@okostream/mcp 0.12.4 → 0.12.6

package/README.md

@@ -96,10 +96,14 @@ Refusals are explicit and never require guessing:
   OKO team.
 - `PLATFORM_REJECTED_READ` — no access to that resource, or it does not exist.
 
-Image URLs are resolved locally. On a machine where a VPN or proxy intercepts
-DNS, public hosts resolve to fake addresses (`198.18.x.x`); such uploads still
-work, and the result says so. Uploading a file from disk (`OKO_IMAGE_ROOTS`)
-always works.
+Image URLs are fetched by the OKO server first, so a VPN, proxy or captive
+portal on the organizer's machine is not in the way. If the server cannot
+reach the URL (a private host, a login wall, a timeout), the MCP client
+fetches it from the local machine; on a machine where a VPN or proxy
+intercepts DNS, public hosts resolve to fake addresses (`198.18.x.x`), such
+uploads still work, and the result says so. When both roads fail, the error
+names both reasons and asks for a file from disk (`OKO_IMAGE_ROOTS`), which
+always works. The result's `sourceVia` says who fetched the image.
 
 ## Capabilities
 

package/dist/server.js

@@ -116223,7 +116223,7 @@ function sanitizeScopes(scopes) {
 }
 
 // build/version.js
-var OKO_MCP_VERSION = "0.12.4";
+var OKO_MCP_VERSION = "0.12.6";
 
 // build/auth.js
 var state = null;
@@ -116465,6 +116465,15 @@ function isPublicUnicastAddress(address) {
     return false;
   return import_ipaddr.default.parse(normalized).range() === "unicast";
 }
+function pinnedLookup(address, family) {
+  return (_hostname, options2, callback) => {
+    if (options2 && typeof options2 === "object" && options2.all) {
+      callback(null, [{ address, family }]);
+      return;
+    }
+    callback(null, address, family);
+  };
+}
 
