gogcli-mcp 4.3.0 → 4.4.0

package/dist/index.js

@@ -34206,14 +34206,14 @@ function serveStdio(factory, options = {}) {
     return false;
   };
   const answerLegacyRejection = (request, reason, requestedVersion) => {
-    const rejection2 = modernOnlyStrictRejection({
+    const rejection3 = modernOnlyStrictRejection({
       kind: "legacy",
       reason,
       ...requestedVersion !== void 0 && { requestedVersion }
     }, SUPPORTED_MODERN_PROTOCOL_VERSIONS);
-    if (rejection2 === void 0) return Promise.resolve();
-    reportError(/* @__PURE__ */ new Error(`Rejected 2025-era request on a modern-only stdio connection (${rejection2.cell}): ${rejection2.message}`));
-    return writeErrorResponse(request.id, rejection2.code, rejection2.message, rejection2.data);
+    if (rejection3 === void 0) return Promise.resolve();
+    reportError(/* @__PURE__ */ new Error(`Rejected 2025-era request on a modern-only stdio connection (${rejection3.cell}): ${rejection3.message}`));
+    return writeErrorResponse(request.id, rejection3.code, rejection3.message, rejection3.data);
   };
   const onInstanceClosed = (channel) => {
     if (closing || channel === discarding) return;
@@ -34995,9 +34995,9 @@ function offsetAt(instant, tz) {
   const w = wallPartsIn(instant, tz);
   const asUTC = Date.UTC(w.year, w.month - 1, w.day, w.hour, w.minute, w.second, instant.getUTCMilliseconds());
   const minutes = Math.round((asUTC - instant.getTime()) / 6e4);
-  const sign = minutes < 0 ? "-" : "+";
+  const sign2 = minutes < 0 ? "-" : "+";
   const abs = Math.abs(minutes);
-  return `${sign}${pad(Math.floor(abs / 60))}:${pad(abs % 60)}`;
+  return `${sign2}${pad(Math.floor(abs / 60))}:${pad(abs % 60)}`;
 }
 function wallPartsIn(instant, tz) {
   const parts = new Intl.DateTimeFormat("en-US", {
@@ -35843,13 +35843,239 @@ function assertNotBoth(inlineParam, fileParam, inlineValue, fileValue) {
   }
 }
 
+// src/dispatch-confirmation.ts
+import { createHash as createHash3 } from "node:crypto";
+import { readFileSync } from "node:fs";
+
+// src/send-confirm-token.ts
+import { createHash as createHash2, createHmac as createHmac2, randomBytes, timingSafeEqual as timingSafeEqual2 } from "node:crypto";
+var CONFIRM_TOKEN_TTL_DEFAULT_SECONDS = 600;
+var PREFIX = "gct1";
+var secret;
+var spent = /* @__PURE__ */ new Map();
+function sendConfirmFallbackEnabled() {
+  return readEnvVar("GOG_SEND_CONFIRM_FALLBACK")?.trim().toLowerCase() === "token";
+}
+function confirmTokenTtlSeconds() {
+  const raw = readEnvVar("GOG_CONFIRM_TTL_SECONDS")?.trim();
+  if (raw && /^\d+$/.test(raw)) {
+    const n = Number(raw);
+    if (n > 0) return n;
+  }
+  return CONFIRM_TOKEN_TTL_DEFAULT_SECONDS;
+}
+function hmacKey() {
+  if (!secret) {
+    const configured = readEnvVar("GOG_CONFIRM_SECRET");
+    secret = configured ? Buffer.from(configured, "utf8") : randomBytes(32);
+  }
+  return secret;
+}
+function canonicalize(value) {
+  if (Array.isArray(value)) return value.map(canonicalize);
+  if (value && typeof value === "object") {
+    const out = {};
+    for (const key of Object.keys(value).sort()) {
+      const v = value[key];
+      if (v !== void 0) out[key] = canonicalize(v);
+    }
+    return out;
+  }
+  return value;
+}
+function hashSendPayload(payload) {
+  return createHash2("sha256").update(JSON.stringify(canonicalize(payload))).digest("hex");
+}
+function sign(body) {
+  return createHmac2("sha256", hmacKey()).update(`${PREFIX}.${body}`).digest("base64url");
+}
+function issueConfirmToken(binding, now = Date.now()) {
+  const exp = now + confirmTokenTtlSeconds() * 1e3;
+  const claims = {
+    t: binding.tool,
+    a: binding.account,
+    g: binding.target,
+    ...binding.revision === void 0 ? {} : { r: binding.revision },
+    h: binding.payloadHash,
+    iat: now,
+    exp,
+    n: randomBytes(16).toString("base64url")
+  };
+  const body = Buffer.from(JSON.stringify(claims), "utf8").toString("base64url");
+  return { token: `${PREFIX}.${body}.${sign(body)}`, expiresAt: new Date(exp).toISOString() };
+}
+function signatureMatches(body, sig) {
+  const expected = Buffer.from(sign(body), "utf8");
+  const actual = Buffer.from(sig, "utf8");
+  return expected.length === actual.length && timingSafeEqual2(expected, actual);
+}
+function parseClaims(body) {
+  try {
+    return JSON.parse(Buffer.from(body, "base64url").toString("utf8"));
+  } catch {
+    return void 0;
+  }
+}
+function verifyConfirmToken(token, binding, now = Date.now()) {
+  for (const [nonce, exp] of spent) if (exp < now) spent.delete(nonce);
+  const parts = token.split(".");
+  if (parts.length !== 3 || parts[0] !== PREFIX || !parts[1] || !parts[2]) return { ok: false, error: "TOKEN_INVALID" };
+  const [, body, sig] = parts;
+  if (!signatureMatches(body, sig)) return { ok: false, error: "TOKEN_INVALID" };
+  const claims = parseClaims(body);
+  if (!claims) return { ok: false, error: "TOKEN_INVALID" };
+  if (claims.t !== binding.tool || claims.a !== binding.account || claims.g !== binding.target) {
+    return { ok: false, error: "TOKEN_INVALID" };
+  }
+  if (spent.has(claims.n)) return { ok: false, error: "TOKEN_REUSED" };
+  if (now > claims.exp) return { ok: false, error: "TOKEN_EXPIRED" };
+  if (claims.r !== binding.revision) return { ok: false, error: "DRAFT_CHANGED", reason: "message-id-rotated" };
+  if (claims.h !== binding.payloadHash) return { ok: false, error: "DRAFT_CHANGED", reason: "payload-changed" };
+  spent.set(claims.n, claims.exp);
+  return { ok: true };
+}
+
+// src/dispatch-confirmation.ts
+var BODY_PREVIEW_MAX = 2048;
+function bodyPreview(text) {
+  if (!text) return void 0;
+  if (text.length <= BODY_PREVIEW_MAX) return text;
+  return `${text.slice(0, BODY_PREVIEW_MAX)}\u2026 [${text.length - BODY_PREVIEW_MAX} more characters not shown]`;
+}
+function attachmentNames(paths, inline) {
+  return [...paths ?? [], ...(inline ?? []).map((a) => a.filename)];
+}
+function attachmentDetails(paths, inline) {
+  const out = [];
+  for (const path of paths ?? []) {
+    let bytes;
+    try {
+      bytes = readFileSync(path);
+    } catch {
+      bytes = void 0;
+    }
+    out.push(bytes ? { name: path, size: bytes.length, sha256: createHash3("sha256").update(bytes).digest("hex") } : { name: path, size: null });
+  }
+  for (const a of inline ?? []) {
+    out.push({
+      name: a.filename,
+      size: Buffer.from(a.contentBase64, "base64").length,
+      sha256: createHash3("sha256").update(a.contentBase64).digest("hex")
+    });
+  }
+  return out;
+}
+function senderPreview(account, from) {
+  return from ?? account ?? readEnvVar("GOG_ACCOUNT") ?? "the gog account's default address";
+}
+function attachmentPreview(details) {
+  return details.map(({ name, size }) => ({ name, size }));
+}
+var CONFIRM_SEND_INSTRUCTION = "Show this preview to the user verbatim and send only after they explicitly approve in chat. Then call again with confirmToken.";
+var CONFIRM_ACTION_INSTRUCTION = "Show this preview to the user verbatim and proceed only after they explicitly approve in chat. Then call again with confirmToken.";
+var FALLBACK_HINT = "Or set GOG_SEND_CONFIRM_FALLBACK=token to enable two-step confirmation.";
+var CONFIRM_FALLBACK_DESCRIPTION = ' If the client cannot show that prompt (no MCP elicitation, e.g. claude.ai) and the server sets GOG_SEND_CONFIRM_FALLBACK=token, a two-step flow applies instead: call WITHOUT confirmToken and nothing is sent or changed \u2014 the result has status "confirmation-required", the full preview and a confirmToken. Show that preview to the user verbatim; only after they explicitly approve it in chat, call again with the SAME arguments plus confirmToken. The tool re-reads what it would act on and refuses (DRAFT_CHANGED, with a fresh preview and token) if it changed; TOKEN_EXPIRED / TOKEN_REUSED / TOKEN_INVALID also do nothing.';
+var confirmTokenParam = external_exports.string().optional().describe(
+  `ONLY for the two-step fallback (client without MCP elicitation, server with GOG_SEND_CONFIRM_FALLBACK=token). The confirmToken from this same tool's phase-1 "confirmation-required" response, passed back ONLY after the user has seen that preview and explicitly approved it in chat \u2014 never on the first call, never invented, never reused. Call again with the same arguments. Ignored when the client supports elicitation.`
+);
+var TOKEN_ERROR_NOTE = {
+  TOKEN_EXPIRED: "Nothing was sent or changed: the confirmToken expired. Call again WITHOUT confirmToken for a fresh preview, and ask the user to approve it again.",
+  TOKEN_REUSED: "Nothing was sent or changed by this call: this confirmToken was already used, and one approval acts once. If doing it again is really intended, call again WITHOUT confirmToken and get a new approval.",
+  TOKEN_INVALID: "Nothing was sent or changed: this confirmToken was not issued by this server for this tool, account and target (or the server has restarted since). Call again WITHOUT confirmToken for a fresh preview and approval."
