@kolbo/mcp 1.65.1 → 1.67.0

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "@kolbo/mcp",
-  "version": "1.65.1",
+  "version": "1.67.0",
   "description": "Kolbo AI MCP Server - Generate images, videos, music, speech, and sound effects from Claude Code",
   "main": "src/index.js",
   "bin": {

package/skill/SKILL.md

@@ -125,6 +125,7 @@ Each `references/models/*.md` mirrors the matching skill prompt in `kolbo-api/sr
 | `clone_voice` / `import_elevenlabs_voice` / `delete_voice` | Custom voices (clone CHARGES CREDITS — confirm first; new voices show in `list_voices`) |
 | `trim_video` | Frame-accurate trim of a Kolbo-hosted video (tool waits and returns the URL). `edit_video` also gained `remove_background`. |
 | `create_doc` / `list_docs` / `get_doc` / `update_doc` / `share_doc` / `delete_doc` | AI Docs (Magic Pad): YOU author full HTML documents (plans, briefs, scripts, research) saved into the user's project, editable in the Kolbo app. `share_doc` returns a public link. `update_doc` content replaces the WHOLE doc — `get_doc` first. |
+| `create_review_asset` / `list_review_assets` / `get_review_asset` / `update_review_asset` / `add_review_version` / `set_review_status` / `delete_review_asset` / `get_review_storage_usage` / review collection + comment + share-link tools | **Kolbo Review** (Frame.io-style): upload first via `upload_media` / ticket / widget → pass `media_id` to `create_review_asset`. Comments are text + optional timecodes. `create_review_share_link` returns a guest URL. |
 | `chat_send_message` / `chat_list_conversations` / `chat_get_messages` | Kolbo chat with optional `media_urls` (up to 10 per call) |
 | `publish_html_artifact` | Publish HTML / SVG / Mermaid to `sites.kolbo.ai`. Server dedupes by content hash. Strict CSP. |
 
@@ -225,7 +226,7 @@ You are NOT allowed to:
 
 Existing video → modify → **single `generate_video_from_video` call** with source video URL + edit prompt.
 
-**Use a TRUE video-to-video model.** Image-to-video models reject with `WRONG_MODEL_TYPE`. Valid: `wan/2-7-videoedit`, `happyhorse/video-edit`, `kling-video/o3-video-to-video`, or any model whose DB `type` includes `video_to_video` (use `list_models({ type: "video_to_video" })`).
+**Use a TRUE video-to-video model.** Image-to-video models reject with `WRONG_MODEL_TYPE`. Valid: `wan/2-7-videoedit`, `happyhorse/video-edit`, `kling-video/o3-video-to-video`, `pika/pikadditions/video-to-video`, `pika/pikaswaps/video-to-video`, `pika/pikaffects/video-to-video`, or any model whose DB `type` includes `video_to_video` (use `list_models({ type: "video_to_video" })`).
 
 **Motion-control / animate-move models invert the inputs**: `reference_images[0]` = the CHARACTER IMAGE to animate, `source_video` = the driving/reference video whose motion is transferred. Omitting the character image returns a `MOTION_CONTROL_INPUTS` error.
 

package/skill/references/workflows/media-library.md

@@ -42,7 +42,7 @@ client share a filesystem. Choose by transport:
 |---|---|
 | **Local (stdio) install** — `npx @kolbo/mcp` on the same machine | `upload_media` with the absolute path |
 | **Remote connector + you can run shell commands** (Claude Code, Codex, Cursor, CI) | `create_upload_ticket`, then POST each file to `upload_url` |
-| **Remote connector, no filesystem** (claude.ai web/mobile) | `media_upload_widget` — the user picks the file |
+| **Remote connector, no filesystem** (claude.ai web/mobile) | `media_upload_widget` — the user picks the file. On Claude iOS/Android the card opens a full-screen uploader (in-chat file pickers are dropped by WebKit); after upload the user pastes the copied CDN URLs back into chat. |
 
 `create_upload_ticket` returns `upload_url` + a short-lived `token`. Upload with
 multipart field `file` and `Authorization: Bearer <token>`; the stable CDN URL comes
@@ -50,9 +50,14 @@ back at `media.url`. One POST per file, ticket reusable for a batch. Then pass t
 URLs to any generation tool.
 
 ```bash
-curl -X POST "<upload_url>" -H "Authorization: Bearer <token>" -F "file=@/abs/path/clip.mp3"
+curl -X POST "<upload_url>" -H "Authorization: Bearer <token>" -F "file=@/abs/path/clip.mp3;type=audio/mpeg"
 ```
 
+**Declare the type.** `curl` labels the part from its own mime table and falls back to
+`application/octet-stream` for anything missing from it — `.mp3` included — which the
+endpoint can reject as an unsupported type. Append `;type=<mime>` (`audio/mpeg`,
+`audio/wav`, `video/mp4`, `image/png`, `application/pdf`, …) and it never comes up.
+
 **Pace a batch.** The upload endpoint is rate limited — the ticket response says by
 how much in `rate_limit` (currently 40 uploads per 60s). Firing 55 files back to
 back stalls at file 41. Sleep ~2s between files, or read the 429: it carries a

package/src/apps/theme.js

@@ -291,6 +291,18 @@ html.k-fullscreen .k-actions { flex: none; padding-top: 8px; }
   .k-generated-audio .k-audio-art { width: 36px; height: 36px; }
   .k-generated-audio .k-btn { grid-column: 2; justify-self: start; }
   .k-generated-audio .k-audio-player { grid-column: 1 / -1; }
+  /* Touch-friendly MCP App layout (Claude iOS/Android iframe). */
+  .k-head { padding: 10px 12px; gap: 8px; }
+  .k-body { padding: 10px 12px 12px; }
+  .k-footer { padding: 8px 12px 12px; }
+  .k-grid { grid-template-columns: repeat(2, minmax(0, 1fr)); gap: 8px; }
+  .k-actions { flex-direction: column; align-items: stretch; }
+  .k-actions .k-btn { width: 100%; min-height: 44px; justify-content: center; }
+  .k-btn { min-height: 40px; padding: 10px 14px; }
+  .k-title { font-size: 13.5px; }
+  .k-prompt-row { flex-wrap: wrap; }
+  .k-prompt-row .k-input { min-width: 0; flex: 1 1 100%; }
+  .k-prompt-row .k-btn { flex: 1 1 auto; }
 }
 .k-play {
   width: 32px; height: 32px; border-radius: 50%; flex: none; border: 1px solid rgba(255,255,255,0.18);

