@kolbo/mcp 1.37.1 → 1.38.0

package/README.md

@@ -163,7 +163,8 @@ Every generation tool also accepts an optional `project_id` arg that routes the
 **Media Library**
 | Tool | Description |
 |------|-------------|
-| `upload_media` | Upload a local file (or remote URL) → stable Kolbo CDN URL for reuse |
+| `media_upload_widget` | Open an in-chat upload card so claude.ai users can upload LOCAL files (image / video / audio / document) — chat attachments are unreachable from remote MCP, so this is the way to bring them in. Returns stable CDN URLs |
+| `upload_media` | Upload a local file (path or URL), or inline `source_base64` + `filename`, → stable Kolbo CDN URL for reuse |
 | `list_media` | Browse media library — filter by `project_id`, `folder_id`, `type`, `category` (ai / uploaded / edited / favorites / training-lab), `source_type`, `sort`, `search`, pagination |
 | `list_media_folders` | List the user's media folders (owned + shared) — discover `folder_id` values to pass to `list_media` |
 | `create_media_folder` | Create a new folder (name, optional description / color / icon) |

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "@kolbo/mcp",
-  "version": "1.37.1",
+  "version": "1.38.0",
   "description": "Kolbo AI MCP Server - Generate images, videos, music, speech, and sound effects from Claude Code",
   "main": "src/index.js",
   "bin": {

package/src/apps/index.js

@@ -20,12 +20,14 @@ const { generationWidgetHtml } = require('./widgets/generation');
 const { mediaGridWidgetHtml } = require('./widgets/mediaGrid');
 const { catalogWidgetHtml } = require('./widgets/catalog');
 const { transcriptWidgetHtml } = require('./widgets/transcript');
+const { uploadWidgetHtml } = require('./widgets/upload');
 
 const UI = {
   generation: 'ui://kolbo/generation.html',
   mediaGrid: 'ui://kolbo/media-grid.html',
   catalog: 'ui://kolbo/catalog.html',
   transcript: 'ui://kolbo/transcript.html',
+  upload: 'ui://kolbo/upload.html',
 };
 
 const WIDGET_BUILDERS = {
@@ -33,6 +35,7 @@ const WIDGET_BUILDERS = {
   [UI.mediaGrid]: mediaGridWidgetHtml,
   [UI.catalog]: catalogWidgetHtml,
   [UI.transcript]: transcriptWidgetHtml,
+  [UI.upload]: uploadWidgetHtml,
 };
 
 // Widgets are pure functions of source — build once per process.
@@ -72,7 +75,14 @@ const WIDGET_CSP = {
     'https://*.sketchfab.com',
     'https://*.cloudfront.net',
   ],
-  connectDomains: [],
+  // connect-src — XHR/fetch FROM widget iframes. Used by the upload widget to
+  // POST files to /mcp/upload with its short-lived ticket.
+  connectDomains: [
+    'https://api.kolbo.ai',
+    'https://api-staging.kolbo.ai',
+    'https://api-dev.kolbo.ai',
+    'https://*.kolbo.ai',
+  ],
 };
 
 /** Register all Kolbo widget resources on an McpServer. */
@@ -82,6 +92,7 @@ function registerApps(server) {
     [UI.mediaGrid, 'Kolbo Library Widget'],
     [UI.catalog, 'Kolbo Model Catalog Widget'],
     [UI.transcript, 'Kolbo Transcription Widget'],
+    [UI.upload, 'Kolbo Upload Widget'],
   ]) {
     registerAppResource(
       server, name, uri,
@@ -269,6 +280,8 @@ const TOOL_WIDGETS = {
   list_visual_dnas: UI.mediaGrid,
   list_moodboards: UI.mediaGrid,
   shorts_analyze: UI.mediaGrid,
+  // upload widget
+  media_upload_widget: UI.upload,
 };
 
