@hotmeshio/long-tail 0.23.2 → 0.24.1

package/build/system/mcp-servers/oauth.js

@@ -37,7 +37,10 @@ exports.createOAuthServer = createOAuthServer;
 const mcp_js_1 = require("@modelcontextprotocol/sdk/server/mcp.js");
 const zod_1 = require("zod");
 const logger_1 = require("../../lib/logger");
+const registered_tools_1 = require("../../services/mcp/registered-tools");
 const oauth = __importStar(require("../activities/oauth"));
+const capabilities_1 = require("../../modules/capabilities");
+const caller_auth_1 = require("./caller-auth");
 const getAccessTokenSchema = zod_1.z.object({
     provider: zod_1.z.string().describe('OAuth provider name (google, github, microsoft, anthropic, etc.)'),
     user_id: zod_1.z.string().describe('User ID to get token for'),
@@ -51,6 +54,21 @@ const revokeConnectionSchema = zod_1.z.object({
     user_id: zod_1.z.string().describe('User ID to revoke connection for'),
     label: zod_1.z.string().optional().describe('Credential label to revoke (default: "default")'),
 });
+/**
+ * A `/mcp` caller may use their own connections; another user's need
+ * superadmin. Internal calls from workflows are unrestricted.
+ */
+async function refuseOtherUser(userId, extra) {
+    const caller = (0, caller_auth_1.externalCaller)(extra);
+    if (!caller || caller.userId === userId)
+        return null;
+    if ((await (0, capabilities_1.resolveCapabilities)(caller)).superadmin)
+        return null;
+    return {
+        isError: true,
+        content: [{ type: 'text', text: JSON.stringify({ error: 'You can only use your own OAuth connections' }) }],
+    };
+}
 /**
  * Create an OAuth MCP server.
  *
@@ -69,7 +87,10 @@ async function createOAuthServer() {
             'authenticated API request — do not cache or reuse across workflow steps. ' +
             'Use the label parameter to select a specific credential when multiple exist.',
         inputSchema: getAccessTokenSchema,
-    }, async (args) => {
+    }, async (args, extra) => {
+        const refused = await refuseOtherUser(args.user_id, extra);
+        if (refused)
+            return refused;
         const result = await oauth.getAccessToken(args);
         return {
             content: [{ type: 'text', text: JSON.stringify(result) }],
@@ -79,7 +100,10 @@ async function createOAuthServer() {
         title: 'List OAuth Connections',
         description: 'List all OAuth providers connected for a user. Returns provider, label, and credential type for each connection.',
         inputSchema: listConnectionsSchema,
-    }, async (args) => {
+    }, async (args, extra) => {
+        const refused = await refuseOtherUser(args.user_id, extra);
+        if (refused)
+            return refused;
         const result = await oauth.listConnections(args);
         return {
             content: [{ type: 'text', text: JSON.stringify(result) }],
@@ -89,12 +113,15 @@ async function createOAuthServer() {
         title: 'Revoke OAuth Connection',
         description: 'Disconnect an OAuth provider for a user, removing stored tokens. Use label to target a specific credential.',
         inputSchema: revokeConnectionSchema,
-    }, async (args) => {
+    }, async (args, extra) => {
+        const refused = await refuseOtherUser(args.user_id, extra);
+        if (refused)
+            return refused;
         const result = await oauth.revokeConnection(args);
         return {
             content: [{ type: 'text', text: JSON.stringify(result) }],
         };
     });
-    logger_1.loggerRegistry.info('[lt-mcp:oauth] long-tail-oauth ready (3 tools registered)');
+    logger_1.loggerRegistry.info(`[lt-mcp:oauth] long-tail-oauth ready (${(0, registered_tools_1.registeredToolCount)(instance)} tools registered)`);
     return instance;
 }

package/build/system/mcp-servers/schema-exchange.js

@@ -37,6 +37,7 @@ exports.createSchemaExchangeServer = createSchemaExchangeServer;
 const mcp_js_1 = require("@modelcontextprotocol/sdk/server/mcp.js");
 const zod_1 = require("zod");
 const logger_1 = require("../../lib/logger");
+const registered_tools_1 = require("../../services/mcp/registered-tools");
 const schemaExchange = __importStar(require("../activities/schema-exchange"));
 const exchangeSchema = zod_1.z.object({
     endpoint: zod_1.z.string().optional().describe('Service endpoint URL. Supports template variables resolved by the caller (e.g. /Patient/{id}).'),
@@ -88,6 +89,6 @@ async function createSchemaExchangeServer(options) {
         const result = schemaExchange.validateSchema(args.data, args.schema);
         return { content: [{ type: 'text', text: JSON.stringify(result) }] };
     });
-    logger_1.loggerRegistry.info(`[lt-mcp:schema-exchange] ${name} ready (2 tools registered)`);
+    logger_1.loggerRegistry.info(`[lt-mcp:schema-exchange] ${name} ready (${(0, registered_tools_1.registeredToolCount)(instance)} tools registered)`);
     return instance;
 }

