@buildinternet/uploads 0.51.0 → 0.52.1

package/dist/commands.js

@@ -4,7 +4,7 @@ import { mapBounded } from "./async.js";
 import { createUploadsClient, } from "./client.js";
 import { parseCommandArgs, flagString, flagBool, flagInt, flagValues, UsageError, } from "./cli-args.js";
 import { resolvePutDefaults, workspaceMismatch, workspaceFromToken, } from "./config.js";
-import { buildUploadMarkdown } from "./embed.js";
+import { buildUploadMarkdown, fileKindFromName } from "./embed.js";
 import { readLocalRepoCommentConfig, resolveCommentOptions } from "./comment-config.js";
 import { urlForGithubEmbed } from "./public-urls.js";
 import { UploadsError } from "./errors.js";
@@ -110,6 +110,10 @@ Still images (PNG/JPEG/…) are optimized to WebP by default (long edge capped,
 high quality; EXIF stripped) so GitHub embeds stay lean. Original bytes are kept
 when they are already smaller, animated, or not an image. Use --no-optimize to
 upload as-is, or --keep-exif when image metadata matters for the discussion.
+Non-media files (PDF, zip, gzip, logs, JSON, CSV, markdown) upload as-is and
+show up in the managed comment as links. HTML and SVG are rejected. Uploads are
+public, so scrub secrets and tokens out of logs, JSON, and other text before
+uploading.
 
 Optional --frame wraps the image in a device/browser chrome before optimize
 (default off). See: uploads put --help frames
@@ -421,13 +425,23 @@ export async function prepareImageForUpload(bytes, filename, opts) {
     return { ...optimized, frame: frameMeta };
 }
 /**
- * Merge an image's own EXIF-derived facts under any explicit metadata.
+ * Merge an image's own EXIF-derived facts under any explicit metadata, when
+ * the caller asked for them and the filename could plausibly be an image —
+ * only an `image/*` extension, or none at all (an extension-less
+ * screenshot), is worth an `imageFactsFromBytes` probe
+ * (`sharp(bytes).metadata()` under the hood); a known non-image extension (a
+ * 25 MB zip, a `.log`, a PDF…) skips it rather than paying a sharp call that
+ * can only come back empty.
+ *
  * Best-effort by contract: `imageFactsFromBytes` never rejects, and a full key
  * budget drops the derived pairs rather than failing the upload. Returns the
  * input untouched (including `undefined`) when there is nothing to add, so a
  * metadata-free upload stays metadata-free.
  */
-async function mergeImageFacts(bytes, metadata) {
+async function maybeDeriveImageFacts(enabled, sourceName, bytes, metadata) {
+    const kind = fileKindFromName(sourceName);
+    if (!enabled || (kind !== "image" && kind !== "unknown"))
+        return metadata;
     const facts = await imageFactsFromBytes(bytes);
     if (Object.keys(facts).length === 0)
         return metadata;
@@ -444,9 +458,7 @@ async function mergeImageFacts(bytes, metadata) {
  */
 export async function uploadPreparedImage(client, bytes, sourceName, opts) {
     // Read EXIF from the original bytes before the optimizer strips it.
-    const metadata = opts.deriveImageFacts
-        ? await mergeImageFacts(bytes, opts.metadata)
-        : opts.metadata;
+    const metadata = await maybeDeriveImageFacts(opts.deriveImageFacts, sourceName, bytes, opts.metadata);
     const prepared = await prepareImageForUpload(bytes, sourceName, {
         frameId: opts.frame.frameId,
         frameUrl: opts.frame.frameUrl,
@@ -643,7 +655,7 @@ export async function syncAttachmentsComment(client, target, run, workspace, opt
         target: { kind: target.kind, num: target.num },
     });
     const prefixes = ghListPrefixes(ghKeyPrefix(target), ghPrefix, (id) => ghPrivateKeyPrefix(id, target));
-    const items = await ghMergedList(prefixes, undefined, async (prefix) => (await client.listAll({ prefix, metadata: true })).map(({ key, url, embedUrl, pageUrl, metadata }) => {
+    const items = await ghMergedList(prefixes, undefined, async (prefix) => (await client.listAll({ prefix, metadata: true })).map(({ key, url, embedUrl, pageUrl, size, metadata }) => {
         // The list endpoint returns every metadata key; the comment
         // renders only these two. Narrowing here keeps both render paths
         // byte-identical.
@@ -661,6 +673,7 @@ export async function syncAttachmentsComment(client, target, run, workspace, opt
             url,
             embedUrl,
             pageUrl,
+            ...(size != null ? { size } : {}),
             ...(path || state
                 ? { meta: { ...(path ? { path } : {}), ...(state ? { state } : {}) } }
                 : {}),
@@ -955,9 +968,7 @@ async function uploadAttachmentBatch(opts) {
             const baseMetadata = mergeSidecarMeta(file, bytes, opts.metadata);
             // Same EXIF promotion uploadPreparedImage does; attach keeps its own
             // per-file tail (it builds keys differently), so it opts in here too.
-            const metadata = opts.deriveImageFacts
-                ? await mergeImageFacts(bytes, baseMetadata)
-                : baseMetadata;
+            const metadata = await maybeDeriveImageFacts(opts.deriveImageFacts, sourceName, bytes, baseMetadata);
             const prepared = await prepareImageForUpload(bytes, sourceName, {
                 ...opts.frame,
                 optimize: opts.optimize,