 function attachToolWidgetMeta(server) {

package/src/apps/widgets/upload.js

@@ -0,0 +1,267 @@
+'use strict';
+
+const { widgetPage } = require('../html');
+
+/**
+ * Upload widget — media_upload_widget tool.
+ *
+ * Lets claude.ai users upload LOCAL files (images / video / audio / documents)
+ * into their Kolbo media library from inside the chat. Chat attachments are
+ * unreachable from remote MCP servers — this widget is the bridge: the file is
+ * POSTed straight from the iframe to api.kolbo.ai/mcp/upload with a
+ * short-lived, upload-only ticket (never the user's API key).
+ *
+ * structuredContent: {
+ *   widget: 'upload', title, upload_url, token, expires_at (epoch ms),
+ *   accept (input accept attr), max_files, max_mb: {image,video,audio,document},
+ *   project_id?
+ * }
+ *
+ * Flow: pick/drop files -> client-side type+size validation -> XHR upload
+ * (2 concurrent, per-file progress) -> per-file CDN URL. Every completed file
+ * is pushed into the model context silently; the "Use these files" button
+ * sends one chat message with all URLs so the model continues the task.
+ */
+
+const BODY = `
+<div class="k-card">
+  <div class="k-head">
+    <span class="k-logo" id="logo"></span>
+    <span class="k-title" id="title">Upload media</span>
+    <span class="k-spacer"></span>
+    <span class="k-chip" id="count-chip" style="display:none"></span>
+  </div>
+  <div class="k-body">
+    <div id="drop" style="border:1.5px dashed var(--border);border-radius:12px;padding:26px 16px;text-align:center;cursor:pointer;transition:border-color .15s,background .15s">
+      <div style="font-size:22px;margin-bottom:6px">⬆</div>
+      <div style="font-size:13px;font-weight:600">Click or drop files here</div>
+      <div id="accept-hint" style="font-size:11.5px;color:var(--text-muted);margin-top:4px"></div>
+    </div>
+    <input type="file" id="picker" multiple style="display:none">
+    <div id="rows" style="margin-top:10px"></div>
+    <div class="k-actions" id="actions" style="display:none"></div>
+    <div id="notice" style="display:none;margin-top:8px;font-size:12px;color:var(--text-muted)"></div>
+  </div>
+  <div class="k-footer">
+    <span><a href="#" id="kolbo-link">Kolbo.AI</a> Media Library</span>
+    <span class="k-credits">free</span>
+  </div>
+</div>
+`;
+
+const SCRIPT = `
+el('logo').innerHTML = KOLBO_LOGO + '<span>Kolbo</span>';
+el('kolbo-link').onclick = function (e) { e.preventDefault(); window.kolbo.openLink('https://app.kolbo.ai/media-library'); };
+
+var state = null;
+var items = []; // {file, kind, status, pct, url, err, id}
+var nextItemId = 1;
+var CONCURRENCY = 2;
+var active = 0;
+var sent = false;
+
+var KINDS = {
+  image: { exts: ['jpg','jpeg','png','webp','gif','heic','heif','avif','bmp','tif','tiff'], icon: '🖼' },
+  video: { exts: ['mp4','mov','webm','m4v','mkv','avi'], icon: '🎬' },
+  audio: { exts: ['mp3','wav','m4a','aac','ogg','flac'], icon: '🎵' },
+  document: { exts: ['pdf','txt','md','csv','json','docx','xlsx','pptx','doc','xls'], icon: '📄' }
+};
+
+function classify(name) {
+  var ext = String(name || '').split('.').pop().toLowerCase();
+  for (var k in KINDS) { if (KINDS[k].exts.indexOf(ext) !== -1) return k; }
+  return null;
+}
+
+function fmtSize(b) {
+  if (b == null) return '';
+  if (b > 1024 * 1024) return (Math.round(b / 1024 / 102.4) / 10) + 'MB';
+  return Math.max(1, Math.round(b / 1024)) + 'KB';
+}
+
+function expired() { return state && state.expires_at && Date.now() > state.expires_at; }
+
+function boot(sc) {
+  if (!sc || sc.widget !== 'upload') return;
+  state = sc;
+  if (sc.title) el('title').textContent = sc.title;
+  var kinds = sc.kinds && sc.kinds.length ? sc.kinds : ['image','video','audio','document'];
+  var exts = [];
+  kinds.forEach(function (k) { if (KINDS[k]) exts = exts.concat(KINDS[k].exts); });
+  el('picker').setAttribute('accept', exts.map(function (e) { return '.' + e; }).join(','));