package/build/system/mcp-servers/vision.d.ts

@@ -1,4 +1,5 @@
 import { McpServer } from '@modelcontextprotocol/sdk/server/mcp.js';
+export declare const STORAGE_READ_DENIED = "Reading an image from managed storage requires builder access; pass an https URL or a data URI";
 /**
  * Create the Vision MCP server.
  *

package/build/system/mcp-servers/vision.js

@@ -36,6 +36,7 @@ var __importDefault = (this && this.__importDefault) || function (mod) {
     return (mod && mod.__esModule) ? mod : { "default": mod };
 };
 Object.defineProperty(exports, "__esModule", { value: true });
+exports.STORAGE_READ_DENIED = void 0;
 exports.createVisionServer = createVisionServer;
 exports.stopVisionServer = stopVisionServer;
 const path = __importStar(require("path"));
@@ -45,7 +46,10 @@ const sharp_1 = __importDefault(require("sharp"));
 const llm_1 = require("../../services/llm");
 const defaults_1 = require("../../modules/defaults");
 const logger_1 = require("../../lib/logger");
+const registered_tools_1 = require("../../services/mcp/registered-tools");
 const storage_1 = require("../../lib/storage");
+const capabilities_1 = require("../../modules/capabilities");
+const caller_auth_1 = require("./caller-auth");
 const vision_prompts_1 = require("./vision-prompts");
 const MIME_MAP = {
     '.png': 'image/png', '.jpg': 'image/jpeg', '.jpeg': 'image/jpeg',
@@ -62,6 +66,7 @@ const describeImageSchema = zod_1.z.object({
     image: zod_1.z.string().describe('Image source: a storage path, data URI, or https:// URL.'),
     context: zod_1.z.string().optional().describe('Optional context about the image'),
 });
+exports.STORAGE_READ_DENIED = 'Reading an image from managed storage requires builder access; pass an https URL or a data URI';
 /**
  * Resolve an image reference to an LLM-ready content block.
  *
@@ -70,7 +75,7 @@ const describeImageSchema = zod_1.z.object({
  * - https:// URL → passed as-is (OpenAI can fetch; Anthropic translate layer handles)
  * - Storage path (anything else, including file:// prefixed) → read via storage backend
  */
-async function resolveImageContent(image) {
+async function resolveImageContent(image, extra) {
     // Already a data URI — pass through
     if (image.startsWith('data:')) {
         return { type: 'image_url', image_url: { url: image } };
@@ -79,7 +84,12 @@ async function resolveImageContent(image) {
     if (image.startsWith('https://') || image.startsWith('http://')) {
         return { type: 'image_url', image_url: { url: image } };
     }
-    // Storage path — strip file:// prefix if present, read via backend
+    // Storage path: reading managed files is a builder capability, as at
+    // /api/file-browser. Internal callers (compiled pipelines) pass no extra.
+    const caller = (0, caller_auth_1.externalCaller)(extra);
+    if (caller && !(await (0, capabilities_1.mayBuild)(caller))) {
+        throw new Error(exports.STORAGE_READ_DENIED);
+    }
     const storagePath = image.replace(/^file:\/\//, '');
     const backend = (0, storage_1.getStorageBackend)();
     const { data } = await backend.read(storagePath);
@@ -109,7 +119,7 @@ function registerTools(srv) {
         title: 'Analyze Image',
         description: 'Analyze an image and extract structured data: description, text content, and notable objects.',
         inputSchema: analyzeImageSchema,
-    }, async (args) => {
+    }, async (args, extra) => {
         const { hasLLMApiKey } = await Promise.resolve().then(() => __importStar(require('../../services/llm')));
         if (!hasLLMApiKey(defaults_1.LLM_MODEL_SECONDARY)) {
             return {
@@ -129,7 +139,7 @@ function registerTools(srv) {
             : vision_prompts_1.ANALYZE_IMAGE_PROMPT;
         let response;
         try {
-            const imageContent = await resolveImageContent(args.image || args.image_path);
+            const imageContent = await resolveImageContent(args.image || args.image_path, extra);
             response = await (0, llm_1.callLLM)({
                 model: defaults_1.LLM_MODEL_SECONDARY,
                 messages: [
@@ -188,7 +198,7 @@ function registerTools(srv) {
         title: 'Describe Image',
         description: 'Generate a detailed description of an image.',
         inputSchema: describeImageSchema,
-    }, async (args) => {
+    }, async (args, extra) => {
         const { hasLLMApiKey } = await Promise.resolve().then(() => __importStar(require('../../services/llm')));
         if (!hasLLMApiKey(defaults_1.LLM_MODEL_SECONDARY)) {
             return {
@@ -210,7 +220,7 @@ function registerTools(srv) {
                 { role: 'system', content: systemPrompt },
                 {
                     role: 'user',
-                    content: [await resolveImageContent(args.image || args.image_path)],
+                    content: [await resolveImageContent(args.image || args.image_path, extra)],
                 },
             ],
             max_tokens: defaults_1.LLM_MAX_TOKENS_VISION,
@@ -247,7 +257,7 @@ async function createVisionServer(options) {
     const name = options?.name || 'long-tail-vision';
     const instance = new mcp_js_1.McpServer({ name, version: '1.0.0' });
     registerTools(instance);
-    logger_1.loggerRegistry.info(`[lt-mcp:vision] ${name} ready (2 tools registered)`);
+    logger_1.loggerRegistry.info(`[lt-mcp:vision] ${name} ready (${(0, registered_tools_1.registeredToolCount)(instance)} tools registered)`);
     return instance;
 }
 /**

