splitwise-mcp 3.1.2 → 3.2.1

package/dist/bundle.js

@@ -63223,6 +63223,33 @@ var storage2 = new AsyncLocalStorage2();
 function withCallerCapabilities(capabilities, fn2) {
   return capabilities ? storage2.run(capabilities, fn2) : fn2();
 }
+function currentCallerCapabilities() {
+  return storage2.getStore();
+}
+var ENVELOPE_CAPABILITIES_KEY = "io.modelcontextprotocol/clientCapabilities";
+var ELICITATION_MODES = ["form", "url"];
+function isRecord(value) {
+  return typeof value === "object" && value !== null && !Array.isArray(value);
+}
+function callerCapabilities(ctx) {
+  const envelope = isRecord(ctx) && isRecord(ctx.mcpReq) ? ctx.mcpReq.envelope : void 0;
+  if (isRecord(envelope)) {
+    const declared = envelope[ENVELOPE_CAPABILITIES_KEY];
+    if (isRecord(declared))
+      return declared;
+  }
+  return currentCallerCapabilities();
+}
+function callerAcceptsFormElicitation(ctx) {
+  const capabilities = callerCapabilities(ctx);
+  if (!capabilities)
+    return void 0;
+  const elicitation = capabilities.elicitation;
+  if (!isRecord(elicitation))
+    return false;
+  const namedModes = ELICITATION_MODES.filter((mode) => mode in elicitation);
+  return namedModes.length === 0 || namedModes.includes("form");
+}
 
 // node_modules/@modelcontextprotocol/server/dist/chunk-Br0eD_fh.mjs
 var __create2 = Object.create;
@@ -67621,6 +67648,37 @@ var inputRequired = Object.assign(buildInputRequired, {
     return { method: "roots/list" };
   }
 });
+function acceptedContent(responses, key, schema) {
+  const view = inputResponse(responses, key);
+  if (view.kind !== "elicit" || view.action !== "accept" || view.content === void 0) return void 0;
+  if (schema === void 0) return view.content;
+  const outcome = schema["~standard"].validate(view.content);
+  if (outcome instanceof Promise) throw new TypeError("acceptedContent(responses, key, schema) requires a synchronously-validating schema");
+  return outcome.issues === void 0 ? outcome.value : void 0;
+}
+function inputResponse(responses, key) {
+  if (responses === void 0 || typeof responses !== "object" || responses === null) return { kind: "missing" };
+  const entry = responses[key];
+  if (entry === null || typeof entry !== "object" || Array.isArray(entry)) return { kind: "missing" };
+  const candidate = entry;
+  if (candidate["action"] === "accept" || candidate["action"] === "decline" || candidate["action"] === "cancel") {
+    const content = candidate["content"];
+    return {
+      kind: "elicit",
+      action: candidate["action"],
+      ...content !== null && typeof content === "object" && !Array.isArray(content) && { content }
+    };
+  }
+  if (Array.isArray(candidate["roots"])) return {
+    kind: "roots",
+    roots: candidate["roots"]
+  };
+  if (typeof candidate["role"] === "string" && candidate["content"] !== void 0) return {
+    kind: "sampling",
+    result: candidate
+  };
+  return { kind: "missing" };
+}
 var REQUEST_STATE_ONLY_LEG_PACING_MS = 250;
 function inputRequiredRoundsExceededMessage(method, maxRounds) {
   return `Multi-round-trip request '${method}' still required input after ${maxRounds} rounds (inputRequired.maxRounds)`;
@@ -77668,14 +77726,14 @@ function serveStdio(factory, options = {}) {
     return false;
   };
   const answerLegacyRejection = (request, reason, requestedVersion) => {
-    const rejection2 = modernOnlyStrictRejection({
+    const rejection3 = modernOnlyStrictRejection({
       kind: "legacy",
       reason,
       ...requestedVersion !== void 0 && { requestedVersion }
     }, SUPPORTED_MODERN_PROTOCOL_VERSIONS);
-    if (rejection2 === void 0) return Promise.resolve();
-    reportError(/* @__PURE__ */ new Error(`Rejected 2025-era request on a modern-only stdio connection (${rejection2.cell}): ${rejection2.message}`));
-    return writeErrorResponse(request.id, rejection2.code, rejection2.message, rejection2.data);
+    if (rejection3 === void 0) return Promise.resolve();
+    reportError(/* @__PURE__ */ new Error(`Rejected 2025-era request on a modern-only stdio connection (${rejection3.cell}): ${rejection3.message}`));
+    return writeErrorResponse(request.id, rejection3.code, rejection3.message, rejection3.data);
   };
   const onInstanceClosed = (channel) => {
     if (closing || channel === discarding) return;
@@ -97696,6 +97754,11 @@ function walk(value, keep, drop) {
 }
 
 // node_modules/@chrischall/mcp-utils/dist/response/index.js
+function textResult(data) {
+  return {
+    content: [{ type: "text", text: JSON.stringify(data, null, 2) }]
+  };
+}
 function imageResult(base643, mimeType) {
   return {
     content: [{ type: "image", data: base643, mimeType }]
@@ -97716,6 +97779,418 @@ function pruneUndefined(obj) {
   return out;
 }
 
+// node_modules/@chrischall/mcp-utils/dist/server/confirmation.js
+import { createHash, createHmac, timingSafeEqual } from "node:crypto";
+
+// node_modules/@chrischall/mcp-utils/dist/server/canonical.js
+function canonicalJson(value) {
+  if (value === null || typeof value === "string" || typeof value === "boolean")
+    return JSON.stringify(value);
+  if (value === void 0)
+    return "null";
+  if (typeof value === "number")
+    return Number.isFinite(value) ? JSON.stringify(value) : `{"$num":"${String(value)}"}`;
+  if (typeof value === "bigint")
+    return `{"$bigint":"${value.toString()}"}`;
+  if (typeof value === "function" || typeof value === "symbol") {
+    throw new TypeError(`confirmation: cannot bind a ${typeof value} argument value.`);
+  }
+  if (Array.isArray(value))
+    return `[${value.map(canonicalJson).join(",")}]`;
+  if (value instanceof Date) {
+    return `{"$date":${JSON.stringify(Number.isNaN(value.getTime()) ? "Invalid Date" : value.toISOString())}}`;
+  }
+  if (ArrayBuffer.isView(value)) {
+    const bytes = Buffer.from(value.buffer, value.byteOffset, value.byteLength);
+    return `{"$bytes":${JSON.stringify(bytes.toString("base64"))}}`;
