@stabgan/openrouter-mcp-multimodal 4.0.0 → 4.0.1

package/dist/index.js

@@ -21,7 +21,7 @@ if (!apiKey) {
     process.exit(1);
 }
 const defaultModel = process.env.OPENROUTER_DEFAULT_MODEL || process.env.DEFAULT_MODEL || DEFAULT_MODEL;
-const server = new Server({ name: 'openrouter-multimodal-server', version: '4.0.0' }, { capabilities: { tools: {} } });
+const server = new Server({ name: 'openrouter-multimodal-server', version: '4.0.1' }, { capabilities: { tools: {} } });
 server.onerror = (error) => console.error('[MCP Error]', error);
 new ToolHandlers(server, apiKey, defaultModel);
 process.on('SIGINT', async () => {

package/dist/tool-handlers/generate-image.d.ts

@@ -89,9 +89,9 @@ export declare function handleGenerateImage(request: {
 }>;
 /**
  * Resolve a caller-supplied input image into a URL the chat-completions
- * API accepts. Local file paths are sandboxed to the workspace root
- * (`OPENROUTER_INPUT_DIR` or `OPENROUTER_OUTPUT_DIR` or cwd) and inlined
- * as base64 data URLs.
+ * API accepts. Local file paths are sandboxed via
+ * `resolveSafeInputPath` (`OPENROUTER_INPUT_DIR` /
+ * `OPENROUTER_OUTPUT_DIR` / cwd) and inlined as base64 data URLs.
  */
 export declare function resolveInputImage(ref: string): Promise<string>;
 export declare function mimeFromExt(ext: string): string | null;

package/dist/tool-handlers/generate-image.js

@@ -1,6 +1,6 @@
 import { promises as fs } from 'fs';
 import path from 'node:path';
-import { resolveSafeOutputPath, UnsafeOutputPathError } from './path-safety.js';
+import { resolveSafeOutputPath, resolveSafeInputPath, UnsafeOutputPathError } from './path-safety.js';
 import { parseBase64DataUrl } from './fetch-utils.js';
 import { ErrorCode, toolError, toolErrorFrom } from '../errors.js';
 import { classifyUpstreamError } from './openrouter-errors.js';
@@ -159,9 +159,9 @@ export async function handleGenerateImage(request, openai) {
 }
 /**
  * Resolve a caller-supplied input image into a URL the chat-completions
- * API accepts. Local file paths are sandboxed to the workspace root
- * (`OPENROUTER_INPUT_DIR` or `OPENROUTER_OUTPUT_DIR` or cwd) and inlined
- * as base64 data URLs.
+ * API accepts. Local file paths are sandboxed via
+ * `resolveSafeInputPath` (`OPENROUTER_INPUT_DIR` /
+ * `OPENROUTER_OUTPUT_DIR` / cwd) and inlined as base64 data URLs.
  */
 export async function resolveInputImage(ref) {
     const trimmed = ref.trim();
@@ -171,36 +171,7 @@ export async function resolveInputImage(ref) {
         return trimmed;
     if (/^https?:\/\//i.test(trimmed))
         return trimmed;
-    const root = path.resolve(process.env.OPENROUTER_INPUT_DIR || process.env.OPENROUTER_OUTPUT_DIR || process.cwd());
-    const unsafe = process.env.OPENROUTER_ALLOW_UNSAFE_PATHS === '1' ||
-        process.env.OPENROUTER_ALLOW_UNSAFE_PATHS?.toLowerCase() === 'true';
-    // Realpath the root first so absolute paths the caller already gave in
-    // canonical form (e.g. /private/var/...) and paths we resolve against
-    // the root (which may go through /var/... symlinks on macOS) live in
-    // the same namespace for the prefix check below.
-    const rootReal = await fs.realpath(root).catch(() => root);
-    const abs = path.isAbsolute(trimmed)
-        ? path.resolve(trimmed)
-        : path.resolve(rootReal, trimmed);
-    if (!unsafe) {
-        const withSep = rootReal.endsWith(path.sep) ? rootReal : rootReal + path.sep;
-        // Prefer realpath for the prefix check so callers can pass paths
-        // through symlinks (e.g. macOS `/var/...` → `/private/var/...`)
-        // without us rejecting them. If the file doesn't exist yet, fall
-        // back to a textual check on the resolved path so traversal
-        // (`../escape.png`) is still rejected with the right error type
-        // instead of leaking an ENOENT to the caller.
-        let canonical;
-        try {
-            canonical = await fs.realpath(abs);
-        }
-        catch {
-            canonical = abs;
-        }
-        if (!(canonical === rootReal || canonical.startsWith(withSep))) {
-            throw new UnsafeOutputPathError(`input_images entry resolves outside workspace root (${rootReal}): ${ref}`);
-        }
-    }
+    const abs = await resolveSafeInputPath(trimmed);
     const buf = await fs.readFile(abs);
     const mime = mimeFromExt(path.extname(abs)) || 'image/png';
     return `data:${mime};base64,${buf.toString('base64')}`;

