@yolo-labs/yolobridge 0.19.0 → 0.21.0

package/dist/api-client.js

@@ -303,3 +303,24 @@ export async function finalizeShare(cfg, workspaceId, attachmentId, assetId) {
     const body = (await res.json());
     return { assetId: body?.asset?.assetId ?? assetId };
 }
+/**
+ * Phase 3, optional: write an already-shared asset into ANOTHER tile's session
+ * pod, so the agent there can open it as a real file.
+ *
+ * Only DELIVERY crosses to another tile. The asset itself stays on this
+ * attachment's tile — the server enforces that, and nothing here can ask
+ * otherwise.
+ */
+export async function deliverShare(cfg, workspaceId, attachmentId, assetId, targetTileId) {
+    const fetchImpl = cfg.fetchImpl ?? fetch;
+    const res = await fetchImpl(`${base(cfg)}/v1/workspaces/${workspaceId}/yolobridge/attach/${attachmentId}/deliver`, {
+        method: 'POST',
+        headers: { ...authHeaders(cfg), 'Content-Type': 'application/json' },
+        body: JSON.stringify({ assetId, targetTileId }),
+    });
+    if (!res.ok) {
+        const { message, code } = await parseErrorBody(res);
+        throw new YoloBridgeApiError(message, res.status, code);
+    }
+    return (await res.json());
+}

package/dist/cli.js

@@ -22,7 +22,7 @@ import { realpathSync, existsSync, readFileSync } from 'node:fs';
 import { hostname } from 'node:os';
 import { runLogin } from './login-cmd.js';
 import { runAttachFromDisk, pickWorkspaceFromDisk } from './attach-cmd.js';
-import { runShare } from './share-cmd.js';
+import { runShare, runDeliver } from './share-cmd.js';
 import { runAllow } from './approved-paths.js';
 import { runDetach } from './detach-cmd.js';
 import { getStatus, formatStatus } from './status-cmd.js';
@@ -106,6 +106,10 @@ function printHelp() {
         '                         The daemon\'s own working directory is always allowed.',
         '  share <path>           Share a local file with the attached workspace, so a cloud',
         '                         agent can see it. Push only — nothing reads your disk remotely.',
+        '    [--to <tileId>]      Also write it into that tile\'s session, so its agent can open it.',
+        '  deliver <assetId>      Write an ALREADY-shared file into a tile\'s session, without',
+        '    --to <tileId>        uploading it again. This is the retry path when a share',
+        '                         uploaded fine but the delivery failed.',
         '  status                 Print local login/attach state.',
         '  version                Print the installed yolo-bridge version (also --version, -v).',
         '  --help                 Print this help.',
@@ -349,6 +353,18 @@ async function cmdAttach(args) {
                         // guess which studio_list_tiles row is itself — and a backwards
                         // guess sends the prompt into its OWN input.
                         callerTileId: tileId,
+                        // Tools the proxy serves ITSELF (local-mcp-tools.ts). A cloud tool
+                        // cannot read this machine's disk, so sharing a local file is the
+                        // one thing that has to be answered here.
+                        //
+                        // `implicitRoots` is the directory the daemon was launched in — the
+                        // project the agent is already working in and can read anyway.
+                        // Anything outside needs `yolo-bridge allow`.
+                        localTools: {
+                            workspaceId,
+                            implicitRoots: [process.cwd()],
+                            commonApiBaseUrl: apiUrl(),
+                        },
                         log: (line) => process.stdout.write(`${line}\n`),
                     });
                     // Command-line MCP configuration, never a file in the project
@@ -554,6 +570,22 @@ function cmdStatus() {
     process.stdout.write(`${formatStatus(getStatus())}\n`);
     return 0;
 }
+async function cmdDeliver(args) {
+    const assetId = args.find((a) => !a.startsWith('-') && a !== args[args.indexOf('--to') + 1]);
+    const toIdx = args.indexOf('--to');
+    const targetTileId = toIdx >= 0 ? args[toIdx + 1] : undefined;
+    if (!assetId || !targetTileId) {
+        process.stderr.write('yolo-bridge deliver: usage — yolo-bridge deliver <assetId> --to <tileId>\n');
+        return 64;
+    }
+    const result = await runDeliver(assetId, targetTileId, { commonApiBaseUrl: apiUrl() });
+    if (!result.ok) {
+        process.stderr.write(`yolo-bridge deliver: ${result.message}\n`);
+        return 1;
+    }
+    process.stdout.write(`${result.path}\n`);
+    return 0;
+}
 function cmdAllow(args) {
     const result = runAllow(args);
     if (!result.ok) {
@@ -569,13 +601,22 @@ async function cmdShare(args) {
         process.stderr.write('yolo-bridge share: a file path is required.\n\n  yolo-bridge share ./cut.mp4\n');
         return 64;
     }
-    const result = await runShare(rawPath, { commonApiBaseUrl: apiUrl() });
+    // `--to <tileId>` also writes the file into that tile's session pod.
