proton-drive-mcp 1.0.32 → 1.0.34

package/CHANGELOG.md

@@ -1,5 +1,36 @@
 # Changelog
 
+## 1.0.34 — 2026-09-03
+
+Continued the live-testing bug sweep from v1.0.33. 7 more real, confirmed bugs across two rounds — every one reproduced live against the real Proton Drive CLI and account before being called a bug, and every fix re-verified live afterward.
+
+### Fixed
+- **Flag injection via `--password`/`--expiration` on `drive_share_set_url`.** Confirmed live: `sharing set-url ... --password "-x"` makes the real CLI's arg parser treat `-x` as an unknown flag and dump usage instead of setting the password — the same flag-injection class fixed for other params in v1.0.33, just missed here. Added `validateFlagValue()` and applied it in both the MCP dispatch and the CLI companion.
+- **`drive_upload` silently disabled thumbnail generation on every upload**, since v1.0.0. `upload()` hardcoded `--skip-thumbnails` unconditionally — never exposed as an option, never documented. Every file uploaded through this tool got no Drive thumbnail, degrading grid/preview views in the Proton apps, with no way to opt out. Removed the hardcoded flag.
+- **`photos_list_timeline` with `loadDetails=true` did nothing useful.** The tool description promises "full node metadata" when `loadDetails=true`. Confirmed live that `photo timeline --load-details` returns rich objects (`name`, `mediaType`, `creationTime`, `totalStorageSize`, `photo.captureTime`, `photo.tags`, ...) — but the code discarded everything except `nodeUid`, identical to the cheap default-mode output. `loadDetails=true` paid for a slower, memory-buffered CLI call and threw the result away. Now extracts and returns the full set of fields.
+- **`drive_list` didn't escape a literal `/` in an item's name when building its path.** The CLI's own path syntax requires escaping `/` in a name with a backslash. Our `validateName()` prevents *our* tools from creating such names, but an item created by any other Proton Drive client (web, desktop, mobile) can still have a literal `/` in its name. Confirmed live: creating such an item via the raw CLI, then naively joining its name into a path made every path-based tool (`drive_info`, `drive_download`, `drive_move`, `drive_delete`, ...) fail with "Node not found", while the correctly escaped form resolved. `drive_list` now escapes `/` in names before building the path it returns.
+- **`drive_invitation_accept`/`drive_invitation_reject` had no flag-injection guard on `uid`**, in both the MCP tool and the CLI. Confirmed live: `invitation accept "-fakeuid"` was misparsed as a CLI flag by the underlying binary ("Unknown option 'f'") instead of a clean rejection. Now validated with `validateFlagValue()`.
+- **`drive_download` silently swallowed partial-download failures.** `download()` narrowed the CLI's real `TransferSummary` response down to `{path, localPath, downloaded}`, dropping `skippedItems`/`failedItems` entirely — and the MCP dispatch never checked for failure, unlike `drive_upload`'s equivalent check. A download where some files failed would report success. `DownloadResult` now includes `skipped`/`failed`, and `drive_download` fails the call when `failed > 0`, mirroring `drive_upload`.
+- **`drive_read_file`/`drive_write_file` echoed the raw, untrimmed input path** instead of the validated one, inconsistent with every other tool in the codebase (which always echo the validated variable). Minor but real: a path with leading/trailing whitespace would show up unchanged in the response even though the actual operation used the trimmed path.