 // build/tools/eventAccess.js
 var EVENT_ACCESS_FIELD_BY_MODE = {
@@ -116640,9 +116649,7 @@ async function readRemoteImage(rawUrl, redirects = 0) {
     remoteFetchNotes.push(`Image fetched through a VPN/proxy with DNS interception: ${url.hostname} resolved to ${pinned.address}, so OKO could not verify the destination address itself; the connection went through the proxy. This is expected on such machines and fine for public image links.`);
   }
   const dispatcher = new import_undici.Agent({
-    connect: {
-      lookup: (_hostname, _options, callback) => callback(null, pinned.address, pinned.family)
-    }
+    connect: { lookup: pinnedLookup(pinned.address, pinned.family) }
   });
   const controller = new AbortController();
   const timeout = setTimeout(() => controller.abort(), REMOTE_IMAGE_TIMEOUT_MS);
@@ -116673,7 +116680,7 @@ async function readRemoteImage(rawUrl, redirects = 0) {
     if (Number.isFinite(contentLength) && contentLength > MAX_SOURCE_IMAGE_BYTES) {
       throw new Error("Image URL is larger than 15MB.");
     }
-    return responseBufferWithLimit(response, MAX_SOURCE_IMAGE_BYTES);
+    return await responseBufferWithLimit(response, MAX_SOURCE_IMAGE_BYTES);
   } catch (err) {
     if (err instanceof Error && err.name === "AbortError") {
       throw new Error("Image URL fetch timed out.");
@@ -116710,12 +116717,65 @@ async function readLocalImage(inputPath) {
     throw new Error("Image file is larger than 15MB.");
   return readFile(filePath);
 }
-async function readImageSource(source) {
-  if (source.path)
-    return readLocalImage(source.path);
-  if (source.url)
-    return readRemoteImage(source.url);
-  throw new Error("Provide image source path or url.");
+function serverFetchRefusal(error3) {
+  if (!error3 || typeof error3 !== "object")
+    return null;
+  const details = error3.details;
+  if (details && typeof details === "object" && details.code === "REMOTE_FETCH_FAILED") {
+    const record2 = details;
+    const fallbackMessage = String(error3.message ?? "the server could not fetch the URL");
+    return {
+      reason: typeof record2.reason === "string" ? record2.reason : "unknown",
+      message: typeof record2.message === "string" ? record2.message : fallbackMessage
+    };
+  }
+  const code = error3.code;
+  const message = String(error3.message ?? "");
+  if (code === "functions/invalid-argument" && message.includes("Image payload is empty or too large")) {
+    return { reason: "server_without_url_support", message: "The OKO server release in use does not fetch URLs yet." };
+  }
+  return null;
+}
+var SERVER_FETCH_NOTE = "Image fetched by the OKO server directly from the URL; this machine's network was not involved.";
+function localFallbackNote(serverFailure) {
+  return `The OKO server could not fetch the URL (${serverFailure.reason}: ${serverFailure.message}), so the image was fetched from this machine instead.`;
+}
+function remoteImageUnavailableMessage(url, serverFailure, localError) {
+  const localMessage = localError instanceof Error ? localError.message : String(localError);
+  return `Image URL could not be fetched by the OKO server or from this machine. Server (${serverFailure.reason}): ${serverFailure.message} This machine: ${localMessage} Ask the organizer to download the image and pass its path via source.path (allowed directories come from OKO_IMAGE_ROOTS), or to share a public HTTPS link that returns the image file directly. URL: ${url}`;
+}
+async function uploadImageFromSource(eventId, kind, cardId, source) {
+  if (source.path) {
+    const buffer2 = await readLocalImage(source.path);
+    const uploaded2 = await uploadMasterImage(eventId, kind, cardId, { imageBase64: buffer2.toString("base64") });
+    return { uploaded: uploaded2, sourceBytes: buffer2.byteLength, sourceVia: "client", notes: [] };
+  }
+  if (!source.url)
+    throw new Error("Provide image source path or url.");
+  let serverFailure;
+  try {
+    const uploaded2 = await uploadMasterImage(eventId, kind, cardId, { sourceUrl: source.url });
+    return { uploaded: uploaded2, sourceBytes: uploaded2.sourceBytes ?? 0, sourceVia: "server", notes: [SERVER_FETCH_NOTE] };
+  } catch (error3) {
+    const refusal = serverFetchRefusal(error3);
+    if (!refusal)
+      throw error3;
+    serverFailure = refusal;
+  }
+  let buffer;
+  try {
+    buffer = await readRemoteImage(source.url);
+  } catch (localError) {
+    takeRemoteFetchNotes();