+    const toIdx = args.indexOf('--to');
+    const targetTileId = toIdx >= 0 ? args[toIdx + 1] : undefined;
+    if (toIdx >= 0 && (!targetTileId || targetTileId.startsWith('-'))) {
+        process.stderr.write('yolo-bridge share: `--to` needs a tile id.\n');
+        return 64;
+    }
+    const result = await runShare(rawPath, { commonApiBaseUrl: apiUrl(), targetTileId });
     if (!result.ok) {
         // Every one of these is an operator-actionable condition, not a bug, so it
         // prints as a sentence with no stack trace.
         process.stderr.write(`yolo-bridge share: ${result.message}\n`);
         return 1;
     }
+    if (result.deliveredPath)
+        process.stdout.write(`${result.deliveredPath}\n`);
     return 0;
 }
 async function cmdWorkspaces() {
@@ -634,6 +675,8 @@ async function main() {
             return cmdDetach();
         case 'allow':
             return cmdAllow(rest);
+        case 'deliver':
+            return cmdDeliver(rest);
         case 'share':
             return cmdShare(rest);
         case 'status':

package/dist/local-mcp-tools.js

@@ -0,0 +1,314 @@
+/**
+ * Tools the daemon serves ITSELF, instead of forwarding to the cloud MCP.
+ *
+ * WHY ANY TOOL IS LOCAL. `mcp-proxy.ts` forwards the attached agent's MCP
+ * traffic to the cloud `yolo-studio-mcp`, and the agent already has full
+ * workspace-wide scope there. But a cloud tool executes in the cloud and cannot
+ * read the operator's disk. Sharing a local file is therefore the one thing the
+ * proxy has to answer on its own.
+ *
+ * TWO PROPERTIES THIS FILE EXISTS TO KEEP:
+ *
+ *   1. A local call is NEVER FORWARDED, so the operator's file never becomes a
+ *      cloud request, and no delegated cloud token is minted for it. The
+ *      interception in `mcp-proxy.ts` runs BEFORE `getToken()` for exactly this
+ *      reason — see the call site.
+ *   2. The upload opens the RESOLVED path the approval check returned, never
+ *      the string the agent passed. Checking one path and opening another is
+ *      how symlink containment gets defeated: an in-tree link can be repointed
+ *      between the two.
+ *
+ * ⚠️ THE APPROVAL LIST IS NOT A SECURITY BOUNDARY. The agent runs as the same
+ * OS user with shell access, so it can widen the list itself, and it could
+ * already `curl -T` a file out without us. What this buys is that ACCIDENTS are
+ * prevented, the credentialed path stays deliberate, and grants are auditable.
+ * Do not write a message here claiming more than that.
+ */
+import { checkPathApproved } from './approved-paths.js';
+import { runShare, runDeliver, describeShareFailure } from './share-cmd.js';
+/** Namespaced so it can never collide with a forwarded cloud tool name. */
+export const SHARE_FILE_TOOL = 'yolobridge_share_file';
+export const LOCAL_TOOL_DEFINITIONS = [
+    {
+        name: SHARE_FILE_TOOL,
+        description: 'Send a file from the LOCAL machine this agent is running on up to the cloud workspace, '
+            + 'so a cloud agent can see it. Push only — this cannot read paths the operator has not '
+            + 'approved, and nothing in the cloud can pull files from this machine.',
+        inputSchema: {
+            type: 'object',
+            properties: {
+                path: {
+                    type: 'string',
+                    description: 'Path to the local file to send. Must be inside an approved directory.',
+                },
+                assetId: {
+                    type: 'string',
+                    description: 'Optional. Deliver an ALREADY-shared asset instead of uploading again — use this to '
+                        + 'retry a delivery that failed after a successful upload. Requires targetTileId; '
+                        + '`path` is ignored when this is given.',
+                },
+                targetTileId: {
+                    type: 'string',
+                    description: 'Optional. A tile in this workspace to ALSO write the file into, so the agent running '
+                        + 'there can open it directly. Use studio_list_tiles to find the id. Omit to leave the '
+                        + 'file in the workspace only.',
+                },
+            },
+            // TWO CALL SHAPES, so `path` cannot be unconditionally required:
+            //   { path }                  — share a local file
+            //   { assetId, targetTileId } — deliver one already shared, no re-upload
+            // A schema-aware client validates before dispatching, so requiring `path`
+            // outright made the retry form unreachable no matter what the handler
+            // accepted. (codex P1, gpt-5.6-sol — the unit tests call the handler
+            // directly and never saw it.)
