@homespunapps/mcp 1.6.47 → 1.6.48

package/dist/config.d.ts

@@ -1,7 +1,7 @@
 import { HomespunClient } from "@homespunapps/core";
 /**
- * The hosted Homespun relay — the URL fallback when nothing else is set. A
- * self-hoster overrides it with HOMESPUN_URL or a registered profile.
+ * The hosted Homespun relay — the URL fallback when nothing else is set. An
+ * operator overrides it with HOMESPUN_URL or a registered profile.
  */
 export declare const DEFAULT_RELAY_URL = "https://homespun.dev";
 /**
@@ -51,7 +51,7 @@ export declare function describeActiveConfig(): {
  * CLI and any later MCP launch reuse the same identity, and the human never
  * has to run `homespun agent register` by hand.
  *
- * A self-hoster on a `secret`-mode relay (or anyone who prefers explicit
+ * An operator on a `secret`-mode relay (or anyone who prefers explicit
  * provisioning) sets HOMESPUN_API_KEY / HOMESPUN_TOKEN and the auto-register path is
  * never taken.
  *

package/dist/config.js

@@ -22,8 +22,8 @@ import { homedir } from "node:os";
 import { join, dirname } from "node:path";
 import { HomespunClient, registerAgent } from "@homespunapps/core";
 /**
- * The hosted Homespun relay — the URL fallback when nothing else is set. A
- * self-hoster overrides it with HOMESPUN_URL or a registered profile.
+ * The hosted Homespun relay — the URL fallback when nothing else is set. An
+ * operator overrides it with HOMESPUN_URL or a registered profile.
  */
 export const DEFAULT_RELAY_URL = "https://homespun.dev";
 /**
@@ -202,7 +202,7 @@ function resolveApiKey() {
  * CLI and any later MCP launch reuse the same identity, and the human never
  * has to run `homespun agent register` by hand.
  *
- * A self-hoster on a `secret`-mode relay (or anyone who prefers explicit
+ * An operator on a `secret`-mode relay (or anyone who prefers explicit
  * provisioning) sets HOMESPUN_API_KEY / HOMESPUN_TOKEN and the auto-register path is
  * never taken.
  *