+    throw new Error(remoteImageUnavailableMessage(source.url, serverFailure, localError));
+  }
+  const uploaded = await uploadMasterImage(eventId, kind, cardId, { imageBase64: buffer.toString("base64") });
+  return {
+    uploaded,
+    sourceBytes: buffer.byteLength,
+    sourceVia: "client",
+    notes: [localFallbackNote(serverFailure), ...takeRemoteFetchNotes()]
+  };
 }
 function readImageRef(eventData, kind, cardId) {
   const blocks = eventData.blocks && typeof eventData.blocks === "object" ? eventData.blocks : {};
@@ -116853,8 +116913,8 @@ var cardItemInputSchema = external_exports.object({
   formId: cardIdSchema.nullable().optional()
 }).strict();
 var imageSourceSchema = external_exports.object({
-  path: external_exports.string().min(1).optional().describe("Local image path on the MCP client machine."),
-  url: external_exports.string().url().optional().describe("HTTPS image URL to fetch from the MCP client machine.")
+  path: external_exports.string().min(1).optional().describe("Local image path on the MCP client machine (inside OKO_IMAGE_ROOTS)."),
+  url: external_exports.string().url().optional().describe("Public HTTPS image URL. The OKO server fetches it first (works behind VPNs and proxies); if the server cannot reach it, the MCP client fetches it from this machine; if both fail, ask the organizer for a local file via path.")
 }).strict().refine((source) => Boolean(source.path) !== Boolean(source.url), {
   message: "Provide exactly one image source: path or url."
 });
@@ -116920,13 +116980,13 @@ async function deleteStorageUrls(eventId, masterUrl, fallbackUrl) {
   const warnings = await deleteStoragePaths(eventId, paths);
   return { attempted: [...new Set(paths)].length, warnings };
 }
-async function uploadMasterImage(eventId, kind, cardId, image) {
+async function uploadMasterImage(eventId, kind, cardId, source) {
   const uploadImage = httpsCallable(functions, "uploadMcpImage");
   const result = await uploadImage({
     eventId,
     kind,
     ...cardId ? { cardId } : {},
-    imageBase64: image.toString("base64")
+    ...source.sourceUrl ? { sourceUrl: source.sourceUrl } : { imageBase64: source.imageBase64 }
   });
   return result.data;
 }
@@ -117007,8 +117067,6 @@ async function uploadEventImageForUser(uid, eventId, kind, cardId, source) {
     throw new Error("cardId is only valid when kind is card.");
   const event = await readEvent(eventId, uid, "edit");
   const previous = readImageRef(event, kind, cardId);
-  const sourceBuffer = await readImageSource(source);
-  const remoteNotes = takeRemoteFetchNotes();
   const eventBlocks = event.blocks && typeof event.blocks === "object" ? event.blocks : {};
   const placeholderCfg = eventBlocks.video?.placeholder && typeof eventBlocks.video.placeholder === "object" ? eventBlocks.video.placeholder : {};
   const blockEnabled = kind === "promoBanner" ? eventBlocks.promoBanner?.enabled === true : kind === "videoPlaceholder" ? placeholderCfg.enabled === true : readCardsConfig(event).enabled;
@@ -117022,7 +117080,7 @@ async function uploadEventImageForUser(uid, eventId, kind, cardId, source) {
   const previousMasterPath = storagePathFromDownloadUrl(previous.imageMasterUrl);
   const deleteWarnings = [];
   let deletesAttempted = 0;
-  const uploaded = await uploadMasterImage(eventId, kind, cardId, sourceBuffer);
+  const { uploaded, sourceBytes, sourceVia, notes: sourceNotes } = await uploadImageFromSource(eventId, kind, cardId, source);
   if (!uploaded)
     throw new Error("Image upload did not return a result.");
   if (kind !== "card" || previousMasterPath && previousMasterPath !== uploaded.storagePath || !previous.imageMasterUrl && previous.imageUrl) {
@@ -117037,14 +117095,15 @@ async function uploadEventImageForUser(uid, eventId, kind, cardId, source) {
     storagePath: uploaded.storagePath,
     masterUrl: uploaded.masterUrl,
     variantsPending: true,
-    sourceBytes: sourceBuffer.byteLength,
+    sourceBytes,
+    sourceVia,
     masterBytes: uploaded.masterBytes,
     imageWidth: uploaded.imageWidth,
     imageHeight: uploaded.imageHeight,
     note: "Image master uploaded. CF generateImageVariants should publish thumb/card/hero variants and update imageUrl/imageVariants in about 10-30 seconds.",
     storageDeletesAttempted: deletesAttempted,
     storageDeleteWarnings: deleteWarnings,
-    hints: [...remoteNotes, ...uploadHints]
+    hints: [...sourceNotes, ...uploadHints]
   };
 }
 