+            anyOf: [
+                { required: ['path'] },
+                { required: ['assetId', 'targetTileId'] },
+            ],
+            additionalProperties: false,
+        },
+    },
+];
+function toolResult(id, text, isError = false) {
+    return {
+        jsonrpc: '2.0',
+        id,
+        result: { content: [{ type: 'text', text }], ...(isError ? { isError: true } : {}) },
+    };
+}
+/** Is this parsed JSON-RPC message a call to one of our local tools? */
+export function isLocalToolCall(msg) {
+    const m = msg;
+    if (!m || m.method !== 'tools/call')
+        return false;
+    return typeof m.params?.name === 'string'
+        && LOCAL_TOOL_DEFINITIONS.some((t) => t.name === m.params.name);
+}
+/**
+ * Run one local tool call and produce its JSON-RPC response.
+ *
+ * Errors come back as a tool result with `isError`, not a JSON-RPC error: a
+ * refused path is a normal answer the agent should read and act on, not a
+ * protocol fault.
+ */
+export async function runLocalToolCall(msg, ctx) {
+    // A message with NO `id` is a notification: JSON-RPC says do the work and
+    // send nothing back. `msg.id ?? null` would have turned that into a normal
+    // reply carrying `id: null` — a spurious entry in a batch, and a body where a
+    // notification-only request expects none. An EXPLICIT null id is a different
+    // thing and still gets answered. (codex P2, gpt-5.6-sol.)
+    const isNotification = !('id' in msg);
+    const id = msg.id ?? null;
+    const name = msg.params?.name;
+    const args = msg.params?.arguments ?? {};
+    if (name !== SHARE_FILE_TOOL) {
+        return isNotification ? undefined : toolResult(id, `Unknown local tool: ${String(name)}`, true);
+    }
+    const targetTileId = typeof args.targetTileId === 'string' && args.targetTileId ? args.targetTileId : undefined;
+    const retryAssetId = typeof args.assetId === 'string' && args.assetId ? args.assetId : undefined;
+    // Delivery-only retry: the bytes are already in the workspace, so there is no
+    // path to approve and nothing to read from disk.
+    if (retryAssetId) {
+        if (!targetTileId) {
+            return isNotification ? undefined : toolResult(id, '`targetTileId` is required when retrying delivery of an assetId.', true);
+        }
+        const redeliver = await (ctx.deliverImpl ?? runDeliver)(retryAssetId, targetTileId, {
+            commonApiBaseUrl: ctx.commonApiBaseUrl,
+            expectedWorkspaceId: ctx.workspaceId,
+        });
+        if (isNotification)
+            return undefined;
+        return redeliver.ok
+            ? toolResult(id, `Delivered asset ${retryAssetId} to tile ${targetTileId} at ${redeliver.path}.`)
+            : toolResult(id, redeliver.message, true);
+    }
+    const rawPath = typeof args.path === 'string' ? args.path : '';
+    if (!rawPath)
+        return isNotification ? undefined : toolResult(id, 'A `path` is required.', true);
+    const check = (ctx.checkImpl ?? checkPathApproved)(rawPath, ctx.workspaceId, ctx.implicitRoots);
+    if (!check.approved || !check.resolvedPath) {
+        return isNotification ? undefined : toolResult(id, check.reason ?? `${rawPath} is not an approved path.`, true);
+    }
+    try {
+        // Property 2: open what the check RESOLVED, not what the caller passed.
+        const result = await (ctx.shareImpl ?? runShare)(check.resolvedPath, {
+            commonApiBaseUrl: ctx.commonApiBaseUrl,
+            targetTileId,
+            // The approval was checked against THIS workspace. The attachment on disk
+            // can have been replaced by a second `attach` since the proxy started, so
+            // bind the upload to the same workspace or refuse. (codex P2.)
+            expectedWorkspaceId: ctx.workspaceId,
+            write: () => { },
+        });
+        if (isNotification)
+            return undefined;
+        if (!result.ok)
+            return toolResult(id, result.message, true);
+        // When it was delivered, the PATH is the useful half — it is what the
+        // target agent needs to be told in order to open the file.
+        return toolResult(id, result.deliveredPath
+            ? `Shared as asset ${result.assetId} and written into tile ${targetTileId} at ${result.deliveredPath}. `
+                + 'Tell that tile\'s agent to open that path.'
+            : `Shared as asset ${result.assetId}. It is now visible in the cloud workspace.`);
+    }
+    catch (err) {
+        return isNotification ? undefined : toolResult(id, describeShareFailure(err), true);
+    }
+}
+/**
+ * Split an incoming body into "answered here" and "still needs the cloud".
+ *
+ * Handles the batch form because `injectToken` already has to, and a batch that
+ * mixes a local tool with cloud tools must not lose either half.
+ *
+ * Returns `undefined` when nothing is local — the overwhelmingly common case,
+ * so the normal path pays one `JSON.parse` and nothing else.
