@kolbo/mcp 1.87.8 → 1.87.10

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "@kolbo/mcp",
-  "version": "1.87.8",
+  "version": "1.87.10",
   "description": "Kolbo AI MCP Server - Generate images, videos, music, speech, and sound effects from Claude Code",
   "main": "src/index.js",
   "bin": {

package/src/apps/bridge.js

@@ -210,6 +210,75 @@ const BRIDGE_JS = `
     },
     hostContext: function () { return hostContext; }
   };
+
+  // ChatGPT (OpenAI Apps SDK) host. It mounts the same iframe but speaks no
+  // JSON-RPC: tool input / output / theme arrive as window.openai globals plus
+  // an 'openai:set_globals' DOM event, and actions are methods on that object.
+  // Without this adapter the card rendered, waited for a tool-input that never
+  // came, and sat on "Preparing" with no prompt, no settings and no result —
+  // even after the tool had returned. Everything here maps onto the same
+  // callbacks the JSON-RPC path drives, so widgets need no host-specific code.
+  var oa = window.openai && typeof window.openai === 'object' ? window.openai : null;
+  if (oa) {
+    var oaInputSeen = false, oaOutputSeen = false;
+    var oaName = function () {
+      var meta = oa.toolResponseMetadata || {};
+      return oa.toolName || meta['kolbo/tool'] || (oa.toolOutput && oa.toolOutput.tool) || undefined;
+    };
+    var oaSync = function () {
+      var name = oaName();
+      // Same shape claude.ai hands ready(): toolInfo.tool.name is what widgets read.
+      hostContext = { theme: oa.theme, displayMode: oa.displayMode, toolInfo: { name: name, tool: { name: name }, arguments: oa.toolInput || {} } };
+      if (!initialized) {
+        initialized = true;
+        queue = [];
+        readyFns.forEach(function (f) { try { f(hostContext); } catch (e) {} });
+      } else {
+        themeFns.forEach(function (f) { try { f(hostContext); } catch (e) {} });
+      }
+      if (oa.toolInput && !oaInputSeen) {
+        oaInputSeen = true;
+        toolInputFns.forEach(function (f) { try { f(oa.toolInput, { name: oaName(), arguments: oa.toolInput }); } catch (e) {} });
+      }
+      if (oa.toolOutput && !oaOutputSeen) {
+        oaOutputSeen = true;
+        var res = { structuredContent: oa.toolOutput, _meta: oa.toolResponseMetadata || {} };
+        toolResultFns.forEach(function (f) { try { f(res); } catch (e) {} });
+      }
+    };
+    var oaCall = function (method) { return typeof oa[method] === 'function'; };
+    window.kolbo.callTool = function (name, args) {
+      if (!oaCall('callTool')) return Promise.reject(new Error('host cannot call tools'));
+      return Promise.resolve(oa.callTool(name, args || {})).then(function (r) {
+        // The SDK resolves with the CallToolResult (content + structuredContent);
+        // some builds unwrap to the structured payload — normalise either.
+        if (r && (r.structuredContent || r.content)) return r;
+        return { structuredContent: r, content: [] };
+      });
+    };
+    window.kolbo.sendMessage = function (text) {
+      return oaCall('sendFollowUpMessage') ? Promise.resolve(oa.sendFollowUpMessage({ prompt: text })) : Promise.reject(new Error('unsupported'));
+    };
+    window.kolbo.insertText = function () { return Promise.reject(new Error('unsupported')); };
+    window.kolbo.openLink = function (url) {
+      return oaCall('openExternal') ? Promise.resolve(oa.openExternal({ href: url })) : Promise.resolve(window.open(url, '_blank'));
+    };
+    window.kolbo.copyText = function (t) {
+      return navigator.clipboard && navigator.clipboard.writeText ? navigator.clipboard.writeText(t) : Promise.reject(new Error('unsupported'));
+    };
+    window.kolbo.attachMedia = function () { return Promise.reject(new Error('unsupported')); };
+    window.kolbo.updateModelContext = function () { return Promise.resolve(); };
+    window.kolbo.requestDisplayMode = function (mode) {
+      if (!oaCall('requestDisplayMode')) return Promise.resolve({ mode: 'inline' });
+      return Promise.resolve(oa.requestDisplayMode({ mode: mode })).then(function (r) { return { mode: (r && r.mode) || mode }; });
+    };
+    window.addEventListener('openai:set_globals', oaSync);
+    // Deferred: the widget's own script (which registers ready/onToolInput/
+    // onToolResult) runs AFTER this bridge block in the same document, and a
+    // synchronous sync here fired into empty listener lists and marked the
+    // input/output as seen.
+    setTimeout(oaSync, 0);
+  }
 })();
 `;
 

package/src/apps/index.js

@@ -48,10 +48,29 @@ const WIDGET_BUILDERS = {
 // Widgets are pure functions of source — build once per process.
 const htmlCache = new Map();
 function widgetHtml(uri) {
+  uri = String(uri).split('?')[0]; // versioned and bare URIs serve the same page
   if (!htmlCache.has(uri)) htmlCache.set(uri, WIDGET_BUILDERS[uri]());
   return htmlCache.get(uri);
 }
 