+  }
+  if (value instanceof ArrayBuffer)
+    return `{"$bytes":${JSON.stringify(Buffer.from(value).toString("base64"))}}`;
+  if (value instanceof Map) {
+    const entries2 = [...value.entries()].map(([k2, v2]) => `[${canonicalJson(k2)},${canonicalJson(v2)}]`).sort();
+    return `{"$map":[${entries2.join(",")}]}`;
+  }
+  if (value instanceof Set) {
+    return `{"$set":[${[...value].map(canonicalJson).sort().join(",")}]}`;
+  }
+  const proto = Object.getPrototypeOf(value);
+  if (proto !== Object.prototype && proto !== null) {
+    throw new TypeError("confirmation: cannot bind a non-plain object argument value (class instance).");
+  }
+  const entries = Object.entries(value).filter(([, v2]) => v2 !== void 0).sort(([a2], [b2]) => a2 < b2 ? -1 : a2 > b2 ? 1 : 0);
+  return `{${entries.map(([k2, v2]) => `${JSON.stringify(escapeKey(k2))}:${canonicalJson(v2)}`).join(",")}}`;
+}
+function escapeKey(key) {
+  return key.startsWith("$") ? `$${key}` : key;
+}
+
+// node_modules/@chrischall/mcp-utils/dist/server/confirmation.js
+var DEFAULT_REQUEST_KEY = "confirmation";
+var DEFAULT_CONFIRMATION_LABEL = "Confirm this action should proceed.";
+var UNSUPPORTED_NOTE = "Nothing was done because this client cannot show a confirmation prompt (it declares no MCP elicitation capability), and this action is never taken without one";
+var STATE_PREFIX = "mcpu.confirm.v1.";
+function bindingKey(binding) {
+  if (binding.ttlSeconds !== void 0 && !(Number.isFinite(binding.ttlSeconds) && binding.ttlSeconds > 0)) {
+    throw new RangeError("requireConfirmation: binding.ttlSeconds must be a finite number greater than 0.");
+  }
+  const key = typeof binding.key === "string" ? Buffer.from(binding.key, "utf8") : Buffer.from(binding.key);
+  if (key.length < 32) {
+    throw new RangeError("requireConfirmation: binding.key must be at least 32 bytes.");
+  }
+  return key;
+}
+function commitment(action, args) {
+  return createHash("sha256").update(`${action}\0${canonicalJson(args)}`).digest("base64url");
+}
+function mintState(key, action, binding) {
+  const exp = Math.floor(Date.now() / 1e3) + (binding.ttlSeconds ?? 600);
+  const body = Buffer.from(JSON.stringify({ c: commitment(action, binding.args), exp })).toString("base64url");
+  const mac3 = createHmac("sha256", key).update(`${STATE_PREFIX}${body}`).digest("base64url");
+  return `${STATE_PREFIX}${body}.${mac3}`;
+}
+function verifyState(key, action, binding, state) {
+  if (typeof state !== "string" || !state.startsWith(STATE_PREFIX))
+    return false;
+  const rest = state.slice(STATE_PREFIX.length);
+  const dot = rest.indexOf(".");
+  if (dot < 0)
+    return false;
+  const body = rest.slice(0, dot);
+  const mac3 = Buffer.from(rest.slice(dot + 1), "base64url");
+  const expected = createHmac("sha256", key).update(`${STATE_PREFIX}${body}`).digest();
+  if (mac3.length !== expected.length || !timingSafeEqual(mac3, expected))
+    return false;
+  let payload;
+  try {
+    payload = JSON.parse(Buffer.from(body, "base64url").toString("utf8"));
+  } catch {
+    return false;
+  }
+  if (typeof payload.exp !== "number" || payload.exp * 1e3 <= Date.now())
+    return false;
+  const want = Buffer.from(commitment(action, binding.args));
+  const got = Buffer.from(typeof payload.c === "string" ? payload.c : "");
+  return got.length === want.length && timingSafeEqual(got, want);
+}
+function echoedState(ctx) {
+  const accessor = ctx.mcpReq.requestState;
+  return typeof accessor === "function" ? accessor() : void 0;
+}
+function requireConfirmation(ctx, options) {
+  const requestKey = options.requestKey ?? DEFAULT_REQUEST_KEY;
+  const key = options.binding ? bindingKey(options.binding) : void 0;
+  const confirmationSchema = external_exports.object({
+    confirmed: external_exports.boolean().describe(options.confirmationLabel ?? DEFAULT_CONFIRMATION_LABEL)
+  });
+  const ask = () => {
+    const preview = {
+      action: options.action,
+      ...options.details === void 0 ? {} : { details: options.details }
+    };
+    return inputRequired({
+      inputRequests: {
+        [requestKey]: inputRequired.elicit({
+          message: `${options.message}
+${JSON.stringify(preview, null, 2)}`,
+          requestedSchema: confirmationSchema
+        })
+      },
+      ...key && options.binding ? { requestState: mintState(key, options.action, options.binding) } : {}
+    });
+  };
+  const response = inputResponse(ctx.mcpReq.inputResponses, requestKey);
+  const accepted = acceptedContent(ctx.mcpReq.inputResponses, requestKey, confirmationSchema);
+  if (response.kind === "missing") {
+    if (callerAcceptsFormElicitation(ctx) === false) {
+      return textResult({
+        confirmed: false,
+        dispatched: false,
+        action: options.action,
+        reason: "confirmation-unsupported",
+        note: options.unsupportedNote ? `${UNSUPPORTED_NOTE}. ${options.unsupportedNote}` : `${UNSUPPORTED_NOTE}.`
+      });
+    }
+    return ask();
+  }
+  if (response.kind === "elicit" && response.action === "accept" && accepted?.confirmed === true) {
+    if (key && options.binding) {
+      const state = echoedState(ctx);
+      if (state === void 0 || state === null) {
+        return errorResult(`Confirmation for ${options.action} was accepted, but the retry carried no requestState, so it cannot be checked against the prompt that was shown. Nothing was done. The likely cause is that the MCP client or host does not round-trip requestState (it must echo the requestState from the input_required result back on the retry); asking again would loop.`);
+      }
+      if (!verifyState(key, options.action, options.binding, state))
+        return ask();
+    }
+    return void 0;
+  }
+  return textResult({
+    confirmed: false,
+    cancelled: true,
+    action: options.action,
+    note: "Nothing was changed because the confirmation was declined, cancelled, or left unchecked."