package/dist/comment-render.generated.d.ts

@@ -47,6 +47,14 @@ export declare function parseGhPrivateKey(key: string): {
     kind: GhTargetKind;
     num: number;
 } | undefined;
+export declare function inferContentType(filename: string): string;
+/**
+ * Coarse family a filename belongs to, for the callers that only branch on
+ * "is this an image / a video / something else" — `unknown` when the
+ * extension maps to nothing (an extension-less screenshot, say), which those
+ * callers treat as "might be an image, probe it".
+ */
+export declare function fileKindFromName(filename: string): "image" | "video" | "file" | "unknown";
 /** Hidden marker identifying the one comment this CLI manages. Never change it — existing comments are found by exact match. */
 export declare const ATTACHMENTS_MARKER = "<!-- uploads.sh:attachments -->";
 /**
@@ -112,6 +120,10 @@ export interface AttachmentItem {
         width?: number;
         height?: number;
     };
+    /** Object size in bytes, when known — drives the non-media file table's Size column. */
+    size?: number;
+    /** Stored content type, when known — preferred over name-based inference for file classification and the table's Type column. */
+    contentType?: string;
 }
 /** A public gallery linked to the PR or issue whose managed comment is syncing. */
 export interface GalleryCommentItem {

package/dist/comment-render.generated.js

@@ -69,27 +69,55 @@ export function parseGhPrivateKey(key) {
     return { prefixId, kind: kind, num: Number(num) };
 }
 /** GitHub-embed helper (content type). Copied from packages/uploads/src/embed.ts. */
-function inferContentType(filename) {
+const CONTENT_TYPE_BY_EXTENSION = {
+    png: "image/png",
+    jpg: "image/jpeg",
+    jpeg: "image/jpeg",
+    gif: "image/gif",
+    webp: "image/webp",
+    avif: "image/avif",
+    svg: "image/svg+xml",
+    mp4: "video/mp4",
+    webm: "video/webm",
+    mov: "video/quicktime",
+    pdf: "application/pdf",
+    zip: "application/zip",
+    gz: "application/gzip",
+    tgz: "application/gzip",
+    txt: "text/plain",
+    text: "text/plain",
+    log: "text/plain",
+    jsonl: "text/plain",
+    ndjson: "text/plain",
+    yaml: "text/plain",
+    yml: "text/plain",
+    md: "text/markdown",
+    markdown: "text/markdown",
+    csv: "text/csv",
+    json: "application/json",
+    xml: "application/xml",
+};
+export function inferContentType(filename) {
     const ext = filename.includes(".")
         ? filename.slice(filename.lastIndexOf(".") + 1).toLowerCase()
         : "";
-    switch (ext) {
-        case "png":
-            return "image/png";
-        case "jpg":
-        case "jpeg":
-            return "image/jpeg";
-        case "gif":
-            return "image/gif";
-        case "webp":
-            return "image/webp";
-        case "svg":
-            return "image/svg+xml";
-        case "mp4":
-            return "video/mp4";
-        default:
-            return "application/octet-stream";
-    }
+    return CONTENT_TYPE_BY_EXTENSION[ext] ?? "application/octet-stream";
+}
+/**
+ * Coarse family a filename belongs to, for the callers that only branch on
+ * "is this an image / a video / something else" — `unknown` when the
+ * extension maps to nothing (an extension-less screenshot, say), which those
+ * callers treat as "might be an image, probe it".
+ */
+export function fileKindFromName(filename) {
+    const type = inferContentType(filename);
+    if (type === "application/octet-stream")
+        return "unknown";
+    if (type.startsWith("image/"))
+        return "image";
+    if (type.startsWith("video/"))
+        return "video";
+    return "file";
 }
 /** Hidden marker identifying the one comment this CLI manages. Never change it — existing comments are found by exact match. */
 export const ATTACHMENTS_MARKER = "<!-- uploads.sh:attachments -->";
@@ -257,6 +285,47 @@ function formatMetaCaption(meta, options, mode) {
     })
         .join(" · ");
 }
+/**
+ * Decimal-SI byte size for the non-media file table's Size column: whole
+ * bytes below 1000, one decimal place at KB/MB/GB and above. `"—"` when the
+ * size is unknown.
+ */
+function formatBytes(bytes) {
+    if (bytes == null || !Number.isFinite(bytes) || bytes < 0)
+        return "—";
+    if (bytes < 1000)
+        return `${Math.round(bytes)} B`;
+    const units = [
+        [1e9, "GB"],
+        [1e6, "MB"],
+        [1e3, "KB"],
+    ];
