@kolbo/mcp 1.30.3 → 1.30.5

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "@kolbo/mcp",
-  "version": "1.30.3",
+  "version": "1.30.5",
   "description": "Kolbo AI MCP Server - Generate images, videos, music, speech, and sound effects from Claude Code",
   "main": "src/index.js",
   "bin": {

package/src/apps/index.js

@@ -48,16 +48,29 @@ function widgetHtml(uri) {
 // img/script/style/font/media-src; connectDomains to connect-src.
 const WIDGET_CSP = {
   resourceDomains: [
-    'https://*.kolbo.ai',                       // media.kolbo.ai CDN + app.kolbo.ai model icons
-    'https://*.digitaloceanspaces.com',         // DO Spaces buckets (all envs)
-    'https://*.cdn.digitaloceanspaces.com',     // DO Spaces CDN endpoints
+    // Exact hosts FIRST — not every host CSP implementation honors wildcards,
+    // and a declared-but-unmatched allowlist blocks harder than no declaration.
+    'https://api.kolbo.ai',                     // model icons (/assets)
+    'https://app.kolbo.ai',
+    'https://media.kolbo.ai',                   // media CDN (prod)
+    'https://media-staging.kolbo.ai',
+    'https://media-dev.kolbo.ai',
+    'https://kolboai-production.ams3.digitaloceanspaces.com',
+    'https://kolboai-production.ams3.cdn.digitaloceanspaces.com',
+    'https://kolboai-development.ams3.digitaloceanspaces.com',
+    'https://kolboai-development.ams3.cdn.digitaloceanspaces.com',
+    'https://kolbo-general-media.fra1.cdn.digitaloceanspaces.com',
     'https://fonts.googleapis.com',             // Inter / JetBrains Mono stylesheet
     'https://fonts.gstatic.com',                // font files
     'https://images.pexels.com',                // stock thumbnails
+    // Wildcards as a second layer for hosts that do support them.
+    'https://*.kolbo.ai',
+    'https://*.digitaloceanspaces.com',
+    'https://*.cdn.digitaloceanspaces.com',
     'https://*.pexels.com',
     'https://*.pixabay.com',
     'https://*.sketchfab.com',
-    'https://*.cloudfront.net',                 // provider-hosted previews
+    'https://*.cloudfront.net',
   ],
   connectDomains: [],
 };
@@ -125,6 +138,23 @@ function uiResult(uri, text, structured) {
 const ICON_TTL_MS = 10 * 60 * 1000;
 const infoCache = new Map(); // apiBase → { at, byKey: Map<lowername, {icon, eta}> }
 
+/**
+ * Resolve a Model.avatar value to an absolute URL. Avatars are bare filenames
+ * (sometimes with spaces) living in the BACKEND's public assets folder —
+ * `<api origin>/assets/<file>`. Do NOT use app.kolbo.ai for this: it's the SPA,
+ * whose catch-all returns 200 text/html for any missing file, which renders as
+ * a broken image in widgets.
+ */
+function resolveAvatarUrl(avatar, apiBase) {
+  if (!avatar) return null;
+  if (/^https?:\/\//i.test(avatar)) return avatar;
+  let origin = 'https://api.kolbo.ai';
+  try {
+    origin = new URL(apiBase || 'https://api.kolbo.ai/api').origin;
+  } catch (_) { /* keep default */ }
+  return `${origin}/assets/${encodeURIComponent(avatar)}`;
+}
+
 async function modelInfoMap(client) {
   const cacheKey = client.apiBase || 'default';
   const hit = infoCache.get(cacheKey);
@@ -135,13 +165,7 @@ async function modelInfoMap(client) {
     const models = res?.models || res?.data?.models || [];
     for (const m of models) {
       if (!m) continue;
-      // The API usually resolves avatars to absolute URLs; bare filenames (older
-      // deployments / internal calls) resolve against the app's public icon dir.
-      const icon = m.avatar
-        ? (/^https?:\/\//i.test(m.avatar)
-          ? m.avatar
-          : `https://app.kolbo.ai/models_icons/${encodeURIComponent(m.avatar)}`)
-        : null;
+      const icon = resolveAvatarUrl(m.avatar, client.apiBase);
       // Real p75 wall-clock estimate mined from production creditUsages —
       // the same source the in-app countdowns use. No estimate → no ETA shown.
       const eta = Number(m.estimatedDurationSeconds || m.estimated_duration_seconds) || null;
@@ -232,5 +256,6 @@ module.exports = {
   modelIcon,
   modelInfo,
   modelInfoMap,
+  resolveAvatarUrl,
   widgetHtml, // exported for smoke tests
 };

package/src/apps/widgets/generation.js

@@ -92,7 +92,7 @@ function renderChips(sc) {
   if (s.voice) h += chip('🎤 ' + esc(s.voice));
   if (s.mode) h += chip(esc(s.mode));
   if (sc.count > 1) h += chip('×' + sc.count);
-  if (sc.reference_image) h += '<img class="k-ref-thumb" src="' + esc(sc.reference_image) + '" alt="" title="Reference image" onerror="this.style.display=\'none\'">';
+  if (sc.reference_image) h += '<img class="k-ref-thumb" src="' + esc(sc.reference_image) + '" alt="" title="Reference image" onerror="this.style.display=\\'none\\'">';
   el('chips').innerHTML = h;
 }
 function chip(inner) { return '<span class="k-chip">' + inner + '</span>'; }

package/src/index.js

@@ -97,7 +97,12 @@ function createServer(opts = {}) {
 
   const server = new McpServer({
     name: 'kolbo',
-    version: '1.0.0'
+    title: 'Kolbo',
+    version: '1.0.0',
+    websiteUrl: 'https://kolbo.ai',
+    // Connector avatar for hosts that render server icons (claude.ai tool
+    // headers show this instead of a letter monogram).
+    icons: [{ src: 'https://api.kolbo.ai/assets/kolbo-ai.png', mimeType: 'image/png', sizes: ['512x512'] }]
   });
 
   // Register all tools. `inlineImages` (off by default) is opt-in: only the