+  el('accept-hint').textContent = kinds.join(' · ') + ' — up to ' + (sc.max_files || 10) + ' files';
+  if (expired()) return showExpired();
+  window.kolbo.notifySize();
+}
+
+function showExpired() {
+  el('drop').style.pointerEvents = 'none';
+  el('drop').style.opacity = '0.5';
+  el('notice').style.display = '';
+  el('notice').innerHTML = '⏱ This upload window expired. Ask Claude to open a new upload widget.';
+  window.kolbo.notifySize();
+}
+
+// ---- picking ----
+el('drop').onclick = function () { el('picker').click(); };
+el('drop').ondragover = function (e) { e.preventDefault(); el('drop').style.borderColor = 'var(--accent, #7c6cff)'; };
+el('drop').ondragleave = function () { el('drop').style.borderColor = 'var(--border)'; };
+el('drop').ondrop = function (e) {
+  e.preventDefault();
+  el('drop').style.borderColor = 'var(--border)';
+  addFiles(e.dataTransfer && e.dataTransfer.files);
+};
+el('picker').onchange = function () { addFiles(el('picker').files); el('picker').value = ''; };
+
+function addFiles(list) {
+  if (!list || !state) return;
+  if (expired()) return showExpired();
+  var maxFiles = state.max_files || 10;
+  for (var i = 0; i < list.length; i++) {
+    if (items.length >= maxFiles) break;
+    var f = list[i];
+    var kind = classify(f.name);
+    var it = { file: f, kind: kind, status: 'queued', pct: 0, url: null, err: null, id: nextItemId++ };
+    var allowedKinds = state.kinds && state.kinds.length ? state.kinds : ['image','video','audio','document'];
+    if (!kind || allowedKinds.indexOf(kind) === -1) {
+      it.status = 'error'; it.err = 'Unsupported file type';
+    } else {
+      var capMb = (state.max_mb && state.max_mb[kind]) || 50;
+      if (f.size > capMb * 1024 * 1024) { it.status = 'error'; it.err = kind + ' files are limited to ' + capMb + 'MB'; }
+    }
+    items.push(it);
+  }
+  render();
+  pump();
+}
+
+// ---- upload queue ----
+function pump() {
+  if (expired()) return showExpired();
+  while (active < CONCURRENCY) {
+    var next = null;
+    for (var i = 0; i < items.length; i++) { if (items[i].status === 'queued') { next = items[i]; break; } }
+    if (!next) break;
+    upload(next);
+  }
+}
+
+function upload(it) {
+  it.status = 'uploading';
+  active++;
+  render();
+  var fd = new FormData();
+  fd.append('file', it.file, it.file.name);
+  if (state.project_id) fd.append('project_id', state.project_id);
+  var xhr = new XMLHttpRequest();
+  xhr.open('POST', state.upload_url, true);
+  xhr.setRequestHeader('Authorization', 'Bearer ' + state.token);
+  xhr.upload.onprogress = function (e) {
+    if (e.lengthComputable) { it.pct = Math.round((e.loaded / e.total) * 100); renderRow(it); }
+  };
+  xhr.onload = function () {
+    active--;
+    var res = null;
+    try { res = JSON.parse(xhr.responseText); } catch (e) {}
+    if (xhr.status >= 200 && xhr.status < 300 && res && res.success && res.media && res.media.url) {
+      it.status = 'done';
+      it.url = res.media.url;
+      // Silent context update — the model learns the URL even before the
+      // user clicks "Use these files".
+      try {
+        window.kolbo.updateModelContext('Upload widget: "' + it.file.name + '" (' + it.kind + ') uploaded to the Kolbo media library. URL: ' + it.url);
+      } catch (e) {}
+    } else {
+      it.status = 'error';
+      it.err = (res && res.error) || ('Upload failed (' + xhr.status + ')');
+    }
+    render();
+    pump();
+  };
+  xhr.onerror = function () {
+    active--;
+    it.status = 'error';
+    it.err = 'Network error — try again';
+    render();
+    pump();
+  };
+  xhr.send(fd);
+}
+
+// ---- rendering ----
+function rowHtml(it) {
+  var icon = it.kind && KINDS[it.kind] ? KINDS[it.kind].icon : '📎';
+  var right = '';
+  if (it.status === 'queued') right = '<span style="color:var(--text-muted)">queued</span>';