+
+## 1.0.33 — 2026-09-02
+
+A full skeptical re-read of every source file (`drive.ts`, `index.ts`, `cli.ts`, `subprocess.ts`, `validation.ts`, `syncfs.ts`, `errors.ts`, `logger.ts`) plus live testing of every candidate finding. 7 real, confirmed bugs — every one reproduced live before being called a bug, and every fix re-verified live afterward, through both the MCP JSON-RPC protocol and the companion CLI.
+
+### Fixed
+- **`validateName()` didn't reject `/`.** Confirmed live: renaming a file to a name containing `/` (e.g. `"evil/nested.txt"`) succeeded on the CLI side, but the resulting item's real Drive name literally contains the slash — it is not two path segments. `drive_list`'s path is computed by joining parent + name, so it then looks like a nested folder that doesn't exist; every other tool (`drive_info`, `drive_download`, `drive_move`, `drive_delete`, ...) fails with "Node not found" on that path, and the item becomes unreachable except by re-listing its real parent. `validateName()` now rejects `/` anywhere in the name.
+- **`photos_create_album` had no flag-injection protection at all**, in both the MCP tool and the CLI (`album create <name>`) — unlike every other user-typed name/path/email in this codebase, it was never run through a validator. Confirmed live: `album create "--help"` was misparsed as a CLI flag by the underlying binary, producing a confusing parse error instead of a clean rejection. Now validated with `validateName()`.
+- **`photos_update_album`'s `--name` and `--cover-photo-uid` had the same gap**, in both the MCP tool and the CLI (`album update`). Same fix.
+- **Large `drive_copy`/`drive_move` operations could be killed mid-flight.** The extended 30-minute timeout was only applied to `upload`/`download`; `copy`/`move` on a large folder tree — which can take just as long, re-encrypting or re-sharing many files server-side — got only the 60-second default and would be `SIGKILL`'d if it ran long, potentially leaving Drive in a partially-copied/moved state. `copy` and `move` now get the same extended timeout.
+
+### Investigated, confirmed NOT bugs (avoided introducing a regression)
+- `photos_download` was missing a `/photos/`-only path check that its sibling tools (`photos_add_to_album` etc.) have. Checked the CLI source first: `photo download` explicitly supports `/photos/`, `/albums/`, and `/photos-shared-with-me/` roots (`SUPPORTED_REMOTE_PATH_TYPES`). Adding the restriction would have been a regression, not a fix — left as-is.
+- Suspected `photos_add_to_album`/`remove_from_album`'s `/photos/`-only restriction was too narrow, since the underlying CLI command imposes no path-type restriction at all. Tested live: a compound `/albums/<name>/<photo>` path does **not** actually resolve through the CLI's path resolver — the existing restriction is correct as shipped.
+- Suspected the MCP-mode logger (stdout vs. stderr gating via `PROTON_DRIVE_MCP=1`) could leak a stray `console.log` into the JSON-RPC stream under some import order. Traced the actual call graph: `logger` is only ever used from within `index.ts`'s own functions, and the env var is set at that same module's top level before those functions can be invoked — the ordering is guaranteed correct by construction, not a bug.
+
+### Testing
+122 tests passing (was 121).
+
 ## 1.0.32 — 2026-08-21
 