package/src/apps/widgets/upload.js

@@ -11,16 +11,21 @@ const { widgetPage } = require('../html');
  * POSTed straight from the iframe to api.kolbo.ai/mcp/upload with a
  * short-lived, upload-only ticket (never the user's API key).
  *
+ * Mobile (Claude iOS/Android): WebKit drops <input type=file> selections inside
+ * cross-origin MCP App iframes, so the primary CTA openLinks a TOP-LEVEL
+ * upload page (/mcp/upload-ui) where the native picker works. Desktop keeps
+ * the in-chat picker; empty-selection after pick also offers the external page.
+ *
  * structuredContent: {
- *   widget: 'upload', title, upload_url, token, expires_at (epoch ms),
+ *   widget: 'upload', title, upload_url, upload_ui_url, token, expires_at (epoch ms),
  *   accept (input accept attr), max_files, max_mb: {image,video,audio,document},
  *   project_id?
  * }
  *
- * Flow: pick/drop files -> client-side type+size validation -> XHR upload
- * (2 concurrent, per-file progress) -> per-file CDN URL. Every completed file
- * is pushed into the model context silently; the "Use these files" button
- * sends one chat message with all URLs so the model continues the task.
+ * Flow (desktop): pick/drop files -> client-side type+size validation -> XHR
+ * upload (2 concurrent, per-file progress + thumbnails) -> per-file CDN URL.
+ * Every completed file is pushed into the model context silently; the
+ * "Use these files" button sends one chat message with all URLs.
  */
 
 const BODY = `
@@ -32,15 +37,15 @@ const BODY = `
     <span class="k-chip" id="count-chip" style="display:none"></span>
   </div>
   <div class="k-body">
-    <div id="drop" style="border:1.5px dashed var(--border);border-radius:12px;padding:26px 16px;text-align:center;cursor:pointer;transition:border-color .15s,background .15s">
+    <div id="drop" style="border:1.5px dashed var(--border);border-radius:12px;padding:22px 14px;text-align:center;cursor:pointer;transition:border-color .15s,background .15s;-webkit-tap-highlight-color:transparent">
       <div id="drop-icon" style="font-size:26px;line-height:1;margin-bottom:8px;color:var(--text-muted)"></div>
-      <div style="font-size:13px;font-weight:600">Click or drop files here</div>
-      <div id="accept-hint" style="font-size:11.5px;color:var(--text-muted);margin-top:4px"></div>
+      <div id="drop-title" style="font-size:13px;font-weight:600">Click or drop files here</div>
+      <div id="accept-hint" style="font-size:11.5px;color:var(--text-muted);margin-top:4px;line-height:1.35"></div>
     </div>
-    <input type="file" id="picker" multiple style="display:none">
+    <input type="file" id="picker" multiple accept="*/*" style="position:absolute;width:1px;height:1px;opacity:0;overflow:hidden;clip:rect(0,0,0,0)">
     <div id="rows" style="margin-top:10px"></div>
     <div class="k-actions" id="actions" style="display:none"></div>
-    <div id="notice" style="display:none;margin-top:8px;font-size:12px;color:var(--text-muted)"></div>
+    <div id="notice" style="display:none;margin-top:8px;font-size:12px;color:var(--text-muted);line-height:1.4"></div>
   </div>
   <div class="k-footer">
     <span><a href="#" id="kolbo-link">Kolbo.AI</a> Media Library</span>
@@ -55,11 +60,12 @@ el('drop-icon').innerHTML = ICONS.upload;
 el('kolbo-link').onclick = function (e) { e.preventDefault(); window.kolbo.openLink('https://app.kolbo.ai/media-library'); };
 
 var state = null;
-var items = []; // {file, kind, status, pct, url, err, id}
+var items = []; // {file, kind, status, pct, url, err, id, thumb}
 var nextItemId = 1;
 var CONCURRENCY = 2;
 var active = 0;
 var sent = false;
+var pickerArmed = false;
 
 var KINDS = {
   image: { exts: ['jpg','jpeg','png','webp','gif','heic','heif','avif','bmp','tif','tiff'], icon: ICONS.image },
@@ -68,12 +74,36 @@ var KINDS = {
   document: { exts: ['pdf','txt','md','csv','json','docx','xlsx','pptx','doc','xls'], icon: ICONS.document }
 };
 
-function classify(name) {
-  var ext = String(name || '').split('.').pop().toLowerCase();
-  for (var k in KINDS) { if (KINDS[k].exts.indexOf(ext) !== -1) return k; }
+function isMobileHost() {
+  var ua = navigator.userAgent || '';
+  if (/iPhone|iPad|iPod|Android/i.test(ua)) return true;
+  // iPadOS desktop-UA spoof
+  if (navigator.maxTouchPoints > 1 && /MacIntel/.test(navigator.platform || '')) return true;
+  return false;
+}
+
+function classify(file) {
+  var name = (file && file.name) || '';
+  var ext = name.indexOf('.') >= 0 ? String(name).split('.').pop().toLowerCase() : '';
+  if (ext) {
+    for (var k in KINDS) { if (KINDS[k].exts.indexOf(ext) !== -1) return k; }
+  }
+  // Mobile Photos often yields a MIME with a weak/missing filename.
+  var mime = String((file && file.type) || '').toLowerCase();
+  if (mime.indexOf('image/') === 0) return 'image';
+  if (mime.indexOf('video/') === 0) return 'video';
+  if (mime.indexOf('audio/') === 0) return 'audio';
+  if (mime === 'application/pdf' || mime.indexOf('text/') === 0 || mime.indexOf('application/vnd.') === 0 || mime === 'application/msword' || mime === 'application/json') return 'document';
   return null;
 }
 