package/dist/tools.js

@@ -1837,7 +1837,7 @@ export const TOOLS = [
     // ----- consolidated management tools --------------------------------------
     {
         name: "attachments",
-        description: "Binary attachments (images, PDFs, audio, video) referenced from event payloads and input_data via `format: homespun-attachment-id`. Actions: upload, fetch, presign, finalize, download, show, list, delete, mint_token, revoke_token, list_tokens.\n\nChoosing an upload path matters for cost. An inline upload with `content_base64` carries the bytes in the tool-call arguments, so they enter the model context at a token cost proportional to file size, paid again on every retry; a few-hundred-KB image is already expensive. Two paths avoid that entirely: fetch, when the bytes are reachable at a URL, and presign plus finalize, when the client can PUT the raw bytes out of band. Inline upload suits small assets and clients that have neither a URL nor an out-of-band PUT.\n\nfetch takes { source_url (https), scope } and the relay downloads the URL itself behind an SSRF guard (https only, no private, loopback or metadata hosts, DNS pinned, redirects refused, size-capped and timed out), then runs the same byte-sniff, allowlist, size, quota and scan checks as any upload. It works on any storage backend. upload takes either `content_base64` (base64 bytes, no filesystem) or `file_path` (an absolute path read on the relay host, so it only applies when the file is local to the relay). presign plus finalize is token-free: presign with { mime, size, sha256, scope } returns { put_url, attachment_id }, the caller PUTs the raw bytes to put_url over plain HTTP out of band, then finalize with the attachment_id. At finalize the relay re-reads the stored bytes, sniffs the real type, and enforces the same allowlist, size, sha256, quota and scan checks, so a presign that misstates its mime is caught and never served inline. The presigned path requires the Azure storage backend; a filesystem self-host returns a clear not-supported error and fetch or inline upload apply there instead. download writes to an absolute out_path or returns base64. An upload is scoped to agent (the default, reusable) or app. mint_token returns a /b/<token> capability URL, shown once, that a browser can GET without the caller's API key.",
+        description: "Binary attachments (images, PDFs, audio, video) referenced from event payloads and input_data via `format: homespun-attachment-id`. Actions: upload, fetch, presign, finalize, download, show, list, delete, mint_token, revoke_token, list_tokens.\n\nChoosing an upload path matters for cost. An inline upload with `content_base64` carries the bytes in the tool-call arguments, so they enter the model context at a token cost proportional to file size, paid again on every retry; a few-hundred-KB image is already expensive. Two paths avoid that entirely: fetch, when the bytes are reachable at a URL, and presign plus finalize, when the client can PUT the raw bytes out of band. Inline upload suits small assets and clients that have neither a URL nor an out-of-band PUT.\n\nfetch takes { source_url (https), scope } and the relay downloads the URL itself behind an SSRF guard (https only, no private, loopback or metadata hosts, DNS pinned, redirects refused, size-capped and timed out), then runs the same byte-sniff, allowlist, size, quota and scan checks as any upload. It works on any storage backend. upload takes either `content_base64` (base64 bytes, no filesystem) or `file_path` (an absolute path read on the relay host, so it only applies when the file is local to the relay). presign plus finalize is token-free: presign with { mime, size, sha256, scope } returns { put_url, attachment_id }, the caller PUTs the raw bytes to put_url over plain HTTP out of band, then finalize with the attachment_id. At finalize the relay re-reads the stored bytes, sniffs the real type, and enforces the same allowlist, size, sha256, quota and scan checks, so a presign that misstates its mime is caught and never served inline. The presigned path requires the Azure storage backend; a filesystem-backed relay returns a clear not-supported error and fetch or inline upload apply there instead. download writes to an absolute out_path or returns base64. An upload is scoped to agent (the default, reusable) or app. mint_token returns a /b/<token> capability URL, shown once, that a browser can GET without the caller's API key.",
         inputSchema: attachmentsShape,
         // Consolidated tool: read actions (download/show/list/list_tokens) +
         // mutating ones (upload/delete/mint_token/revoke_token). openWorld:true

package/dist/version.d.ts

@@ -1 +1 @@
-export declare const VERSION = "1.6.47";
+export declare const VERSION = "1.6.48";

package/dist/version.js

@@ -1,3 +1,3 @@
 // Single source of the package version, reported in the MCP server's
 // serverInfo. Kept in sync with package.json by the release tooling.
-export const VERSION = "1.6.47";
+export const VERSION = "1.6.48";

package/package.json

@@ -1,7 +1,7 @@
 {
   "name": "@homespunapps/mcp",
   "mcpName": "dev.homespun/homespun",
-  "version": "1.6.47",
+  "version": "1.6.48",
   "description": "Model Context Protocol (stdio) server for Homespun: lets any MCP client (Claude Desktop, Cursor, …) deploy a multi-user web app with hosting, auth, a shared database and permissions included.",
   "license": "MIT",
   "type": "module",
@@ -46,7 +46,7 @@
   },
   "dependencies": {
     "@modelcontextprotocol/sdk": "^1.30.0",
-    "@homespunapps/core": "^1.6.47",
+    "@homespunapps/core": "^1.6.48",
     "zod": "^4.4.3"
   },
   "devDependencies": {

package/server.json

@@ -3,14 +3,14 @@
   "name": "dev.homespun/homespun",
   "title": "Homespun",
   "description": "Deploy a multi-user web app from your agent: hosting, auth, database, and permissions.",
-  "version": "1.6.47",
-  "websiteUrl": "https://docs.homespun.dev",
+  "version": "1.6.48",
+  "websiteUrl": "https://homespun.dev",
   "packages": [
     {
       "registryType": "npm",
       "registryBaseUrl": "https://registry.npmjs.org",
       "identifier": "@homespunapps/mcp",
-      "version": "1.6.47",
+      "version": "1.6.48",
       "transport": {
         "type": "stdio"
       },