 Closed the last disclosed gap from v1.0.31 — tested `drive_share_invite` for real, against the user's own Gmail address, through the actual MCP JSON-RPC server. Found a real bug in the process.

package/dist/cli.js

@@ -9,7 +9,7 @@
 import { DriveService, } from "./services/drive.js";
 import { DriveCliError, DriveCliNotFoundError, DriveNotAuthenticatedError, DriveParseError } from "./utils/errors.js";
 import { checkCliAvailable } from "./utils/subprocess.js";
-import { validateRemotePath, validateLocalPath, validateEmail, validateMessage, validateName } from "./utils/validation.js";
+import { validateRemotePath, validateLocalPath, validateEmail, validateMessage, validateName, validateFlagValue } from "./utils/validation.js";
 const drive = new DriveService();
 const args = process.argv.slice(2);
 const jsonMode = args.includes("--json");
@@ -288,8 +288,10 @@ async function run() {
                     console.error(`Invalid --role value: ${roleRaw}. Must be viewer or editor.`);
                     process.exit(1);
                 }
-                const password = getFlag("--password");
-                const expiration = getFlag("--expiration");
+                const rawPassword = getFlag("--password");
+                const rawExpiration = getFlag("--expiration");
+                const password = rawPassword ? validateFlagValue(rawPassword, "password") : undefined;
+                const expiration = rawExpiration ? validateFlagValue(rawExpiration, "expiration") : undefined;
                 print(await drive.shareSetUrl(setUrlPath, roleRaw, password, expiration));
             }
             else if (sub === "remove-url") {
@@ -344,20 +346,38 @@ async function run() {
                 print(await drive.listInvitations());
             }
             else if (sub === "accept") {
-                const acceptUid = rest[0];
-                if (!acceptUid) {
+                const rawAcceptUid = rest[0];
+                if (!rawAcceptUid) {
                     console.error("Usage: invitation accept <uid>");
                     process.exit(1);
                 }
+                let acceptUid;
+                try {
+                    acceptUid = validateFlagValue(rawAcceptUid, "uid");
+                }
+                catch (e) {
+                    console.error(e instanceof Error ? e.message : String(e));
+                    process.exit(1);
+                    return;
+                }
                 await drive.invitationAccept(acceptUid);
                 console.log("Invitation accepted.");
             }
             else if (sub === "reject") {
-                const rejectUid = rest[0];
-                if (!rejectUid) {
+                const rawRejectUid = rest[0];
+                if (!rawRejectUid) {
                     console.error("Usage: invitation reject <uid>");
                     process.exit(1);
                 }
+                let rejectUid;
+                try {
+                    rejectUid = validateFlagValue(rawRejectUid, "uid");
+                }
+                catch (e) {
+                    console.error(e instanceof Error ? e.message : String(e));
+                    process.exit(1);
+                    return;
+                }
                 await drive.invitationReject(rejectUid);
                 console.log("Invitation rejected.");
             }
@@ -371,21 +391,43 @@ async function run() {
                 print(await drive.listAlbums());
             }
             else if (sub === "create") {
-                const albumName = rest[0];
-                if (!albumName) {
+                const rawAlbumName = rest[0];
+                if (!rawAlbumName) {
                     console.error("Usage: album create <name>");
                     process.exit(1);
+                    return;
+                }
+                let albumName;
+                try {
+                    albumName = validateName(rawAlbumName);
+                }
+                catch (e) {
+                    console.error(e instanceof Error ? e.message : String(e));
+                    process.exit(1);
+                    return;
                 }
                 await drive.createAlbum(albumName);
                 console.log(`Album created: ${albumName}`);
             }
             else if (sub === "update") {
                 const albumPath = requirePath(rest[0], "album update <path> [--name] [--cover-photo-uid]");
-                const newName = getFlag("--name");
-                const coverPhotoUid = getFlag("--cover-photo-uid");
-                if (!newName && !coverPhotoUid) {
+                const rawNewName = getFlag("--name");
+                const rawCoverPhotoUid = getFlag("--cover-photo-uid");
+                if (!rawNewName && !rawCoverPhotoUid) {
                     console.error("Usage: album update <path> [--name <name>] [--cover-photo-uid <uid>] (at least one required)");
                     process.exit(1);
+                    return;
+                }
+                let newName;
+                let coverPhotoUid;
+                try {
+                    newName = rawNewName ? validateName(rawNewName) : undefined;
+                    coverPhotoUid = rawCoverPhotoUid ? validateName(rawCoverPhotoUid) : undefined;
+                }
+                catch (e) {
+                    console.error(e instanceof Error ? e.message : String(e));
+                    process.exit(1);
+                    return;
                 }
                 await drive.updateAlbum(albumPath, newName, coverPhotoUid);
                 console.log(`Album updated: ${albumPath}`);