+function filenameFor(it) {
+  var n = (it.file && it.file.name) || '';
+  if (n && n.indexOf('.') !== -1) return n;
+  var ext = { image: 'jpg', video: 'mp4', audio: 'mp3', document: 'pdf' }[it.kind] || 'bin';
+  return 'upload-' + it.id + '.' + ext;
+}
+
 function fmtSize(b) {
   if (b == null) return '';
   if (b > 1024 * 1024) return (Math.round(b / 1024 / 102.4) / 10) + 'MB';
@@ -82,6 +112,38 @@ function fmtSize(b) {
 
 function expired() { return state && state.expires_at && Date.now() > state.expires_at; }
 
+function uploadUiUrl() {
+  if (!state) return '';
+  var base = state.upload_ui_url || String(state.upload_url || '').replace(/\\/upload\\/?$/, '/upload-ui');
+  if (!base) return '';
+  var cfg = {
+    token: state.token,
+    upload_url: state.upload_url,
+    title: state.title || 'Upload media',
+    kinds: state.kinds,
+    max_files: state.max_files,
+    max_mb: state.max_mb,
+    project_id: state.project_id,
+    expires_at: state.expires_at
+  };
+  try {
+    var json = JSON.stringify(cfg);
+    var b64 = btoa(unescape(encodeURIComponent(json))).replace(/\\+/g, '-').replace(/\\//g, '_').replace(/=+$/, '');
+    return base + '#' + b64;
+  } catch (e) {
+    return base + '#' + encodeURIComponent(JSON.stringify(cfg));
+  }
+}
+
+function openExternalUploader() {
+  var url = uploadUiUrl();
+  if (!url) return;
+  window.kolbo.openLink(url);
+  el('notice').style.display = '';
+  el('notice').innerHTML = ICONS.open + ' Uploader opened. After files finish, return here and paste the copied message into Claude.';
+  window.kolbo.notifySize();
+}
+
 function boot(sc) {
   if (!sc || sc.widget !== 'upload') return;
   state = sc;
@@ -89,10 +151,27 @@ function boot(sc) {
   var kinds = sc.kinds && sc.kinds.length ? sc.kinds : ['image','video','audio','document'];
   var exts = [];
   kinds.forEach(function (k) { if (KINDS[k]) exts = exts.concat(KINDS[k].exts); });
-  el('picker').setAttribute('accept', exts.map(function (e) { return '.' + e; }).join(','));
+  el('picker').setAttribute('accept', exts.map(function (e) { return '.' + e; }).concat(kinds.map(function (k) { return k + '/*'; })).join(','));
   var maxN = sc.max_files || 10;
-  el('accept-hint').textContent = kinds.join(' · ') + (maxN === 1 ? ' — one file' : ' — up to ' + maxN + ' files');
+  var mobile = isMobileHost();
+  if (mobile) {
+    el('drop-title').textContent = 'Tap to open uploader';
+    el('accept-hint').textContent = kinds.join(' · ') + (maxN === 1 ? ' — one file' : ' — up to ' + maxN + ' files') + '. Opens a full-screen picker (required on iPhone & Android).';
+  } else {
+    el('drop-title').textContent = 'Click or drop files here';
+    el('accept-hint').textContent = kinds.join(' · ') + (maxN === 1 ? ' — one file' : ' — up to ' + maxN + ' files');
+  }
   if (expired()) return showExpired();
+  // Always offer the external path — desktop users may be inside a host that
+  // also sandboxes file inputs; mobile uses it as the primary CTA.
+  el('actions').style.display = '';
+  el('actions').innerHTML = mobile
+    ? '<button class="k-btn primary" id="btn-external" style="width:100%;min-height:44px">' + ICONS.upload + ' Open uploader</button>' +
+      '<button class="k-btn ghost" id="btn-inline">Try in-chat picker</button>'
+    : '<button class="k-btn ghost" id="btn-external">' + ICONS.open + ' Open full-screen uploader</button>';
+  el('btn-external').onclick = function (e) { e.preventDefault(); e.stopPropagation(); openExternalUploader(); };
+  var inline = el('btn-inline');
+  if (inline) inline.onclick = function (e) { e.preventDefault(); e.stopPropagation(); armInlinePicker(); };
   window.kolbo.notifySize();
 }
 
@@ -104,8 +183,18 @@ function showExpired() {
   window.kolbo.notifySize();
 }
 
+function armInlinePicker() {
+  pickerArmed = true;
+  el('picker').click();
+}
+
 // ---- picking ----
-el('drop').onclick = function () { el('picker').click(); };
+el('drop').onclick = function () {
+  if (!state) return;
+  if (expired()) return showExpired();
+  if (isMobileHost()) return openExternalUploader();
+  armInlinePicker();
+};
 el('drop').ondragover = function (e) { e.preventDefault(); el('drop').style.borderColor = 'var(--accent, #7c6cff)'; };
 el('drop').ondragleave = function () { el('drop').style.borderColor = 'var(--border)'; };
 el('drop').ondrop = function (e) {
@@ -113,7 +202,54 @@ el('drop').ondrop = function (e) {
   el('drop').style.borderColor = 'var(--border)';
   addFiles(e.dataTransfer && e.dataTransfer.files);
 };
-el('picker').onchange = function () { addFiles(el('picker').files); el('picker').value = ''; };
+el('picker').onchange = function () {
+  var files = el('picker').files;
+  // iOS/WebKit cross-origin iframe: picker UI runs, selection is dropped → empty FileList.
+  if (pickerArmed && (!files || !files.length)) {
+    pickerArmed = false;
+    el('notice').style.display = '';
+    el('notice').innerHTML = ICONS.warn + ' In-chat picker could not receive the file on this device. Use the full-screen uploader instead.';
+    el('actions').style.display = '';
+    el('actions').innerHTML = '<button class="k-btn primary" id="btn-external" style="width:100%;min-height:44px">' + ICONS.upload + ' Open uploader</button>';
+    el('btn-external').onclick = function (e) { e.preventDefault(); openExternalUploader(); };
+    window.kolbo.notifySize();
+    return;
+  }
+  pickerArmed = false;
+  addFiles(files);
+  el('picker').value = '';
+};
+
+function makeThumb(it) {
+  if (it.kind === 'image') {
+    try { it.thumb = URL.createObjectURL(it.file); } catch (e) {}
+    return;
+  }
+  if (it.kind !== 'video') return;
+  try {
+    var url = URL.createObjectURL(it.file);
+    var v = document.createElement('video');
+    v.muted = true; v.playsInline = true; v.preload = 'metadata'; v.src = url;
+    var done = false;
+    function snap() {
+      if (done) return;
+      try {
+        var c = document.createElement('canvas');
+        c.width = 68; c.height = 68;
+        c.getContext('2d').drawImage(v, 0, 0, 68, 68);
+        it.thumb = c.toDataURL('image/jpeg', 0.7);
+        done = true;
+        render();
+      } catch (e) {}
+      try { URL.revokeObjectURL(url); } catch (e2) {}
+    }
+    v.addEventListener('loadeddata', function () {
+      try { v.currentTime = Math.min(0.25, (v.duration || 1) * 0.1); } catch (e) { snap(); }
+    });
+    v.addEventListener('seeked', snap);
+    setTimeout(snap, 1500);
+  } catch (e) {}
+}
 