+  });
+}
+
+// node_modules/@chrischall/mcp-utils/dist/server/confirm-token.js
+import { createHash as createHash2, createHmac as createHmac2, randomBytes, timingSafeEqual as timingSafeEqual2 } from "node:crypto";
+function createSpentTokenStore() {
+  const spent = /* @__PURE__ */ new Map();
+  return {
+    has: (nonce) => spent.has(nonce),
+    add: (nonce, exp) => {
+      spent.set(nonce, exp);
+    },
+    prune: (now) => {
+      for (const [nonce, exp] of spent)
+        if (exp < now)
+          spent.delete(nonce);
+    },
+    clear: () => spent.clear(),
+    get size() {
+      return spent.size;
+    }
+  };
+}
+var PROCESS_SPENT = createSpentTokenStore();
+var PREFIX = "mcpu.token.v1.";
+var DEFAULT_TTL_SECONDS = 600;
+function tokenKey(key) {
+  const bytes = typeof key === "string" ? Buffer.from(key, "utf8") : Buffer.from(key);
+  if (bytes.length < 32)
+    throw new RangeError("confirm token: key must be at least 32 bytes.");
+  return bytes;
+}
+function ttlOf(ttlSeconds) {
+  if (ttlSeconds === void 0)
+    return DEFAULT_TTL_SECONDS;
+  if (!(Number.isFinite(ttlSeconds) && ttlSeconds > 0)) {
+    throw new RangeError("confirm token: ttlSeconds must be a finite number greater than 0.");
+  }
+  return ttlSeconds;
+}
+function sign(key, body) {
+  return createHmac2("sha256", key).update(`${PREFIX}${body}`).digest();
+}
+function hashConfirmPayload(payload) {
+  return createHash2("sha256").update(canonicalJson(payload)).digest("base64url");
+}
+function issueConfirmToken(key, binding, options = {}) {
+  const k2 = tokenKey(key);
+  const now = options.now ?? Date.now();
+  const exp = now + ttlOf(options.ttlSeconds) * 1e3;
+  const claims = {
+    t: binding.tool,
+    ...binding.account === void 0 ? {} : { a: binding.account },
+    g: binding.target,
+    ...binding.revision === void 0 ? {} : { r: binding.revision },
+    h: binding.payloadHash,
+    exp,
+    n: randomBytes(16).toString("base64url")
+  };
+  const body = Buffer.from(JSON.stringify(claims), "utf8").toString("base64url");
+  return { token: `${PREFIX}${body}.${sign(k2, body).toString("base64url")}`, expiresAt: new Date(exp).toISOString() };
+}
+function parseClaims(body) {
+  try {
+    const claims = JSON.parse(Buffer.from(body, "base64url").toString("utf8"));
+    return claims && typeof claims === "object" ? claims : void 0;
+  } catch {
+    return void 0;
+  }
+}
+function verifyConfirmToken(key, token, binding, options = {}) {
+  const k2 = tokenKey(key);
+  const now = options.now ?? Date.now();
+  const spent = options.spent ?? PROCESS_SPENT;
+  spent.prune(now);
+  if (!token.startsWith(PREFIX))
+    return { ok: false, error: "TOKEN_INVALID" };
+  const rest = token.slice(PREFIX.length);
+  const dot = rest.indexOf(".");
+  const body = dot < 0 ? "" : rest.slice(0, dot);
+  const mac3 = Buffer.from(dot < 0 ? "" : rest.slice(dot + 1), "base64url");
+  const expected = sign(k2, body);
+  if (!body || mac3.length !== expected.length || !timingSafeEqual2(mac3, expected))
+    return { ok: false, error: "TOKEN_INVALID" };
+  const claims = parseClaims(body);
+  if (!claims)
+    return { ok: false, error: "TOKEN_INVALID" };
+  if (claims.t !== binding.tool || claims.a !== binding.account || claims.g !== binding.target) {
+    return { ok: false, error: "TOKEN_INVALID" };
+  }
+  if (spent.has(claims.n))
+    return { ok: false, error: "TOKEN_REUSED" };
+  if (now > claims.exp)
+    return { ok: false, error: "TOKEN_EXPIRED" };
+  if (claims.r !== binding.revision)
+    return { ok: false, error: "DRAFT_CHANGED", reason: "revision-changed" };
+  if (claims.h !== binding.payloadHash)
+    return { ok: false, error: "DRAFT_CHANGED", reason: "payload-changed" };
+  spent.add(claims.n, claims.exp);
+  return { ok: true };
+}
+var CONFIRM_TOKEN_INSTRUCTION = "Show this preview to the user verbatim and proceed only after they explicitly approve in chat. Then call again with confirmToken.";
+var confirmTokenParam = external_exports.string().optional().describe(`ONLY for the two-step confirmation fallback (a client without MCP elicitation). The confirmToken from this same tool's phase-1 "confirmation-required" response, passed back ONLY after the user has seen that preview and explicitly approved it in chat \u2014 never on the first call, never invented, never reused. Call again with the same arguments. Ignored when the client supports elicitation.`);
+var TOKEN_ERROR_NOTE = {
+  TOKEN_EXPIRED: "Nothing was sent or changed: the confirmToken expired. Call again WITHOUT confirmToken for a fresh preview, and ask the user to approve it again.",
+  TOKEN_REUSED: "Nothing was sent or changed by this call: this confirmToken was already used, and one approval acts once. If doing it again is really intended, call again WITHOUT confirmToken and get a new approval.",
+  TOKEN_INVALID: "Nothing was sent or changed: this confirmToken was not issued by this server for this tool, account and target (or the server has restarted since). Call again WITHOUT confirmToken for a fresh preview and approval."
+};
+var CHANGED_NOTE = {
+  "revision-changed": "Nothing was sent or changed: the target was edited since the user approved it (its version rotated), so what would happen is not what they saw.",
+  "payload-changed": "Nothing was sent or changed: what would happen no longer matches what the user approved."