package/dist/index.js

@@ -7,7 +7,7 @@ import { DriveService, } from "./services/drive.js";
 import { isMainModule } from "./utils/isMainModule.js";
 import { checkCliAvailable } from "./utils/subprocess.js";
 import { DriveCliNotFoundError, DriveCliError, DriveNotAuthenticatedError, DriveParseError, } from "./utils/errors.js";
-import { validateRemotePath, validateLocalPath, validateEmail, validateMessage, validateName } from "./utils/validation.js";
+import { validateRemotePath, validateLocalPath, validateEmail, validateMessage, validateName, validateFlagValue } from "./utils/validation.js";
 import { logger } from "./utils/logger.js";
 import { getSyncRoot, readSyncFile, writeSyncFile } from "./utils/syncfs.js";
 const require = createRequire(import.meta.url);
@@ -158,7 +158,7 @@ const TOOLS = [
             "E.g. downloading /my-files/report.pdf with localPath '/tmp/out' produces /tmp/out/report.pdf, not /tmp/out itself as a file — confirmed live against the real CLI (v0.8.0). " +
             "For folders, downloads recursively. " +
             "Conflict strategies are set separately for files and folders (CLI v0.8.0+) — both default to 'skip'. " +
-            "Returns {downloaded} count — not the actual local path; construct it as localPath + the remote item's basename if you need it. " +
+            "Returns {downloaded, skipped, failed} counts — not the actual local path; construct it as localPath + the remote item's basename if you need it. Fails the call if any file failed to download. " +
             "Do not use to move files within Drive (use drive_move) or to read a small text file's contents (use drive_read_file if PROTON_DRIVE_SYNC_PATH is set).",
         annotations: { openWorldHint: true },
         inputSchema: {
@@ -743,7 +743,7 @@ const TOOLS = [
     {
         name: "photos_list_timeline",
         description: "List photos in your Proton Photos timeline (your full photo library, not scoped to an album). Requires authentication. " +
-            "Returns [{nodeUid}] by default — pass loadDetails=true for full node metadata (slower; buffers the whole list in memory first). " +
+            "Returns [{nodeUid}] by default — pass loadDetails=true for [{nodeUid, name, mediaType, creationTime, totalStorageSize, captureTime, tags}] (slower; buffers the whole list in memory first). " +
             "Use photos_download to download items by path, or photos_add_to_album to add them to an album.",
         annotations: { readOnlyHint: true, idempotentHint: true },
         inputSchema: {
@@ -926,7 +926,11 @@ export async function main() {
                     if (!["skip", "merge", "rename", "remove"].includes(fodcs)) {
                         return fail(`folderConflictStrategy must be skip, merge, rename, or remove`);
                     }
-                    return ok(await drive.download(validateRemotePath(a.remotePath), validateLocalPath(a.localPath), fdcs, fodcs));
+                    const downloadResult = await drive.download(validateRemotePath(a.remotePath), validateLocalPath(a.localPath), fdcs, fodcs);
+                    if (downloadResult.failed > 0) {
+                        return fail(`Download completed with ${downloadResult.failed} failed file(s). downloaded=${downloadResult.downloaded} skipped=${downloadResult.skipped}`);
+                    }
+                    return ok(downloadResult);
                 }
                 case "drive_rename": {
                     const renamePath = validateRemotePath(a.path);
@@ -999,13 +1003,15 @@ export async function main() {
                 case "drive_invitation_accept": {
                     if (typeof a.uid !== "string" || !a.uid)
                         return fail("uid must be a non-empty string");
-                    await drive.invitationAccept(a.uid);
+                    const acceptUid = validateFlagValue(a.uid, "uid");
+                    await drive.invitationAccept(acceptUid);
                     return ok({ message: "Invitation accepted." });
                 }
                 case "drive_invitation_reject": {
                     if (typeof a.uid !== "string" || !a.uid)
                         return fail("uid must be a non-empty string");
-                    await drive.invitationReject(a.uid);
+                    const rejectUid = validateFlagValue(a.uid, "uid");