 function addFiles(list) {
   if (!list || !state) return;
@@ -122,15 +258,15 @@ function addFiles(list) {
   for (var i = 0; i < list.length; i++) {
     if (items.length >= maxFiles) break;
     var f = list[i];
-    var kind = classify(f.name);
+    var kind = classify(f);
     var it = { file: f, kind: kind, status: 'queued', pct: 0, url: null, err: null, id: nextItemId++, thumb: null };
-    if (kind === 'image') { try { it.thumb = URL.createObjectURL(f); } catch (e) {} }
     var allowedKinds = state.kinds && state.kinds.length ? state.kinds : ['image','video','audio','document'];
     if (!kind || allowedKinds.indexOf(kind) === -1) {
       it.status = 'error'; it.err = 'Unsupported file type';
     } else {
       var capMb = (state.max_mb && state.max_mb[kind]) || 50;
       if (f.size > capMb * 1024 * 1024) { it.status = 'error'; it.err = kind + ' files are limited to ' + capMb + 'MB'; }
+      else makeThumb(it);
     }
     items.push(it);
   }
@@ -154,7 +290,7 @@ function upload(it) {
   active++;
   render();
   var fd = new FormData();
-  fd.append('file', it.file, it.file.name);
+  fd.append('file', it.file, filenameFor(it));
   if (state.project_id) fd.append('project_id', state.project_id);
   var xhr = new XMLHttpRequest();
   xhr.open('POST', state.upload_url, true);
@@ -169,10 +305,9 @@ function upload(it) {
     if (xhr.status >= 200 && xhr.status < 300 && res && res.success && res.media && res.media.url) {
       it.status = 'done';
       it.url = res.media.url;
-      // Silent context update — the model learns the URL even before the
-      // user clicks "Use these files".
+      if (!it.thumb && res.media.thumbnail_url) it.thumb = res.media.thumbnail_url;
       try {
-        window.kolbo.updateModelContext('Upload widget: "' + it.file.name + '" (' + it.kind + ') uploaded to the Kolbo media library. URL: ' + it.url);
+        window.kolbo.updateModelContext('Upload widget: "' + filenameFor(it) + '" (' + it.kind + ') uploaded to the Kolbo media library. URL: ' + it.url);
       } catch (e) {}
     } else {
       it.status = 'error';
@@ -184,7 +319,7 @@ function upload(it) {
   xhr.onerror = function () {
     active--;
     it.status = 'error';
-    it.err = 'Network error — try again';
+    it.err = 'Network error — try the full-screen uploader';
     render();
     pump();
   };
@@ -204,11 +339,11 @@ function rowHtml(it) {
     : '';
   var left = it.thumb
     ? '<img data-thumb="' + it.id + '" src="' + it.thumb + '" alt="" style="width:34px;height:34px;object-fit:cover;border-radius:7px;flex:none;border:1px solid var(--border);background:var(--surface)">'
-    : '<span>' + icon + '</span>';
+    : '<span style="width:34px;height:34px;display:inline-flex;align-items:center;justify-content:center;border-radius:7px;background:var(--surface);border:1px solid var(--border);color:var(--text-muted)">' + icon + '</span>';
   return '<div id="row-' + it.id + '" style="padding:8px 10px;border:1px solid var(--border);border-radius:10px;margin-bottom:6px;background:var(--surface)">' +
     '<div style="display:flex;align-items:center;gap:8px;font-size:12.5px">' +
     left +
-    '<span style="flex:1;overflow:hidden;text-overflow:ellipsis;white-space:nowrap" title="' + esc(it.file.name) + '">' + esc(it.file.name) + '</span>' +
+    '<span style="flex:1;overflow:hidden;text-overflow:ellipsis;white-space:nowrap" title="' + esc(filenameFor(it)) + '">' + esc(filenameFor(it)) + '</span>' +
     '<span style="color:var(--text-muted);font-size:11px">' + fmtSize(it.file.size) + '</span>' +
     '<span id="status-' + it.id + '" style="font-size:11.5px">' + right + '</span>' +
     '</div>' + bar + '</div>';
@@ -223,8 +358,6 @@ function renderRow(it) {
 