+};
+function isToolResult(value) {
+  return Array.isArray(value.content);
+}
+function rejection2(data) {
+  return { ...textResult({ status: "confirmation-rejected", confirmed: false, dispatched: false, ...data }), isError: true };
+}
+async function tokenConfirmation(action, fb) {
+  const subject = await fb.subject();
+  if (isToolResult(subject))
+    return subject;
+  const binding = {
+    tool: fb.tool,
+    ...fb.account === void 0 ? {} : { account: fb.account },
+    target: subject.target,
+    ...subject.revision === void 0 ? {} : { revision: subject.revision },
+    payloadHash: hashConfirmPayload(subject.payload)
+  };
+  const phaseOne = () => {
+    const { token, expiresAt } = issueConfirmToken(fb.key, binding, { ttlSeconds: fb.ttlSeconds });
+    return {
+      action,
+      preview: subject.preview,
+      confirmToken: token,
+      expiresAt,
+      ttlSeconds: ttlOf(fb.ttlSeconds),
+      instruction: fb.instruction ?? CONFIRM_TOKEN_INSTRUCTION
+    };
+  };
+  if (!fb.confirmToken) {
+    return textResult({ status: "confirmation-required", confirmed: false, dispatched: false, ...phaseOne() });
+  }
+  const verdict = verifyConfirmToken(fb.key, fb.confirmToken, binding, { spent: fb.spent });
+  if (verdict.ok)
+    return void 0;
+  if (verdict.error === "DRAFT_CHANGED") {
+    return rejection2({
+      error: "DRAFT_CHANGED",
+      reason: verdict.reason,
+      note: `${CHANGED_NOTE[verdict.reason]} The current preview and a fresh confirmToken are below.`,
+      ...phaseOne()
+    });
+  }
+  return rejection2({ error: verdict.error, action, note: TOKEN_ERROR_NOTE[verdict.error] });
+}
+async function requireConfirmationWithFallback(ctx, options) {
+  const { tokenFallback, ...confirmation } = options;
+  if (tokenFallback && callerAcceptsFormElicitation(ctx) === false) {
+    return tokenConfirmation(options.action, tokenFallback);
+  }
+  return requireConfirmation(ctx, confirmation);
+}
+
+// node_modules/@chrischall/mcp-utils/dist/server/confirm-env.js
+import { createHash as createHash3, randomBytes as randomBytes2 } from "node:crypto";
+
+// node_modules/@chrischall/mcp-utils/dist/config/index.js
+import { homedir } from "node:os";
+import { isAbsolute, join, resolve } from "node:path";
+var PLACEHOLDER_RE = /^\$\{[^}]*\}$/;
+function readEnvVar(key, opts = {}) {
+  const env = opts.env ?? process.env;
+  const raw = env[key];
+  if (typeof raw === "string") {
+    const trimmed = raw.trim();
+    if (trimmed.length > 0 && trimmed !== "undefined" && trimmed !== "null" && !PLACEHOLDER_RE.test(trimmed)) {
+      return trimmed;
+    }
+  }
+  return opts.default;
+}
+function expandPath(p2) {
+  let expanded = p2;
+  if (p2 === "~") {
+    expanded = homedir();
+  } else if (p2.startsWith("~/")) {
+    expanded = join(homedir(), p2.slice(2));
+  }
+  return isAbsolute(expanded) ? expanded : resolve(expanded);
+}
+async function loadDotenvSafely(opts = {}) {
+  try {
+    const mod = await import(
+      /* @vite-ignore */
+      "dotenv"
+    );
+    const result = mod.config({
+      ...opts.path !== void 0 ? { path: opts.path } : {},
+      override: opts.override ?? false,
+      quiet: true
+    });
+    return result.error === void 0;
+  } catch {
+    return false;
+  }
+}
+
+// node_modules/@chrischall/mcp-utils/dist/server/confirm-env.js
+var MODES = /* @__PURE__ */ new Set(["ask-user", "auto", "refuse"]);
+var DEFAULT_TTL_SECONDS2 = 600;
+var warned = /* @__PURE__ */ new Set();
+function readConfirmMode(env = process.env) {
+  const raw = readEnvVar("MCP_CONFIRM_MODE", { env })?.trim().toLowerCase();
+  if (!raw)
+    return "ask-user";
+  if (MODES.has(raw))
+    return raw;
+  if (!warned.has(raw)) {
+    warned.add(raw);
+    process.stderr.write(`MCP_CONFIRM_MODE="${raw}" is not one of ask-user, auto, refuse; treating it as refuse.