+                    await drive.invitationReject(rejectUid);
                     return ok({ message: "Invitation rejected." });
                 }
                 case "drive_share_leave": {
@@ -1018,8 +1024,8 @@ export async function main() {
                     const role = typeof a.role === "string" ? a.role : "viewer";
                     if (!["viewer", "editor"].includes(role))
                         return fail("role must be viewer or editor");
-                    const password = typeof a.password === "string" ? a.password : undefined;
-                    const expiration = typeof a.expiration === "string" ? a.expiration : undefined;
+                    const password = typeof a.password === "string" && a.password ? validateFlagValue(a.password, "password") : undefined;
+                    const expiration = typeof a.expiration === "string" && a.expiration ? validateFlagValue(a.expiration, "expiration") : undefined;
                     const link = await drive.shareSetUrl(setUrlPath, role, password, expiration);
                     return ok(link);
                 }
@@ -1041,15 +1047,16 @@ export async function main() {
                 case "photos_create_album": {
                     if (typeof a.name !== "string" || !a.name.trim())
                         return fail("name must be a non-empty string");
-                    await drive.createAlbum(a.name.trim());
-                    return ok({ message: `Album created: ${a.name.trim()}` });
+                    const albumName = validateName(a.name);
+                    await drive.createAlbum(albumName);
+                    return ok({ message: `Album created: ${albumName}` });
                 }
                 case "photos_update_album": {
                     const updateAlbumPath = validateRemotePath(a.albumPath);
                     if (!updateAlbumPath.startsWith("/albums/"))
                         return fail("albumPath must start with /albums/");
-                    const newName = typeof a.name === "string" && a.name.trim() ? a.name.trim() : undefined;
-                    const coverPhotoUid = typeof a.coverPhotoUid === "string" && a.coverPhotoUid.trim() ? a.coverPhotoUid.trim() : undefined;
+                    const newName = typeof a.name === "string" && a.name.trim() ? validateName(a.name) : undefined;
+                    const coverPhotoUid = typeof a.coverPhotoUid === "string" && a.coverPhotoUid.trim() ? validateName(a.coverPhotoUid) : undefined;
                     if (!newName && !coverPhotoUid)
                         return fail("At least one of name or coverPhotoUid must be provided");
                     await drive.updateAlbum(updateAlbumPath, newName, coverPhotoUid);
@@ -1123,8 +1130,9 @@ export async function main() {
                     const syncRoot = getSyncRoot();
                     if (!syncRoot)
                         return fail("PROTON_DRIVE_SYNC_PATH is not set. Set it to the root of your Proton Drive sync folder.");
-                    const content = await readSyncFile(syncRoot, validateRemotePath(a.path));
-                    return ok({ path: a.path, content });
+                    const readPath = validateRemotePath(a.path);
+                    const content = await readSyncFile(syncRoot, readPath);
+                    return ok({ path: readPath, content });
                 }
                 case "drive_write_file": {
                     const syncRoot = getSyncRoot();
@@ -1132,8 +1140,9 @@ export async function main() {
                         return fail("PROTON_DRIVE_SYNC_PATH is not set. Set it to the root of your Proton Drive sync folder.");
                     if (typeof a.content !== "string")
                         return fail("content must be a string");
-                    await writeSyncFile(syncRoot, validateRemotePath(a.path), a.content);
-                    return ok({ message: `Written: ${a.path}` });
+                    const writePath = validateRemotePath(a.path);
+                    await writeSyncFile(syncRoot, writePath, a.content);
+                    return ok({ message: `Written: ${writePath}` });
                 }
                 default:
                     throw new McpError(ErrorCode.MethodNotFound, `Unknown tool: ${name}`);