+ */
+export async function interceptLocalTools(rawBody, ctx) {
+    let parsed;
+    try {
+        parsed = JSON.parse(rawBody);
+    }
+    catch {
+        return undefined;
+    }
+    if (!Array.isArray(parsed)) {
+        if (!isLocalToolCall(parsed))
+            return undefined;
+        const response = await runLocalToolCall(parsed, ctx);
+        // A notification produced no response; there is still nothing to forward.
+        return response
+            ? { localResponse: JSON.stringify(response), localIds: [parsed.id ?? null] }
+            : { localIds: [] };
+    }
+    const localIdx = parsed.map((m, i) => (isLocalToolCall(m) ? i : -1)).filter((i) => i >= 0);
+    if (!localIdx.length)
+        return undefined;
+    const responses = [];
+    for (const i of localIdx) {
+        const r = await runLocalToolCall(parsed[i], ctx);
+        if (r)
+            responses.push(r);
+    }
+    const remainder = parsed.filter((_, i) => !localIdx.includes(i));
+    return {
+        localResponse: responses.length ? JSON.stringify(responses) : undefined,
+        forwardBody: remainder.length ? JSON.stringify(remainder) : undefined,
+        localIds: localIdx.map((i) => parsed[i]?.id ?? null),
+    };
+}
+/**
+ * Does this request contain a `tools/list`, whose reply we must rewrite to
+ * advertise the locally-served tools?
+ */
+export function requestWantsToolsList(rawBody) {
+    try {
+        const parsed = JSON.parse(rawBody);
+        const messages = Array.isArray(parsed) ? parsed : [parsed];
+        return messages.some((m) => m?.method === 'tools/list');
+    }
+    catch {
+        return false;
+    }
+}
+const SSE_DATA = /^data:\s?(.*)$/;
+export function parseRpcEnvelope(text) {
+    const trimmed = text.trimStart();
+    // Plain JSON — the common case.
+    if (trimmed.startsWith('{') || trimmed.startsWith('[')) {
+        try {
+            const parsed = JSON.parse(text);
+            const wasArray = Array.isArray(parsed);
+            return {
+                messages: wasArray ? parsed : [parsed],
+                rebuild: (m) => JSON.stringify(wasArray ? m : (m[0] ?? null)),
+            };
+        }
+        catch {
+            return undefined;
+        }
+    }
+    // SSE framing: one or more `data:` lines, blank-line separated.
+    if (!/(^|\n)data:/.test(text))
+        return undefined;
+    const lines = text.split(/\r?\n/);
+    const dataIdx = [];
+    const messages = [];
+    lines.forEach((line, i) => {
+        const m = SSE_DATA.exec(line);
+        if (!m)
+            return;
+        try {
+            messages.push(JSON.parse(m[1]));
+            dataIdx.push(i);
+        }
+        catch {
+            /* a non-JSON data line (a keepalive, say) is left exactly as it is */
+        }
+    });
+    if (!messages.length)
+        return undefined;
+    return {
+        messages,
+        rebuild: (next) => {
+            const out = [...lines];
+            // Rewrite the frames we parsed, in order...
+            next.slice(0, dataIdx.length).forEach((msg, i) => {
+                out[dataIdx[i]] = `data: ${JSON.stringify(msg)}`;
+            });
+            // ...and append any EXTRA messages as their own frames, so a merged-in
+            // local result reaches a client that negotiated a stream.
+            const extra = next.slice(dataIdx.length);
+            const tail = extra.map((msg) => `event: message\ndata: ${JSON.stringify(msg)}\n`);
+            return tail.length ? `${out.join('\n').replace(/\n*$/, '\n\n')}${tail.join('\n')}\n` : out.join('\n');
+        },
+    };
+}
+/**
+ * Add our tools to an upstream `tools/list` reply, so the agent can discover
+ * them alongside the cloud ones.
+ *
+ * Returns the text unchanged on anything unexpected — a malformed or
+ * error-shaped upstream reply must pass through untouched rather than be
+ * rewritten into something that only looks well-formed.
+ */
+export function augmentToolsList(requestBody, responseText) {
+    let request;
+    try {
+        request = JSON.parse(requestBody);
+    }
+    catch {
+        return responseText;
+    }
+    const requests = Array.isArray(request) ? request : [request];
+    const listIds = new Set(requests
+        .filter((m) => m?.method === 'tools/list')
+        .map((m) => m?.id)
+        .filter((id) => id !== undefined));
+    if (!listIds.size)
+        return responseText;
+    const envelope = parseRpcEnvelope(responseText);
+    if (!envelope)
+        return responseText;
+    let changed = false;
+    for (const m of envelope.messages) {
+        if (!listIds.has(m?.id))
+            continue;
+        if (!Array.isArray(m?.result?.tools))
+            continue;
+        // Paginated discovery: a client that follows `nextCursor` aggregates every
+        // page, so appending on each one yields duplicate tool names and an
+        // ambiguous or rejected registration. Add them to the FINAL page only, so
+        // they appear exactly once across the sequence. (codex P2.)
