@buildinternet/uploads 0.51.0 → 0.52.0

package/dist/commands.js

@@ -4,7 +4,7 @@ import { mapBounded } from "./async.js";
 import { createUploadsClient, } from "./client.js";
 import { parseCommandArgs, flagString, flagBool, flagInt, flagValues, UsageError, } from "./cli-args.js";
 import { resolvePutDefaults, workspaceMismatch, workspaceFromToken, } from "./config.js";
-import { buildUploadMarkdown } from "./embed.js";
+import { buildUploadMarkdown, fileKindFromName } from "./embed.js";
 import { readLocalRepoCommentConfig, resolveCommentOptions } from "./comment-config.js";
 import { urlForGithubEmbed } from "./public-urls.js";
 import { UploadsError } from "./errors.js";
@@ -110,6 +110,10 @@ Still images (PNG/JPEG/…) are optimized to WebP by default (long edge capped,
 high quality; EXIF stripped) so GitHub embeds stay lean. Original bytes are kept
 when they are already smaller, animated, or not an image. Use --no-optimize to
 upload as-is, or --keep-exif when image metadata matters for the discussion.
+Non-media files (PDF, zip, gzip, logs, JSON, CSV, markdown) upload as-is and
+show up in the managed comment as links. HTML and SVG are rejected. Uploads are
+public, so scrub secrets and tokens out of logs, JSON, and other text before
+uploading.
 
 Optional --frame wraps the image in a device/browser chrome before optimize
 (default off). See: uploads put --help frames
@@ -421,13 +425,23 @@ export async function prepareImageForUpload(bytes, filename, opts) {
     return { ...optimized, frame: frameMeta };
 }
 /**
- * Merge an image's own EXIF-derived facts under any explicit metadata.
+ * Merge an image's own EXIF-derived facts under any explicit metadata, when
+ * the caller asked for them and the filename could plausibly be an image —
+ * only an `image/*` extension, or none at all (an extension-less
+ * screenshot), is worth an `imageFactsFromBytes` probe
+ * (`sharp(bytes).metadata()` under the hood); a known non-image extension (a
+ * 25 MB zip, a `.log`, a PDF…) skips it rather than paying a sharp call that
+ * can only come back empty.
+ *
  * Best-effort by contract: `imageFactsFromBytes` never rejects, and a full key
  * budget drops the derived pairs rather than failing the upload. Returns the
  * input untouched (including `undefined`) when there is nothing to add, so a
  * metadata-free upload stays metadata-free.
  */
-async function mergeImageFacts(bytes, metadata) {
+async function maybeDeriveImageFacts(enabled, sourceName, bytes, metadata) {
+    const kind = fileKindFromName(sourceName);
+    if (!enabled || (kind !== "image" && kind !== "unknown"))
+        return metadata;
     const facts = await imageFactsFromBytes(bytes);
     if (Object.keys(facts).length === 0)
         return metadata;
@@ -444,9 +458,7 @@ async function mergeImageFacts(bytes, metadata) {
  */
 export async function uploadPreparedImage(client, bytes, sourceName, opts) {
     // Read EXIF from the original bytes before the optimizer strips it.
-    const metadata = opts.deriveImageFacts
-        ? await mergeImageFacts(bytes, opts.metadata)
-        : opts.metadata;
+    const metadata = await maybeDeriveImageFacts(opts.deriveImageFacts, sourceName, bytes, opts.metadata);
     const prepared = await prepareImageForUpload(bytes, sourceName, {
         frameId: opts.frame.frameId,
         frameUrl: opts.frame.frameUrl,
@@ -955,9 +967,7 @@ async function uploadAttachmentBatch(opts) {
             const baseMetadata = mergeSidecarMeta(file, bytes, opts.metadata);
             // Same EXIF promotion uploadPreparedImage does; attach keeps its own
             // per-file tail (it builds keys differently), so it opts in here too.
-            const metadata = opts.deriveImageFacts
-                ? await mergeImageFacts(bytes, baseMetadata)
-                : baseMetadata;
+            const metadata = await maybeDeriveImageFacts(opts.deriveImageFacts, sourceName, bytes, baseMetadata);
             const prepared = await prepareImageForUpload(bytes, sourceName, {
                 ...opts.frame,
                 optimize: opts.optimize,