+  else if (it.status === 'uploading') right = '<span style="color:var(--text-muted)">' + it.pct + '%</span>';
+  else if (it.status === 'done') right = '<span style="color:#4ade80">✓ uploaded</span>';
+  else right = '<span class="k-error" style="padding:0;border:0;background:none">✕ ' + esc(it.err || 'failed') + '</span> <a href="#" data-retry="' + it.id + '" style="font-size:11px">retry</a>';
+  var bar = it.status === 'uploading'
+    ? '<div style="height:3px;border-radius:2px;background:var(--surface);margin-top:5px;overflow:hidden"><div id="bar-' + it.id + '" style="height:100%;width:' + it.pct + '%;background:var(--accent,#7c6cff);transition:width .2s"></div></div>'
+    : '';
+  return '<div id="row-' + it.id + '" style="padding:8px 10px;border:1px solid var(--border);border-radius:10px;margin-bottom:6px;background:var(--surface)">' +
+    '<div style="display:flex;align-items:center;gap:8px;font-size:12.5px">' +
+    '<span>' + icon + '</span>' +
+    '<span style="flex:1;overflow:hidden;text-overflow:ellipsis;white-space:nowrap" title="' + esc(it.file.name) + '">' + esc(it.file.name) + '</span>' +
+    '<span style="color:var(--text-muted);font-size:11px">' + fmtSize(it.file.size) + '</span>' +
+    '<span id="status-' + it.id + '" style="font-size:11.5px">' + right + '</span>' +
+    '</div>' + bar + '</div>';
+}
+
+function renderRow(it) {
+  var s = el('status-' + it.id);
+  if (s && it.status === 'uploading') s.innerHTML = '<span style="color:var(--text-muted)">' + it.pct + '%</span>';
+  var b = el('bar-' + it.id);
+  if (b) b.style.width = it.pct + '%';
+}
+
+function render() {
+  el('rows').innerHTML = items.map(rowHtml).join('');
+  Array.prototype.forEach.call(el('rows').querySelectorAll('[data-retry]'), function (a) {
+    a.onclick = function (e) {
+      e.preventDefault();
+      var id = Number(a.getAttribute('data-retry'));
+      for (var i = 0; i < items.length; i++) {
+        if (items[i].id === id) { items[i].status = 'queued'; items[i].err = null; items[i].pct = 0; }
+      }
+      render();
+      pump();
+    };
+  });
+  var done = items.filter(function (i) { return i.status === 'done'; });
+  var busy = items.some(function (i) { return i.status === 'uploading' || i.status === 'queued'; });
+  el('count-chip').style.display = items.length ? '' : 'none';
+  el('count-chip').textContent = done.length + '/' + items.length + ' uploaded';
+  if (done.length && !busy && !sent) {
+    el('actions').style.display = '';
+    el('actions').innerHTML = '<button class="k-btn primary" id="btn-use">Use ' + (done.length === 1 ? 'this file' : 'these ' + done.length + ' files') + '</button>' +
+      '<button class="k-btn ghost" id="btn-more">Add more</button>';
+    el('btn-use').onclick = function () {
+      if (sent) return;
+      sent = true;
+      var lines = done.map(function (i, idx) { return (idx + 1) + '. ' + i.file.name + ' (' + i.kind + '): ' + i.url; });
+      window.kolbo.sendMessage('I uploaded ' + done.length + ' file(s) to my Kolbo media library:\\n' + lines.join('\\n') + '\\nContinue with these files.');
+      el('actions').innerHTML = '<span style="font-size:12px;color:var(--text-muted)">✓ Sent to Claude — continuing…</span>';
+      window.kolbo.notifySize();
+    };
+    el('btn-more').onclick = function () { el('picker').click(); };
+  } else if (!done.length || busy) {
+    el('actions').style.display = 'none';
+  }
+  window.kolbo.notifySize();
+}
+
+window.kolbo.onToolResult(function (result) {
+  var sc = result.structuredContent || structured(result);
+  if (sc && sc.widget === 'upload') return boot(sc);
+  var card = document.querySelector('.k-card');
+  if (card && !state) card.style.display = 'none';
+  window.kolbo.notifySize();
+});
+`;
+
+function uploadWidgetHtml() {
+  return widgetPage({ title: 'Kolbo Upload', body: BODY, script: SCRIPT });
+}
+
+module.exports = { uploadWidgetHtml };