+        if (m.result.nextCursor !== undefined && m.result.nextCursor !== null)
+            continue;
+        const present = new Set(m.result.tools.map((t) => t?.name));
+        for (const def of LOCAL_TOOL_DEFINITIONS) {
+            if (!present.has(def.name)) {
+                m.result.tools.push({ ...def });
+                changed = true;
+            }
+        }
+    }
+    return changed ? envelope.rebuild(envelope.messages) : responseText;
+}

package/dist/mcp-proxy.js

@@ -69,6 +69,7 @@
  * proxy serves have disjoint capabilities — see `providedSecrets` below.
  */
 import * as http from 'node:http';
+import { interceptLocalTools, augmentToolsList, parseRpcEnvelope } from './local-mcp-tools.js';
 import { randomBytes, timingSafeEqual } from 'node:crypto';
 const DEFAULT_MCP_URL = 'https://services.yolo.studio';
 export function mcpUrl() {
@@ -275,7 +276,7 @@ export async function startMcpProxy(opts) {
             res.end(JSON.stringify({ error: 'missing or invalid proxy credential' }));
             return;
         }
-        handleRequest(req, res, upstream, tokenCache.getToken, tokenCache.forceRefresh, fetchImpl, tracker, log).catch((err) => {
+        handleRequest(req, res, upstream, tokenCache.getToken, tokenCache.forceRefresh, fetchImpl, tracker, log, opts.localTools).catch((err) => {
             log(`yolo-bridge: local MCP proxy error: ${err instanceof Error ? err.message : String(err)}`);
             if (!res.headersSent) {
                 res.writeHead(502, { 'Content-Type': 'application/json' });
@@ -495,6 +496,39 @@ function mergeRetryResponses(originalResponseText, retryResponseText, retriedIds
         return originalResponseText;
     }
 }
+/**
+ * Answer a mixed batch whose CLOUD half could not be sent, without discarding
+ * the local half that already ran.
+ *
+ * The local calls have side effects — a file is uploaded by the time we get
+ * here — so silently 503ing the whole batch would hide a completed upload and
+ * invite the client to repeat it. Each un-forwardable id gets an explicit
+ * JSON-RPC error instead. (codex P2, gpt-5.6-sol.)
+ */
+export function mergeLocalWithRemoteFailure(localResponseText, forwardBody, message) {
+    const local = (() => {
+        try {
+            const parsed = JSON.parse(localResponseText);
+            return Array.isArray(parsed) ? parsed : [parsed];
+        }
+        catch {
+            return [];
+        }
+    })();
+    const failures = [];
+    try {
+        const pending = JSON.parse(forwardBody ?? '[]');
+        for (const m of (Array.isArray(pending) ? pending : [pending])) {
+            if (m?.id === undefined)
+                continue;
+            failures.push({ jsonrpc: '2.0', id: m.id, error: { code: -32000, message } });
+        }
+    }
+    catch {
+        /* nothing forwardable to describe */
+    }
+    return JSON.stringify([...local, ...failures]);
+}
 async function forwardOnce(upstream, method, headers, body, fetchImpl, tracker) {
     return tracker.run(async (signal) => {
         const res = await fetchImpl(`${upstream}/mcp`, { method, headers, body, signal });
@@ -568,23 +602,72 @@ function hasValidSecret(req, secret) {
     }
     return valid;
 }
-async function handleRequest(req, res, upstream, getToken, forceRefresh, fetchImpl, tracker, log) {
+async function handleRequest(req, res, upstream, getToken, forceRefresh, fetchImpl, tracker, log, localTools) {
     const method = req.method ?? 'POST';
     const body = method === 'POST' || method === 'DELETE' ? await readBody(req) : undefined;
+    // ── Locally-served tools ──────────────────────────────────────────────────
+    // BEFORE `getToken()` deliberately: a local call must never mint a delegated
+    // CLOUD credential, and must never leave this machine. A body that contains
+    // no local tool call falls straight through, paying one JSON.parse.
+    let forwardedAfterLocal = body;
+    let localResponseText;
+    if (localTools && method === 'POST' && body) {
+        const intercepted = await interceptLocalTools(body, localTools);
+        if (intercepted) {
+            if (!intercepted.forwardBody) {
+                if (!intercepted.localResponse) {
+                    // Every local message was a NOTIFICATION, which must not be answered.
+                    // 202 with an empty body is what the MCP Streamable HTTP transport
+                    // returns for a notification-only POST. (codex P2.)
+                    res.writeHead(202);
+                    res.end();
+                    return;
+                }
+                // Nothing left for the cloud — answer entirely from here.