 function render() {
   el('rows').innerHTML = items.map(rowHtml).join('');
-  // Thumbnail fallback chain: local blob preview -> CDN URL (allowlisted in the
-  // host CSP) once uploaded -> plain type icon.
   Array.prototype.forEach.call(el('rows').querySelectorAll('[data-thumb]'), function (img) {
     img.onerror = function () {
       var id = Number(img.getAttribute('data-thumb'));
@@ -253,19 +386,29 @@ function render() {
   el('count-chip').textContent = done.length + '/' + items.length + ' uploaded';
   if (done.length && !busy && !sent) {
     el('actions').style.display = '';
-    el('actions').innerHTML = '<button class="k-btn primary" id="btn-use">Use ' + (done.length === 1 ? 'this file' : 'these ' + done.length + ' files') + '</button>' +
-      '<button class="k-btn ghost" id="btn-more">Add more</button>';
+    el('actions').innerHTML = '<button class="k-btn primary" id="btn-use" style="min-height:44px">Use ' + (done.length === 1 ? 'this file' : 'these ' + done.length + ' files') + '</button>' +
+      '<button class="k-btn ghost" id="btn-more">Add more</button>' +
+      '<button class="k-btn ghost" id="btn-external">' + ICONS.open + ' Full-screen</button>';
     el('btn-use').onclick = function () {
       if (sent) return;
       sent = true;
-      var lines = done.map(function (i, idx) { return (idx + 1) + '. ' + i.file.name + ' (' + i.kind + '): ' + i.url; });
+      var lines = done.map(function (i, idx) { return (idx + 1) + '. ' + filenameFor(i) + ' (' + i.kind + '): ' + i.url; });
       window.kolbo.sendMessage('I uploaded ' + done.length + ' file(s) to my Kolbo media library:\\n' + lines.join('\\n') + '\\nContinue with these files.');
       el('actions').innerHTML = '<span style="font-size:12px;color:var(--text-muted)">' + ICONS.check + ' Sent to Claude — continuing…</span>';
       window.kolbo.notifySize();
     };
-    el('btn-more').onclick = function () { el('picker').click(); };
+    el('btn-more').onclick = function () {
+      if (isMobileHost()) openExternalUploader();
+      else armInlinePicker();
+    };
+    el('btn-external').onclick = function (e) { e.preventDefault(); openExternalUploader(); };
+  } else if (!items.length) {
+    // keep boot() actions (external / inline)
   } else if (!done.length || busy) {
-    el('actions').style.display = 'none';
+    el('actions').style.display = '';
+    el('actions').innerHTML = (busy ? '<span style="font-size:12px;color:var(--text-muted)">Uploading…</span>' : '') +
+      '<button class="k-btn ghost" id="btn-external">' + ICONS.open + ' Full-screen uploader</button>';
+    el('btn-external').onclick = function (e) { e.preventDefault(); openExternalUploader(); };
   }
   window.kolbo.notifySize();
 }

package/src/index.js

@@ -72,6 +72,7 @@ const { registerArtifactTools } = require('./tools/artifacts');
 const { registerProjectTools } = require('./tools/projects');
 const { registerAgentTools } = require('./tools/agents');
 const { registerDocTools } = require('./tools/docs');
+const { registerReviewTools } = require('./tools/review');
 const { registerVoiceTools } = require('./tools/voices');
 const { registerMusicLibraryTools } = require('./tools/music_library');
 const { registerStockLibraryTools } = require('./tools/stock_library');
@@ -156,6 +157,7 @@ function createServer(opts = {}) {
   registerProjectTools(server, client, toolOptions);
   registerAgentTools(server, client, toolOptions);
   registerDocTools(server, client, toolOptions);
+  registerReviewTools(server, client, toolOptions);
   registerMusicLibraryTools(server, client, toolOptions);
   registerStockLibraryTools(server, client, toolOptions);
 

package/src/tools/media.js

@@ -43,7 +43,14 @@ function uploadTicketPayload(ticket) {
     accepted: ticket.accepted,
     rate_limit: rate,
     how_to_upload: {
-      example: 'curl -X POST "<upload_url>" -H "Authorization: Bearer <token>" -F "file=@/absolute/path/to/file.mp3"',
+      example: 'curl -X POST "<upload_url>" -H "Authorization: Bearer <token>" -F "file=@/absolute/path/to/file.mp3;type=audio/mpeg"',
+      // curl types the part from ITS mime table and falls back to
+      // application/octet-stream for anything missing from it (.mp3 included).
+      // Newer servers resolve that from the extension, older ones answer
+      // "File type not supported: application/octet-stream" — so the example
+      // above declares the type and this says why, rather than leaving the
+      // caller to rediscover it from a 415.
+      mime_note: 'Append `;type=<mime>` to the file part (audio/mpeg, audio/wav, video/mp4, image/png, application/pdf …). Without it curl declares application/octet-stream and the upload can be rejected as an unsupported type.',
       optional_fields: ['project_id', 'description'],
       response: 'JSON — the stable CDN URL is at media.url. One POST per file; reuse the ticket for a batch.',
       pacing: `RATE LIMIT: ${rate.max_uploads} uploads per ${rate.per_seconds}s. For a batch larger than that, pace it (e.g. sleep ${Math.max(1, Math.ceil(rate.per_seconds / rate.max_uploads))}s between files) instead of firing them back to back. Over the limit you get HTTP 429 with a Retry-After header and retry_after_seconds in the body — wait that long, then continue; do not guess a backoff and do not treat it as a failed upload.`,
@@ -95,10 +102,15 @@ function registerMediaTools(server, client, options = {}) {
       };
 
       if (ui()) {
+        // upload_ui_url: top-level page for Claude iOS/Android — in-iframe
+        // <input type=file> selections are dropped by WebKit (see upload widget).
+        const uploadUiUrl = ticket.upload_ui_url
+          || String(ticket.upload_url || '').replace(/\/upload\/?$/, '/upload-ui');
         return uiResult(UI.upload, JSON.stringify(info, null, 2), {
           widget: 'upload',
           title: purpose || 'Upload media',
           upload_url: ticket.upload_url,
+          upload_ui_url: uploadUiUrl,
           token: ticket.token,
           expires_at: Date.now() + (ticket.expires_in || 900) * 1000,
           kinds: media_types && media_types.length ? media_types : undefined,

