,9 @@ export function registerChatTools(server: McpServer): void {
       'Post a message to a Chat space. THIS IS IMMEDIATELY VISIBLE TO EVERYONE IN THE SPACE and cannot be unsent through '
       + 'this tool, so treat it like sending mail, not like saving a draft. Pass `thread` to reply inside an existing '
       + 'conversation (from gog_chat_threads_list or a message\'s thread field); omit it to start a new one. Text supports '
-      + 'Chat\'s markdown-ish formatting (*bold*, _italic_, `code`).' + workspaceOnlyNote,
+      + 'Chat\'s markdown-ish formatting (*bold*, _italic_, `code`). Asks the MCP host to show the user a confirmation '
+      + 'prompt with the space, thread, text and attachments first; nothing is posted unless they accept.'
+      + CONFIRM_FALLBACK_DESCRIPTION + workspaceOnlyNote,
     annotations: { destructiveHint: true },
     inputSchema: z.object({
       space: spaceParam,
@@ -184,16 +220,18 @@ export function registerChatTools(server: McpServer): void {
       thread: threadParam,
       attach: z.array(z.string()).optional().describe(
         'Attachment file paths, read WHERE GOG RUNS. On a hosted or remote deployment that is not your machine — use '
-        + 'attachInline there instead.',
+        + 'attachInline there instead. Must be inside the server\'s GOG_FILE_ROOTS directories (default ~/gogcli-mcp-files).',
       ),
       attachInline: attachInlineParam,
       account: accountParam,
+      confirmToken: confirmTokenParam,
     }),
-  }, async ({ space, text, thread, attach, attachInline, account }) => {
+  }, async ({ space, text, thread, attach, attachInline, account, confirmToken }, ctx) => {
+    confinePaths(attach, 'attach');
     if (text === undefined && !attach?.length && !attachInline?.length) {
       throw new Error('A Chat message needs text, an attachment, or both.');
     }
-    const args: GogArg[] = ['chat', 'messages', 'send', space];
+    const args: GogArg[] = ['chat', 'messages', 'send', pos(space)];
     if (text !== undefined) args.push(`--text=${text}`);
     if (thread) args.push(`--thread=${thread}`);
     if (attach) for (const path of attach) args.push(`--attach=${path}`);
@@ -201,24 +239,61 @@ export function registerChatTools(server: McpServer): void {
     // a temp file beside gog. `args` is passed so the size check sees the whole
     // request, not just the attachments.
     args.push(...inlineAttachmentArgs('attach', attachInline, args));
+    const confirmation = await requireDispatchConfirmation(ctx, {
+      ...CHAT_CONFIRM,
+      action: 'chat.message-send',
+      details: { space, thread, textPreview: bodyPreview(text), attachments: attachmentNames(attach, attachInline) },
+      fallback: {
+        tool: 'gog_chat_messages_send',
+        account,
+        confirmToken,
+        subject: () => {
+          const attachments = attachmentDetails(attach, attachInline);
+          const from = senderPreview(account);
+          return {
+            target: space,
+            payload: { from, space, thread, text, attachments },
+            preview: { from, space, thread, text, attachments: attachmentPreview(attachments) },
+          };
+        },
+      },
+    });
+    if (confirmation) return confirmation;
     return runOrDiagnose(args, { account });
   });
 
   server.registerTool('gog_chat_dm_send', {
     description:
       'Send a direct message to one person by email address, creating the DM space if this is the first message. Delivered '
-      + 'immediately and cannot be unsent through this tool. For a room rather than a person, use gog_chat_messages_send.'
-      + workspaceOnlyNote,
+      + 'immediately and cannot be unsent through this tool. For a room rather than a person, use gog_chat_messages_send. '
+      + 'Asks the MCP host to show the user a confirmation prompt with the recipient and text first; nothing is sent '
+      + 'unless they accept.' + CONFIRM_FALLBACK_DESCRIPTION + workspaceOnlyNote,
     annotations: { destructiveHint: true },
     inputSchema: z.object({
       email: z.string().describe('Recipient email address'),
       text: z.string().describe('Message text'),
       thread: threadParam,
       account: accountParam,
+      confirmToken: confirmTokenParam,
     }),
-  }, async ({ email, text, thread, account }) => {
-    const args = ['chat', 'dm', 'send', email, `--text=${text}`];
+  }, async ({ email, text, thread, account, confirmToken }, ctx) => {
+    const args: GogArg[] = ['chat', 'dm', 'send', pos(email), `--text=${text}`];
     if (thread) args.push(`--thread=${thread}`);
+    const confirmation = await requireDispatchConfirmation(ctx, {
+      ...CHAT_CONFIRM,
+      action: 'chat.dm-send',
+      details: { to: email, thread, textPreview: bodyPreview(text) },
+      fallback: {
+        tool: 'gog_chat_dm_send',
+        account,
+        confirmToken,
+        subject: () => {
+          const from = senderPreview(account);
+          return { target: email, payload: { from, to: email, thread, text }, preview: { from, to: email, thread, text } };
+        },
+      },
+    });
+    if (confirmation) return confirmation;
     return runOrDiagnose(args, { account });
   });
 
@@ -232,7 +307,7 @@ export function registerChatTools(server: McpServer): void {
       account: accountParam,
     }),
   }, async ({ email, account }) => {
-    return runOrDiagnose(['chat', 'dm', 'space', email], { account });
+    return runOrDiagnose(['chat', 'dm', 'space', pos(email)], { account });
   });
 
   server.registerTool('gog_chat_reactions_list', {
@@ -248,7 +323,7 @@ export function registerChatTools(server: McpServer): void {
       account: accountParam,
     }),
   }, async ({ message, space, max, pageToken, page, all, account }) => {
-    const args = ['chat', 'messages', 'reactions', 'list', message];
+    const args: GogArg[] = ['chat', 'messages', 'reactions', 'list', pos(message)];
     if (space) args.push(`--space=${space}`);
     pushPaginationFlags(args, { max, pageToken, page, all });
     return runOrDiagnose(args, { account });
@@ -266,7 +341,7 @@ export function registerChatTools(server: McpServer): void {
       account: accountParam,
     }),
   }, async ({ message, emoji, space, account }) => {
-    const args = ['chat', 'messages', 'reactions', 'create', message, emoji];
+    const args: GogArg[] = ['chat', 'messages', 'reactions', 'create', pos(message), pos(emoji)];
     if (space) args.push(`--space=${space}`);
     return runOrDiagnose(args, { account });
   });
@@ -282,12 +357,13 @@ export function registerChatTools(server: McpServer): void {
       account: accountParam,
     }),
   }, async ({ reaction, account }) => {
-    return runOrDiagnose(['chat', 'messages', 'reactions', 'delete', reaction], { account });
+    return runOrDiagnose(['chat', 'messages', 'reactions', 'delete', pos(reaction)], { account });
   });
 
   registerRunTool(server, {
     service: 'chat',
     examples: '"spaces", "messages", "dm"',
+    vet: vetChatRun,
     note: 'Google Chat has no API for consumer accounts: every chat subcommand fails on an @gmail.com account regardless of scopes.',
   });
 }