+};
+var DRAFT_CHANGED_NOTE = {
+  "message-id-rotated": "Nothing was sent or changed: the target was edited since the user approved it (a draft's messageId or an event's version rotated), so what would happen is not what they saw.",
+  "payload-changed": "Nothing was sent or changed: what would happen no longer matches what the user approved."
+};
+function isToolResult(value) {
+  return Array.isArray(value.content);
+}
+function rejection2(data) {
+  return { ...textResult({ status: "confirmation-rejected", confirmed: false, dispatched: false, ...data }), isError: true };
+}
+async function tokenConfirmation(op, fallback) {
+  const subject = await fallback.subject();
+  if (isToolResult(subject)) return subject;
+  const binding = {
+    tool: fallback.tool,
+    account: fallback.account ?? readEnvVar("GOG_ACCOUNT") ?? "",
+    target: subject.target,
+    ...subject.revision === void 0 ? {} : { revision: subject.revision },
+    payloadHash: hashSendPayload(subject.payload)
+  };
+  const phaseOne = () => {
+    const { token, expiresAt } = issueConfirmToken(binding);
+    return {
+      action: op,
+      preview: subject.preview,
+      confirmToken: token,
+      expiresAt,
+      ttlSeconds: confirmTokenTtlSeconds(),
+      instruction: fallback.instruction ?? CONFIRM_ACTION_INSTRUCTION
+    };
+  };
+  if (!fallback.confirmToken) {
+    return textResult({ status: "confirmation-required", confirmed: false, dispatched: false, ...phaseOne() });
+  }
+  const verdict = verifyConfirmToken(fallback.confirmToken, binding);
+  if (verdict.ok) return void 0;
+  if (verdict.error === "DRAFT_CHANGED") {
+    return rejection2({
+      error: "DRAFT_CHANGED",
+      reason: verdict.reason,
+      note: `${DRAFT_CHANGED_NOTE[verdict.reason]} The current preview and a fresh confirmToken are below.`,
+      ...phaseOne()
+    });
+  }
+  return rejection2({ error: verdict.error, action: op, note: TOKEN_ERROR_NOTE[verdict.error] });
+}
+function gatedElsewhere(what, via, does, tool) {
+  return `${what} ${does} and is not available through ${via}. Use ${tool}, which asks the user to confirm.`;
+}
+function hasCommandWord(args, words) {
+  return args.find((a) => words.has(a.toLowerCase()));
+}
+async function requireDispatchConfirmation(ctx, options) {
+  const { action, fallback } = options;
+  if (fallback && callerAcceptsFormElicitation(ctx) === false && sendConfirmFallbackEnabled()) {
+    return tokenConfirmation(action, fallback);
+  }
+  const note = fallback ? [options.unsupportedNote, FALLBACK_HINT].filter(Boolean).join(" ") : options.unsupportedNote;
+  return requireConfirmation(ctx, {
+    action,
+    message: options.message,
+    details: options.details,
+    confirmationLabel: options.confirmationLabel,
+    ...note ? { unsupportedNote: note } : {}
+  });
+}
+function resultText(result) {
+  const first = result.content[0];
+  return first && first.type === "text" && typeof first.text === "string" ? first.text : "{}";
+}
+
 // src/tools/api.ts
 var GMAIL_API_BLOCKED = /(?:\.send$|forwarding|filters\.create|filters\.update|delegates\.create)/i;
+var DISPATCH_API_BLOCKED = {
+  chat: [{ method: /(?:^|\.)spaces\.messages\.create$/i, does: "posts a Chat message", tool: "gog_chat_messages_send / gog_chat_dm_send" }],
+  drive: [{ method: /(?:^|\.)permissions\.(?:create|update)$/i, does: "grants access to a file", tool: "gog_drive_share" }],
+  classroom: [
+    { method: /(?:^|\.)courses\.announcements\.create$/i, does: "posts to a class", tool: "gog_classroom_announcements_create" },
+    { method: /(?:^|\.)invitations\.create$/i, does: "invites someone to a class", tool: "gog_classroom_invitations_create" }
+  ],
+  calendar: [
+    { method: /(?:^|\.)events\.(?:insert|import|quickadd)$/i, does: "can put an event on guests' calendars", tool: "gog_calendar_create" },
+    { method: /(?:^|\.)events\.(?:update|patch)$/i, does: "can change what guests see", tool: "gog_calendar_update / gog_calendar_respond" }
+  ]
+};
 function refusedApiCall(api, method) {
-  if (api.trim().toLowerCase() === "gmail" && GMAIL_API_BLOCKED.test(method.trim())) {
+  const name = api.trim().toLowerCase();
+  const m = method.trim();
+  if (name === "gmail" && GMAIL_API_BLOCKED.test(m)) {
     return `gmail ${method} is not available through gog_api_call: it sends or forwards mail. Use gog_gmail_send / gog_gmail_drafts_send (which ask the user to confirm) or the dedicated gog_gmail_* tool.`;
   }
-  return void 0;
+  const hit = (Object.hasOwn(DISPATCH_API_BLOCKED, name) ? DISPATCH_API_BLOCKED[name] : []).find((b) => b.method.test(m));
+  return hit ? gatedElsewhere(`${name} ${m}`, "gog_api_call", hit.does, hit.tool) : void 0;
 }
 function registerApiTools(server) {
   server.registerTool("gog_api_list", {
@@ -35879,7 +36105,7 @@ function registerApiTools(server) {
     return runOrDiagnose(args, { account });
   });
   server.registerTool("gog_api_call", {
-    description: "Call any Discovery-described Google API method directly \u2014 an escape hatch for endpoints gog has no dedicated tool for. Find the exact api/version/method/params with gog_api_describe first. Read methods (GET/LIST) run as-is. Mutating methods (POST/PUT/PATCH/DELETE) are refused unless you set allowWrite=true \u2014 keep it false to preview, or set dryRun=true to print the intended request without sending it. Gmail send and forwarding methods (users.messages.send, users.drafts.send, forwarding/auto-forwarding, filters, delegates) are refused \u2014 use the dedicated gog_gmail_* tools, which ask the user to confirm.",
+    description: "Call any Discovery-described Google API method directly \u2014 an escape hatch for endpoints gog has no dedicated tool for. Find the exact api/version/method/params with gog_api_describe first. Read methods (GET/LIST) run as-is. Mutating methods (POST/PUT/PATCH/DELETE) are refused unless you set allowWrite=true \u2014 keep it false to preview, or set dryRun=true to print the intended request without sending it. Gmail send and forwarding methods (users.messages.send, users.drafts.send, forwarding/auto-forwarding, filters, delegates) are refused \u2014 use the dedicated gog_gmail_* tools, which ask the user to confirm. So are the other methods a dedicated tool asks about: Chat spaces.messages.create, Drive permissions.create/update, Classroom courses.announcements.create and invitations.create, and Calendar events.insert/import/quickAdd/update/patch.",
     annotations: { destructiveHint: true },
     inputSchema: external_exports.object({
       api: external_exports.string().describe("Discovery API name (e.g. drive, gmail, calendar)"),
@@ -36162,6 +36388,54 @@ function registerAuthTools(server) {
 }
 
 // src/tools/calendar.ts
+var CALENDAR_GATED = {
+  create: "gog_calendar_create",
+  add: "gog_calendar_create",
+  new: "gog_calendar_create",
+  update: "gog_calendar_update",
+  edit: "gog_calendar_update",
+  set: "gog_calendar_update",
+  respond: "gog_calendar_respond",
+  rsvp: "gog_calendar_respond",
+  reply: "gog_calendar_respond"
+};
+function vetCalendarRun(subcommand, _args) {
+  const sub = subcommand.toLowerCase();
+  const tool = Object.hasOwn(CALENDAR_GATED, sub) ? CALENDAR_GATED[sub] : void 0;
+  return tool ? gatedElsewhere(`gog calendar ${sub}`, "gog_calendar_run", "can change what guests see", tool) : void 0;
+}
+function parseAttendees(value) {
+  if (!value) return [];