package/src/tools/review.js

@@ -0,0 +1,338 @@
+/* ⛔ BACKWARD COMPATIBILITY: Tool names and arg names below are a PUBLIC
+ * CONTRACT. Never rename, remove, or break an existing tool/arg — old cached
+ * `npx @kolbo/mcp` installs in the wild will break silently. Add new tools or
+ * new OPTIONAL args only. Full rules: ../index.js top-of-file and CLAUDE.md. */
+
+const { z } = require('zod');
+const { projectIdField } = require('./_shared');
+
+const REVIEW_STATUS = z.enum(['in_progress', 'needs_review', 'approved', 'changes_requested']);
+
+function registerReviewTools(server, client) {
+  // ─── get_review_storage_usage ────────────────────────────────
+  server.tool(
+    'get_review_storage_usage',
+    'Get Kolbo Review storage usage for the API-key owner (5GB cap across all review versions).',
+    {},
+    async () => {
+      const result = await client.get('/v1/review/storage-usage');
+      return { content: [{ type: 'text', text: JSON.stringify(result, null, 2) }] };
+    }
+  );
+
+  // ─── list_review_assets ──────────────────────────────────────
+  server.tool(
+    'list_review_assets',
+    'List review assets in a project (Frame.io-style client review). Pass `project_id` from `list_projects`. Optional filters: `collection_id`, `status`, pagination.',
+    {
+      project_id: projectIdField,
+      collection_id: z.string().optional().describe('Filter to one review collection.'),
+      status: REVIEW_STATUS.optional(),
+      page: z.number().optional(),
+      limit: z.number().optional(),
+    },
+    async ({ project_id, collection_id, status, page, limit }) => {
+      const params = new URLSearchParams();
+      if (project_id) params.set('project_id', project_id);
+      if (collection_id) params.set('collection_id', collection_id);
+      if (status) params.set('status', status);
+      if (page) params.set('page', String(page));
+      if (limit) params.set('limit', String(limit));
+      const qs = params.toString();
+      const result = await client.get(`/v1/review/assets${qs ? '?' + qs : ''}`);
+      return { content: [{ type: 'text', text: JSON.stringify(result, null, 2) }] };
+    }
+  );
+
+  // ─── get_review_asset ────────────────────────────────────────
+  server.tool(
+    'get_review_asset',
+    'Fetch one review asset with all versions, status, and media URLs.',
+    {
+      asset_id: z.string().describe('Review asset ObjectId from list_review_assets or create_review_asset.'),
+    },
+    async ({ asset_id }) => {
+      const result = await client.get(`/v1/review/assets/${encodeURIComponent(asset_id)}`);
+      return { content: [{ type: 'text', text: JSON.stringify(result, null, 2) }] };
+    }
+  );
+
+  // ─── create_review_asset ─────────────────────────────────────
+  server.tool(
+    'create_review_asset',
+    'Create a Kolbo Review asset with v1 media attached. Upload first via `upload_media`, `create_upload_ticket`, or `media_upload_widget`, then pass the returned `media_id`. Requires `project_id` when the user named a project.',
+    {
+      name: z.string().describe('Display name for the review asset.'),
+      media_id: z.string().describe('MediaLibraryItem id from upload_media / list_media.'),
+      project_id: projectIdField,
+      collection_id: z.string().optional().describe('Optional review collection folder id.'),
+      version_note: z.string().optional().describe('Optional note on the first version (max 1000 chars).'),
+    },
+    async (args) => {
+      const result = await client.post('/v1/review/assets', args);
+      return {
+        content: [{
+          type: 'text',
+          text: JSON.stringify({
+            ...result,
+            _hint: 'Asset created. Share with clients via create_review_share_link, or add feedback with create_review_comment.',
+          }, null, 2),
+        }],
+      };
+    }
+  );
+
+  // ─── update_review_asset ─────────────────────────────────────
+  server.tool(
+    'update_review_asset',
+    'Rename a review asset, move it to a collection, or switch the active version index.',
+    {
+      asset_id: z.string(),
+      name: z.string().optional(),
+      collection_id: z.string().nullable().optional().describe('Collection id, or null to uncollected.'),
+      current_version_index: z.number().optional(),
+    },
+    async ({ asset_id, ...body }) => {
+      const result = await client.patch(`/v1/review/assets/${encodeURIComponent(asset_id)}`, body);
+      return { content: [{ type: 'text', text: JSON.stringify(result, null, 2) }] };
+    }
+  );
+
+  // ─── add_review_version ──────────────────────────────────────
+  server.tool(
+    'add_review_version',
+    'Append a new version to an existing review asset from an uploaded `media_id`.',
+    {
+      asset_id: z.string(),
+      media_id: z.string(),
+      version_note: z.string().optional(),
+    },
+    async ({ asset_id, media_id, version_note }) => {
+      const result = await client.post(`/v1/review/assets/${encodeURIComponent(asset_id)}/versions`, {
+        media_id,
+        version_note,
+      });
+      return { content: [{ type: 'text', text: JSON.stringify(result, null, 2) }] };
+    }
+  );
+
+  // ─── set_review_status ───────────────────────────────────────
+  server.tool(
+    'set_review_status',
+    'Update review workflow status on an asset (in_progress, needs_review, approved, changes_requested).',
+    {
+      asset_id: z.string(),
+      review_status: REVIEW_STATUS,
+    },
+    async ({ asset_id, review_status }) => {
+      const result = await client.post(`/v1/review/assets/${encodeURIComponent(asset_id)}/status`, {
+        review_status,
+      });
+      return { content: [{ type: 'text', text: JSON.stringify(result, null, 2) }] };
+    }
+  );
+
+  // ─── delete_review_asset ─────────────────────────────────────
+  server.tool(
+    'delete_review_asset',
+    'Soft-delete a review asset and its underlying review media.',
+    { asset_id: z.string() },
+    async ({ asset_id }) => {
+      const result = await client.delete(`/v1/review/assets/${encodeURIComponent(asset_id)}`);
+      return { content: [{ type: 'text', text: JSON.stringify(result, null, 2) }] };
+    }
+  );
+
+  // ─── Collections ─────────────────────────────────────────────
+  server.tool(
+    'list_review_collections',
+    'List review collection folders in a project.',
+    { project_id: projectIdField },
+    async ({ project_id }) => {
+      const qs = project_id ? `project_id=${encodeURIComponent(project_id)}` : '';
+      const result = await client.get(`/v1/review/collections${qs ? '?' + qs : ''}`);
+      return { content: [{ type: 'text', text: JSON.stringify(result, null, 2) }] };
+    }
+  );
+
+  server.tool(
+    'create_review_collection',
+    'Create a review collection folder inside a project.',
+    {
+      name: z.string(),
