@sellable/mcp 0.1.902 → 0.1.903

package/dist/tools/integrations.d.ts

@@ -77,6 +77,28 @@ export type IntegrationsResultEnvelope = {
     guidance: string | null;
     result: unknown;
 };
+/**
+ * A local Fly/Hermes path has no meaning inside Pipedream's cloud action runner.
+ * The live Gmail actions hand each `attachments[]` value to Nodemailer as
+ * `attachment.path`; Nodemailer accepts a data URI there, so a small PDF can cross
+ * the existing JSON call without a public bucket or a durable File Stash.
+ *
+ * Two MiB keeps the base64 body below the call route's dedicated 3 MiB ceiling.
+ * This is intentionally narrower than Gmail's own attachment limit: it is the
+ * bounded hot path for receipts and similar one-page PDFs, not a general file
+ * transfer service.
+ */
+export declare const INTEGRATION_LOCAL_PDF_MAX_BYTES: number;
+/**
+ * Materialize only the two live Gmail actions whose file-ref contract is known.
+ * Remote URLs/data URIs remain byte-identical. Endpoint-run effects are already
+ * authorized against their original argument hash, so they may not introduce a
+ * local path that would change after authorization.
+ */
+export declare function materializeIntegrationLocalPdfAttachments(toolName: string, args: Record<string, unknown>, options: {
+    allowLocal: boolean;
+    env?: NodeJS.ProcessEnv;
+}): Promise<Record<string, unknown>>;
 type IntegrationHomeWorkspacePin = {
     ok: true;
     workspaceId?: string;