+  return value.split(",").map((entry) => entry.split(";")).filter((parts) => !parts.slice(1).some((m) => m.trim().toLowerCase() === "resource")).map((parts) => parts[0].trim()).filter(Boolean);
+}
+function timeOf(t) {
+  const v = t?.dateTime ?? t?.date;
+  return typeof v === "string" ? v : void 0;
+}
+function eventSnapshot(raw) {
+  let event;
+  try {
+    event = JSON.parse(raw)?.event;
+  } catch {
+    event = void 0;
+  }
+  const str = (v) => typeof v === "string" ? v : void 0;
+  return {
+    summary: str(event?.summary),
+    start: timeOf(event?.start),
+    end: timeOf(event?.end),
+    organizer: str(event?.organizer?.email),
+    // Guests are the OTHER people: not this account's own attendee row, not rooms.
+    guests: (Array.isArray(event?.attendees) ? event.attendees : []).filter((a) => a.self !== true && a.resource !== true && typeof a.email === "string").map((a) => a.email),
+    etag: str(event?.etag)
+  };
+}
+async function readEvent(calendarId, eventId, account) {
+  const got = await runOrDiagnose(["calendar", "event", pos(calendarId), pos(eventId)], { account });
+  if (got.isError) return { error: got };
+  return { event: eventSnapshot(resultText(got)) };
+}
+var CALENDAR_CONFIRM_LABEL = "Confirm that this change, which other people will see, should be made now.";
 var reminderParams = {
   reminders: external_exports.array(external_exports.string()).max(5).optional().describe(
     `Reminders as method:duration, e.g. ["popup:30m", "email:1d"]. Method is popup or email; duration accepts m/h/d (max 40320 minutes = 4 weeks). Google allows at most 5. These REPLACE the event's reminders \u2014 on update, pass an EMPTY array to drop custom reminders and go back to the calendar's defaults. Cannot be combined with noReminders.`
@@ -36249,7 +36523,7 @@ function registerCalendarTools(server) {
     return runOrDiagnose(args, { account });
   });
   server.registerTool("gog_calendar_create", {
-    description: "Create a calendar event. Set withZoom=true to attach a Zoom meeting (requires Zoom S2S OAuth setup via gog_zoom_auth_setup; the join URL + meeting ID + passcode are appended to the event description \u2014 Google rejects native conference card writes from non-Workspace-Marketplace OAuth clients).",
+    description: "Create a calendar event. Set withZoom=true to attach a Zoom meeting (requires Zoom S2S OAuth setup via gog_zoom_auth_setup; the join URL + meeting ID + passcode are appended to the event description \u2014 Google rejects native conference card writes from non-Workspace-Marketplace OAuth clients). With attendees, the event lands on other people's calendars (no invitation email is sent), so the MCP host is asked to show the user a confirmation prompt with the guests, time and details first; a guest-free event is created without asking." + CONFIRM_FALLBACK_DESCRIPTION,
     annotations: { destructiveHint: false },
     inputSchema: external_exports.object({
       calendarId: external_exports.string().describe('Calendar ID (use "primary" for the default calendar)'),
@@ -36263,9 +36537,10 @@ function registerCalendarTools(server) {
       timezone: external_exports.string().optional().describe("IANA timezone metadata applied to from/to (e.g. America/New_York). Sets both start and end timezone unless start/end timezone are overridden."),
       withZoom: external_exports.boolean().optional().describe("Create a Zoom video conference for this event (requires Zoom S2S OAuth setup)"),
       ...reminderParams,
-      account: accountParam
+      account: accountParam,
+      confirmToken: confirmTokenParam
     })
-  }, async ({ calendarId, summary, from, to, description, location, attendees, allDay, timezone, withZoom, reminders, noReminders, account }) => {
+  }, async ({ calendarId, summary, from, to, description, location, attendees, allDay, timezone, withZoom, reminders, noReminders, account, confirmToken }, ctx) => {
     const args = ["calendar", "create", pos(calendarId), `--summary=${summary}`, `--from=${from}`, `--to=${to}`];
     if (description) args.push(`--description=${description}`);
     if (location) args.push(`--location=${location}`);
@@ -36274,10 +36549,28 @@ function registerCalendarTools(server) {
     if (timezone) args.push(`--timezone=${timezone}`);
     if (withZoom) args.push("--with-zoom");
     pushReminderFlags(args, { reminders, noReminders });
+    const guests = parseAttendees(attendees);
+    if (guests.length > 0) {
+      const event = { calendarId, summary, from, to, allDay: Boolean(allDay), timezone, location, description, guests, attendees, withZoom: Boolean(withZoom) };
+      const confirmation = await requireDispatchConfirmation(ctx, {
+        action: "calendar.create",
+        message: "Review and confirm this event, which will appear on the guests' calendars:",
+        confirmationLabel: CALENDAR_CONFIRM_LABEL,
+        details: event,
+        unsupportedNote: "Create it without attendees instead; the user can add the guests in Google Calendar.",
+        fallback: {
+          tool: "gog_calendar_create",
+          account,
+          confirmToken,
+          subject: () => ({ target: calendarId, payload: event, preview: event })
+        }
+      });
+      if (confirmation) return confirmation;
+    }
     return runOrDiagnose(args, { account });
   });
   server.registerTool("gog_calendar_update", {
-    description: "Update an existing calendar event. Zoom: withZoom adds a Zoom meeting, regenerateZoom replaces the existing one, removeZoom strips it. removeMeet clears the event's Google Meet conference data (e.g. before attaching another provider). Conference flags are independent \u2014 use one per call.",
+    description: "Update an existing calendar event. Zoom: withZoom adds a Zoom meeting, regenerateZoom replaces the existing one, removeZoom strips it. removeMeet clears the event's Google Meet conference data (e.g. before attaching another provider). Conference flags are independent \u2014 use one per call. A change guests can see (time, title, place, description, attendees, attachments, conferencing) on an event that has guests \u2014 or gains them \u2014 reads the event and asks the MCP host to show the user a confirmation prompt with the event as it stands and the change; no invitation email is sent. Reminder-only changes and guest-free events are updated without asking." + CONFIRM_FALLBACK_DESCRIPTION,
     annotations: { destructiveHint: false },
     inputSchema: external_exports.object({
       calendarId: external_exports.string().describe("Calendar ID"),
@@ -36295,9 +36588,10 @@ function registerCalendarTools(server) {
       removeZoom: external_exports.boolean().optional().describe("Remove the event's Zoom video conference"),
       removeMeet: external_exports.boolean().optional().describe("Remove the event's Google Meet video conference (clears conference data only)"),
       ...reminderParams,
-      account: accountParam
+      account: accountParam,
+      confirmToken: confirmTokenParam
     })
-  }, async ({ calendarId, eventId, summary, from, to, description, location, attendees, addAttendees, attachments, withZoom, regenerateZoom, removeZoom, removeMeet, reminders, noReminders, account }) => {
+  }, async ({ calendarId, eventId, summary, from, to, description, location, attendees, addAttendees, attachments, withZoom, regenerateZoom, removeZoom, removeMeet, reminders, noReminders, account, confirmToken }, ctx) => {