package/dist/comment-render.generated.d.ts

@@ -47,6 +47,14 @@ export declare function parseGhPrivateKey(key: string): {
     kind: GhTargetKind;
     num: number;
 } | undefined;
+export declare function inferContentType(filename: string): string;
+/**
+ * Coarse family a filename belongs to, for the callers that only branch on
+ * "is this an image / a video / something else" — `unknown` when the
+ * extension maps to nothing (an extension-less screenshot, say), which those
+ * callers treat as "might be an image, probe it".
+ */
+export declare function fileKindFromName(filename: string): "image" | "video" | "file" | "unknown";
 /** Hidden marker identifying the one comment this CLI manages. Never change it — existing comments are found by exact match. */
 export declare const ATTACHMENTS_MARKER = "<!-- uploads.sh:attachments -->";
 /**

package/dist/comment-render.generated.js

@@ -69,27 +69,55 @@ export function parseGhPrivateKey(key) {
     return { prefixId, kind: kind, num: Number(num) };
 }
 /** GitHub-embed helper (content type). Copied from packages/uploads/src/embed.ts. */
-function inferContentType(filename) {
+const CONTENT_TYPE_BY_EXTENSION = {
+    png: "image/png",
+    jpg: "image/jpeg",
+    jpeg: "image/jpeg",
+    gif: "image/gif",
+    webp: "image/webp",
+    avif: "image/avif",
+    svg: "image/svg+xml",
+    mp4: "video/mp4",
+    webm: "video/webm",
+    mov: "video/quicktime",
+    pdf: "application/pdf",
+    zip: "application/zip",
+    gz: "application/gzip",
+    tgz: "application/gzip",
+    txt: "text/plain",
+    text: "text/plain",
+    log: "text/plain",
+    jsonl: "text/plain",
+    ndjson: "text/plain",
+    yaml: "text/plain",
+    yml: "text/plain",
+    md: "text/markdown",
+    markdown: "text/markdown",
+    csv: "text/csv",
+    json: "application/json",
+    xml: "application/xml",
+};
+export function inferContentType(filename) {
     const ext = filename.includes(".")
         ? filename.slice(filename.lastIndexOf(".") + 1).toLowerCase()
         : "";
-    switch (ext) {
-        case "png":
-            return "image/png";
-        case "jpg":
-        case "jpeg":
-            return "image/jpeg";
-        case "gif":
-            return "image/gif";
-        case "webp":
-            return "image/webp";
-        case "svg":
-            return "image/svg+xml";
-        case "mp4":
-            return "video/mp4";
-        default:
-            return "application/octet-stream";
-    }
+    return CONTENT_TYPE_BY_EXTENSION[ext] ?? "application/octet-stream";
+}
+/**
+ * Coarse family a filename belongs to, for the callers that only branch on
+ * "is this an image / a video / something else" — `unknown` when the
+ * extension maps to nothing (an extension-less screenshot, say), which those
+ * callers treat as "might be an image, probe it".
+ */
+export function fileKindFromName(filename) {
+    const type = inferContentType(filename);
+    if (type === "application/octet-stream")
+        return "unknown";
+    if (type.startsWith("image/"))
+        return "image";
+    if (type.startsWith("video/"))
+        return "video";
+    return "file";
 }
 /** Hidden marker identifying the one comment this CLI manages. Never change it — existing comments are found by exact match. */
 export const ATTACHMENTS_MARKER = "<!-- uploads.sh:attachments -->";