+                res.writeHead(200, { 'Content-Type': 'application/json' });
+                res.end(intercepted.localResponse);
+                return;
+            }
+            // A batch that mixed local and cloud tools: forward only the remainder,
+            // and merge our answers back in below so neither half is lost.
+            forwardedAfterLocal = intercepted.forwardBody;
+            localResponseText = intercepted.localResponse;
+        }
+    }
     const headers = { Accept: 'application/json, text/event-stream' };
     const incomingContentType = req.headers['content-type'];
     if (typeof incomingContentType === 'string')
         headers['Content-Type'] = incomingContentType;
     else if (body)
         headers['Content-Type'] = 'application/json';
-    let forwardedBody = body;
-    if (method === 'POST' && body) {
+    // ⚠️ DO NOT narrow the Accept header to make the rewrites below easier.
+    //
+    // An earlier attempt asked for `application/json` only on requests whose
+    // response gets rewritten, to dodge SSE framing. That would have broken tool
+    // discovery outright: the MCP SDK's
+    // `WebStandardStreamableHTTPServerTransport.handlePostRequest` returns 406
+    // unless the client accepts BOTH `application/json` and `text/event-stream`
+    // (verified in the installed SDK 1.29.0, not assumed — codex P1,
+    // gpt-5.6-sol). The rewrites handle both shapes instead; see
+    // `parseRpcEnvelope`.
+    let forwardedBody = forwardedAfterLocal;
+    if (method === 'POST' && forwardedAfterLocal) {
         try {
             const token = await getToken();
-            forwardedBody = injectToken(body, token);
+            forwardedBody = injectToken(forwardedAfterLocal, token);
         }
         catch (err) {
             log(`yolo-bridge: MCP token unavailable: ${err instanceof Error ? err.message : String(err)}`);
+            // The local half of a mixed batch has ALREADY RUN by this point — the
+            // file is uploaded. Dropping its reply would leave the client never
+            // learning the assetId and retrying the batch, uploading the same file
+            // again. So answer with what actually happened: local results, plus an
+            // explicit error for each id we could not forward. (codex P2.)
+            if (localResponseText) {
+                res.writeHead(200, { 'Content-Type': 'application/json' });
+                res.end(mergeLocalWithRemoteFailure(localResponseText, forwardedAfterLocal, 'MCP token unavailable'));
+                return;
+            }
             res.writeHead(503, { 'Content-Type': 'application/json' });
             res.end(JSON.stringify({ error: 'MCP token unavailable', code: 'MCP_TOKEN_UNAVAILABLE', retryable: true }));
             return;
@@ -597,7 +680,12 @@ async function handleRequest(req, res, upstream, getToken, forceRefresh, fetchIm
     // isUnauthorizedToolResult's doc comment) — a real 401 from this upstream
     // has never actually been observed; the in-band case is the one that
     // matters in practice.
-    if (method === 'POST' && body && (result.status === 401 || isUnauthorizedToolResult(result.text))) {
+    // ⚠️ Every path below uses `forwardedAfterLocal`, NEVER `body`. The original
+    // still contains any locally-intercepted call, and re-forwarding it on a
+    // retry would send the operator's local file path to the cloud — breaking the
+    // local-only invariant on the one path that skips the interception. (codex
+    // P1, gpt-5.6-sol.)
+    if (method === 'POST' && forwardedAfterLocal && (result.status === 401 || isUnauthorizedToolResult(result.text))) {
         log(`yolo-bridge: MCP upstream reported an invalid/expired token (status ${result.status}), force-refreshing`);
         try {
             const refreshed = await forceRefresh();
@@ -607,7 +695,7 @@ async function handleRequest(req, res, upstream, getToken, forceRefresh, fetchIm
             // 200-with-mixed-results batch (Codex review, 2026-08-24, round 20)
             // needs the narrower partial-batch retry below -- see
             // `buildUnauthorizedRetryBatch`'s doc comment.
-            const retryBatch = result.status === 401 ? null : buildUnauthorizedRetryBatch(body, result.text);
+            const retryBatch = result.status === 401 ? null : buildUnauthorizedRetryBatch(forwardedAfterLocal, result.text);
             if (retryBatch) {
                 const reinjected = injectToken(retryBatch.requestSubset, refreshed);
                 const retryResult = await forwardOnce(upstream, method, headers, reinjected, fetchImpl, tracker);
@@ -631,7 +719,7 @@ async function handleRequest(req, res, upstream, getToken, forceRefresh, fetchIm
                     : { ...result, text: mergedText };
             }
             else {
-                const reinjected = injectToken(body, refreshed);
+                const reinjected = injectToken(forwardedAfterLocal, refreshed);
                 result = await forwardOnce(upstream, method, headers, reinjected, fetchImpl, tracker);
             }
         }
@@ -639,10 +727,56 @@ async function handleRequest(req, res, upstream, getToken, forceRefresh, fetchIm
             log(`yolo-bridge: MCP token refresh failed: ${err instanceof Error ? err.message : String(err)}`);
         }
     }
+    let outText = result.text;
+    // A `tools/list` reply from the cloud does not know about the tools this
+    // daemon serves itself, so add them — otherwise the agent can only call them
+    // by guessing they exist.