     const args = ["calendar", "update", pos(calendarId), pos(eventId)];
     if (summary !== void 0) args.push(`--summary=${summary}`);
     if (from !== void 0) args.push(`--from=${from}`);
@@ -36312,6 +36606,45 @@ function registerCalendarTools(server) {
     if (removeZoom) args.push("--remove-zoom");
     if (removeMeet) args.push("--remove-meet");
     pushReminderFlags(args, { reminders, noReminders });
+    const changes = Object.fromEntries(Object.entries({
+      summary,
+      from,
+      to,
+      description,
+      location,
+      attendees,
+      addAttendees,
+      attachments,
+      withZoom,
+      regenerateZoom,
+      removeZoom,
+      removeMeet
+    }).filter(([, v]) => v !== void 0 && v !== false));
+    if (Object.keys(changes).length > 0) {
+      const read = await readEvent(calendarId, eventId, account);
+      if (read.error) return read.error;
+      const { etag, ...current } = read.event;
+      const added = [...parseAttendees(attendees), ...parseAttendees(addAttendees)];
+      if (current.guests.length > 0 || added.length > 0) {
+        const view = { calendarId, eventId, current, changes };
+        const confirmation = await requireDispatchConfirmation(ctx, {
+          action: "calendar.update",
+          message: "Review and confirm this change to an event other people are on:",
+          confirmationLabel: CALENDAR_CONFIRM_LABEL,
+          details: view,
+          unsupportedNote: "Ask the user to make this change in Google Calendar.",
+          fallback: {
+            tool: "gog_calendar_update",
+            account,
+            confirmToken,
+            // The etag rotates on any edit, so an event changed elsewhere between
+            // the two phases is DRAFT_CHANGED rather than edited over.
+            subject: () => ({ target: `${calendarId}/${eventId}`, revision: etag, payload: view, preview: view })
+          }
+        });
+        if (confirmation) return confirmation;
+      }
+    }
     return runOrDiagnose(args, { account });
   });
   server.registerTool("gog_calendar_delete", {
@@ -36326,21 +36659,40 @@ function registerCalendarTools(server) {
     return runOrDiagnose(["calendar", "delete", pos(calendarId), pos(eventId), "--force"], { account });
   });
   server.registerTool("gog_calendar_respond", {
-    description: "Respond to a calendar event invitation.",
+    description: "Respond to a calendar event invitation. The organizer sees the response, so this reads the event and asks the MCP host to show the user a confirmation prompt with the event, organizer, response and comment; nothing is recorded unless they accept." + CONFIRM_FALLBACK_DESCRIPTION,
     annotations: { destructiveHint: true },
     inputSchema: external_exports.object({
       calendarId: external_exports.string().describe("Calendar ID"),
       eventId: external_exports.string().describe("Event ID"),
       status: external_exports.enum(["accepted", "declined", "tentative"]).describe("Response status"),
       comment: external_exports.string().optional().describe("Optional comment to include with response"),
-      account: accountParam
+      account: accountParam,
+      confirmToken: confirmTokenParam
     })
-  }, async ({ calendarId, eventId, status, comment, account }) => {
+  }, async ({ calendarId, eventId, status, comment, account, confirmToken }, ctx) => {
     const args = ["calendar", "respond", pos(calendarId), pos(eventId), `--status=${status}`];
     if (comment) args.push(`--comment=${comment}`);
+    const read = await readEvent(calendarId, eventId, account);
+    if (read.error) return read.error;
+    const { etag, ...event } = read.event;
+    const view = { calendarId, eventId, event, response: status, ...comment ? { comment } : {} };
+    const confirmation = await requireDispatchConfirmation(ctx, {
+      action: "calendar.respond",
+      message: "Review and confirm this response, which the organizer will see:",
+      confirmationLabel: "Confirm that this response should be recorded now.",
+      details: view,
+      unsupportedNote: "Ask the user to respond from Google Calendar.",
+      fallback: {
+        tool: "gog_calendar_respond",
+        account,
+        confirmToken,
+        subject: () => ({ target: `${calendarId}/${eventId}`, revision: etag, payload: view, preview: view })
+      }
+    });
+    if (confirmation) return confirmation;
     return runOrDiagnose(args, { account });
   });
-  registerRunTool(server, { service: "calendar", examples: '"calendars", "freebusy"' });
+  registerRunTool(server, { service: "calendar", examples: '"calendars", "freebusy"', vet: vetCalendarRun });
 }
 
 // src/attachments.ts
@@ -36424,6 +36776,23 @@ function inlineAttachmentArgs(flag, attachments, siblingArgs = []) {
 }
 
 // src/tools/chat.ts
+var CHAT_SEND_WORDS = /* @__PURE__ */ new Set(["send", "create", "post"]);
+function vetChatRun(subcommand, args) {
+  const sub = subcommand.toLowerCase();
+  if (sub !== "messages" && sub !== "dm") return void 0;
+  const word = hasCommandWord(args, CHAT_SEND_WORDS);
+  if (!word) return void 0;
+  return gatedElsewhere(
+    `gog chat ${sub} ${word.toLowerCase()}`,
+    "gog_chat_run",
+    "posts a message",
+    sub === "dm" ? "gog_chat_dm_send" : "gog_chat_messages_send"
+  );
+}
+var CHAT_CONFIRM = {
+  message: "Review and confirm this Google Chat message:",
+  confirmationLabel: "Confirm that this Chat message should be posted now."
+};
 function registerChatTools(server) {
   const workspaceOnlyNote = ' WORKSPACE ONLY: Google Chat has no API for consumer accounts, so this fails on an @gmail.com account with "chat requires a Google Workspace account". That is the ACCOUNT, not the token \u2014 re-authorizing or adding scopes will not help.';
   const spaceParam = external_exports.string().describe(
@@ -36529,7 +36898,7 @@ function registerChatTools(server) {
     return runOrDiagnose(args, { account });
   });
   server.registerTool("gog_chat_messages_send", {
-    description: "Post a message to a Chat space. THIS IS IMMEDIATELY VISIBLE TO EVERYONE IN THE SPACE and cannot be unsent through this tool, so treat it like sending mail, not like saving a draft. Pass `thread` to reply inside an existing conversation (from gog_chat_threads_list or a message's thread field); omit it to start a new one. Text supports Chat's markdown-ish formatting (*bold*, _italic_, `code`)." + workspaceOnlyNote,
+    description: "Post a message to a Chat space. THIS IS IMMEDIATELY VISIBLE TO EVERYONE IN THE SPACE and cannot be unsent through this tool, so treat it like sending mail, not like saving a draft. Pass `thread` to reply inside an existing conversation (from gog_chat_threads_list or a message's thread field); omit it to start a new one. Text supports Chat's markdown-ish formatting (*bold*, _italic_, `code`). Asks the MCP host to show the user a confirmation prompt with the space, thread, text and attachments first; nothing is posted unless they accept." + CONFIRM_FALLBACK_DESCRIPTION + workspaceOnlyNote,
     annotations: { destructiveHint: true },
     inputSchema: external_exports.object({
       space: spaceParam,
@@ -36539,9 +36908,10 @@ function registerChatTools(server) {
         "Attachment file paths, read WHERE GOG RUNS. On a hosted or remote deployment that is not your machine \u2014 use attachInline there instead. Must be inside the server's GOG_FILE_ROOTS directories (default ~/gogcli-mcp-files)."