package/dist/services/drive.js

@@ -17,6 +17,18 @@ function unwrapResult(value, fallback = "") {
     }
     return typeof value === "string" ? value : fallback;
 }
+// The CLI's own path syntax requires escaping a literal '/' inside a node
+// name with a backslash (confirmed in `filesystem info --help`: "Escape /
+// in node names with a backslash"). Our own validateName() rejects '/' in
+// names WE create, but an item created by any other Proton Drive client
+// (web, desktop, mobile) can still have a literal '/' in its name. Confirmed
+// live: naively joining such a name into a path ("/parent/raw/slash") makes
+// every path-based tool (info, download, move, rename, delete, ...) fail
+// with "Node not found", while the correctly escaped form ("/parent/raw\/slash")
+// resolves. list() must escape names before building the path it returns.
+function escapeNameForPath(name) {
+    return name.replace(/\//g, "\\/");
+}
 // Strips "<package-name>@" and "+<hash>" from a version token like
 // "cli-drive@0.8.0+06e8c605", leaving "0.8.0". Falls back to the raw
 // token if it doesn't match, so an unexpected future format still shows
@@ -87,7 +99,7 @@ export class DriveService {
             const name = unwrapResult(item.name, "[unnamed]");
             return {
                 name,
-                path: posixPath.join(remotePath, name),
+                path: posixPath.join(remotePath, escapeNameForPath(name)),
                 type: item.type === "folder" || item.type === "album" ? "folder" : "file",
                 size: typeof item.totalStorageSize === "number" ? item.totalStorageSize : undefined,
                 modifiedAt: typeof item.modificationTime === "string" ? item.modificationTime : undefined,
@@ -105,7 +117,6 @@ export class DriveService {
             fileConflictStrategy,
             "--folder-conflict-strategy",
             folderConflictStrategy,
-            "--skip-thumbnails",
         ]);
         // Real shape is TransferSummary: {transferredItems, transferredBytes,
         // skippedItems, failedItems, failures}. Confirmed live — the old
@@ -125,12 +136,17 @@ export class DriveService {
             "--file-conflict-strategy", fileConflictStrategy,
             "--folder-conflict-strategy", folderConflictStrategy,
         ]);
-        // Same real shape as upload — TransferSummary, not {downloaded}.
+        // Same real shape as upload — TransferSummary, not {downloaded}. Previously
+        // this dropped skippedItems/failedItems entirely, and the MCP dispatch
+        // never checked for partial failure the way drive_upload's does — a
+        // download where some files failed silently reported success.
         const summary = this.parseTransferSummary(result);
         return {
             path: remotePath,
             localPath,
             downloaded: summary.transferredItems,
+            skipped: summary.skippedItems,
+            failed: summary.failedItems,
         };
     }
     // The CLI has no `mkdir` — it's `create-folder <parentPath> <name>`.
@@ -376,9 +392,24 @@ export class DriveService {
             return [];
         if (!Array.isArray(result))
             throw new DriveParseError(`Expected array from photo timeline, got: ${JSON.stringify(result).slice(0, 100)}`);
-        return result.map((item) => ({
-            nodeUid: String(item.nodeUid ?? item.uid ?? ""),
-        }));
+        // Without --load-details the CLI returns {nodeUid, captureTime, tags}.
+        // With --load-details it returns full node objects ({uid, name, mediaType,
+        // creationTime, totalStorageSize, photo: {captureTime, tags}, ...}) —
+        // confirmed live. Previously this always extracted only nodeUid, so
+        // loadDetails=true paid the CLI's slower buffered call for nothing: the
+        // "full node metadata" the tool description promises was thrown away.
+        return result.map((item) => {
+            const photo = (item.photo ?? {});
+            return {
+                nodeUid: String(item.nodeUid ?? item.uid ?? ""),
+                name: item.name !== undefined ? unwrapResult(item.name) || undefined : undefined,
+                mediaType: typeof item.mediaType === "string" ? item.mediaType : undefined,
+                creationTime: typeof item.creationTime === "string" ? item.creationTime : undefined,
+                totalStorageSize: typeof item.totalStorageSize === "number" ? item.totalStorageSize : undefined,
+                captureTime: typeof (item.captureTime ?? photo.captureTime) === "string" ? (item.captureTime ?? photo.captureTime) : undefined,
+                tags: Array.isArray(item.tags ?? photo.tags) ? (item.tags ?? photo.tags) : undefined,
+            };
+        });
     }
     async photoDownload(remotePaths, localFolder, conflictStrategy = "skip") {
         const result = await this.run([