+    if (localTools && method === 'POST' && forwardedAfterLocal) {
+        outText = augmentToolsList(forwardedAfterLocal, outText);
+    }
+    // Re-join the halves of a mixed batch. Order does not matter to a JSON-RPC
+    // client (ids correlate the replies), but LOSING one half would.
+    //
+    // ⚠️ STATUS MATTERS AS MUCH AS BODY. The local half already uploaded a file.
+    // If we propagate a non-2xx from the cloud half, a client may reject the whole
+    // HTTP response without reading it and retry the batch — uploading the same
+    // file twice. So once a local result exists, this answers 200 and reports the
+    // cloud failure per-id inside the body. (codex P1, gpt-5.6-sol.)
+    let outStatus = result.status;
+    if (localResponseText) {
+        let merged;
+        if (result.status >= 200 && result.status < 300) {
+            // The upstream half may be plain JSON or an SSE stream — it chooses. The
+            // envelope puts our local results back in whichever shape the client is
+            // already reading, instead of discarding the cloud half on a failed
+            // JSON.parse (codex P2).
+            const envelope = parseRpcEnvelope(outText);
+            if (envelope) {
+                try {
+                    const local = JSON.parse(localResponseText);
+                    merged = envelope.rebuild([
+                        ...envelope.messages,
+                        ...(Array.isArray(local) ? local : [local]),
+                    ]);
+                }
+                catch {
+                    merged = undefined;
+                }
+            }
+        }
+        outText = merged
+            ?? mergeLocalWithRemoteFailure(localResponseText, forwardedAfterLocal, `upstream MCP request failed (status ${result.status})`);
+        outStatus = 200;
+    }
     const outHeaders = {};
     const contentType = result.headers.get('content-type');
     if (contentType)
         outHeaders['Content-Type'] = contentType;
-    res.writeHead(result.status, outHeaders);
-    res.end(result.text);
+    // Only force JSON when we could NOT preserve the upstream's shape (the
+    // failure-merge path emits a plain array). A successful merge keeps whatever
+    // framing the upstream chose, so the header must keep matching it.
+    if (localResponseText && !outText.includes('data:'))
+        outHeaders['Content-Type'] = 'application/json';
+    res.writeHead(outStatus, outHeaders);
+    res.end(outText);
 }

package/dist/share-cmd.js

@@ -15,7 +15,7 @@
 import { createReadStream } from 'node:fs';
 import { stat } from 'node:fs/promises';
 import path from 'node:path';
-import { presignShare, finalizeShare, YoloBridgeApiError, } from './api-client.js';
+import { presignShare, finalizeShare, deliverShare, YoloBridgeApiError, } from './api-client.js';
 import { loadAuth, loadAttachment } from './config-store.js';
 /**
  * Mirrors common-api's `MAX_ASSET_BYTES`. The server is authoritative and
@@ -147,7 +147,22 @@ export async function shareFile(rawPath, deps) {
     }
     const finalized = await finalizeShare(cfg, deps.workspaceId, deps.attachmentId, presigned.assetId);
     write(`Shared ${file.filename} → ${finalized.assetId}`);
-    return finalized;
+    if (!deps.targetTileId)
+        return finalized;
+    // The upload has ALREADY SUCCEEDED. If delivery fails the file is genuinely
+    // in the workspace, so say that rather than reporting a flat failure and
+    // inviting a re-upload of something already there.
+    try {
+        const delivered = await deliverShare(cfg, deps.workspaceId, deps.attachmentId, finalized.assetId, deps.targetTileId);
+        write(`Delivered to ${deps.targetTileId} at ${delivered.path}`);
+        return { ...finalized, deliveredPath: delivered.path };
+    }
+    catch (err) {
+        const why = err instanceof YoloBridgeApiError ? err.message : err?.message || 'unknown error';
+        throw new ShareError(`${file.filename} was uploaded (asset ${finalized.assetId}) but could not be delivered to `
+            + `${deps.targetTileId}: ${why}. The file IS in the workspace — retry the DELIVERY only, with `
+            + `\`yolo-bridge deliver ${finalized.assetId} --to ${deps.targetTileId}\`, rather than sharing it again.`);
+    }
 }
 /** Turn an API error into something the operator can act on. */
 export function describeShareFailure(err) {
@@ -174,6 +189,44 @@ export function describeShareFailure(err) {
  * the config store rather than from daemon memory — the same credential the
  * running daemon uses, and the only one the upload routes accept (Boundary B).