+    for (const [threshold, label] of units) {
+        if (bytes >= threshold)
+            return `${(bytes / threshold).toFixed(1)} ${label}`;
+    }
+    return `${Math.round(bytes)} B`;
+}
+/**
+ * Type label for the non-media file table: uppercase filename extension
+ * first, then the content type's subtype, then a bare "FILE" fallback.
+ */
+function fileTypeLabel(name, contentType) {
+    const dot = name.lastIndexOf(".");
+    if (dot !== -1 && dot < name.length - 1)
+        return name.slice(dot + 1).toUpperCase();
+    if (contentType) {
+        const slash = contentType.indexOf("/");
+        if (slash !== -1 && slash < contentType.length - 1) {
+            return contentType.slice(slash + 1).toUpperCase();
+        }
+    }
+    return "FILE";
+}
+/** Escape `|` so a filename can't break out of a markdown table cell. */
+function escapeTableCell(s) {
+    return s.replace(/\|/g, "\\|");
+}
 /** Resolved pixel width for an image site, or `null` meaning "omit the width
  * attribute". `"auto"` defers to the caller's per-item heuristic (`autoPx`);
  * `"full"` always omits; a number always wins. */
@@ -457,6 +526,10 @@ export function attachmentsCommentBody(items, galleries = [], marker = ATTACHMEN
     const consumedByPair = new Set();
     let inlinedImages = 0;
     const overflowImages = [];
+    // Non-media attachments (PDFs, archives, text/data files) never inline and
+    // never overflow into the <details> link list — they render as one table
+    // after the image/video section instead (issue #946).
+    const fileItems = [];
     for (let idx = 0; idx < sorted.length; idx++) {
         if (consumedByPair.has(idx))
             continue;
@@ -482,8 +555,21 @@ export function attachmentsCommentBody(items, galleries = [], marker = ATTACHMEN
         const stable = item.url;
         const src = item.embedUrl ?? item.url;
         const link = item.pageUrl ?? stable; // click-through: file page when known, else raw
-        const isImage = Boolean(src) && inferContentType(name).startsWith("image/");
-        const isPosterVideo = Boolean(item.posterUrl) && inferContentType(name).startsWith("video/");
+        // "application/octet-stream" is the server's generic fallback for an
+        // object stored without an explicit content type — not a real signal —
+        // so it defers to the filename the same as an absent `contentType`.
+        const effectiveType = item.contentType && item.contentType !== "application/octet-stream"
+            ? item.contentType
+            : inferContentType(name);
+        const isImage = Boolean(src) && effectiveType.startsWith("image/");
+        const isPosterVideo = Boolean(item.posterUrl) && effectiveType.startsWith("video/");
+        if (!effectiveType.startsWith("image/") && !effectiveType.startsWith("video/")) {
+            // Neither an image nor a video by content type — a non-media
+            // attachment goes into the file table, never the bullet list or
+            // overflow details.
+            fileItems.push(item);
+            continue;
+        }
         const inlines = isImage || isPosterVideo;
         if (inlines && inlinedImages >= options.maxInlineImages) {
             // Cap hit — defer to the collapsed overflow list below rather than
@@ -576,6 +662,23 @@ export function attachmentsCommentBody(items, galleries = [], marker = ATTACHMEN
             lines.push(`- ${name}${cap ? ` · ${cap}` : ""}`);
         }
     }
+    if (fileItems.length > 0) {
+        lines.push("| File | Type | Size |", "| --- | --- | --- |");
+        for (const item of fileItems) {
+            const name = item.key.slice(item.key.lastIndexOf("/") + 1);
+            const escapedName = escapeTableCell(name);
+            let fileCell = item.url ? `[${escapedName}](${item.url})` : escapedName;
+            if (item.pageUrl)
+                fileCell += ` · [page](${item.pageUrl})`;
+            const cap = formatMetaCaption(item.meta, options, "markdown");
+            if (cap)
+                fileCell += ` · ${cap}`;
+            const typeLabel = fileTypeLabel(name, item.contentType);
+            const sizeLabel = formatBytes(item.size);
+            lines.push(`| ${fileCell} | ${typeLabel} | ${sizeLabel} |`);
+        }
+        lines.push("");
+    }
     if (overflowImages.length > 0) {
         const n = overflowImages.length;
         lines.push(`<details><summary>${n} more attachment${n === 1 ? "" : "s"}</summary>`, "");