       ),
       attachInline: attachInlineParam,
-      account: accountParam
+      account: accountParam,
+      confirmToken: confirmTokenParam
     })
-  }, async ({ space, text, thread, attach, attachInline, account }) => {
+  }, async ({ space, text, thread, attach, attachInline, account, confirmToken }, ctx) => {
     confinePaths(attach, "attach");
     if (text === void 0 && !attach?.length && !attachInline?.length) {
       throw new Error("A Chat message needs text, an attachment, or both.");
@@ -36551,20 +36921,56 @@ function registerChatTools(server) {
     if (thread) args.push(`--thread=${thread}`);
     if (attach) for (const path of attach) args.push(`--attach=${path}`);
     args.push(...inlineAttachmentArgs("attach", attachInline, args));
+    const confirmation = await requireDispatchConfirmation(ctx, {
+      ...CHAT_CONFIRM,
+      action: "chat.message-send",
+      details: { space, thread, textPreview: bodyPreview(text), attachments: attachmentNames(attach, attachInline) },
+      fallback: {
+        tool: "gog_chat_messages_send",
+        account,
+        confirmToken,
+        subject: () => {
+          const attachments = attachmentDetails(attach, attachInline);
+          const from = senderPreview(account);
+          return {
+            target: space,
+            payload: { from, space, thread, text, attachments },
+            preview: { from, space, thread, text, attachments: attachmentPreview(attachments) }
+          };
+        }
+      }
+    });
+    if (confirmation) return confirmation;
     return runOrDiagnose(args, { account });
   });
   server.registerTool("gog_chat_dm_send", {
-    description: "Send a direct message to one person by email address, creating the DM space if this is the first message. Delivered immediately and cannot be unsent through this tool. For a room rather than a person, use gog_chat_messages_send." + workspaceOnlyNote,
+    description: "Send a direct message to one person by email address, creating the DM space if this is the first message. Delivered immediately and cannot be unsent through this tool. For a room rather than a person, use gog_chat_messages_send. Asks the MCP host to show the user a confirmation prompt with the recipient and text first; nothing is sent unless they accept." + CONFIRM_FALLBACK_DESCRIPTION + workspaceOnlyNote,
     annotations: { destructiveHint: true },
     inputSchema: external_exports.object({
       email: external_exports.string().describe("Recipient email address"),
       text: external_exports.string().describe("Message text"),
       thread: threadParam,
-      account: accountParam
+      account: accountParam,
+      confirmToken: confirmTokenParam
     })
-  }, async ({ email: email3, text, thread, account }) => {
+  }, async ({ email: email3, text, thread, account, confirmToken }, ctx) => {
     const args = ["chat", "dm", "send", pos(email3), `--text=${text}`];
     if (thread) args.push(`--thread=${thread}`);
+    const confirmation = await requireDispatchConfirmation(ctx, {
+      ...CHAT_CONFIRM,
+      action: "chat.dm-send",
+      details: { to: email3, thread, textPreview: bodyPreview(text) },
+      fallback: {
+        tool: "gog_chat_dm_send",
+        account,
+        confirmToken,
+        subject: () => {
+          const from = senderPreview(account);
+          return { target: email3, payload: { from, to: email3, thread, text }, preview: { from, to: email3, thread, text } };
+        }
+      }
+    });
+    if (confirmation) return confirmation;
     return runOrDiagnose(args, { account });
   });
   server.registerTool("gog_chat_dm_space", {
@@ -36619,11 +37025,45 @@ function registerChatTools(server) {
   registerRunTool(server, {
     service: "chat",
     examples: '"spaces", "messages", "dm"',
+    vet: vetChatRun,
     note: "Google Chat has no API for consumer accounts: every chat subcommand fails on an @gmail.com account regardless of scopes."
   });
 }
 
 // src/tools/classroom.ts
+var CLASSROOM_CREATE_WORDS = /* @__PURE__ */ new Set(["create", "add", "new"]);
+var CLASSROOM_GATED = {
+  announcements: { does: "posts to a class", tool: "gog_classroom_announcements_create" },
+  announcement: { does: "posts to a class", tool: "gog_classroom_announcements_create" },
+  ann: { does: "posts to a class", tool: "gog_classroom_announcements_create" },
+  invitations: { does: "invites someone to a class", tool: "gog_classroom_invitations_create" },
+  invitation: { does: "invites someone to a class", tool: "gog_classroom_invitations_create" },
+  invites: { does: "invites someone to a class", tool: "gog_classroom_invitations_create" }
+};
+function vetClassroomRun(subcommand, args) {
+  const sub = subcommand.toLowerCase();
+  const gated = Object.hasOwn(CLASSROOM_GATED, sub) ? CLASSROOM_GATED[sub] : void 0;
+  if (!gated) return void 0;
+  const word = hasCommandWord(args, CLASSROOM_CREATE_WORDS);
+  return word ? gatedElsewhere(`gog classroom ${sub} ${word.toLowerCase()}`, "gog_classroom_run", gated.does, gated.tool) : void 0;
+}
+async function readCourse(courseId, account, runner = runOrDiagnose) {
+  const got = await runner(["classroom", "courses", "get", pos(courseId)], { account });
+  if (got.isError) return { error: got };
+  let course;
+  try {
+    course = JSON.parse(resultText(got))?.course;
+  } catch {
+    course = void 0;
+  }
+  return {
+    course: {
+      id: courseId,
+      ...typeof course?.name === "string" ? { name: course.name } : {},
+      ...typeof course?.section === "string" ? { section: course.section } : {}
+    }
+  };
+}
 function registerClassroomTools(server) {
   server.registerTool("gog_classroom_courses_list", {
     description: "List Google Classroom courses.",
@@ -36906,19 +37346,42 @@ function registerClassroomTools(server) {
     return runOrDiagnose(["classroom", "announcements", "get", pos(courseId), pos(announcementId)], { account });
   });
   server.registerTool("gog_classroom_announcements_create", {
-    description: "Create an announcement in a Google Classroom course.",
+    description: "Create an announcement in a Google Classroom course. Unless state is DRAFT (which students cannot see), this reads the course and asks the MCP host to show the user a confirmation prompt with the class, the full text and when it publishes; nothing is posted unless they accept. To stage one without asking, pass state DRAFT." + CONFIRM_FALLBACK_DESCRIPTION,
     annotations: { destructiveHint: true },
     inputSchema: external_exports.object({
       courseId: external_exports.string().describe("Course ID"),
       text: external_exports.string().describe("Announcement text"),
-      state: external_exports.enum(["PUBLISHED", "DRAFT"]).optional().describe("State"),
+      state: external_exports.enum(["PUBLISHED", "DRAFT"]).optional().describe("State (DRAFT is visible only to teachers and needs no confirmation)"),
       scheduled: external_exports.string().optional().describe("Scheduled publish time"),
-      account: accountParam
+      account: accountParam,
+      confirmToken: confirmTokenParam
     })
-  }, async ({ courseId, text, state, scheduled, account }) => {
+  }, async ({ courseId, text, state, scheduled, account, confirmToken }, ctx) => {
     const args = ["classroom", "announcements", "create", pos(courseId), `--text=${text}`];
     if (state) args.push(`--state=${state}`);
     if (scheduled) args.push(`--scheduled=${scheduled}`);
+    if (state !== "DRAFT") {
+      const read = await readCourse(courseId, account);
+      if (read.error) return read.error;
+      const publishes = scheduled ? `at ${scheduled}` : "immediately";
+      const confirmation = await requireDispatchConfirmation(ctx, {
+        action: "classroom.announcement-create",
+        message: "Review and confirm this Classroom announcement:",
+        confirmationLabel: "Confirm that this announcement should be posted to the class.",
+        details: { course: read.course, publishes, textPreview: bodyPreview(text) },
+        unsupportedNote: "Create it with state DRAFT instead; the user can review and post it from Classroom.",
+        fallback: {
+          tool: "gog_classroom_announcements_create",
+          account,
+          confirmToken,
+          subject: () => {
+            const view = { course: read.course, publishes, text };
+            return { target: courseId, payload: view, preview: view };
+          }
+        }
+      });
+      if (confirmation) return confirmation;
+    }
     return runOrDiagnose(args, { account });
   });
   server.registerTool("gog_classroom_topics_list", {
@@ -37008,6 +37471,7 @@ function registerClassroomTools(server) {
   registerRunTool(server, {
     service: "classroom",
     examples: '"guardians", "materials", "guardian-invitations"',
+    vet: vetClassroomRun,
     note: "Covers anything not wrapped by the dedicated tools (guardians, guardian-invitations, materials, coursework assignees, announcement assignees, etc.)."