package/src/index.js

@@ -118,7 +118,8 @@ function createServer(opts = {}) {
       '4. If the user has not mentioned any project, omit `project_id` — the default bucket is correct in that case. Do not ask which project to use unless the user\'s intent is ambiguous.',
       '5. Written deliverables (plans, briefs, scripts, research summaries) can live in Kolbo too: author them as AI Docs with `create_doc` (project-scoped, editable in the app, shareable via `share_doc`).',
       '6. DIRECTOR / BATCH JOBS: generate_creative_director runs its scenes (image OR video) in parallel and only reports state="completed" once EVERY scene is terminal. Video batches can take many minutes. If the tool returns `_timed_out:true`, the batch is STILL RUNNING on the server — call `get_creative_director_status` with the returned generation_id and keep checking until state="completed" to collect all scene outputs. NEVER conclude a Director run failed and fall back to plain generate_image/generate_video without first checking status — doing so wastes the user\'s credits by paying twice. If scenes already carry image_urls/video_urls, they are done; do not regenerate.',
-      '7. SESSION CONTINUITY: keep one workflow in ONE session. chat_send_message and the generation tools return a `session_id` — for follow-ups, refinements, retries, or additional steps on the SAME task/theme, pass that same `session_id` back on the next call instead of starting fresh. Only OMIT session_id (start a new session) when the user genuinely switches to an unrelated task. Do not open a new conversation/session for every message of the same workflow — it fragments the user\'s history and loses context.'
+      '7. SESSION CONTINUITY: keep one workflow in ONE session. chat_send_message and the generation tools return a `session_id` — for follow-ups, refinements, retries, or additional steps on the SAME task/theme, pass that same `session_id` back on the next call instead of starting fresh. Only OMIT session_id (start a new session) when the user genuinely switches to an unrelated task. Do not open a new conversation/session for every message of the same workflow — it fragments the user\'s history and loses context.',
+      '8. LOCAL FILES / CHAT ATTACHMENTS: remote MCP tools CANNOT read files the user attached to the chat. When a claude.ai (browser/mobile) user has a local image/video/audio/document to use as a generation input, IMMEDIATELY call `media_upload_widget` — an upload card appears in the chat, they upload, and stable Kolbo CDN URLs come back in a follow-up message. Never ask them to re-attach the file in chat and never invent a URL. On Claude Desktop/Code with filesystem access, use `upload_media` with the absolute local path instead.'
     ].join('\n')
   });
 

package/src/tools/media.js

@@ -10,17 +10,94 @@ const { UI, uiResult, appsEnabled } = require('../apps');
 