package/dist/tool-handlers/generate-video.js

@@ -2,7 +2,7 @@ import { promises as fs } from 'node:fs';
 import { extname } from 'node:path';
 import { ErrorCode, toolError, toolErrorFrom } from '../errors.js';
 import { logger } from '../logger.js';
-import { resolveSafeOutputPath, UnsafeOutputPathError, } from './path-safety.js';
+import { resolveSafeOutputPath, resolveSafeInputPath, UnsafeOutputPathError, } from './path-safety.js';
 import { readEnvInt } from './fetch-utils.js';
 import { classifyUpstreamError } from './openrouter-errors.js';
 const FALLBACK_MODEL = 'google/veo-3.1';
@@ -54,8 +54,15 @@ async function prepareImageInput(source) {
         const mime = (contentType?.split(';')[0]?.trim() || 'image/jpeg').toLowerCase();
         return { mime, data: buffer.toString('base64') };
     }
-    const buf = await fs.readFile(source);
-    const ext = extname(source).toLowerCase();
+    // Local file: sandbox via path-safety's resolveSafeInputPath so
+    // generate_video's first_frame_image / last_frame_image /
+    // reference_images fields enforce the same OPENROUTER_INPUT_DIR
+    // / OPENROUTER_OUTPUT_DIR / cwd scope that generate_image's
+    // input_images already uses. Callers can still bypass with
+    // OPENROUTER_ALLOW_UNSAFE_PATHS=1 for legacy scripts.
+    const abs = await resolveSafeInputPath(source);
+    const buf = await fs.readFile(abs);
+    const ext = extname(abs).toLowerCase();
     const mime = ext === '.png'
         ? 'image/png'
         : ext === '.webp'
@@ -245,6 +252,11 @@ export async function handleGenerateVideo(request, apiClient, progress) {
         await attachFrameImages(args, body);
     }
     catch (err) {
+        // Sandbox violation → UNSAFE_PATH; all other decode failures stay
+        // as UNSUPPORTED_FORMAT (couldn't read, invalid data URL, etc.).
+        if (err instanceof UnsafeOutputPathError) {
+            return toolErrorFrom(ErrorCode.UNSAFE_PATH, err, 'Reference/frame image');
+        }
         return toolErrorFrom(ErrorCode.UNSUPPORTED_FORMAT, err, 'Reference/frame image');
     }
     let envelope;

package/dist/tool-handlers/path-safety.d.ts

@@ -9,3 +9,14 @@ export declare class UnsafeOutputPathError extends Error {
  * (traversal attempt) and the sandbox is enabled.
  */
 export declare function resolveSafeOutputPath(savePath: string): Promise<string>;
+/**
+ * Resolve and validate a caller-supplied INPUT path. Unlike
+ * `resolveSafeOutputPath`, this never creates directories — it only
+ * confirms the path lives inside the input sandbox and returns the
+ * absolute path the caller can `fs.readFile` from.
+ *
+ * Accepts the same `OPENROUTER_ALLOW_UNSAFE_PATHS=1` legacy bypass.
+ * Throws `UnsafeOutputPathError` on traversal attempts (re-used type so
+ * handlers map errors uniformly to `ErrorCode.UNSAFE_PATH`).
+ */
+export declare function resolveSafeInputPath(inputPath: string): Promise<string>;