   });
 }
@@ -37168,7 +37632,18 @@ function registerDocsTools(server) {
 }
 
 // src/tools/drive.ts
+function vetDriveRun(subcommand, _args) {
+  return subcommand.toLowerCase() === "share" ? gatedElsewhere("gog drive share", "gog_drive_run", "grants access to a file", "gog_drive_share") : void 0;
+}
 var GOOGLE_DOC_MIME = "application/vnd.google-apps.document";
+function shareTargetMeta(raw) {
+  try {
+    const { name, mimeType } = fileMeta(raw);
+    return { name, mimeType };
+  } catch {
+    return {};
+  }
+}
 function fileMeta(raw) {
   const parsed = JSON.parse(raw);
   const f = parsed.file ?? parsed;
@@ -37291,7 +37766,7 @@ function registerDriveTools(server) {
     return runOrDiagnose(args, { account });
   });
   server.registerTool("gog_drive_share", {
-    description: "Share a Google Drive file or folder.",
+    description: "Share a Google Drive file or folder. Granting access is the risk even though no email is sent (gog does not notify by default), so this reads the file and asks the MCP host to show the user a confirmation prompt naming it, who gets access and with what role; nothing is shared unless they accept." + CONFIRM_FALLBACK_DESCRIPTION,
     annotations: { destructiveHint: true },
     inputSchema: external_exports.object({
       fileId: external_exports.string().describe("File or folder ID"),
@@ -37299,9 +37774,35 @@ function registerDriveTools(server) {
       email: external_exports.string().optional().describe("User email (required when to=user)"),
       domain: external_exports.string().optional().describe("Domain (required when to=domain)"),
       role: external_exports.enum(["reader", "writer"]).optional().describe("Permission role (default: reader)"),
-      account: accountParam
+      account: accountParam,
+      confirmToken: confirmTokenParam
     })
-  }, async ({ fileId, to, email: email3, domain: domain2, role, account }) => {
+  }, async ({ fileId, to, email: email3, domain: domain2, role, account, confirmToken }, ctx) => {
+    const got = await runOrDiagnose(["drive", "get", pos(fileId)], { account });
+    if (got.isError) return got;
+    const file2 = { id: fileId, ...shareTargetMeta(resultText(got)) };
+    const grant = {
+      file: file2,
+      to,
+      ...email3 ? { email: email3 } : {},
+      ...domain2 ? { domain: domain2 } : {},
+      role: role ?? "reader",
+      publicLink: to === "anyone"
+    };
+    const confirmation = await requireDispatchConfirmation(ctx, {
+      action: "drive.share",
+      message: to === "anyone" ? "Review and confirm making this file available to ANYONE with the link:" : "Review and confirm this Drive share:",
+      confirmationLabel: "Confirm that this access should be granted now.",
+      details: grant,
+      unsupportedNote: "Ask the user to share it themselves from Google Drive.",
+      fallback: {
+        tool: "gog_drive_share",
+        account,
+        confirmToken,
+        subject: () => ({ target: fileId, payload: grant, preview: grant })
+      }
+    });
+    if (confirmation) return confirmation;
     const args = ["drive", "share", pos(fileId), `--to=${to}`];
     if (email3) args.push(`--email=${email3}`);
     if (domain2) args.push(`--domain=${domain2}`);
@@ -37414,7 +37915,7 @@ function registerDriveTools(server) {
       return diagnose(err);
     }
   });
-  registerRunTool(server, { service: "drive", examples: '"copy", "download", "permissions"' });
+  registerRunTool(server, { service: "drive", examples: '"copy", "download", "permissions"', vet: vetDriveRun });
 }
 
 // src/gmail-results.ts
@@ -37540,24 +38041,16 @@ var STAGING_TWIN = {
 var UNSUPPORTED_NOTE2 = {
   "gmail.drafts-send": "The draft is still saved: ask the user to review it and send it from Gmail."
 };
-var BODY_PREVIEW_MAX = 2048;
-function bodyPreview(text) {
-  if (!text) return void 0;
-  if (text.length <= BODY_PREVIEW_MAX) return text;
-  return `${text.slice(0, BODY_PREVIEW_MAX)}\u2026 [${text.length - BODY_PREVIEW_MAX} more characters not shown]`;
-}
-function attachmentNames(paths, inline) {
-  return [...paths ?? [], ...(inline ?? []).map((a) => a.filename)];
-}
-function requireGmailDispatchConfirmation(ctx, op, details) {
+async function requireGmailDispatchConfirmation(ctx, op, details, fallback) {
   const twin = STAGING_TWIN[op];
   const note = twin ? `Stage it with ${twin} instead; the user can review the draft and send it from Gmail (gog_gmail_drafts_send also asks for confirmation).` : UNSUPPORTED_NOTE2[op];
-  return requireConfirmation(ctx, {
+  return requireDispatchConfirmation(ctx, {
     action: op,
     message: op === "gmail.filter-forward" ? "Review and confirm this mail-forwarding filter:" : "Review and confirm this email dispatch:",
     details,
     confirmationLabel: op === "gmail.filter-forward" ? "Confirm that matching mail should be forwarded automatically from now on." : "Confirm that this email should be sent now.",
-    ...note ? { unsupportedNote: note } : {}
+    unsupportedNote: note,
+    ...fallback ? { fallback: { instruction: CONFIRM_SEND_INSTRUCTION, ...fallback } } : {}
   });
 }
 var EMAIL_PATTERN = /[a-z0-9!#$%&'*+/=?^_`{|}~.-]+@[a-z0-9-]+(?:\.[a-z0-9-]+)+/gi;
@@ -37611,10 +38104,6 @@ function logGmailDispatch(tool, recipients, account) {
   process.stderr.write(`${JSON.stringify(event)}
 `);
 }
-function resultText(result) {
-  const first = result.content[0];
-  return first && first.type === "text" && typeof first.text === "string" ? first.text : "{}";
-}
 
 // src/tools/gmail.ts
 var replySchema = {
@@ -37662,7 +38151,7 @@ function appendReplyFlags(args, f) {
   if (f.signatureFile) args.push(`--signature-file=${f.signatureFile}`);
   args.push(f.autoFromAddressedAlias ? "--auto-from-addressed-alias" : "--auto-from-addressed-alias=false");
 }
-var sendReplySchema = external_exports.object(replySchema);
+var sendReplySchema = external_exports.object({ ...replySchema, confirmToken: confirmTokenParam });
 function parseMetadataHeaders(raw) {
   let parsed;
   try {
@@ -37687,12 +38176,69 @@ function computeReplyRecipients(kind, headers, flags) {
   }
   return emails;
 }
-async function sendReply(kind, toolName, messageId, account, flags, ctx) {
+function metadataThreadId(raw) {
+  try {
+    const threadId = JSON.parse(raw)?.message?.threadId;
+    return typeof threadId === "string" ? threadId : void 0;
+  } catch {
+    return void 0;
+  }
+}
+function replyTokenSubject(kind, messageId, account, headers, threadId, flags) {
+  const removed = new Set(extractEmails(...flags.remove ?? []));
+  const keep = (emails) => emails.filter((e) => !removed.has(e));
+  const to = keep(extractEmails(headers.from, ...kind === "reply-all" ? [headers.to] : [], ...flags.to ?? []));
+  const cc = keep(extractEmails(...kind === "reply-all" ? [headers.cc] : [], ...flags.cc ?? []));
+  const bcc = keep(extractEmails(...flags.bcc ?? []));
+  const attachments = attachmentDetails(flags.attach, flags.attachInline);
+  const subject = flags.subject || (headers.subject ? `Re: ${headers.subject}` : void 0);
+  const from = flags.from ?? (flags.autoFromAddressedAlias ? "the send-as alias the original was addressed to" : senderPreview(account));
+  const localFiles = attachmentDetails([flags.bodyHtmlFile, flags.signatureFile].filter((p) => Boolean(p)), void 0);
+  return {
+    target: messageId,
+    payload: {
+      kind,
+      to,
+      cc,
+      bcc,
+      subject,
+      from,
+      body: flags.body,
+      bodyHtml: flags.bodyHtml,
+      localFiles,
+      signature: Boolean(flags.signature),
+      signatureFrom: flags.signatureFrom,
+      attachments,