package/dist/embed.d.ts

@@ -1,5 +1,18 @@
 /** GitHub-embed helpers (content type + markdown). */
-export declare function inferContentType(filename: string): string;
+/**
+ * The filename→type map and its two readers live in
+ * packages/comment-render/src/index.ts (inlined here as
+ * `comment-render.generated.ts`), so the CLI and the managed-comment renderer
+ * cannot drift apart. Re-exported from this module because every existing
+ * caller imports them from `./embed.js`. That map mirrors the upload table in
+ * apps/api/src/guards.ts; keep the two in step. `svg` maps to
+ * `image/svg+xml` here same as any other type (issue #929): the server no
+ * longer rejects it outright — it accepts SVG only on a storage lane
+ * verified to serve it behind a sandboxing CSP (`apps/api/src/active-content.ts`),
+ * so whether a given upload actually lands depends on that lane's state,
+ * not on anything this map decides.
+ */
+export { fileKindFromName, inferContentType } from "./comment-render.generated.js";
 export declare function buildMarkdown(url: string, opts: {
     alt: string;
     width?: number;

package/dist/embed.js

@@ -1,26 +1,18 @@
 /** GitHub-embed helpers (content type + markdown). */
-export function inferContentType(filename) {
-    const ext = filename.includes(".")
-        ? filename.slice(filename.lastIndexOf(".") + 1).toLowerCase()
-        : "";
-    switch (ext) {
-        case "png":
-            return "image/png";
-        case "jpg":
-        case "jpeg":
-            return "image/jpeg";
-        case "gif":
-            return "image/gif";
-        case "webp":
-            return "image/webp";
-        case "svg":
-            return "image/svg+xml";
-        case "mp4":
-            return "video/mp4";
-        default:
-            return "application/octet-stream";
-    }
-}
+/**
+ * The filename→type map and its two readers live in
+ * packages/comment-render/src/index.ts (inlined here as
+ * `comment-render.generated.ts`), so the CLI and the managed-comment renderer
+ * cannot drift apart. Re-exported from this module because every existing
+ * caller imports them from `./embed.js`. That map mirrors the upload table in
+ * apps/api/src/guards.ts; keep the two in step. `svg` maps to
+ * `image/svg+xml` here same as any other type (issue #929): the server no
+ * longer rejects it outright — it accepts SVG only on a storage lane
+ * verified to serve it behind a sandboxing CSP (`apps/api/src/active-content.ts`),
+ * so whether a given upload actually lands depends on that lane's state,
+ * not on anything this map decides.
+ */
+export { fileKindFromName, inferContentType } from "./comment-render.generated.js";
 export function buildMarkdown(url, opts) {
     if (opts.width) {
         const alt = opts.alt.replace(/"/g, """);

package/dist/mcp/tools.js

@@ -292,7 +292,7 @@ export function createUploadsMcpTools(opts) {
             title: "Upload file",
             annotations: mcpDestroyPublic,
             securitySchemes: mcpOAuthWrite,
-            description: "Upload one or more files and get a public URL plus GitHub-ready markdown. Prefer `embedUrl` in GitHub markdown. Pass `contentUrl` for a public HTTPS file, or http://localhost on this machine, instead of a local path. With `pr`/`issue`, keys are stable and the managed comment is synced. All uploads are public.",
+            description: "Upload one or more files and get a public URL plus GitHub-ready markdown. Prefer `embedUrl` in GitHub markdown. Pass `contentUrl` for a public HTTPS file, or http://localhost on this machine, instead of a local path. With `pr`/`issue`, keys are stable and the managed comment is synced. All uploads are public. Accepts images (PNG, JPEG, GIF, WebP, AVIF), video (MP4, WebM, MOV), PDF, zip, gzip, and text (plain, markdown, CSV, JSON). SVG and XML are accepted only on storage lanes verified to serve them sandboxed (see the workspace's storage settings); HTML is rejected.",
             inputSchema: {
                 type: "object",
                 properties: {