+// ChatGPT treats the widget URI as a permanent cache key: it fetched
+// generation.html once per app link and kept serving that snapshot across every
+// later release (1.87.9's ChatGPT fix never reached a card until the URI
+// changed — verified 2026-09-06 via its widget endpoint, where only
+// force_local=true returned the new HTML). OpenAI's own guidance is "treat the
+// resource URI as a cache key; publish a new URI on every change", so the URI
+// every tool declares and returns carries a content hash of the HTML it points
+// at. The bare URI stays registered for hosts holding an older tools/list.
+const crypto = require('crypto');
+const versionCache = new Map();
+function versionedUri(uri) {
+  if (!versionCache.has(uri)) {
+    const v = crypto.createHash('sha1').update(widgetHtml(uri)).digest('hex').slice(0, 10);
+    versionCache.set(uri, uri + '?v=' + v);
+  }
+  return versionCache.get(uri);
+}
+
 // Hosts apply a deny-by-default CSP to widget iframes — without this
 // declaration EVERY external asset (generated images/videos on the CDN, model
 // icons, Google Fonts) is silently blocked. resourceDomains maps to
@@ -71,12 +90,12 @@ const WIDGET_CSP = {
     // Public hosts owned by Kolbo.
     'https://api.kolbo.ai',
     'https://app.kolbo.ai',
-    'https://cdn.kolbo.ai',
-    // Preset thumbnails and library media live on the media-* hosts (prod
-    // presets still reference media-dev); without these every preset tile
-    // rendered as a black box. All three are on kolbo-api's download allowlist.
-    'https://media.kolbo.ai',
-    'https://media-staging.kolbo.ai',
+    'https://cdn.kolbo.ai',
+    // Preset thumbnails and library media live on the media-* hosts (prod
+    // presets still reference media-dev); without these every preset tile
+    // rendered as a black box. All three are on kolbo-api's download allowlist.
+    'https://media.kolbo.ai',
+    'https://media-staging.kolbo.ai',
     'https://media-dev.kolbo.ai',
     ...KOLBO_MEDIA_DOMAINS,
     'https://kolbo-general-media.fra1.digitaloceanspaces.com',
@@ -145,22 +164,25 @@ function registerApps(server) {
     [UI.list, 'Kolbo List Widget'],
     [UI.plans, 'Kolbo Plans Widget'],
   ]) {
-    registerAppResource(
-      server, name, uri,
-      { mimeType: RESOURCE_MIME_TYPE, _meta: { csp: WIDGET_CSP, ui: { csp: WIDGET_CSP } } },
-      async () => ({
-        contents: [{
-          uri, mimeType: RESOURCE_MIME_TYPE, text: widgetHtml(uri),
-          _meta: { csp: WIDGET_CSP, ui: { csp: WIDGET_CSP } },
-        }],
-      })
-    );
+    for (const u of [versionedUri(uri), uri]) {
+      registerAppResource(
+        server, name + (u === uri ? ' (unversioned)' : ''), u,
+        { mimeType: RESOURCE_MIME_TYPE, _meta: { csp: WIDGET_CSP, ui: { csp: WIDGET_CSP } } },
+        async () => ({
+          contents: [{
+            uri: u, mimeType: RESOURCE_MIME_TYPE, text: widgetHtml(uri),
+            _meta: { csp: WIDGET_CSP, ui: { csp: WIDGET_CSP } },
+          }],
+        })
+      );
+    }
   }
 }
 
 /** `_meta` for a tool RESULT (and optionally for tool registration). */
 function uiMeta(uri) {
-  return { [RESOURCE_URI_META_KEY]: uri, ui: { resourceUri: uri } };
+  const u = versionedUri(uri);
+  return { [RESOURCE_URI_META_KEY]: u, ui: { resourceUri: u } };
 }
 
 /**
@@ -201,7 +223,9 @@ function uiResult(uri, text, structured) {
   return {
     content: [{ type: 'text', text }],
     structuredContent: structured,
-    _meta: uiMeta(uri),
+    // 'kolbo/tool' reaches ChatGPT widgets as toolResponseMetadata — that host
+    // never tells the iframe which tool ran, and the card title depends on it.
+    _meta: { ...uiMeta(uri), ...(structured && structured.tool ? { 'kolbo/tool': structured.tool } : {}) },
   };
 }
 
@@ -738,6 +762,7 @@ module.exports = {
   TOOL_WIDGETS,
   registerApps,
   attachToolWidgetMeta,
+  versionedUri,
   uiMeta,
   uiResult,
   listResult,