  */
+/**
+ * The preconditions every daemon-credentialed command shares: logged in,
+ * attached, attached to the EXPECTED workspace, and holding a scoped token.
+ *
+ * Factored out so `runShare` and `runDeliver` cannot drift apart on which
+ * checks they perform or what they say when one fails.
+ */
+function resolveShareIdentity(deps) {
+    if (!loadAuth(deps.env, deps.io)) {
+        return { ok: false, reason: 'not-logged-in', message: 'Not logged in — run `yolo-bridge login` first.' };
+    }
+    const attachment = loadAttachment(deps.env, deps.io);
+    if (!attachment) {
+        return { ok: false, reason: 'not-attached', message: 'No active attachment — run `yolo-bridge attach` first.' };
+    }
+    if (deps.expectedWorkspaceId && attachment.workspaceId !== deps.expectedWorkspaceId) {
+        return {
+            ok: false,
+            reason: 'workspace-changed',
+            message: 'This machine is now attached to a different workspace than the one this request was '
+                + 'authorised against. Nothing was sent. Re-run `yolo-bridge attach` or retry.',
+        };
+    }
+    if (!attachment.scopedToken) {
+        return {
+            ok: false,
+            reason: 'no-scoped-credential',
+            message: 'No workspace-scoped credential is stored for this attachment, so files cannot be shared '
+                + 'from this machine. Run `yolo-bridge attach` to reconnect.',
+        };
+    }
+    return {
+        ok: true,
+        cfg: { commonApiBaseUrl: deps.commonApiBaseUrl, accessToken: attachment.scopedToken, fetchImpl: deps.fetchImpl },
+        workspaceId: attachment.workspaceId,
+        attachmentId: attachment.attachmentId,
+    };
+}
 export async function runShare(rawPath, deps) {
     // Same precondition ordering as detach: `auth.json` is what makes this a
     // set-up machine, and its absence has a far better remedy to offer than a
@@ -185,6 +238,14 @@ export async function runShare(rawPath, deps) {
     if (!attachment) {
         return { ok: false, reason: 'not-attached', message: 'No active attachment — run `yolo-bridge attach` first.' };
     }
+    if (deps.expectedWorkspaceId && attachment.workspaceId !== deps.expectedWorkspaceId) {
+        return {
+            ok: false,
+            reason: 'workspace-changed',
+            message: 'This machine is now attached to a different workspace than the one this request was '
+                + 'authorised against. Nothing was sent. Re-run `yolo-bridge attach` or retry.',
+        };
+    }
     const scopedToken = attachment.scopedToken;
     if (!scopedToken) {
         // Nothing on this machine can mint one for an existing attachment, so say
@@ -202,14 +263,37 @@ export async function runShare(rawPath, deps) {
         fetchImpl: deps.fetchImpl,
     };
     try {
-        const { assetId } = await shareFile(rawPath, {
+        const { assetId, deliveredPath } = await shareFile(rawPath, {
             cfg,
             workspaceId: attachment.workspaceId,
             attachmentId: attachment.attachmentId,
+            targetTileId: deps.targetTileId,
             fetchImpl: deps.fetchImpl,
             write: deps.write,
         });
-        return { ok: true, assetId };
+        return { ok: true, assetId, ...(deliveredPath ? { deliveredPath } : {}) };
+    }
+    catch (err) {
+        return { ok: false, reason: 'error', message: describeShareFailure(err) };
+    }
+}
+/**
+ * Deliver an ALREADY-SHARED asset into a tile's session, without re-uploading.
+ *
+ * WHY THIS EXISTS: `shareFile` tells the operator, after a delivery failure,
+ * that the file IS in the workspace and to retry the delivery rather than the
+ * upload. That instruction was false until this existed — every entry point
+ * began with a fresh presign, so the only available "retry" duplicated the
+ * asset. (codex P2, gpt-5.6-sol.) An error message must name a recovery the
+ * caller can actually perform.
+ */
+export async function runDeliver(assetId, targetTileId, deps) {
+    const preflight = await resolveShareIdentity(deps);
+    if (!preflight.ok)
+        return preflight;
+    try {
+        const delivered = await deliverShare(preflight.cfg, preflight.workspaceId, preflight.attachmentId, assetId, targetTileId);
+        return { ok: true, path: delivered.path };
     }
     catch (err) {
         return { ok: false, reason: 'error', message: describeShareFailure(err) };

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "@yolo-labs/yolobridge",
-  "version": "0.19.0",
+  "version": "0.21.0",
   "description": "YoloBridge — local coding-agent daemon that attaches a user's own Claude Code/Codex session to a YOLO Studio workspace as a first-class tile (docs/YOLOBRIDGE_PLAN.md, build-order Phase 5).",
   "license": "MIT",
   "type": "module",