+`);
+  }
+  return "refuse";
+}
+function confirmTtlFromEnv(env = process.env) {
+  const raw = readEnvVar("MCP_CONFIRM_TTL_SECONDS", { env })?.trim();
+  return raw && /^[1-9]\d*$/.test(raw) ? Number(raw) : DEFAULT_TTL_SECONDS2;
+}
+var processKey;
+function confirmKeyFromEnv(env = process.env) {
+  const secret = readEnvVar("MCP_CONFIRM_SECRET", { env });
+  if (secret)
+    return createHash3("sha256").update(secret, "utf8").digest();
+  processKey ??= randomBytes2(32);
+  return processKey;
+}
+var CONFIRM_TOKEN_AUTO_INSTRUCTION = "Nothing has been done yet. Review this preview; if it is what was intended, call again with the same arguments plus confirmToken. (This server runs with MCP_CONFIRM_MODE=auto, so the user's approval in chat is not required.)";
+var REFUSE_HINT = "Set MCP_CONFIRM_MODE=ask-user on the server to allow two-step confirmation instead.";
+function confirmationFromEnv(options) {
+  const { tool, account, confirmToken, subject, instruction, spent, env = process.env, ...confirmation } = options;
+  const mode = readConfirmMode(env);
+  if (mode === "refuse") {
+    return {
+      ...confirmation,
+      unsupportedNote: confirmation.unsupportedNote ? `${confirmation.unsupportedNote} ${REFUSE_HINT}` : REFUSE_HINT
+    };
+  }
+  return {
+    ...confirmation,
+    tokenFallback: {
+      key: confirmKeyFromEnv(env),
+      tool,
+      ...account === void 0 ? {} : { account },
+      ...confirmToken === void 0 ? {} : { confirmToken },
+      subject,
+      ttlSeconds: confirmTtlFromEnv(env),
+      instruction: mode === "auto" ? CONFIRM_TOKEN_AUTO_INSTRUCTION : instruction ?? CONFIRM_TOKEN_INSTRUCTION,
+      ...spent === void 0 ? {} : { spent }
+    }
+  };
+}
+
 // node_modules/@chrischall/mcp-utils/dist/server/index.js
 var SERVER_PROTOCOL_VERSIONS = Object.freeze([
   "2026-07-28",
@@ -97891,47 +98366,6 @@ function runMcp(opts) {
   return handle;
 }
 
-// node_modules/@chrischall/mcp-utils/dist/config/index.js
-import { homedir } from "node:os";
-import { isAbsolute, join, resolve } from "node:path";
-var PLACEHOLDER_RE = /^\$\{[^}]*\}$/;
-function readEnvVar(key, opts = {}) {
-  const env = opts.env ?? process.env;
-  const raw = env[key];
-  if (typeof raw === "string") {
-    const trimmed = raw.trim();
-    if (trimmed.length > 0 && trimmed !== "undefined" && trimmed !== "null" && !PLACEHOLDER_RE.test(trimmed)) {
-      return trimmed;
-    }
-  }
-  return opts.default;
-}
-function expandPath(p2) {
-  let expanded = p2;
-  if (p2 === "~") {
-    expanded = homedir();
-  } else if (p2.startsWith("~/")) {
-    expanded = join(homedir(), p2.slice(2));
-  }
-  return isAbsolute(expanded) ? expanded : resolve(expanded);
-}
-async function loadDotenvSafely(opts = {}) {
-  try {
-    const mod = await import(
-      /* @vite-ignore */
-      "dotenv"
-    );
-    const result = mod.config({
-      ...opts.path !== void 0 ? { path: opts.path } : {},
-      override: opts.override ?? false,
-      quiet: true
-    });
-    return result.error === void 0;
-  } catch {
-    return false;
-  }
-}
-
 // node_modules/@chrischall/mcp-utils/dist/fs/confine.js
 import { existsSync, realpathSync } from "node:fs";
 import { dirname, isAbsolute as isAbsolute2, relative, resolve as resolve2, sep } from "node:path";
@@ -98563,16 +98997,25 @@ function viewGeneric(view, payload) {
 }
 
 // src/tools/_confirm.ts
-function previewUnlessConfirmed(confirm, action, method, path, body) {
-  if (confirm === true) return null;
-  return minifiedResult({
-    dryRun: true,
-    action,
-    method,
-    path,
-    ...body !== void 0 ? { willSend: body } : {},
-    note: "Re-run with confirm: true to execute."
-  });
+var CONFIRM_NOTE = "Asks the user to confirm first: a confirmation prompt where the client supports one; otherwise the first call returns a preview and a confirmToken, and only a repeat call with that token proceeds (see MCP_CONFIRM_MODE).";
+function confirmWrite(ctx, gate) {
+  const request = {
+    method: gate.method,
+    path: gate.path,
+    ...gate.body !== void 0 ? { willSend: gate.body } : {}
+  };
+  const preview = { action: gate.summary, ...request };
+  return requireConfirmationWithFallback(
+    ctx,
+    confirmationFromEnv({
+      action: gate.action,
+      message: `Review and confirm: ${gate.summary}`,
+      details: preview,
+      tool: gate.tool,
+      confirmToken: gate.confirmToken,
+      subject: () => ({ target: String(gate.target), payload: request, preview })
+    })
+  );
 }
 
 // src/tools/user.ts
@@ -98609,11 +99052,11 @@ function registerUserTools(server, client2) {
   server.registerTool(
     "sw_update_user",
     {
-      description: "Update the current user's profile fields: name, locale and default currency. id must be the current user's id. The login email and password are deliberately not settable here \u2014 account credentials are changed in the Splitwise app, not by an assistant.",
+      description: "Update the current user's profile fields: name, locale and default currency. id must be the current user's id. The login email and password are deliberately not settable here \u2014 account credentials are changed in the Splitwise app, not by an assistant. " + CONFIRM_NOTE,
       annotations: { readOnlyHint: false, destructiveHint: true },
       // No `email` / `password`: changing the login email is an account
       // takeover primitive (a password reset to the new address follows), and
-      // the only gate would be a model-set `confirm` that injected text from
+      // the only gate would be a model-driven confirmation that injected text from
       // comments, notifications or receipts could talk it into (fleet-audit
       // #250). z.object strips unknown keys, so a caller passing them anyway
       // has them dropped before the request is built.