+      project_id: projectIdField,
+    },
+    async (args) => {
+      const result = await client.post('/v1/review/collections', args);
+      return { content: [{ type: 'text', text: JSON.stringify(result, null, 2) }] };
+    }
+  );
+
+  server.tool(
+    'update_review_collection',
+    'Rename a review collection.',
+    {
+      collection_id: z.string(),
+      name: z.string(),
+    },
+    async ({ collection_id, name }) => {
+      const result = await client.patch(`/v1/review/collections/${encodeURIComponent(collection_id)}`, { name });
+      return { content: [{ type: 'text', text: JSON.stringify(result, null, 2) }] };
+    }
+  );
+
+  server.tool(
+    'delete_review_collection',
+    'Soft-delete a review collection (assets become uncollected).',
+    { collection_id: z.string() },
+    async ({ collection_id }) => {
+      const result = await client.delete(`/v1/review/collections/${encodeURIComponent(collection_id)}`);
+      return { content: [{ type: 'text', text: JSON.stringify(result, null, 2) }] };
+    }
+  );
+
+  // ─── Comments ────────────────────────────────────────────────
+  server.tool(
+    'list_review_comments',
+    'List text comments on a review asset (default: current version media). Optional `version_media_id` for a specific version.',
+    {
+      asset_id: z.string(),
+      version_media_id: z.string().optional(),
+    },
+    async ({ asset_id, version_media_id }) => {
+      const qs = version_media_id ? `version_media_id=${encodeURIComponent(version_media_id)}` : '';
+      const result = await client.get(`/v1/review/assets/${encodeURIComponent(asset_id)}/comments${qs ? '?' + qs : ''}`);
+      return { content: [{ type: 'text', text: JSON.stringify(result, null, 2) }] };
+    }
+  );
+
+  server.tool(
+    'create_review_comment',
+    'Add a text comment on a review asset. Optional video timecodes: time_start / time_end (seconds).',
+    {
+      asset_id: z.string(),
+      body: z.string(),
+      time_start: z.number().optional(),
+      time_end: z.number().optional(),
+      version_media_id: z.string().optional(),
+    },
+    async ({ asset_id, ...body }) => {
+      const result = await client.post(`/v1/review/assets/${encodeURIComponent(asset_id)}/comments`, body);
+      return { content: [{ type: 'text', text: JSON.stringify(result, null, 2) }] };
+    }
+  );
+
+  server.tool(
+    'reply_review_comment',
+    'Reply to an existing review comment (one level of threading).',
+    {
+      note_id: z.string().describe('Comment id from list_review_comments.'),
+      body: z.string(),
+    },
+    async ({ note_id, body }) => {
+      const result = await client.post(`/v1/review/comments/${encodeURIComponent(note_id)}/reply`, { body });
+      return { content: [{ type: 'text', text: JSON.stringify(result, null, 2) }] };
+    }
+  );
+
+  server.tool(
+    'edit_review_comment',
+    'Edit your own review comment text and/or timecodes.',
+    {
+      note_id: z.string(),
+      body: z.string().optional(),
+      time_start: z.number().optional(),
+      time_end: z.number().optional(),
+    },
+    async ({ note_id, ...body }) => {
+      const result = await client.patch(`/v1/review/comments/${encodeURIComponent(note_id)}`, body);
+      return { content: [{ type: 'text', text: JSON.stringify(result, null, 2) }] };
+    }
+  );
+
+  server.tool(
+    'delete_review_comment',
+    'Delete a review comment (own comment, or any comment if you have full project access).',
+    { note_id: z.string() },
+    async ({ note_id }) => {
+      const result = await client.delete(`/v1/review/comments/${encodeURIComponent(note_id)}`);
+      return { content: [{ type: 'text', text: JSON.stringify(result, null, 2) }] };
+    }
+  );
+
+  server.tool(
+    'resolve_review_comment',
+    'Mark a review comment thread as resolved.',
+    { note_id: z.string() },
+    async ({ note_id }) => {
+      const result = await client.post(`/v1/review/comments/${encodeURIComponent(note_id)}/resolve`, {});
+      return { content: [{ type: 'text', text: JSON.stringify(result, null, 2) }] };
+    }
+  );
+
+  server.tool(
+    'unresolve_review_comment',
+    'Re-open a resolved review comment thread.',
+    { note_id: z.string() },
+    async ({ note_id }) => {
+      const result = await client.post(`/v1/review/comments/${encodeURIComponent(note_id)}/unresolve`, {});
+      return { content: [{ type: 'text', text: JSON.stringify(result, null, 2) }] };
+    }
+  );
+
+  // ─── Share links ─────────────────────────────────────────────
+  server.tool(
+    'create_review_share_link',
+    'Create a guest review link for an asset or collection. Returns share_url for clients (no Kolbo account needed).',
+    {
+      target_type: z.enum(['asset', 'collection']),
+      target_id: z.string(),
+      role_label: z.string().optional().describe('Guest role label shown in the UI (e.g. Client).'),
+      require_email: z.boolean().optional(),
+      permissions: z.object({
+        canComment: z.boolean().optional(),
+        canDownload: z.boolean().optional(),
+        canViewOtherComments: z.boolean().optional(),
+        canResolveOwn: z.boolean().optional(),
+        canSwitchVersions: z.boolean().optional(),
+        canSetStatus: z.boolean().optional(),
+      }).optional(),
+      password: z.string().optional(),
+      allowed_emails: z.array(z.string()).optional(),
+      expires_at: z.string().optional().describe('ISO8601 expiry datetime.'),
+    },
+    async ({ target_type, target_id, ...body }) => {
+      const path = target_type === 'collection'
+        ? `/v1/review/collections/${encodeURIComponent(target_id)}/share-links`
+        : `/v1/review/assets/${encodeURIComponent(target_id)}/share-links`;
+      const result = await client.post(path, body);
+      return { content: [{ type: 'text', text: JSON.stringify(result, null, 2) }] };
+    }
+  );
+
+  server.tool(
+    'list_review_share_links',
+    'List active share links for a review asset or collection.',
+    {
+      target_type: z.enum(['asset', 'collection']),
+      target_id: z.string(),
+    },
+    async ({ target_type, target_id }) => {
+      const params = new URLSearchParams({ target_type, target_id });
+      const result = await client.get(`/v1/review/share-links?${params}`);
+      return { content: [{ type: 'text', text: JSON.stringify(result, null, 2) }] };
+    }
+  );
+
+  server.tool(
+    'revoke_review_share_link',
+    'Revoke a guest review share link by link id.',
+    { link_id: z.string() },
+    async ({ link_id }) => {
+      const result = await client.post(`/v1/review/share-links/${encodeURIComponent(link_id)}/revoke`, {});
+      return { content: [{ type: 'text', text: JSON.stringify(result, null, 2) }] };
+    }
+  );
+}
+
+module.exports = { registerReviewTools };