package/dist/embed.d.ts

@@ -1,5 +1,18 @@
 /** GitHub-embed helpers (content type + markdown). */
-export declare function inferContentType(filename: string): string;
+/**
+ * The filename→type map and its two readers live in
+ * packages/comment-render/src/index.ts (inlined here as
+ * `comment-render.generated.ts`), so the CLI and the managed-comment renderer
+ * cannot drift apart. Re-exported from this module because every existing
+ * caller imports them from `./embed.js`. That map mirrors the upload table in
+ * apps/api/src/guards.ts; keep the two in step. `svg` maps to
+ * `image/svg+xml` here same as any other type (issue #929): the server no
+ * longer rejects it outright — it accepts SVG only on a storage lane
+ * verified to serve it behind a sandboxing CSP (`apps/api/src/active-content.ts`),
+ * so whether a given upload actually lands depends on that lane's state,
+ * not on anything this map decides.
+ */
+export { fileKindFromName, inferContentType } from "./comment-render.generated.js";
 export declare function buildMarkdown(url: string, opts: {
     alt: string;
     width?: number;

package/dist/embed.js

@@ -1,26 +1,18 @@
 /** GitHub-embed helpers (content type + markdown). */
-export function inferContentType(filename) {
-    const ext = filename.includes(".")
-        ? filename.slice(filename.lastIndexOf(".") + 1).toLowerCase()
-        : "";
-    switch (ext) {
-        case "png":
-            return "image/png";
-        case "jpg":
-        case "jpeg":
-            return "image/jpeg";
-        case "gif":
-            return "image/gif";
-        case "webp":
-            return "image/webp";
-        case "svg":
-            return "image/svg+xml";
-        case "mp4":
-            return "video/mp4";
-        default:
-            return "application/octet-stream";
-    }
-}
+/**
+ * The filename→type map and its two readers live in
+ * packages/comment-render/src/index.ts (inlined here as
+ * `comment-render.generated.ts`), so the CLI and the managed-comment renderer
+ * cannot drift apart. Re-exported from this module because every existing
+ * caller imports them from `./embed.js`. That map mirrors the upload table in
+ * apps/api/src/guards.ts; keep the two in step. `svg` maps to
+ * `image/svg+xml` here same as any other type (issue #929): the server no
+ * longer rejects it outright — it accepts SVG only on a storage lane
+ * verified to serve it behind a sandboxing CSP (`apps/api/src/active-content.ts`),
+ * so whether a given upload actually lands depends on that lane's state,
+ * not on anything this map decides.
+ */
+export { fileKindFromName, inferContentType } from "./comment-render.generated.js";
 export function buildMarkdown(url, opts) {
     if (opts.width) {
         const alt = opts.alt.replace(/"/g, """);

package/dist/mcp/tools.js

@@ -292,7 +292,7 @@ export function createUploadsMcpTools(opts) {
             title: "Upload file",
             annotations: mcpDestroyPublic,
             securitySchemes: mcpOAuthWrite,
-            description: "Upload one or more files and get a public URL plus GitHub-ready markdown. Prefer `embedUrl` in GitHub markdown. Pass `contentUrl` for a public HTTPS file, or http://localhost on this machine, instead of a local path. With `pr`/`issue`, keys are stable and the managed comment is synced. All uploads are public.",
+            description: "Upload one or more files and get a public URL plus GitHub-ready markdown. Prefer `embedUrl` in GitHub markdown. Pass `contentUrl` for a public HTTPS file, or http://localhost on this machine, instead of a local path. With `pr`/`issue`, keys are stable and the managed comment is synced. All uploads are public. Accepts images (PNG, JPEG, GIF, WebP, AVIF), video (MP4, WebM, MOV), PDF, zip, gzip, and text (plain, markdown, CSV, JSON). SVG and XML are accepted only on storage lanes verified to serve them sandboxed (see the workspace's storage settings); HTML is rejected.",
             inputSchema: {
                 type: "object",
                 properties: {