@@ -98623,23 +99066,26 @@ function registerUserTools(server, client2) {
         last_name: external_exports.string().optional(),
         locale: external_exports.string().optional(),
         default_currency: external_exports.string().optional(),
-        confirm: schemaConfirm
+        confirmToken: confirmTokenParam
       })
     },
-    async ({ id, first_name, last_name, locale, default_currency, confirm }) => {
+    async ({ id, first_name, last_name, locale, default_currency, confirmToken }, ctx) => {
       const body = pruneUndefined({
         first_name,
         last_name,
         locale,
         default_currency
       });
-      const gate = previewUnlessConfirmed(
-        confirm,
-        `Update current Splitwise user ${id} profile`,
-        "POST",
-        `/update_user/${id}`,
-        body
-      );
+      const gate = await confirmWrite(ctx, {
+        tool: "sw_update_user",
+        action: "user.update",
+        summary: `Update current Splitwise user ${id} profile`,
+        method: "POST",
+        path: `/update_user/${id}`,
+        body,
+        target: id,
+        confirmToken
+      });
       if (gate) return gate;
       const data = await client2.request("POST", `/update_user/${id}`, body);
       return minifiedResult(data);
@@ -98850,24 +99296,27 @@ function registerGroupTools(server, client2) {
   server.registerTool(
     "sw_create_group",
     {
-      description: "Create a new Splitwise group.",
+      description: `Create a new Splitwise group. ${CONFIRM_NOTE}`,
       annotations: { destructiveHint: true },
       inputSchema: external_exports.object({
         name: external_exports.string().describe("Group name"),
         group_type: external_exports.enum(["apartment", "house", "trip", "other"]).describe("Type of group").optional(),
         simplify_by_default: external_exports.boolean().describe("Whether to simplify debts by default").optional(),
-        confirm: schemaConfirm
+        confirmToken: confirmTokenParam
       })
     },
-    async ({ name, group_type, simplify_by_default, confirm }) => {
+    async ({ name, group_type, simplify_by_default, confirmToken }, ctx) => {
       const body = pruneUndefined({ name, group_type, simplify_by_default });
-      const gate = previewUnlessConfirmed(
-        confirm,
-        `Create Splitwise group "${name}"`,
-        "POST",
-        "/create_group",
-        body
-      );
+      const gate = await confirmWrite(ctx, {
+        tool: "sw_create_group",
+        action: "group.create",
+        summary: `Create Splitwise group "${name}"`,
+        method: "POST",
+        path: "/create_group",
+        body,
+        target: "",
+        confirmToken
+      });
       if (gate) return gate;
       const data = await client2.request("POST", "/create_group", body);
       return minifiedResult(data);
@@ -98876,17 +99325,17 @@ function registerGroupTools(server, client2) {
   server.registerTool(
     "sw_add_user_to_group",
     {
-      description: "Add a user to a Splitwise group. Provide user_id (preferred, use sw_list_friends to resolve a name) or first_name + last_name + email to invite by email.",
+      description: `Add a user to a Splitwise group. Provide user_id (preferred, use sw_list_friends to resolve a name) or first_name + last_name + email to invite by email. ${CONFIRM_NOTE}`,
       inputSchema: external_exports.object({
         group_id: external_exports.number().describe("Group ID"),
         user_id: external_exports.number().describe("User ID (preferred)").optional(),
         first_name: external_exports.string().optional(),
         last_name: external_exports.string().optional(),
         email: external_exports.string().optional(),
-        confirm: schemaConfirm
+        confirmToken: confirmTokenParam
       })
     },
-    async ({ group_id, user_id, first_name, last_name, email: email4, confirm }) => {
+    async ({ group_id, user_id, first_name, last_name, email: email4, confirmToken }, ctx) => {
       let body;
       if (user_id !== void 0) {
         body = { group_id, user_id };
@@ -98898,13 +99347,16 @@ function registerGroupTools(server, client2) {
         }
         body = { group_id, first_name, last_name, email: email4 };
       }
-      const gate = previewUnlessConfirmed(
-        confirm,
-        `Add a user to Splitwise group ${group_id} (may send an invite email)`,
-        "POST",
-        "/add_user_to_group",
-        body
-      );
+      const gate = await confirmWrite(ctx, {
+        tool: "sw_add_user_to_group",
+        action: "group.add_user",
+        summary: `Add a user to Splitwise group ${group_id} (may send an invite email)`,
+        method: "POST",
+        path: "/add_user_to_group",
+        body,
+        target: group_id,
+        confirmToken
+      });
       if (gate) return gate;
       const data = await client2.request("POST", "/add_user_to_group", body);
       return minifiedResult(data);
@@ -98913,22 +99365,25 @@ function registerGroupTools(server, client2) {
   server.registerTool(
     "sw_remove_user_from_group",
     {
-      description: "Remove a user from a Splitwise group. Without confirm:true this returns a dry-run preview and makes NO network call; with confirm:true it removes the user.",
+      description: `Remove a user from a Splitwise group. ${CONFIRM_NOTE}`,
       annotations: { destructiveHint: true },
       inputSchema: external_exports.object({
         group_id: external_exports.number().describe("Group ID"),
         user_id: external_exports.number().describe("User ID to remove"),
-        confirm: schemaConfirm
+        confirmToken: confirmTokenParam
       })
     },
-    async ({ group_id, user_id, confirm }) => {
-      const gate = previewUnlessConfirmed(
-        confirm,
-        `Remove user ${user_id} from Splitwise group ${group_id}`,
-        "POST",
-        "/remove_user_from_group",
-        { group_id, user_id }
-      );
+    async ({ group_id, user_id, confirmToken }, ctx) => {
+      const gate = await confirmWrite(ctx, {
+        tool: "sw_remove_user_from_group",
+        action: "group.remove_user",
+        summary: `Remove user ${user_id} from Splitwise group ${group_id}`,
+        method: "POST",
+        path: "/remove_user_from_group",
+        body: { group_id, user_id },
+        target: group_id,
+        confirmToken
+      });
       if (gate) return gate;
       const data = await client2.request("POST", "/remove_user_from_group", { group_id, user_id });
       return minifiedResult(data);
@@ -98937,20 +99392,23 @@ function registerGroupTools(server, client2) {
   server.registerTool(
     "sw_delete_group",
     {
-      description: "Soft-delete a Splitwise group. Without confirm:true this returns a dry-run preview and makes NO network call; with confirm:true it deletes.",
+      description: `Soft-delete a Splitwise group. ${CONFIRM_NOTE}`,
       annotations: { destructiveHint: true },
       inputSchema: external_exports.object({
         id: external_exports.number().describe("Group ID to delete"),
-        confirm: schemaConfirm
+        confirmToken: confirmTokenParam
       })
     },
-    async ({ id, confirm }) => {
-      const gate = previewUnlessConfirmed(
-        confirm,
-        `Soft-delete Splitwise group ${id}`,
-        "POST",
-        `/delete_group/${id}`
-      );
+    async ({ id, confirmToken }, ctx) => {
+      const gate = await confirmWrite(ctx, {
+        tool: "sw_delete_group",
+        action: "group.delete",
+        summary: `Soft-delete Splitwise group ${id}`,
+        method: "POST",
+        path: `/delete_group/${id}`,
+        target: id,
+        confirmToken
+      });
       if (gate) return gate;
       const data = await client2.request("POST", `/delete_group/${id}`);
       return minifiedResult(data);
@@ -98990,24 +99448,27 @@ function registerFriendTools(server, client2) {
   server.registerTool(
     "sw_create_friend",
     {
-      description: "Add a Splitwise friend by email (sends them an invite). Without confirm:true this returns a dry-run preview and makes NO network call; with confirm:true it adds the friend.",
+      description: `Add a Splitwise friend by email (sends them an invite). ${CONFIRM_NOTE}`,
       annotations: { destructiveHint: true },
       inputSchema: external_exports.object({
         user_email: external_exports.string().describe("Email of the user to add as a friend"),
         user_first_name: external_exports.string().describe("First name of the user").optional(),
         user_last_name: external_exports.string().describe("Last name of the user").optional(),
-        confirm: schemaConfirm