package/dist/tool-handlers/path-safety.js

@@ -86,3 +86,57 @@ async function findExistingAncestor(dir) {
         }
     }
 }
+/**
+ * Root-resolution for caller-supplied INPUT paths. Prefers
+ * `OPENROUTER_INPUT_DIR`, then `OPENROUTER_OUTPUT_DIR`, then `process.cwd()`.
+ * This mirrors the semantics `generate_image`'s `input_images` originally
+ * shipped with; exposing it here lets `generate_video`'s frame and
+ * reference images use the same sandbox.
+ */
+function getInputRoot() {
+    const inputDir = process.env.OPENROUTER_INPUT_DIR;
+    if (inputDir && inputDir.length > 0)
+        return path.resolve(inputDir);
+    const outputDir = process.env.OPENROUTER_OUTPUT_DIR;
+    if (outputDir && outputDir.length > 0)
+        return path.resolve(outputDir);
+    return process.cwd();
+}
+/**
+ * Resolve and validate a caller-supplied INPUT path. Unlike
+ * `resolveSafeOutputPath`, this never creates directories — it only
+ * confirms the path lives inside the input sandbox and returns the
+ * absolute path the caller can `fs.readFile` from.
+ *
+ * Accepts the same `OPENROUTER_ALLOW_UNSAFE_PATHS=1` legacy bypass.
+ * Throws `UnsafeOutputPathError` on traversal attempts (re-used type so
+ * handlers map errors uniformly to `ErrorCode.UNSAFE_PATH`).
+ */
+export async function resolveSafeInputPath(inputPath) {
+    if (isUnsafeMode()) {
+        return path.resolve(inputPath);
+    }
+    const root = getInputRoot();
+    const rootReal = await fs.realpath(root).catch(() => path.resolve(root));
+    const withSep = rootReal.endsWith(path.sep) ? rootReal : rootReal + path.sep;
+    const abs = path.isAbsolute(inputPath)
+        ? path.resolve(inputPath)
+        : path.resolve(rootReal, inputPath);
+    // Prefer realpath for the prefix check so callers can pass paths
+    // through symlinks (e.g. macOS `/var/...` → `/private/var/...`)
+    // without us rejecting them. If the file doesn't exist yet, fall
+    // back to a textual check on the resolved path so traversal
+    // (`../escape.png`) is still rejected with the right error type
+    // instead of leaking an ENOENT to the caller.
+    let canonical;
+    try {
+        canonical = await fs.realpath(abs);
+    }
+    catch {
+        canonical = abs;
+    }
+    if (!(canonical === rootReal || canonical.startsWith(withSep))) {
+        throw new UnsafeOutputPathError(`input path resolves outside OPENROUTER_INPUT_DIR (${rootReal}): ${inputPath}`);
+    }
+    return abs;
+}

package/dist/tool-handlers/provider-routing.js

@@ -80,8 +80,12 @@ export function readProviderDefaults() {
         if (order)
             out.order = order;
     }
-    catch {
-        /* silently drop malformed env var */
+    catch (err) {
+        // Don't crash the server on a malformed env var — log once so an
+        // operator notices instead of wondering why their ordering is being
+        // ignored. All other OPENROUTER_PROVIDER_* fields follow the same
+        // "silent drop" policy for consistency.
+        console.error(`[openrouter-mcp] OPENROUTER_PROVIDER_ORDER ignored: ${err instanceof Error ? err.message : String(err)}`);
     }
     const requireParams = parseBool(env.OPENROUTER_PROVIDER_REQUIRE_PARAMETERS);
     if (requireParams !== undefined)

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "@stabgan/openrouter-mcp-multimodal",
-  "version": "4.0.0",
+  "version": "4.0.1",
   "mcpName": "io.github.stabgan/openrouter-multimodal",
   "description": "MCP server for OpenRouter with text chat, image analysis + generation, audio analysis + generation, video analysis, and video generation (Veo 3.1 / Sora 2 Pro / Seedance / Wan)",
   "type": "module",