@cueai/omni-reader-mcp 1.3.1 → 1.3.3

package/README.md

@@ -15,10 +15,14 @@ Parse https://example.com/report.pdf with Omni
 Parse ./report.pdf with Omni and summarize the revenue changes
 ```
 
-URLs never require installing Bridge. For local files, the agent should first explain the
-minimal directory authorization and data handling and obtain confirmation, then install
-a pinned Bridge version. After parsing completes, the agent continues the original task —
-summarization, Q&A, field extraction — rather than stopping at "parse done".
+Install Bridge as the default: it handles a URL and a local file through the same call, so
+neither the agent nor the user has to reason about which kind of source it is. The only
+exception is a deployment that will genuinely never need local files — that case is covered
+by a remote-only MCP connection instead, with nothing to install. Otherwise, before
+installing Bridge the agent should first explain the minimal directory authorization and
+data handling and obtain confirmation, then install a pinned Bridge version. After parsing
+completes, the agent continues the original task — summarization, Q&A, field extraction —
+rather than stopping at "parse done".
 
 ## Requirements
 
@@ -60,7 +64,7 @@ differ from the numbers above, report the live values.
 Always use an audited exact version, never an implicit `latest`:
 
 ```sh
-npx -y @cueai/omni-reader-mcp@1.3.1 setup
+npx -y @cueai/omni-reader-mcp@1.3.3 setup
 ```
 
 The interactive setup supports Hermes, Cursor, Claude Desktop, and generic stdio
@@ -68,9 +72,9 @@ configuration. Non-interactive installation uses the same argument parsing and w
 logic:
 
 ```sh
-npx -y @cueai/omni-reader-mcp@1.3.1 setup --client hermes --allowed-root /absolute/minimum/root --yes --json
-npx -y @cueai/omni-reader-mcp@1.3.1 setup --client cursor --add-root /absolute/minimum/root --yes --json
-npx -y @cueai/omni-reader-mcp@1.3.1 setup --client claude-desktop --allowed-root /absolute/minimum/root --yes --json
+npx -y @cueai/omni-reader-mcp@1.3.3 setup --client hermes --allowed-root /absolute/minimum/root --yes --json
+npx -y @cueai/omni-reader-mcp@1.3.3 setup --client cursor --add-root /absolute/minimum/root --yes --json
+npx -y @cueai/omni-reader-mcp@1.3.3 setup --client claude-desktop --allowed-root /absolute/minimum/root --yes --json
 ```
 
 When an agent or script runs under a pty (stdin is still a TTY), declare non-interactive
@@ -78,7 +82,7 @@ mode explicitly with `--headless` (alias `--non-interactive`): no `--yes` is req
 stdin is never read:
 
 ```sh
-npx -y @cueai/omni-reader-mcp@1.3.1 setup --client cursor --allowed-root /absolute/minimum/root --headless --json
+npx -y @cueai/omni-reader-mcp@1.3.3 setup --client cursor --allowed-root /absolute/minimum/root --headless --json
 ```
 
 ## Cache and journal isolation
@@ -199,22 +203,25 @@ Bridge validates the local source before grant, upload, and billing:
 - `UNSUPPORTED_MEDIA_TYPE`: unsupported media type, with the current authoritative
   `supported_extensions`.
 
-Agents should not auto-split, transcode, or upload to public sites; ask the user for a
-new source that satisfies the constraints.
+Do not upload the source to a public site to work around a constraint. Splitting or
+transcoding the source yourself (with your own tools, outside Bridge) is fine, but only
+after explicitly telling the user what you intend to do to it and getting their
+confirmation — never do this silently. Otherwise, ask the user for a new source that
+satisfies the constraints.
 
 ## Commands
 
 ```sh
-npx -y @cueai/omni-reader-mcp@1.3.1 doctor
-npx -y @cueai/omni-reader-mcp@1.3.1 doctor --json
-npx -y @cueai/omni-reader-mcp@1.3.1 clean
-npx -y @cueai/omni-reader-mcp@1.3.1 uninstall --yes --json
+npx -y @cueai/omni-reader-mcp@1.3.3 doctor
+npx -y @cueai/omni-reader-mcp@1.3.3 doctor --json
+npx -y @cueai/omni-reader-mcp@1.3.3 clean
+npx -y @cueai/omni-reader-mcp@1.3.3 uninstall --yes --json
 ```
 
 Running the pinned version without a command starts the stdio MCP server:
 