+        confirmToken: confirmTokenParam
       })
     },
-    async ({ user_email, user_first_name, user_last_name, confirm }) => {
+    async ({ user_email, user_first_name, user_last_name, confirmToken }, ctx) => {
       const body = pruneUndefined({ user_email, user_first_name, user_last_name });
-      const gate = previewUnlessConfirmed(
-        confirm,
-        `Add ${user_email} as a Splitwise friend`,
-        "POST",
-        "/create_friend",
-        body
-      );
+      const gate = await confirmWrite(ctx, {
+        tool: "sw_create_friend",
+        action: "friend.create",
+        summary: `Add ${user_email} as a Splitwise friend`,
+        method: "POST",
+        path: "/create_friend",
+        body,
+        target: user_email,
+        confirmToken
+      });
       if (gate) return gate;
       const data = await client2.request("POST", "/create_friend", body);
       return minifiedResult(data);
@@ -99016,20 +99477,23 @@ function registerFriendTools(server, client2) {
   server.registerTool(
     "sw_delete_friend",
     {
-      description: "Remove a Splitwise friendship by user id. Without confirm:true this returns a dry-run preview and makes NO network call; with confirm:true it removes the friendship.",
+      description: `Remove a Splitwise friendship by user id. ${CONFIRM_NOTE}`,
       annotations: { destructiveHint: true },
       inputSchema: external_exports.object({
         id: external_exports.number().describe("User ID of the friend to remove"),
-        confirm: schemaConfirm
+        confirmToken: confirmTokenParam
       })
     },
-    async ({ id, confirm }) => {
-      const gate = previewUnlessConfirmed(
-        confirm,
-        `Remove Splitwise friendship with user ${id}`,
-        "POST",
-        `/delete_friend/${id}`
-      );
+    async ({ id, confirmToken }, ctx) => {
+      const gate = await confirmWrite(ctx, {
+        tool: "sw_delete_friend",
+        action: "friend.delete",
+        summary: `Remove Splitwise friendship with user ${id}`,
+        method: "POST",
+        path: `/delete_friend/${id}`,
+        target: id,
+        confirmToken
+      });
       if (gate) return gate;
       const data = await client2.request("POST", `/delete_friend/${id}`);
       return minifiedResult(data);
@@ -99052,7 +99516,7 @@ function buildExpenseBody(args) {
     split_equally,
     users,
     expense_id: _id,
-    confirm: _confirm,
+    confirmToken: _confirmToken,
     ...rest
   } = args;
   if (split_equally && users) {
@@ -99126,7 +99590,7 @@ function registerExpenseTools(server, client2) {
   server.registerTool(
     "sw_create_expense",
     {
-      description: 'Create a Splitwise expense. Use split_equally:true to split evenly among group members, or provide a users array for custom per-person splits (paid_share and owed_share as decimal strings like "25.00"). cost must be a decimal string. Without confirm:true this returns a dry-run preview and makes NO network call; with confirm:true it creates the expense.',
+      description: `Create a Splitwise expense. Use split_equally:true to split evenly among group members, or provide a users array for custom per-person splits (paid_share and owed_share as decimal strings like "25.00"). cost must be a decimal string. ${CONFIRM_NOTE}`,
       inputSchema: external_exports.object({
         group_id: external_exports.number().describe("Group to add expense to (use 0 for no group)"),
         description: external_exports.string().describe("Short description of the expense"),
@@ -99139,18 +99603,21 @@ function registerExpenseTools(server, client2) {
         date: external_exports.string().describe("ISO 8601 datetime").optional(),
         category_id: external_exports.number().describe("Category id from sw_get_categories").optional(),
         details: external_exports.string().describe("Notes").optional(),
-        confirm: schemaConfirm
+        confirmToken: confirmTokenParam
       })
     },
-    async (args) => {
+    async (args, ctx) => {
       const body = buildExpenseBody(args);
-      const gate = previewUnlessConfirmed(
-        args.confirm,
-        `Create a Splitwise expense "${args.description}" (${args.cost}) \u2014 notifies group members`,
-        "POST",
-        "/create_expense",
-        body
-      );
+      const gate = await confirmWrite(ctx, {
+        tool: "sw_create_expense",
+        action: "expense.create",
+        summary: `Create a Splitwise expense "${args.description}" (${args.cost}) \u2014 notifies group members`,
+        method: "POST",
+        path: "/create_expense",
+        body,
+        target: args.group_id,
+        confirmToken: args.confirmToken
+      });
       if (gate) return gate;
       const data = await client2.request("POST", "/create_expense", body);
       return minifiedResult(data);
@@ -99159,7 +99626,7 @@ function registerExpenseTools(server, client2) {
   server.registerTool(
     "sw_update_expense",
     {
-      description: "Edit an existing Splitwise expense. Provide expense_id and any fields to change. For custom split updates, the full users array must be provided (the API replaces the entire split). Without confirm:true this returns a dry-run preview and makes NO network call; with confirm:true it updates the expense.",
+      description: `Edit an existing Splitwise expense. Provide expense_id and any fields to change. For custom split updates, the full users array must be provided (the API replaces the entire split). ${CONFIRM_NOTE}`,
       inputSchema: external_exports.object({
         expense_id: external_exports.number().describe("ID of the expense to update"),
         description: external_exports.string().optional(),
@@ -99172,19 +99639,22 @@ function registerExpenseTools(server, client2) {
         date: external_exports.string().optional(),
         category_id: external_exports.number().optional(),
         details: external_exports.string().optional(),
-        confirm: schemaConfirm
+        confirmToken: confirmTokenParam
       })
     },
-    async (args) => {
+    async (args, ctx) => {
       const { expense_id } = args;
       const body = buildExpenseBody(args);
-      const gate = previewUnlessConfirmed(
-        args.confirm,
-        `Update Splitwise expense ${expense_id} \u2014 notifies group members`,
-        "POST",
-        `/update_expense/${expense_id}`,
-        body
-      );
+      const gate = await confirmWrite(ctx, {
+        tool: "sw_update_expense",
+        action: "expense.update",
+        summary: `Update Splitwise expense ${expense_id} \u2014 notifies group members`,
+        method: "POST",
+        path: `/update_expense/${expense_id}`,
+        body,
+        target: expense_id,
+        confirmToken: args.confirmToken
+      });
       if (gate) return gate;
       const data = await client2.request("POST", `/update_expense/${expense_id}`, body);
       return minifiedResult(data);
@@ -99193,20 +99663,23 @@ function registerExpenseTools(server, client2) {
   server.registerTool(
     "sw_delete_expense",
     {
-      description: "Soft-delete a Splitwise expense by id. Returns {success: true} on success. Use sw_undelete_expense to restore. Without confirm:true this returns a dry-run preview and makes NO network call; with confirm:true it deletes.",
+      description: `Soft-delete a Splitwise expense by id. Returns {success: true} on success. Use sw_undelete_expense to restore. ${CONFIRM_NOTE}`,
       annotations: { destructiveHint: true },
       inputSchema: external_exports.object({
         id: external_exports.number().describe("Expense ID to delete"),
-        confirm: schemaConfirm
+        confirmToken: confirmTokenParam
       })
     },
-    async ({ id, confirm }) => {
-      const gate = previewUnlessConfirmed(
-        confirm,
-        `Soft-delete Splitwise expense ${id}`,
-        "POST",
-        `/delete_expense/${id}`
-      );
+    async ({ id, confirmToken }, ctx) => {
+      const gate = await confirmWrite(ctx, {
+        tool: "sw_delete_expense",
+        action: "expense.delete",
+        summary: `Soft-delete Splitwise expense ${id}`,
+        method: "POST",
+        path: `/delete_expense/${id}`,
+        target: id,
+        confirmToken
+      });
       if (gate) return gate;
       const data = await client2.request("POST", `/delete_expense/${id}`);
       return minifiedResult(data);
@@ -99285,7 +99758,7 @@ function registerReceiptTools(server, client2) {
           "Also return the PDF's text layer as `text`. Ideal for looking up line items or totals without transferring the file. PDFs only; a scanned receipt has no text layer to extract."
