@parall/parall 1.54.0 → 1.55.1

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "@parall/parall",
-  "version": "1.54.0",
+  "version": "1.55.1",
   "description": "OpenClaw channel plugin for Parall IM",
   "license": "MIT",
   "repository": {
@@ -16,8 +16,8 @@
     "openclaw.plugin.json"
   ],
   "dependencies": {
-    "@parall/agent-core": "1.54.0",
-    "@parall/sdk": "1.54.0"
+    "@parall/agent-core": "1.55.1",
+    "@parall/sdk": "1.55.1"
   },
   "devDependencies": {
     "@types/node": "^22.0.0",

package/skills/parall-clip-authoring/SKILL.md

@@ -114,6 +114,7 @@ function parseTweets(data) { /* ... */ }
 - `tab.cookie(name)` · `tab.fetch(url, opts)` (in-browser fetch, carries the session)
 - `tab.eval(expr)` (escape hatch) · `tab.click(sel)` · `tab.fill(sel, text)` · `tab.navigate(url)`
 - `tab.waitForSelector(sel)` · `tab.getTitle()` · `tab.getURL()` · `tab.screenshot()` · `tab.close()`
+- `tab.setFileInput(sel, url, opts?)` — upload a file into an `<input type=file>`
 - `fetch` — runtime-side HTTP, does NOT go through the browser (no session)
 - `console` — logs · `args` — the invocation input
 
@@ -122,6 +123,40 @@ returns structured data; eval is the last resort. Always `tab.close()` what you
 open, and do it in a `finally` — an early return or a thrown fetch is exactly
 when the tab leaks.
 
+### Uploading a file
+
+`tab.setFileInput` takes a URL, never a path, and the runtime — not the page —
+fetches the bytes. That is what makes it work where an in-page `fetch` +
+`DataTransfer` cannot: upload targets ship a Content-Security-Policy that
+forbids the page from fetching an arbitrary file host (Instagram's `default-src`
+allows only its own domains), and you cannot change a header on their site. The
+runtime is not a page, so no CSP applies to it — and a large video never has to
+pass through the page's memory.
+
+```js
+await tab.setFileInput("input[type=file]", videoUrl, { filename: "clip.mp4" });
+await tab.click("button[type=submit]");
+await tab.waitForSelector(".upload-complete");   // ← do not skip this
+```
+
+Four rules that decide whether your clip works:
+
+1. **The URL must be fetchable with no credentials** — a public direct link or a
+   signed temporary one. The runtime sends no cookies, so a Drive or Feishu link
+   copied from the address bar will not work: those are HTML pages behind a
+   login. If the file needs a session, use a logged-in tab to obtain a signed
+   direct link first, then pass THAT here. An HTML answer is refused with
+   `EDGE_FILE_SOURCE_NOT_A_FILE` rather than uploaded as if it were a file.
+2. **Finish the upload inside the same command.** The browser reads the file when
+   the page submits, and the runtime deletes it when your command ends. Injecting
+   and returning immediately uploads nothing — wait for the site to confirm.
+3. **Main-document inputs only.** An input inside an iframe or a shadow root is
+   not addressable and returns `EDGE_FILE_SELECTOR_MISS`. If the page rebuilds
+   the input after you inject (navigation, re-render), inject again.
+4. **`opts.filename` is what the page sees**, and many sites validate by
+   extension — set it when the URL has none. `opts.timeoutMs` bounds the
+   download. One file per call; there is no multi-file form yet.
+
 ## Develop → publish → iterate
 
 Use the platform `parall clip` subcommands — they reuse the credentials you
@@ -228,18 +263,30 @@ and the folder is just a manifest:
 }
 ```
 
-- The `mcp` block takes ONLY `server_url` and `auth` (`"none" | "bearer" |
-  "api_key" | "oauth"`). Any other key is refused at publish — a credential
-  belongs to the installing org's own configuration, NEVER to the clip
-  definition.
+- The `mcp` block takes ONLY `server_url`, `auth` (`"none" | "api_key" |
+  "basic" | "oauth"`, legacy `"bearer"` accepted) and `auth_headers`. Any
+  other key is refused at publish — a credential belongs to the installing
+  org's own configuration, NEVER to the clip definition.
+- `auth` is REQUIRED at publish: you know what your server speaks, and this
+  one word decides what the install form asks for (`none` = zero input,
+  `api_key` = key field(s), `basic` = username + password, `oauth` = a
+  Connect button).
+- `api_key` delivers as a single `X-API-Key` header by default. When the
+  server wants a different shape, declare `auth_headers` (max 4 slots, one
+  admin-supplied value each): `[{"name": "Authorization", "scheme":
+  "Bearer"}]` for Bearer tokens, `[{"name": "api-key"}]` for a custom
+  header, or a pair like `[{"name": "CF-Access-Client-Id"}, {"name":
+  "CF-Access-Client-Secret"}]`. Framing/platform headers (Host, Cookie,
+  X-Prll-*, …) are refused.
 - `server_url` must be an absolute **https** URL with no embedded credentials,
   query, or fragment. It is review material, frozen with the approved version.
+  It stays OPTIONAL for self-hosted products where each org connects its own
+  instance URL.
 - Do NOT put the server in the top-level `server` / `auth` manifest keys —
   those are legacy Edge-manifest fields nothing reads. Only the `mcp` block
   declares the server.
-- Both fields are optional, but what you declare is LOCKED: the installing
-  org's config must match it, and changing the URL or auth mode means
-  republishing.
+- What you declare is LOCKED: the installing org's config must match it, and
+  changing the URL, auth mode, or header shape means republishing.
 - Entering the credential / completing OAuth is a HUMAN step in the Clip
   Console (the config-write endpoints are session-only — an API key cannot
   call them). An org can add SEVERAL connections to one MCP clip — one