+      quote: !flags.noQuote,
+      threadId,
+      inReplyTo: headers.message_id,
+      references: headers.references
+    },
+    preview: {
+      from,
+      to,
+      cc,
+      bcc,
+      subject,
+      body: flags.body,
+      ...flags.bodyHtml ? { bodyHtml: flags.bodyHtml } : {},
+      ...flags.bodyHtmlFile ? { bodyHtmlFile: flags.bodyHtmlFile } : {},
+      ...flags.signature || flags.signatureFrom || flags.signatureFile ? { signature: flags.signatureFile ?? flags.signatureFrom ?? "the Gmail signature of the sending address" } : {},
+      quotesOriginal: !flags.noQuote,
+      attachments: attachmentPreview(attachments),
+      replyingToMessageId: messageId,
+      threadId,
+      inReplyTo: headers.message_id
+    }
+  };
+}
+async function sendReply(kind, toolName, messageId, account, flags, ctx, confirmToken) {
   const metaResult = await runOrDiagnose(["gmail", "get", pos(messageId), "--format=metadata"], { account });
   if (metaResult.isError) return metaResult;
-  const headers = parseMetadataHeaders(resultText(metaResult));
+  const metaText = resultText(metaResult);
+  const headers = parseMetadataHeaders(metaText);
   const recipients = computeReplyRecipients(kind, headers, flags);
-  const confirmation = requireGmailDispatchConfirmation(ctx, replyDispatchOp(kind), {
+  const confirmation = await requireGmailDispatchConfirmation(ctx, replyDispatchOp(kind), {
     messageId,
     recipients,
     recipientCount: recipients.length,
@@ -37703,6 +38249,13 @@ async function sendReply(kind, toolName, messageId, account, flags, ctx) {
     bodyHtmlFile: flags.bodyHtmlFile,
     attachmentCount: (flags.attach?.length ?? 0) + (flags.attachInline?.length ?? 0),
     attachments: attachmentNames(flags.attach, flags.attachInline)
+  }, {
+    tool: toolName,
+    account,
+    confirmToken,
+    // The metadata read above IS the phase-2 re-read: it runs on every call,
+    // so the original's Message-ID/References are fresh here.
+    subject: () => replyTokenSubject(kind, messageId, account, headers, metadataThreadId(metaText), flags)
   });
   if (confirmation) return confirmation;
   const args = ["gmail", kind, pos(messageId)];
@@ -37720,7 +38273,7 @@ function vetGmailRun(subcommand, args) {
     return `gog gmail ${subcommand} can forward or hand over mail and is not available through gog_gmail_run. Use the dedicated gog_gmail_* tool instead.`;
   }
   if (subcommand === "settings") {
-    const blocked = args.find((a) => GMAIL_RUN_BLOCKED_SETTINGS.has(a.toLowerCase()));
+    const blocked = hasCommandWord(args, GMAIL_RUN_BLOCKED_SETTINGS);
     if (blocked) {
       return `gog gmail settings ${blocked} can forward or hand over mail and is not available through gog_gmail_run. Use the dedicated gog_gmail_* tool instead.`;
     }
@@ -37779,7 +38332,7 @@ function registerGmailTools(server) {
     return runOrDiagnose(args, { account });
   });
   server.registerTool("gog_gmail_send", {
-    description: 'SENDS MAIL \u2014 asks the MCP host to show a confirmation prompt with the recipients, subject, a preview of the body and the attachment names. Mail is sent only after the user accepts that prompt. Two ways to attach a file: `attach` takes paths READ ON THE GOG SERVER, and `attachInline` takes the bytes themselves. Use attachInline unless you know the file exists on the same machine gog runs on \u2014 on the hosted connector and any remote deployment there is no shared filesystem, so no path you can name resolves there and `attach` will fail with "no such file or directory". When either is used, the JSON result echoes the attached filenames and byte sizes \u2014 check it to confirm the files were embedded. NOT the tool for answering a message: replyToMessageId only files this in the right thread \u2014 the subject, recipients and body are entirely yours, and the original is not quoted unless you set quote. Use gog_gmail_reply / gog_gmail_reply_all instead, which inherit all three.',
+    description: 'SENDS MAIL \u2014 asks the MCP host to show a confirmation prompt with the recipients, subject, a preview of the body and the attachment names. Mail is sent only after the user accepts that prompt. Two ways to attach a file: `attach` takes paths READ ON THE GOG SERVER, and `attachInline` takes the bytes themselves. Use attachInline unless you know the file exists on the same machine gog runs on \u2014 on the hosted connector and any remote deployment there is no shared filesystem, so no path you can name resolves there and `attach` will fail with "no such file or directory". When either is used, the JSON result echoes the attached filenames and byte sizes \u2014 check it to confirm the files were embedded. NOT the tool for answering a message: replyToMessageId only files this in the right thread \u2014 the subject, recipients and body are entirely yours, and the original is not quoted unless you set quote. Use gog_gmail_reply / gog_gmail_reply_all instead, which inherit all three.' + CONFIRM_FALLBACK_DESCRIPTION,
     annotations: { destructiveHint: true },
     inputSchema: external_exports.object({
       to: external_exports.string().describe("Recipient(s), comma-separated"),
@@ -37792,9 +38345,10 @@ function registerGmailTools(server) {
       quote: external_exports.boolean().optional().describe("Include the original message quoted below the body. Requires replyToMessageId or threadId. gog quotes by DEFAULT on gmail reply but never on gmail send, so without this a threaded send arrives with the original nowhere in it."),
       attach: external_exports.array(external_exports.string()).optional().describe(`File paths to attach (repeatable), resolved ON THE GOG SERVER's filesystem \u2014 NOT this client's. Only usable when gog runs on the same machine you do (local stdio); on a hosted deployment (e.g. mcp-host) these paths do not exist and the call fails with "no such file or directory" \u2014 use attachInline there. Each file is read on the server, base64-encoded with a MIME type inferred from its extension, and added as a multipart attachment. Must be inside the server's GOG_FILE_ROOTS directories (default ~/gogcli-mcp-files).`),
       attachInline: attachInlineParam,
-      account: accountParam
+      account: accountParam,
+      confirmToken: confirmTokenParam
     })
-  }, async ({ to, subject, body, cc, bcc, replyToMessageId, threadId, quote, attach, attachInline, account }, ctx) => {
+  }, async ({ to, subject, body, cc, bcc, replyToMessageId, threadId, quote, attach, attachInline, account, confirmToken }, ctx) => {
     confinePaths(attach, "attach");
     const args = ["gmail", "send", `--to=${to}`, `--subject=${subject}`, payloadArg("body", "body-file", body)];
     if (cc) args.push(`--cc=${cc}`);
@@ -37806,7 +38360,7 @@ function registerGmailTools(server) {
     const inline = inlineAttachmentArgs("attach", attachInline, args);
     args.push(...inline);
     const recipients = extractEmails(to, cc, bcc);
-    const confirmation = requireGmailDispatchConfirmation(ctx, "gmail.send", {
+    const confirmation = await requireGmailDispatchConfirmation(ctx, "gmail.send", {
       to,
       cc,
       bcc,
@@ -37819,6 +38373,32 @@ function registerGmailTools(server) {
       quoting: Boolean(quote),
       attachmentCount: (attach?.length ?? 0) + (attachInline?.length ?? 0),
       attachments: attachmentNames(attach, attachInline)
+    }, {
+      tool: "gog_gmail_send",
+      account,
+      confirmToken,
+      // Nothing is stored between the phases: the payload IS the arguments,
+      // so phase 2 must repeat them and any difference is a changed send.