         ).optional(),
         output_dir: external_exports.string().describe(
-          "Directory to write the receipt into. Defaults to $SPLITWISE_OUTPUT_DIR, else the current working directory."
+          "Directory to write the receipt into. Defaults to $SPLITWISE_OUTPUT_DIR, else the current working directory. When SPLITWISE_OUTPUT_DIR is set, this must be inside it."
         ).optional(),
         write: external_exports.boolean().describe(
           "Write the receipt to disk. Defaults to true. Pass false when the caller cannot reach this server's filesystem, or when the server runs read-only."
@@ -99312,8 +99785,11 @@ function registerReceiptTools(server, client2) {
       let writeError;
       if (write !== false) {
         try {
+          const configuredDir = readEnvVar("SPLITWISE_OUTPUT_DIR");
           path = writeBinaryOutput({
-            dir: resolveOutputDir(output_dir, "SPLITWISE_OUTPUT_DIR"),
+            dir: resolveOutputDir(output_dir, "SPLITWISE_OUTPUT_DIR", {
+              ...configuredDir ? { allowedRoots: [configuredDir] } : {}
+            }),
             baseName: `splitwise-receipt-${id}`,
             base64: base643,
             extension: extensionFor(mimeType, url4)
@@ -99462,22 +99938,25 @@ function registerUtilityTools(server, client2) {
   server.registerTool(
     "sw_create_comment",
     {
-      description: "Add a comment to a Splitwise expense (visible to other participants). Without confirm:true this returns a dry-run preview and makes NO network call; with confirm:true it posts.",
+      description: `Add a comment to a Splitwise expense (visible to other participants). ${CONFIRM_NOTE}`,
       annotations: { destructiveHint: true },
       inputSchema: external_exports.object({
         expense_id: external_exports.number().describe("Expense ID to comment on"),
         content: external_exports.string().describe("Comment text"),
-        confirm: schemaConfirm
+        confirmToken: confirmTokenParam
       })
     },
-    async ({ expense_id, content, confirm }) => {
-      const gate = previewUnlessConfirmed(
-        confirm,
-        `Comment on Splitwise expense ${expense_id} (visible to participants)`,
-        "POST",
-        "/create_comment",
-        { expense_id, content }
-      );
+    async ({ expense_id, content, confirmToken }, ctx) => {
+      const gate = await confirmWrite(ctx, {
+        tool: "sw_create_comment",
+        action: "comment.create",
+        summary: `Comment on Splitwise expense ${expense_id} (visible to participants)`,
+        method: "POST",
+        path: "/create_comment",
+        body: { expense_id, content },
+        target: expense_id,
+        confirmToken
+      });
       if (gate) return gate;
       const data = await client2.request("POST", "/create_comment", { expense_id, content });
       return minifiedResult(data);
@@ -99486,20 +99965,23 @@ function registerUtilityTools(server, client2) {
   server.registerTool(
     "sw_delete_comment",
     {
-      description: "Delete a comment by id. Without confirm:true this returns a dry-run preview and makes NO network call; with confirm:true it deletes.",
+      description: `Delete a comment by id. ${CONFIRM_NOTE}`,
       annotations: { destructiveHint: true },
       inputSchema: external_exports.object({
         id: external_exports.number().describe("Comment ID to delete"),
-        confirm: schemaConfirm
+        confirmToken: confirmTokenParam
       })
     },
-    async ({ id, confirm }) => {
-      const gate = previewUnlessConfirmed(
-        confirm,
-        `Delete Splitwise comment ${id}`,
-        "POST",
-        `/delete_comment/${id}`
-      );
+    async ({ id, confirmToken }, ctx) => {
+      const gate = await confirmWrite(ctx, {
+        tool: "sw_delete_comment",
+        action: "comment.delete",
+        summary: `Delete Splitwise comment ${id}`,
+        method: "POST",
+        path: `/delete_comment/${id}`,
+        target: id,
+        confirmToken
+      });
       if (gate) return gate;
       const data = await client2.request("POST", `/delete_comment/${id}`);
       return minifiedResult(data);
@@ -99510,7 +99992,7 @@ function registerUtilityTools(server, client2) {
 // src/index.ts
 await runMcp({
   name: "splitwise-mcp",
-  version: "3.1.2",
+  version: "3.2.1",
   // x-release-please-version
   deps: client,
   banner: "[splitwise-mcp] This project was developed and is maintained by AI (Claude Sonnet 4.6). Use at your own discretion.",