@hotmeshio/long-tail 0.23.1 → 0.24.0

package/build/system/mcp-servers/vision.js

@@ -36,6 +36,7 @@ var __importDefault = (this && this.__importDefault) || function (mod) {
     return (mod && mod.__esModule) ? mod : { "default": mod };
 };
 Object.defineProperty(exports, "__esModule", { value: true });
+exports.STORAGE_READ_DENIED = void 0;
 exports.createVisionServer = createVisionServer;
 exports.stopVisionServer = stopVisionServer;
 const path = __importStar(require("path"));
@@ -45,7 +46,10 @@ const sharp_1 = __importDefault(require("sharp"));
 const llm_1 = require("../../services/llm");
 const defaults_1 = require("../../modules/defaults");
 const logger_1 = require("../../lib/logger");
+const registered_tools_1 = require("../../services/mcp/registered-tools");
 const storage_1 = require("../../lib/storage");
+const capabilities_1 = require("../../modules/capabilities");
+const caller_auth_1 = require("./caller-auth");
 const vision_prompts_1 = require("./vision-prompts");
 const MIME_MAP = {
     '.png': 'image/png', '.jpg': 'image/jpeg', '.jpeg': 'image/jpeg',
@@ -62,6 +66,7 @@ const describeImageSchema = zod_1.z.object({
     image: zod_1.z.string().describe('Image source: a storage path, data URI, or https:// URL.'),
     context: zod_1.z.string().optional().describe('Optional context about the image'),
 });
+exports.STORAGE_READ_DENIED = 'Reading an image from managed storage requires builder access; pass an https URL or a data URI';
 /**
  * Resolve an image reference to an LLM-ready content block.
  *
@@ -70,7 +75,7 @@ const describeImageSchema = zod_1.z.object({
  * - https:// URL → passed as-is (OpenAI can fetch; Anthropic translate layer handles)
  * - Storage path (anything else, including file:// prefixed) → read via storage backend
  */
-async function resolveImageContent(image) {
+async function resolveImageContent(image, extra) {
     // Already a data URI — pass through
     if (image.startsWith('data:')) {
         return { type: 'image_url', image_url: { url: image } };
@@ -79,7 +84,12 @@ async function resolveImageContent(image) {
     if (image.startsWith('https://') || image.startsWith('http://')) {
         return { type: 'image_url', image_url: { url: image } };
     }
-    // Storage path — strip file:// prefix if present, read via backend
+    // Storage path: reading managed files is a builder capability, as at
+    // /api/file-browser. Internal callers (compiled pipelines) pass no extra.
+    const caller = (0, caller_auth_1.externalCaller)(extra);
+    if (caller && !(await (0, capabilities_1.mayBuild)(caller))) {
+        throw new Error(exports.STORAGE_READ_DENIED);
+    }
     const storagePath = image.replace(/^file:\/\//, '');
     const backend = (0, storage_1.getStorageBackend)();
     const { data } = await backend.read(storagePath);
@@ -109,7 +119,7 @@ function registerTools(srv) {
         title: 'Analyze Image',
         description: 'Analyze an image and extract structured data: description, text content, and notable objects.',
         inputSchema: analyzeImageSchema,
-    }, async (args) => {
+    }, async (args, extra) => {
         const { hasLLMApiKey } = await Promise.resolve().then(() => __importStar(require('../../services/llm')));
         if (!hasLLMApiKey(defaults_1.LLM_MODEL_SECONDARY)) {
             return {
@@ -129,7 +139,7 @@ function registerTools(srv) {
             : vision_prompts_1.ANALYZE_IMAGE_PROMPT;
         let response;
         try {
-            const imageContent = await resolveImageContent(args.image || args.image_path);
+            const imageContent = await resolveImageContent(args.image || args.image_path, extra);
             response = await (0, llm_1.callLLM)({
                 model: defaults_1.LLM_MODEL_SECONDARY,
                 messages: [
@@ -188,7 +198,7 @@ function registerTools(srv) {
         title: 'Describe Image',
         description: 'Generate a detailed description of an image.',
         inputSchema: describeImageSchema,
-    }, async (args) => {
+    }, async (args, extra) => {
         const { hasLLMApiKey } = await Promise.resolve().then(() => __importStar(require('../../services/llm')));
         if (!hasLLMApiKey(defaults_1.LLM_MODEL_SECONDARY)) {
             return {
@@ -210,7 +220,7 @@ function registerTools(srv) {
                 { role: 'system', content: systemPrompt },
                 {
                     role: 'user',
-                    content: [await resolveImageContent(args.image || args.image_path)],
+                    content: [await resolveImageContent(args.image || args.image_path, extra)],
                 },
             ],
             max_tokens: defaults_1.LLM_MAX_TOKENS_VISION,
@@ -247,7 +257,7 @@ async function createVisionServer(options) {
     const name = options?.name || 'long-tail-vision';
     const instance = new mcp_js_1.McpServer({ name, version: '1.0.0' });
     registerTools(instance);
-    logger_1.loggerRegistry.info(`[lt-mcp:vision] ${name} ready (2 tools registered)`);
+    logger_1.loggerRegistry.info(`[lt-mcp:vision] ${name} ready (${(0, registered_tools_1.registeredToolCount)(instance)} tools registered)`);
     return instance;
 }
 /**