 ```sh
-npx -y @cueai/omni-reader-mcp@1.3.1
+npx -y @cueai/omni-reader-mcp@1.3.3
 ```
 
 `doctor --json` returns package/npm/client adapter, Key present/absent, allowed-root
@@ -223,12 +230,12 @@ status; it never prints the Key, private source paths, or content.
 
 ## Uninstall and rollback
 
-`uninstall --yes --json` removes only a trusted 1.3.0 or 1.3.1 Bridge entry; when a
+`uninstall --yes --json` removes only a trusted 1.3.2 or 1.3.3 Bridge entry; when a
 matching trusted backup exists, it restores the original URL-only `omni-reader` entry.
 Uninstall never deletes user source files and never silently removes unexpired local
 results.
 
-To roll back from 1.3.1:
+To roll back from 1.3.3:
 
 1. stop recommending or installing that version;
 2. run `uninstall --yes --json` to restore the trusted URL-only entry;

package/dist/cli/agent-config.js

@@ -4,7 +4,7 @@ import { chmod, lstat, mkdir, open, realpath, rename, unlink, } from "node:fs/pr
 import path from "node:path";
 import { BRIDGE_RELEASE_VERSION, REMOTE_OMNI_MCP_URL, } from "../constants.js";
 const PACKAGE_SPEC = `@cueai/omni-reader-mcp@${BRIDGE_RELEASE_VERSION}`;
-const PREVIOUS_PACKAGE_SPEC = "@cueai/omni-reader-mcp@1.3.0";
+const PREVIOUS_PACKAGE_SPEC = "@cueai/omni-reader-mcp@1.3.2";
 const LEGACY_PACKAGE_SPEC = "@cueai/omni-reader-mcp";
 const TRUSTED_EXACT_PACKAGE_SPECS = new Set([PREVIOUS_PACKAGE_SPEC, PACKAGE_SPEC]);
 function isRecord(value) {
@@ -586,7 +586,7 @@ function expectedBridgeVersion(target, value) {
     if (!isExpectedOmniEntry(target, value))
         return undefined;
     const packageSpec = value.args[1];
-    return packageSpec === PREVIOUS_PACKAGE_SPEC ? "1.3.0" : BRIDGE_RELEASE_VERSION;
+    return packageSpec === PREVIOUS_PACKAGE_SPEC ? "1.3.2" : BRIDGE_RELEASE_VERSION;
 }
 function isLegacyBridgeEntry(target, value) {
     if (!isRecord(value) || value.command !== "npx")

package/dist/constants.d.ts

@@ -6,7 +6,7 @@ export declare const CUBE_GRANT_PROTOCOL_VERSION = "omni.parse_grant.v1";
 export declare const GRANTED_STREAM_PROTOCOL_VERSION = "omni.granted_parse_stream.v1";
 export declare const DEFAULT_CUBE_BASE_URL = "https://mcp.cuecue.cn";
 export declare const DEFAULT_IIIS_GRANTED_BASE_URL = "https://cubefile.ai.iiis.co:9443/omni/granted/";
-export declare const BRIDGE_RELEASE_VERSION = "1.3.1";
+export declare const BRIDGE_RELEASE_VERSION = "1.3.3";
 export declare const REMOTE_OMNI_MCP_URL = "https://mcp.cuecue.cn/api/omni-reader/mcp/";
 export declare const FOREGROUND_BUDGET_MS = 15000;
 export declare const STATUS_LONG_POLL_MAX_MS = 20000;

package/dist/constants.js

@@ -6,7 +6,7 @@ export const CUBE_GRANT_PROTOCOL_VERSION = "omni.parse_grant.v1";
 export const GRANTED_STREAM_PROTOCOL_VERSION = "omni.granted_parse_stream.v1";
 export const DEFAULT_CUBE_BASE_URL = "https://mcp.cuecue.cn";
 export const DEFAULT_IIIS_GRANTED_BASE_URL = "https://cubefile.ai.iiis.co:9443/omni/granted/";
-export const BRIDGE_RELEASE_VERSION = "1.3.1";
+export const BRIDGE_RELEASE_VERSION = "1.3.3";
 export const REMOTE_OMNI_MCP_URL = "https://mcp.cuecue.cn/api/omni-reader/mcp/";
 export const FOREGROUND_BUDGET_MS = 15_000;
 export const STATUS_LONG_POLL_MAX_MS = 20_000;

package/dist/remote-client.js

@@ -174,7 +174,57 @@ function jsonFromSse(body, requestId) {
     }
     throw protocolError();
 }
-function decodeEnvelope(value, requestId) {
+// Real repro (2026-08-18): cube-mcp's `parse` tool returns a BARE `{ok:false, code, ...}` object —
+// no `status` field — for a pre-operation source-classification rejection. `parseResultSchema` is
+// a discriminated union keyed on `status`, so this can never match it; the resulting parse failure