@@ -117186,6 +117245,7 @@ var imageOutputSchema = external_exports.object({
   masterUrl: external_exports.string().url(),
   variantsPending: external_exports.boolean(),
   sourceBytes: external_exports.number().int().nonnegative(),
+  sourceVia: external_exports.enum(["server", "client"]).optional(),
   masterBytes: external_exports.number().int().nonnegative(),
   imageWidth: external_exports.number().int().positive(),
   imageHeight: external_exports.number().int().positive(),
@@ -117363,7 +117423,7 @@ var SCOPE_UNLOCKS = {
   "chat:moderate": "chat mode, moderation, bans and mutes",
   "telegram:write": "claiming channels and publishing Telegram posts",
   "workspace:read": "listing workspaces, members, invites, notifications",
-  "workspace:write": "workspace management, invites, profile edits, moving events between workspaces",
+  "workspace:write": "workspace management, invites, profile edits",
   "leads:read": "reading and exporting leads"
 };
 function presetsWithScope(scope) {
@@ -118033,6 +118093,25 @@ async function assertCanCreateInWorkspace(uid, workspaceId) {
     }
   }
 }
+function buildCreateWebinarDocument(input) {
+  return {
+    ownerId: input.uid,
+    workspaceId: input.workspaceId,
+    createdAt: input.createdAt,
+    title: input.title.trim(),
+    pinned: false,
+    video: input.video,
+    meta: {
+      eventDate: input.eventDate,
+      speakerName: input.speakerName,
+      description: input.description
+    },
+    blocks: {
+      chat: { enabled: input.chatEnabled, visibility: "always" },
+      promoBanner: { enabled: false, text: "", link: "", visibility: "always" }
+    }
+  };
+}
 async function addEventWithRtdbMirror(eventData) {
   const eventRef = await addDoc(collection(firestore, "events"), eventData);
   try {
@@ -118317,23 +118396,17 @@ function registerEventTools(server2) {
     const workspaceId = args.workspaceId ?? uid;
     await assertCanCreateInWorkspace(uid, workspaceId);
     const video = normalizeVideo(args.videoUrl);
-    const docRef = await addEventWithRtdbMirror({
-      ownerId: uid,
+    const docRef = await addEventWithRtdbMirror(buildCreateWebinarDocument({
+      uid,
       workspaceId,
-      createdAt: serverTimestamp2(),
-      title: args.title.trim(),
-      pinned: false,
+      title: args.title,
       video,
-      meta: {
-        eventDate: args.eventDate ? Timestamp.fromDate(new Date(args.eventDate)) : null,
-        speakerName: args.speakerName?.trim() || null,
-        description: args.description?.trim() || null
-      },
-      blocks: {
-        chat: { enabled: args.chatEnabled, visibility: "always" },
-        promoBanner: { enabled: false, text: "", link: "", visibility: "always" }
-      }
-    });
+      eventDate: args.eventDate ? Timestamp.fromDate(new Date(args.eventDate)) : null,
+      speakerName: args.speakerName?.trim() || null,
+      description: args.description?.trim() || null,
+      chatEnabled: args.chatEnabled,
+      createdAt: serverTimestamp2()
+    }));
     return textResult({
       id: docRef.id,
       ...eventLinks(docRef.id),
@@ -118643,10 +118716,10 @@ function registerImageTools(server2) {
         "eventId: event to edit.",
         "kind: promoBanner, videoPlaceholder, or card.",
         "cardId: required when kind=card; must match an existing blocks.cards.items id.",
-        "source: exactly one of local path or HTTPS image URL.",
+        "source: exactly one of local path or public HTTPS image URL.",
         "confirm: must be true because the public event image may be replaced."
       ],
-      returns: "eventId, kind, imageId, Storage path, masterUrl, byte counts, and a note that CF-generated variants are pending.",
+      returns: "eventId, kind, imageId, Storage path, masterUrl, byte counts, sourceVia (server or client fetched the URL), hints, and a note that CF-generated variants are pending.",
       examples: [
         'Use kind="promoBanner" with source.url to set a webinar banner from an image link.',
         'Use kind="card" with cardId after the card item already exists.'
@@ -118654,7 +118727,7 @@ function registerImageTools(server2) {
       notes: [