 function registerMediaTools(server, client, options = {}) {
   const ui = () => appsEnabled(server, options);
+
+  // ─── media_upload_widget ───────────────────────────────────
+  server.tool(
+    'media_upload_widget',
+    'Open an interactive file-upload card in the chat so the user can upload LOCAL files (images, videos, audio, documents) into their Kolbo media library. USE THIS IMMEDIATELY whenever a claude.ai (browser/mobile) user wants to use a local file, or references a file they attached to the chat — remote MCP tools CANNOT read chat attachments, so the user must re-upload through this widget; do not ask them to re-attach the file in chat. Each uploaded file gets a stable Kolbo CDN URL that arrives in a follow-up user message — then pass those URLs to generation tools (generate_image_edit, generate_video_from_image, generate_lipsync, transcribe_audio, visual DNA, etc.). On Claude Desktop / Claude Code with filesystem access, prefer `upload_media` with the local path instead.',
+    {
+      purpose: z.string().optional().describe('Short title shown on the card, e.g. "Upload the photo to animate". Helps the user know what to drop.'),
+      media_types: z.array(z.enum(['image', 'video', 'audio', 'document'])).optional().describe('Restrict which file kinds the widget accepts. Omit to accept all types.'),
+      max_files: z.number().optional().describe('Maximum number of files (default 10, max 20).'),
+      project_id: z.string().optional().describe('Project ObjectId to file the uploads into (resolve names via `list_projects`).')
+    },
+    async ({ purpose, media_types, max_files, project_id }) => {
+      const ticket = await client.post('/v1/media/upload-ticket', {});
+      if (!ticket || !ticket.token) throw new Error('Could not create an upload ticket — try again.');
+
+      const info = {
+        status: 'upload_widget_opened',
+        instructions: 'An upload card is now shown to the user. WAIT for them to upload — the uploaded file URLs will arrive in a follow-up message (or in the model context). Do not guess URLs.',
+        accepted: ticket.accepted,
+        expires_in_seconds: ticket.expires_in,
+      };
+
+      if (ui()) {
+        return uiResult(UI.upload, JSON.stringify(info, null, 2), {
+          widget: 'upload',
+          title: purpose || 'Upload media',
+          upload_url: ticket.upload_url,
+          token: ticket.token,
+          expires_at: Date.now() + (ticket.expires_in || 900) * 1000,
+          kinds: media_types && media_types.length ? media_types : undefined,
+          max_files: Math.min(Math.max(Number(max_files) || 10, 1), 20),
+          max_mb: ticket.max_file_mb || { image: 50, video: 500, audio: 200, document: 50 },
+          ...(project_id ? { project_id } : {}),
+        });
+      }
+
+      // Text-only host: no iframe to render — steer to upload_media.
+      return {
+        content: [{
+          type: 'text',
+          text: JSON.stringify({
+            status: 'widget_unavailable',
+            hint: 'This host cannot render the upload widget. Use the upload_media tool with a URL or absolute local file path instead.'
+          }, null, 2)
+        }]
+      };
+    }
+  );
+
   // ─── upload_media ──────────────────────────────────────────
   server.tool(
     'upload_media',
     'Upload a local file (or remote URL) to the user\'s Kolbo media library and get back a stable Kolbo CDN URL. Use this when the user wants to reference a local file in multiple subsequent generation calls — upload once, then pass the returned URL to generate_image / generate_video / visual_dna / etc. Auto-detects media type (image / video / audio) from the file extension. For a single-use reference where you already have a public URL, you can skip this and pass the URL directly to the generation tool.',
     {
-      source: z.string().describe('URL or absolute local path to the file to upload. For local files this is the primary mode; for URLs, this re-hosts the file on Kolbo CDN for stability.'),
+      source: z.string().optional().describe('URL or absolute local path to the file to upload. For local files this is the primary mode; for URLs, this re-hosts the file on Kolbo CDN for stability. Provide this OR source_base64.'),
+      source_base64: z.string().optional().describe('Raw file content as base64 (no data: prefix) — fallback for hosts with no filesystem or public URL (e.g. small images on claude.ai when the upload widget is unavailable). Requires `filename`. Keep under ~10MB; for larger files use media_upload_widget.'),
+      filename: z.string().optional().describe('Original filename WITH extension (e.g. photo.png) — required with source_base64; the extension determines the media type.'),
       description: z.string().optional().describe('Optional description / caption for the uploaded media'),
       project_id: z.string().optional().describe('Project ObjectId to file the upload into. Call `list_projects` to resolve a name → id. When the user is working in a named project, pass it here too — omitting it files the upload outside that project.')
     },
-    async ({ source, description, project_id }) => {
-      if (!source) throw new Error('source is required (URL or absolute local path)');
+    async ({ source, source_base64, filename, description, project_id }) => {
+      if (!source && !source_base64) throw new Error('Provide source (URL or absolute local path) OR source_base64 (+ filename)');
+
+      if (source_base64) {
+        if (!filename || !/\.[a-z0-9]{2,5}$/i.test(filename)) {
+          throw new Error('source_base64 requires a `filename` with an extension (e.g. photo.png)');
+        }
+        const buffer = Buffer.from(source_base64, 'base64');
+        if (!buffer.length) throw new Error('source_base64 decoded to an empty file');
+        // Backend routes by mimetype (video/audio must NOT hit the image
+        // optimizer) — derive it from the extension, never octet-stream.
+        const ext = filename.split('.').pop().toLowerCase();
+        const MIME = {
+          jpg: 'image/jpeg', jpeg: 'image/jpeg', png: 'image/png', webp: 'image/webp', gif: 'image/gif', heic: 'image/heic', avif: 'image/avif',
+          mp4: 'video/mp4', mov: 'video/quicktime', webm: 'video/webm', m4v: 'video/x-m4v', mkv: 'video/x-matroska',
+          mp3: 'audio/mpeg', wav: 'audio/wav', m4a: 'audio/mp4', aac: 'audio/aac', ogg: 'audio/ogg', flac: 'audio/flac',
+          pdf: 'application/pdf', txt: 'text/plain', md: 'text/markdown', csv: 'text/csv', json: 'application/json',
+          docx: 'application/vnd.openxmlformats-officedocument.wordprocessingml.document',
+          xlsx: 'application/vnd.openxmlformats-officedocument.spreadsheetml.sheet',
+          pptx: 'application/vnd.openxmlformats-officedocument.presentationml.presentation'
+        };
+        const form = new FormData();
+        form.append('file', buffer, { filename, contentType: MIME[ext] || 'application/octet-stream' });
+        if (description) form.append('description', description);
+        if (project_id) form.append('project_id', project_id);
+        const result = await client.postMultipart('/v1/media/upload', form);
+        return { content: [{ type: 'text', text: JSON.stringify(result.media || result, null, 2) }] };
+      }
 
       // Even for URL input we download-and-reupload — that's the whole point
       // of upload_media (getting a stable Kolbo-owned URL). For ephemeral