package/dist/tools/integrations.js

@@ -1,3 +1,6 @@
+import { lstat, open, realpath } from "node:fs/promises";
+import os from "node:os";
+import path from "node:path";
 import { readMcpAgentServiceContext } from "../agent-service-auth.js";
 import { getApi, SellableApiError } from "../api.js";
 import { getConfig } from "../auth.js";
@@ -92,6 +95,152 @@ const CALL_PATH = "/api/v3/sellable-agent/integrations/tools/call";
  */
 const READ_TIMEOUT_MS = 25_000;
 const CALL_TIMEOUT_MS = 45_000;
+/**
+ * A local Fly/Hermes path has no meaning inside Pipedream's cloud action runner.
+ * The live Gmail actions hand each `attachments[]` value to Nodemailer as
+ * `attachment.path`; Nodemailer accepts a data URI there, so a small PDF can cross
+ * the existing JSON call without a public bucket or a durable File Stash.
+ *
+ * Two MiB keeps the base64 body below the call route's dedicated 3 MiB ceiling.
+ * This is intentionally narrower than Gmail's own attachment limit: it is the
+ * bounded hot path for receipts and similar one-page PDFs, not a general file
+ * transfer service.
+ */
+export const INTEGRATION_LOCAL_PDF_MAX_BYTES = 2 * 1024 * 1024;
+const GMAIL_FILE_ATTACHMENT_TOOLS = new Set([
+    "gmail-create-draft",
+    "gmail-send-email",
+]);
+const PDF_MAGIC = Object.freeze([0x25, 0x50, 0x44, 0x46, 0x2d]);
+class IntegrationLocalAttachmentError extends Error {
+    constructor() {
+        super("integration_local_attachment_rejected");
+        this.name = "IntegrationLocalAttachmentError";
+    }
+}
+function localAttachmentRefusal() {
+    return envelope({
+        ok: false,
+        outcome: "refused",
+        attribution: "configuration",
+        error: "integration_local_attachment_rejected",
+        guidance: "Attach a regular PDF under the Agent's writable media directory or /tmp; local PDFs are limited to 2 MiB total.",
+    });
+}
+function withinRoot(root, candidate) {
+    const relative = path.relative(root, candidate);
+    return (relative === "" ||
+        (relative !== ".." &&
+            !relative.startsWith(`..${path.sep}`) &&
+            !path.isAbsolute(relative)));
+}
+async function allowedLocalAttachmentRoots(env) {
+    const candidates = [env.HERMES_WRITE_SAFE_ROOT?.trim(), os.tmpdir()].filter((value) => Boolean(value && path.isAbsolute(value)));
+    const roots = await Promise.all([...new Set(candidates)].map(async (candidate) => {
+        try {
+            return await realpath(candidate);
+        }
+        catch {
+            return null;
+        }
+    }));
+    return roots.filter((value) => Boolean(value));
+}
+async function localPdfDataUri(localPath, filename, remainingBytes, env) {
+    if (!path.isAbsolute(localPath) ||
+        filename.length < 1 ||
+        filename.length > 160 ||
+        path.basename(filename) !== filename ||
+        !filename.toLowerCase().endsWith(".pdf") ||
+        /[\u0000-\u001f\u007f]/.test(filename)) {
+        throw new IntegrationLocalAttachmentError();
+    }
+    const [entry, resolved, roots] = await Promise.all([
+        lstat(localPath),
+        realpath(localPath),
+        allowedLocalAttachmentRoots(env),
+    ]).catch(() => {
+        throw new IntegrationLocalAttachmentError();
+    });
+    if (entry.isSymbolicLink() ||
+        !roots.some((root) => withinRoot(root, resolved))) {
+        throw new IntegrationLocalAttachmentError();
+    }
+    const handle = await open(resolved, "r").catch(() => {
+        throw new IntegrationLocalAttachmentError();
+    });
+    let bytes;
+    try {
+        const opened = await handle.stat();
+        if (!entry.isFile() ||
+            !opened.isFile() ||
+            opened.dev !== entry.dev ||
+            opened.ino !== entry.ino ||
+            opened.size < PDF_MAGIC.length ||
+            opened.size > remainingBytes) {
+            throw new IntegrationLocalAttachmentError();
+        }
+        bytes = new Uint8Array(new ArrayBuffer(opened.size));
+        let offset = 0;
+        while (offset < opened.size) {
+            const chunk = await handle.read(bytes, offset, opened.size - offset, offset);
+            if (chunk.bytesRead < 1)
+                throw new IntegrationLocalAttachmentError();
+            offset += chunk.bytesRead;
+        }
+    }
+    catch (error) {
+        if (error instanceof IntegrationLocalAttachmentError)
+            throw error;
+        throw new IntegrationLocalAttachmentError();
+    }
+    finally {
+        await handle.close().catch(() => undefined);
+    }
+    if (!PDF_MAGIC.every((byte, index) => bytes[index] === byte)) {
+        throw new IntegrationLocalAttachmentError();
+    }
+    return {
+        dataUri: `data:application/pdf;base64,${Buffer.from(bytes).toString("base64")}`,
+        bytes: bytes.byteLength,
+    };
+}
+/**
+ * Materialize only the two live Gmail actions whose file-ref contract is known.
+ * Remote URLs/data URIs remain byte-identical. Endpoint-run effects are already
+ * authorized against their original argument hash, so they may not introduce a
+ * local path that would change after authorization.
+ */
+export async function materializeIntegrationLocalPdfAttachments(toolName, args, options) {
+    if (!GMAIL_FILE_ATTACHMENT_TOOLS.has(toolName))
+        return args;
+    const attachments = args.attachments;
+    if (!Array.isArray(attachments) || attachments.length === 0)
+        return args;
+    const filenames = args.attachmentFilenames;
+    if (!Array.isArray(filenames) || filenames.length !== attachments.length) {
+        throw new IntegrationLocalAttachmentError();
+    }
+    let remainingBytes = INTEGRATION_LOCAL_PDF_MAX_BYTES;
+    const materialized = [];
+    for (let index = 0; index < attachments.length; index += 1) {
+        const attachment = attachments[index];
+        const filename = filenames[index];
+        if (typeof attachment !== "string" || typeof filename !== "string") {
+            throw new IntegrationLocalAttachmentError();
+        }
+        if (/^(?:https?:|data:)/i.test(attachment)) {
+            materialized.push(attachment);
+            continue;
+        }
+        if (!options.allowLocal)
+            throw new IntegrationLocalAttachmentError();
+        const converted = await localPdfDataUri(attachment, filename, remainingBytes, options.env ?? process.env);
+        materialized.push(converted.dataUri);
+        remainingBytes -= converted.bytes;
+    }
+    return { ...args, attachments: materialized };
+}
 /**
  * Mirror the home-workspace consistency invariant owned by
  * `readMcpAgentServiceContext`. Customer profiles prove home with the customer
@@ -604,17 +753,20 @@ export async function integrationsCallTool(input = {}, actor, agentEffectId) {
         return home.envelope;
     try {
         const endpointContext = isEndpointIntegrationContext(actor);
+        const callArguments = args
+            ? await materializeIntegrationLocalPdfAttachments(tool.toolName, args, { allowLocal: !endpointContext })
+            : null;
         const body = endpointContext
             ? {
                 ...selector.selector,
                 toolName: tool.toolName,
-                ...(args ? { arguments: args } : {}),
+                ...(callArguments ? { arguments: callArguments } : {}),
                 ...trustedIntegrationContextBody(actor, "DISPATCH"),
             }
             : {
                 ...selector.selector,
                 toolName: tool.toolName,
-                ...(args ? { arguments: args } : {}),
+                ...(callArguments ? { arguments: callArguments } : {}),
                 ...(typeof input.approvalId === "string" && input.approvalId
                     ? { approvalId: input.approvalId }
                     : {}),
@@ -628,6 +780,9 @@ export async function integrationsCallTool(input = {}, actor, agentEffectId) {
         return normalizeRouteResult(response);
     }
     catch (error) {
+        if (error instanceof IntegrationLocalAttachmentError) {
+            return localAttachmentRefusal();
+        }
         return toolError("call_tool", error);
     }
 }

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "@sellable/mcp",
-  "version": "0.1.902",
+  "version": "0.1.903",
   "type": "module",
   "description": "Sellable MCP server for Claude Code, Codex, and Hermes campaign workflows",
   "main": "dist/index.js",