package/build/system/mcp-servers/workflow.js

@@ -41,7 +41,8 @@ const zod_1 = require("zod");
 const defaults_1 = require("../../modules/defaults");
 const logger_1 = require("../../lib/logger");
 const yamlDb = __importStar(require("../../services/yaml-workflow/db"));
-const yamlDeployer = __importStar(require("../../services/yaml-workflow/deployer"));
+const deploy_1 = require("../../api/yaml-workflows/deploy");
+const caller_auth_1 = require("./caller-auth");
 let server = null;
 // ── Schemas ─────────────────────────────────────────────────────────────────
 const listWorkflowsSchema = zod_1.z.object({
@@ -161,7 +162,7 @@ async function createWorkflowServer(options) {
             'to discover available workflows and their input schemas. ' +
             'Set async=true for fire-and-forget (returns job ID), or leave false to wait for the result.',
         inputSchema: invokeWorkflowSchema,
-    }, async (args) => {
+    }, async (args, extra) => {
         const wf = await yamlDb.getYamlWorkflowByName(args.workflow_name);
         if (!wf) {
             return {
@@ -183,32 +184,19 @@ async function createWorkflowServer(options) {
                 isError: true,
             };
         }
-        if (args.async) {
-            const jobId = await yamlDeployer.invokeYamlWorkflow(wf.app_id, wf.graph_topic, args.input || {}, wf.graph_topic);
+        // Runs as the /mcp caller, under each step tool's gate.
+        const invoked = await (0, deploy_1.invokeYamlWorkflow)({ id: wf.id, data: args.input || {}, sync: !args.async, timeout: args.timeout }, (0, caller_auth_1.externalCaller)(extra));
+        if (invoked.error) {
             return {
-                content: [{
-                        type: 'text',
-                        text: JSON.stringify({
-                            job_id: jobId,
-                            workflow: wf.name,
-                            status: 'started',
-                        }),
-                    }],
+                content: [{ type: 'text', text: JSON.stringify({ error: invoked.error }) }],
+                isError: true,
             };
         }
-        const { job_id, result } = await yamlDeployer.invokeYamlWorkflowSync(wf.app_id, wf.graph_topic, args.input || {}, args.timeout, wf.graph_topic);
-        return {
-            content: [{
-                    type: 'text',
-                    text: JSON.stringify({
-                        job_id,
-                        namespace: wf.app_id,
-                        workflow: wf.name,
-                        status: 'completed',
-                        result,
-                    }),
-                }],
-        };
+        const { job_id, result } = invoked.data;
+        const outcome = args.async
+            ? { job_id, workflow: wf.name, status: 'started' }
+            : { job_id, namespace: wf.app_id, workflow: wf.name, status: 'completed', result };
+        return { content: [{ type: 'text', text: JSON.stringify(outcome) }] };
     });
     const toolCount = 3;
     logger_1.loggerRegistry.info(`[lt-mcp:server] ${name} ready (${toolCount} tools registered)`);