         "Uploading an image does not enable its block: toggle the block independently via oko_configure_blocks, in either order.",
         "The MCP server reads local paths on the organizer machine.",
-        "Remote URLs must be public HTTPS images, max 15MB; private/local hosts are blocked.",
+        "A URL is fetched by the OKO server first (no VPN or proxy in the way), then from this machine if the server could not reach it; if both fail, the error names both reasons \u2014 ask the organizer to download the image and pass source.path. Public HTTPS only, max 15MB; private/local hosts are blocked.",
         "For card images, imageId is the cardId so OKO CF4 can update the correct item.",
         IMAGE_ADVICE.promoBanner,
         IMAGE_ADVICE.videoPlaceholder,
@@ -118891,7 +118964,6 @@ async function recordToolAudit(toolName, outcome, args, startedAt, error3) {
 var REPORT_URL = `${APP_ORIGIN}/contact`;
 var KEYS_URL = `${APP_ORIGIN}/app/mcp`;
 var SCOPE_WORKAROUNDS = {
-  oko_move_event: "Without workspace:write you can still place the event in another workspace: call oko_duplicate_event with targetWorkspaceId to create a copy there. The original stays where it is; live overrides (chat mode, placeholder visibility) are not copied and must be set again on the copy.",
   oko_trash_event: "This key cannot delete events. Tell the organizer which event to remove; they can do it in the OKO cabinet, or create a key with the full preset.",
   oko_delete_event_permanently: "This key cannot delete events. Tell the organizer which event to remove; they can do it in the OKO cabinet, or create a key with the full preset.",
   oko_publish_telegram_post: "This key cannot publish to Telegram. The organizer can publish the announcement from the OKO cabinet, or create a key with the full preset."
@@ -119205,7 +119277,7 @@ function registerLifecycleTools(server2) {
       notes: [
         "Copies title, video, meta, blocks, forms, and Telegram config; does not copy analytics sessions or leads.",
         "Live overrides are NOT copied: the copy starts with chat mode public and the placeholder hidden, whatever the source had. Set them again with oko_set_chat_mode and oko_set_block_visibility on the new event.",
-        "Requires only events:write plus createEvents in the target workspace, so it also works as the way to place an event in another workspace when the key lacks workspace:write for oko_move_event."
+        "Requires only events:write plus createEvents in the target workspace. To move (not copy) an event, use oko_move_event with the same scope."
       ]
     }),
     inputSchema: {
@@ -119258,7 +119330,7 @@ function registerLifecycleTools(server2) {
       examples: ["Use when an event belongs in another workspace. Call oko_list_workspaces first to choose the target."],
       notes: [
         "Reads target workspace shares from Firestore with permissions; does not use RTDB workspaceMembers.",
-        "Requires the workspace:write scope (preset full). Keys with the operator preset cannot move events: use oko_duplicate_event with targetWorkspaceId instead, which creates a copy in the target workspace and leaves the original in place."
+        "Requires events:write plus ownership of the event (or of its source workspace) and createEvents in the target workspace; no workspace:write needed. Live overrides (chat mode, placeholder) travel with the event: they live in the event's own RTDB node."
       ]
     }),
     inputSchema: {
@@ -119269,7 +119341,7 @@ function registerLifecycleTools(server2) {
     outputSchema: updateOutputSchema,
     annotations: writeTool
   }, async ({ eventId, targetWorkspaceId, confirm }) => {
-    await authed(["events:write", "workspace:write"]);
+    await authed(["events:write"]);
     requireConfirm(confirm, "oko_move_event", { eventId, targetWorkspaceId });
     const moveEvent = httpsCallable(functions, "moveEventToWorkspace");
     const result = await moveEvent({ eventId, targetWorkspaceId });

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "@okostream/mcp",
-  "version": "0.12.4",
+  "version": "0.12.6",
   "description": "Control OKO Stream webinars from Claude, Codex, and other MCP clients.",
   "license": "UNLICENSED",
   "author": {