+      subject: () => {
+        const attachments = attachmentDetails(attach, attachInline);
+        const from = senderPreview(account);
+        return {
+          target: replyToMessageId ?? threadId ?? "",
+          payload: { from, to, cc, bcc, subject, body, attachments, threadId, inReplyTo: replyToMessageId, quote: Boolean(quote) },
+          preview: {
+            from,
+            to,
+            cc,
+            bcc,
+            subject,
+            body,
+            attachments: attachmentPreview(attachments),
+            threadId,
+            inReplyTo: replyToMessageId,
+            quotesOriginal: Boolean(quote)
+          }
+        };
+      }
     });
     if (confirmation) return confirmation;
     const result = await runOrDiagnose(args, { account });
@@ -37826,22 +38406,22 @@ function registerGmailTools(server) {
     return result;
   });
   server.registerTool("gog_gmail_reply", {
-    description: 'SENDS MAIL \u2014 asks the MCP host to show a confirmation prompt with the resolved recipient, subject, a preview of the body and the attachment names. Mail is sent only after the user accepts that prompt. To STAGE a reply instead of sending it, use gog_gmail_drafts_reply (gogcli-mcp-gmail only), which never needs confirmation. Reply to a Gmail message (goes to the original sender only). USE THIS, not gog_gmail_send, whenever you are answering a message: it threads off the original AND inherits its "Re:" subject and quotes its body below yours, which gog_gmail_send does not \u2014 a send with replyToMessageId lands in the right thread but reads as a brand-new message, with the original nowhere in it. To answer every participant use gog_gmail_reply_all. The gogcli-mcp-gmail package adds two more routes with the same composition: gog_gmail_autoreply to reply across every message matching a query, and gog_gmail_drafts_reply to stage this exact reply as a draft instead of sending it.',
+    description: 'SENDS MAIL \u2014 asks the MCP host to show a confirmation prompt with the resolved recipient, subject, a preview of the body and the attachment names. Mail is sent only after the user accepts that prompt. To STAGE a reply instead of sending it, use gog_gmail_drafts_reply (gogcli-mcp-gmail only), which never needs confirmation. Reply to a Gmail message (goes to the original sender only). USE THIS, not gog_gmail_send, whenever you are answering a message: it threads off the original AND inherits its "Re:" subject and quotes its body below yours, which gog_gmail_send does not \u2014 a send with replyToMessageId lands in the right thread but reads as a brand-new message, with the original nowhere in it. To answer every participant use gog_gmail_reply_all. The gogcli-mcp-gmail package adds two more routes with the same composition: gog_gmail_autoreply to reply across every message matching a query, and gog_gmail_drafts_reply to stage this exact reply as a draft instead of sending it.' + CONFIRM_FALLBACK_DESCRIPTION,
     annotations: { destructiveHint: true },
     inputSchema: sendReplySchema
-  }, async ({ messageId, account, ...flags }, ctx) => {
+  }, async ({ messageId, account, confirmToken, ...flags }, ctx) => {
     assertNotBoth("bodyHtml", "bodyHtmlFile", flags.bodyHtml, flags.bodyHtmlFile);
     confineReplyPaths(flags);
-    return sendReply("reply", "gog_gmail_reply", messageId, account, flags, ctx);
+    return sendReply("reply", "gog_gmail_reply", messageId, account, flags, ctx, confirmToken);
   });
   server.registerTool("gog_gmail_reply_all", {
-    description: 'SENDS MAIL \u2014 asks the MCP host to show a confirmation prompt with the resolved recipients, subject, a preview of the body and the attachment names. Mail is sent only after the user accepts that prompt. To STAGE a reply-all instead of sending it, use gog_gmail_drafts_reply_all (gogcli-mcp-gmail only), which never needs confirmation. Reply to all participants of a Gmail message (the sender plus every To/Cc recipient). Same inherited "Re:" subject and quoted original as gog_gmail_reply. Use the remove flag to drop specific recipients from the reply-all.',
+    description: 'SENDS MAIL \u2014 asks the MCP host to show a confirmation prompt with the resolved recipients, subject, a preview of the body and the attachment names. Mail is sent only after the user accepts that prompt. To STAGE a reply-all instead of sending it, use gog_gmail_drafts_reply_all (gogcli-mcp-gmail only), which never needs confirmation. Reply to all participants of a Gmail message (the sender plus every To/Cc recipient). Same inherited "Re:" subject and quoted original as gog_gmail_reply. Use the remove flag to drop specific recipients from the reply-all.' + CONFIRM_FALLBACK_DESCRIPTION,
     annotations: { destructiveHint: true },
     inputSchema: sendReplySchema
-  }, async ({ messageId, account, ...flags }, ctx) => {
+  }, async ({ messageId, account, confirmToken, ...flags }, ctx) => {
     assertNotBoth("bodyHtml", "bodyHtmlFile", flags.bodyHtml, flags.bodyHtmlFile);
     confineReplyPaths(flags);
-    return sendReply("reply-all", "gog_gmail_reply_all", messageId, account, flags, ctx);
+    return sendReply("reply-all", "gog_gmail_reply_all", messageId, account, flags, ctx, confirmToken);
   });
   registerRunTool(server, {
     service: "gmail",
@@ -38182,7 +38762,7 @@ function registerTasksTools(server) {
 }
 
 // src/server.ts
-var VERSION = true ? "4.3.0" : "0.0.0";
+var VERSION = true ? "4.4.0" : "0.0.0";
 var BASE_TOOL_REGISTRARS = [
   registerApiTools,
   registerAppScriptTools,
@@ -38234,12 +38814,12 @@ async function bootstrapGogAuth(env = process.env, options = {}) {
   const [clientId, clientSecret, refreshToken, account] = values;
   const { spawner } = options;
   try {
-    const { createHash: createHash2 } = await import("node:crypto");
+    const { createHash: createHash4 } = await import("node:crypto");
     const { mkdir, readFile, writeFile, chmod } = await import("node:fs/promises");
     const home = options.home ?? (await import("node:os")).homedir();
     const dir = join5(home, ".gogcli-mcp");
     const marker = join5(dir, AUTH_BOOTSTRAP_MARKER);
-    const fingerprint = createHash2("sha256").update(values.join("\0")).digest("hex");
+    const fingerprint = createHash4("sha256").update(values.join("\0")).digest("hex");
     const previous = await readFile(marker, "utf8").catch(() => void 0);
     if (previous === fingerprint && await accountListed(account, spawner)) return "present";
     await run(