package/dist/utils/subprocess.js

@@ -6,7 +6,12 @@ const CLI_BINARY = process.env["PROTON_DRIVE_BIN"] ?? "proton-drive";
 const DEFAULT_TIMEOUT_MS = 60_000;
 // Upload and download transfer actual file bytes — use a much longer timeout.
 const TRANSFER_TIMEOUT_MS = 30 * 60_000; // 30 minutes
-const TRANSFER_COMMANDS = new Set(["upload", "download"]);
+// copy/move can process large folder trees server-side (re-encrypting or
+// re-sharing many files), just like upload/download — they need the same
+// extended timeout. Previously only upload/download got it; a large
+// drive_copy or drive_move would be SIGKILL'd after the 60s default,
+// potentially leaving Drive in a partially-copied/moved state.
+const TRANSFER_COMMANDS = new Set(["upload", "download", "copy", "move"]);
 const TRANSFER_GROUPS = new Set(["filesystem", "photo"]);
 function timeoutFor(args) {
     // args[0] is the group (e.g. "filesystem"), args[1] is the subcommand

package/dist/utils/validation.js

@@ -31,18 +31,42 @@ export function validateMessage(message) {
     return m;
 }
 // For bare filename/name arguments passed as a positional CLI arg (not a
-// path) — e.g. rename's newName. Guards against flag injection the same way
-// validatePath/validateEmail/validateMessage do.
+// path) — e.g. rename's newName, album create/update's name. Guards against
+// flag injection the same way validatePath/validateEmail/validateMessage do.
+//
+// Also rejects '/': confirmed live that renaming a file to a name containing
+// '/' (e.g. "evil/nested.txt") succeeds on the CLI side, but the resulting
+// item's actual Drive name contains the slash literally — it is not two path
+// segments. Every other tool computes this item's path by joining parent +
+// name (see list()), producing a path that LOOKS like a nested folder but
+// isn't, and that path then fails to resolve ("Node not found") in every
+// other tool (info, download, move, delete, ...). The item becomes
+// unreachable except by listing its real parent and matching by prefix.
 export function validateName(name) {
     const n = String(name ?? "").trim();
     if (!n)
         throw new Error("name must not be empty");
     if (n.startsWith("-"))
         throw new Error(`name must not start with '-': ${n}`);
+    if (n.includes("/"))
+        throw new Error(`name must not contain '/': ${n}`);
     if (CONTROL_RE.test(n))
         throw new Error("name contains control characters");
     return n;
 }
+// Guards a value passed to a bare CLI flag (e.g. --password, --expiration)
+// against flag injection — confirmed live: `sharing set-url --password "-x"`
+// makes the real CLI's arg parser treat "-x" as an unknown flag and print
+// usage instead of setting the password. Unlike validateName, allows '/'
+// since these aren't Drive item names.
+export function validateFlagValue(value, label) {
+    const v = String(value ?? "").trim();
+    if (v.startsWith("-"))
+        throw new Error(`${label} must not start with '-': ${v}`);
+    if (CONTROL_RE.test(v))
+        throw new Error(`${label} contains control characters`);
+    return v;
+}
 export function validateLocalPath(path) {
     const p = validatePath(path);
     if (!isAbsolute(p))

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "proton-drive-mcp",
-  "version": "1.0.32",
+  "version": "1.0.34",
   "description": "MCP server and CLI that gives Claude full access to Proton Drive — upload, download, share, and manage your end-to-end encrypted files without leaving the conversation.",
   "type": "module",
   "main": "dist/index.js",