package/src/tools/voices.js

@@ -11,13 +11,15 @@ function registerVoiceTools(server, client, options = {}) {
   // ─── list_voices ──────────────────────────────────────────────
   server.tool(
     'list_voices',
-    'List available TTS voices for speech generation. Filter by language, gender, or provider to find the right voice. Returns voice_id, name, provider, language, gender, accent, description, styles, and preview_url for each voice.',
+    'List available TTS voices for speech generation. Filter by language, gender, or provider to find the right voice. Returns voice_id, name, provider, language, gender, accent, description, styles, and preview_url for each voice. The catalogue runs to hundreds of voices, so results are paginated: filter first, then use `page` to walk the rest.',
     {
-      language: z.string().optional().describe('Filter by language name (e.g. "english", "hebrew", "spanish", "french"). Case-insensitive partial match.'),
+      language: z.string().optional().describe('Filter by language name (e.g. "english", "hebrew", "spanish", "french") or locale code ("he", "he-IL"). Case-insensitive partial match.'),
       gender: z.enum(['male', 'female']).optional().describe('Filter by gender.'),
-      provider: z.string().optional().describe('Filter by provider (e.g. "elevenlabs", "google"). Omit for all providers.')
+      provider: z.string().optional().describe('Filter by provider (e.g. "elevenlabs", "google"). Omit for all providers.'),
+      page: z.number().optional().describe('Page number, 1-indexed. Default: 1'),
+      limit: z.number().optional().describe('Results per page, max 200. Default: 60')
     },
-    async ({ language, gender, provider }) => {
+    async ({ language, gender, provider, page, limit }) => {
       const params = new URLSearchParams();
       if (gender) params.set('gender', gender);
       if (provider) params.set('provider', provider);
@@ -28,10 +30,9 @@ function registerVoiceTools(server, client, options = {}) {
       const result = await client.get(`/v1/voices${qs.toString() ? '?' + qs.toString() : ''}`);
 
       let voices = result.voices || [];
-      // The API matches `language` EXACTLY against the voice's language name or
-      // its locale code — "hebrew" and "he-IL" both hit, but "he" / "heb" /
-      // "Hebrew (Israel)" return nothing. This arg is documented as a partial
-      // match, and an empty list reads to the model as "Kolbo has no Google
+      // Safety net for a server whose `language` matching is narrower than this
+      // arg promises (it was once an exact match, so "he" / "heb" returned
+      // nothing). An empty list reads to the model as "Kolbo has no Google
       // Hebrew voices at all", which is how a whole provider goes missing.
       // Retry ONCE, unfiltered, and match locally — only on the empty path, so
       // the normal call still costs one request.
@@ -48,29 +49,42 @@ function registerVoiceTools(server, client, options = {}) {
         };
       }
 
-      const lines = voices.map(v => {
+      // The unfiltered catalog measured 190,286 chars — past what hosts accept — so
+      // only a slice can ever come back. Page it instead of truncating it: the API
+      // returns the whole filtered set, the window is picked here. Without `page`
+      // every voice past the first 60 was simply unreachable.
+      const VOICE_CAP = 60;
+      const perPage = Math.min(Math.max(Math.trunc(limit) || VOICE_CAP, 1), 200);
+      const pageNum = Math.max(Math.trunc(page) || 1, 1);
+      const pageCount = Math.ceil(voices.length / perPage);
+      const start = (pageNum - 1) * perPage;
+      const shownVoices = voices.slice(start, start + perPage);
+
+      if (shownVoices.length === 0) {
+        return {
+          content: [{ type: 'text', text: `Page ${pageNum} is past the end — ${voices.length} voice(s) match those filters (${pageCount} page(s) at ${perPage} per page).` }]
+        };
+      }
+
+      const lines = shownVoices.map(v => {
         const tags = [v.language, v.gender, v.accent].filter(Boolean).join(' · ');
         const styles = Array.isArray(v.styles) && v.styles.length ? ` | styles: ${v.styles.join(', ')}` : '';
         const v3 = v.v3_optimized ? ' [v3]' : '';
         return `${v.voice_id} — ${v.name} (${v.provider})${v3}\n   ${tags}${styles}${v.description ? `\n   ${v.description}` : ''}`;
       });
 
-      // The unfiltered catalog measured 190,286 chars — past what hosts accept.
-      // Cap the listing and tell the model how to narrow, rather than handing
-      // back a blob the host truncates at an arbitrary byte.
-      const VOICE_CAP = 60;
-      const shown = lines.slice(0, VOICE_CAP);
-      const more = voices.length - shown.length;
+      const more = voices.length - (start + shownVoices.length);
       const narrowHint = more > 0
-        ? `\n\n…and ${more} more. Filter by \`language\`, \`gender\`, or \`provider\` to narrow.`
+        ? `\n\n…and ${more} more. Pass \`page: ${pageNum + 1}\` for the next ${perPage}, or narrow with \`language\` / \`gender\` / \`provider\`.`
         : '';
-      const text = `Available voices (showing ${shown.length} of ${voices.length}):\n\n${shown.join('\n\n')}${narrowHint}\n\nUse the "voice_id" value in generate_speech calls.`;
+      const range = `${start + 1}–${start + shownVoices.length}`;
+      const text = `Available voices (showing ${range} of ${voices.length}, page ${pageNum}/${pageCount}):\n\n${lines.join('\n\n')}${narrowHint}\n\nUse the "voice_id" value in generate_speech calls.`;
 
       if (ui()) {
         return uiResult(UI.mediaGrid, text, {
           widget: 'media-grid',
           title: 'Voices',
-          items: voices.slice(0, 24).map(v => ({
+          items: shownVoices.map(v => ({
             id: v.voice_id,
             title: v.name,
             subtitle: [v.provider, v.language, v.gender, v.accent].filter(Boolean).join(' · '),
@@ -80,7 +94,7 @@ function registerVoiceTools(server, client, options = {}) {
             use_hint: 'Use voice "{TITLE}" (voice_id: {ID}) for text-to-speech — ask me what text to speak.'
           })),
           total: voices.length,
-          has_more: voices.length > 24
+          has_more: more > 0
         });
       }