package/dist/optimize.js

@@ -6,6 +6,7 @@
  * SVG, video, and non-images are left unchanged.
  */
 import sharp from "sharp";
+import { fileKindFromName, inferContentType } from "./embed.js";
 /** Longest edge in pixels (screenshots beyond this rarely help PR review). */
 export const DEFAULT_OPTIMIZE_MAX_EDGE = 2400;
 /** WebP quality tuned for UI screenshots (text/chrome stay sharp enough). */
@@ -68,11 +69,25 @@ function passthrough(bytes, filename, contentType, skippedReason) {
  */
 export async function optimizeImageForUpload(bytes, filename, opts = {}) {
     const originalBytes = bytes.byteLength;
+    // The filename's own claim, used by every passthrough exit below.
+    const guessed = inferContentType(filename);
     if (opts.enabled === false) {
-        return passthrough(bytes, filename, guessContentType(filename), "disabled");
+        return passthrough(bytes, filename, guessed, "disabled");
     }
     if (originalBytes === 0) {
-        return passthrough(bytes, filename, guessContentType(filename), "empty");
+        return passthrough(bytes, filename, guessed, "empty");
+    }
+    // A known non-image extension (log, pdf, zip, video…) never needs sharp —
+    // and must be checked before `looksLikeSvg` below, since that check sniffs
+    // the leading bytes for an XML/SVG prologue with no regard for the actual
+    // extension: a `.log` or `.json` file that happens to start with `<?xml`
+    // (a JUnit report, say) would otherwise misreport as `skippedReason: "svg"`
+    // / `image/svg+xml`. An unknown extension is still "might be an image": it
+    // falls through to the SVG sniff and the sharp probe below, so an
+    // extension-less screenshot is optimized as before.
+    const kind = fileKindFromName(filename);
+    if (kind === "file" || kind === "video") {
+        return passthrough(bytes, filename, guessed, "not_image");
     }
     if (looksLikeSvg(bytes, filename)) {
         return passthrough(bytes, filename, "image/svg+xml", "svg");
@@ -92,14 +107,14 @@ export async function optimizeImageForUpload(bytes, filename, opts = {}) {
         meta = await image.metadata();
     }
     catch {
-        return passthrough(bytes, filename, guessContentType(filename), "not_image");
+        return passthrough(bytes, filename, guessed, "not_image");
     }
     if (!meta.format) {
-        return passthrough(bytes, filename, guessContentType(filename), "not_image");
+        return passthrough(bytes, filename, guessed, "not_image");
     }
     // Animated GIF/WebP: keep as-is (re-encoding often breaks or balloons size).
     if ((meta.pages ?? 1) > 1) {
-        return passthrough(bytes, filename, meta.format === "gif" ? "image/gif" : guessContentType(filename), "animated");
+        return passthrough(bytes, filename, meta.format === "gif" ? "image/gif" : guessed, "animated");
     }
     if (meta.format === "gif") {
         // Single-frame GIF can convert; multi-page already returned above.
@@ -134,10 +149,10 @@ export async function optimizeImageForUpload(bytes, filename, opts = {}) {
         }
     }
     catch {
-        return passthrough(bytes, filename, guessContentType(filename), "encode_failed");
+        return passthrough(bytes, filename, guessed, "encode_failed");
     }
     if (encoded.byteLength >= originalBytes) {
-        return passthrough(bytes, filename, guessContentType(filename), "not_smaller");
+        return passthrough(bytes, filename, guessed, "not_smaller");
     }
     const outFilename = withImageExtension(filename, format === "jpeg" ? "jpg" : "webp");
     return {
@@ -149,25 +164,6 @@ export async function optimizeImageForUpload(bytes, filename, opts = {}) {
         outputBytes: encoded.byteLength,
     };
 }
-function guessContentType(filename) {
-    switch (extensionOf(filename)) {
-        case "png":
-            return "image/png";
-        case "jpg":
-        case "jpeg":
-            return "image/jpeg";
-        case "gif":
-            return "image/gif";
-        case "webp":
-            return "image/webp";
-        case "avif":
-            return "image/avif";
-        case "svg":
-            return "image/svg+xml";
-        default:
-            return "application/octet-stream";
-    }
-}
 /** Rewrite an object key's trailing image extension to match optimized output. */
 export function rewriteKeyExtension(key, filename) {
     const ext = extensionOf(filename);

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "@buildinternet/uploads",
-  "version": "0.51.0",
+  "version": "0.52.1",
   "mcpName": "sh.uploads/mcp",
   "description": "CLI and client for uploads.sh — workspace-scoped image hosting for GitHub embeds",
   "type": "module",