package/dist/optimize.js

@@ -6,6 +6,7 @@
  * SVG, video, and non-images are left unchanged.
  */
 import sharp from "sharp";
+import { fileKindFromName, inferContentType } from "./embed.js";
 /** Longest edge in pixels (screenshots beyond this rarely help PR review). */
 export const DEFAULT_OPTIMIZE_MAX_EDGE = 2400;
 /** WebP quality tuned for UI screenshots (text/chrome stay sharp enough). */
@@ -68,11 +69,25 @@ function passthrough(bytes, filename, contentType, skippedReason) {
  */
 export async function optimizeImageForUpload(bytes, filename, opts = {}) {
     const originalBytes = bytes.byteLength;
+    // The filename's own claim, used by every passthrough exit below.
+    const guessed = inferContentType(filename);
     if (opts.enabled === false) {
-        return passthrough(bytes, filename, guessContentType(filename), "disabled");
+        return passthrough(bytes, filename, guessed, "disabled");
     }
     if (originalBytes === 0) {
-        return passthrough(bytes, filename, guessContentType(filename), "empty");
+        return passthrough(bytes, filename, guessed, "empty");
+    }
+    // A known non-image extension (log, pdf, zip, video…) never needs sharp —
+    // and must be checked before `looksLikeSvg` below, since that check sniffs
+    // the leading bytes for an XML/SVG prologue with no regard for the actual
+    // extension: a `.log` or `.json` file that happens to start with `<?xml`
+    // (a JUnit report, say) would otherwise misreport as `skippedReason: "svg"`
+    // / `image/svg+xml`. An unknown extension is still "might be an image": it
+    // falls through to the SVG sniff and the sharp probe below, so an
+    // extension-less screenshot is optimized as before.
+    const kind = fileKindFromName(filename);
+    if (kind === "file" || kind === "video") {
+        return passthrough(bytes, filename, guessed, "not_image");
     }
     if (looksLikeSvg(bytes, filename)) {
         return passthrough(bytes, filename, "image/svg+xml", "svg");
@@ -92,14 +107,14 @@ export async function optimizeImageForUpload(bytes, filename, opts = {}) {
         meta = await image.metadata();
     }
     catch {
-        return passthrough(bytes, filename, guessContentType(filename), "not_image");
+        return passthrough(bytes, filename, guessed, "not_image");
     }
     if (!meta.format) {
-        return passthrough(bytes, filename, guessContentType(filename), "not_image");
+        return passthrough(bytes, filename, guessed, "not_image");
     }
     // Animated GIF/WebP: keep as-is (re-encoding often breaks or balloons size).
     if ((meta.pages ?? 1) > 1) {
-        return passthrough(bytes, filename, meta.format === "gif" ? "image/gif" : guessContentType(filename), "animated");
+        return passthrough(bytes, filename, meta.format === "gif" ? "image/gif" : guessed, "animated");
     }
     if (meta.format === "gif") {
         // Single-frame GIF can convert; multi-page already returned above.
@@ -134,10 +149,10 @@ export async function optimizeImageForUpload(bytes, filename, opts = {}) {
         }
     }
     catch {
-        return passthrough(bytes, filename, guessContentType(filename), "encode_failed");
+        return passthrough(bytes, filename, guessed, "encode_failed");
     }
     if (encoded.byteLength >= originalBytes) {
-        return passthrough(bytes, filename, guessContentType(filename), "not_smaller");
+        return passthrough(bytes, filename, guessed, "not_smaller");
     }
     const outFilename = withImageExtension(filename, format === "jpeg" ? "jpg" : "webp");
     return {
@@ -149,25 +164,6 @@ export async function optimizeImageForUpload(bytes, filename, opts = {}) {
         outputBytes: encoded.byteLength,
     };
 }
-function guessContentType(filename) {
-    switch (extensionOf(filename)) {
-        case "png":
-            return "image/png";
-        case "jpg":
-        case "jpeg":
-            return "image/jpeg";
-        case "gif":
-            return "image/gif";
-        case "webp":
-            return "image/webp";
-        case "avif":
-            return "image/avif";
-        case "svg":
-            return "image/svg+xml";
-        default:
-            return "application/octet-stream";
-    }
-}
 /** Rewrite an object key's trailing image extension to match optimized output. */
 export function rewriteKeyExtension(key, filename) {
     const ext = extensionOf(filename);

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "@buildinternet/uploads",
-  "version": "0.51.0",
+  "version": "0.52.0",
   "mcpName": "sh.uploads/mcp",
   "description": "CLI and client for uploads.sh — workspace-scoped image hosting for GitHub embeds",
   "type": "module",