+// was masked as a generic REMOTE_PROTOCOL_ERROR, hiding the server's own actionable error
+// (UNSUPPORTED_SOURCE) from the caller. Verified end-to-end against the real remote endpoint.
+//
+// codex review 2026-08-18 (2 rounds, cube-mcp source inspection): an earlier version keyed off
+// `failure_scope` alone ("source"/"local_capability"), reasoning those were inherently
+// pre-operation — WRONG: `failure_scope` names a failure DOMAIN, not a lifecycle stage. cube-mcp's
+// own `url_operations/service.py` can emit a LATE error (e.g. SOURCE_TOO_LARGE) with
+// `failure_scope:"source"` while retrieving an ALREADY-CREATED operation's result — defaulting
+// that case's booleans to false would fabricate "nothing happened" over a real fact. Separately,
+// the claimed LOCAL_BRIDGE_REQUIRED coverage was itself wrong: cube-mcp's actual
+// `local_bridge_required()` payload is missing the required `message` field and carries extra keys
+// `stableErrorSchema.strict()` rejects — it was never going to validate through this fallback
+// regardless. Narrowed to EXACTLY the one call (`parse`, not `status`/`cancel` — an operation
+// necessarily already exists for those) and EXACTLY the one evidenced code (`UNSUPPORTED_SOURCE`)
+// this fix actually verified end-to-end. Any field the server DID provide still wins over the
+// default (spread order). Anything outside this exact, evidenced case is left unchanged and still
+// fails loudly as REMOTE_PROTOCOL_ERROR.
+//
+// review 2026-08-18 (subagent, standing in for codex — quota exhausted): a SECOND server-side
+// producer of this exact code exists — cube-mcp's `url_operations/service.py` falls back to
+// `code="UNSUPPORTED_SOURCE"` for any unmapped-400 from the L1 create call, AFTER metering
+// admission. Traced: that path always runs `fail_reservation`/`_release_metering_lease` before
+// returning (the code's own `_PUBLIC_ERROR_FACTS` hardcodes `retryable=False` for it), so
+// operation_created/billed:false IS accurate there too — not a live bug — but this fix only ever
+// verified the FIRST (pre-flight classify_source) producer end-to-end, not this one.
+function bareStableErrorFallback(candidate, toolName) {
+    if (toolName !== "parse"
+        || candidate === null
+        || typeof candidate !== "object"
+        || Array.isArray(candidate)
+        || candidate.status !== undefined
+        || candidate.ok !== false
+        || candidate.code !== "UNSUPPORTED_SOURCE") {
+        return candidate;
+    }
+    return {
+        status: "failed",
+        error: {
+            operation_created: false,
+            file_uploaded: false,
+            parser_started: false,
+            billed: false,
+            content_released: false,
+            ...candidate,
+        },
+    };
+}
+function decodeEnvelope(value, requestId, toolName) {
     if (value === null || typeof value !== "object" || Array.isArray(value)) {
         throw protocolError();
     }
@@ -208,7 +258,7 @@ function decodeEnvelope(value, requestId) {
         }
     }
     try {
-        return parseResultSchema.parse(candidate);
+        return parseResultSchema.parse(bareStableErrorFallback(candidate, toolName));
     }
     catch {
         throw protocolError();
@@ -395,6 +445,6 @@ export class HttpRemoteOmniClient {
                 throw error;
             throw protocolError();
         }
-        return decodeEnvelope(envelope, requestId);
+        return decodeEnvelope(envelope, requestId, name);
     }
 }

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "@cueai/omni-reader-mcp",
-  "version": "1.3.1",
+  "version": "1.3.3",
   "description": "Local stdio MCP bridge for direct Omni document parsing",
   "type": "module",
   "license": "UNLICENSED",