@zeph-to/mcp-server 1.15.2 → 1.16.0

package/README.md

@@ -138,15 +138,21 @@ priority:  "normal"
 
 ### zeph_file
 
-Send a text file to the user's device.
+Send a file to the user's device. Either `filePath` (a file already on disk) or
+`content` (text you generated) is required.
 
 ```
-fileName:       "report.json"
-content:        "{\"status\": \"ok\"}"
-title:          "Build Report"  (optional, defaults to fileName)
-targetDeviceId: "dev_..."       (optional)
+filePath:       "/abs/path/screenshot.png"  (images, PDFs, logs — anything on disk)
+content:        "{\"status\": \"ok\"}"       (text only; requires fileName)
+fileName:       "report.json"               (required with content; defaults to basename of filePath)
+title:          "Build Report"              (optional, defaults to fileName)
+targetDeviceId: "dev_..."                   (optional)
 ```
 
+Images are delivered with their real mime type and render inline on the device.
+Never base64 a binary file into `content` — pass `filePath` and the server reads
+the bytes off disk.
+
 Returns: `{ pushId: "...", fileKey: "...", fileSize: 42 }`
 
 ### zeph_session_rename

package/dist/crypto.d.ts

@@ -80,7 +80,7 @@ export declare const encryptPushBodyForSelf: (input: {
 /**
  * Encrypt file content for self (all own devices).
  */
-export declare const encryptFileForSelf: (content: string) => Promise<{
+export declare const encryptFileForSelf: (content: string | Buffer) => Promise<{
     ciphertext: Buffer;
     iv: string;
     encryptedKey: string;

package/dist/crypto.d.ts.map

@@ -1 +1 @@
-{"version":3,"file":"crypto.d.ts","sourceRoot":"","sources":["../src/crypto.ts"],"names":[],"mappings":"AAAA;;;;;;;;;;;;;;;;;;;;;;;;;;;;GA4BG;AA0JH;;;;;;;;;;;;;;;;;;;;;;;GAuBG;AACH,eAAO,MAAM,UAAU,GAAI,SAAS,MAAM,EAAE,UAAU,MAAM,KAAG,OAAO,CAAC,MAAM,CAsE5E,CAAC;AAmCF,eAAO,MAAM,UAAU,QAAO,aAAa,GAAG,IAAqB,CAAC;AACpE,eAAO,MAAM,YAAY,QAAO,MAAM,GAAG,IAA+B,CAAC;AAEzE;;;;;;;;GAQG;AACH,eAAO,MAAM,aAAa,QAAO,IAIhC,CAAC;AAEF;;GAEG;AACH,eAAO,MAAM,sBAAsB,GACjC,OAAO;IAAE,KAAK,CAAC,EAAE,MAAM,CAAC;IAAC,IAAI,CAAC,EAAE,MAAM,CAAC;IAAC,GAAG,CAAC,EAAE,MAAM,CAAA;CAAE,KACrD,OAAO,CAAC;IACT,IAAI,EAAE,MAAM,CAAC;IACb,YAAY,EAAE,MAAM,CAAC;IACrB,eAAe,EAAE,MAAM,CAAC;IACxB,WAAW,EAAE,IAAI,CAAC;CACnB,CAaA,CAAC;AAEF;;GAEG;AACH,eAAO,MAAM,kBAAkB,GAC7B,SAAS,MAAM,KACd,OAAO,CAAC;IAAE,UAAU,EAAE,MAAM,CAAC;IAAC,EAAE,EAAE,MAAM,CAAC;IAAC,YAAY,EAAE,MAAM,CAAA;CAAE,CAQlE,CAAC"}
+{"version":3,"file":"crypto.d.ts","sourceRoot":"","sources":["../src/crypto.ts"],"names":[],"mappings":"AAAA;;;;;;;;;;;;;;;;;;;;;;;;;;;;GA4BG;AAiKH;;;;;;;;;;;;;;;;;;;;;;;GAuBG;AACH,eAAO,MAAM,UAAU,GAAI,SAAS,MAAM,EAAE,UAAU,MAAM,KAAG,OAAO,CAAC,MAAM,CAsE5E,CAAC;AAmCF,eAAO,MAAM,UAAU,QAAO,aAAa,GAAG,IAAqB,CAAC;AACpE,eAAO,MAAM,YAAY,QAAO,MAAM,GAAG,IAA+B,CAAC;AAEzE;;;;;;;;GAQG;AACH,eAAO,MAAM,aAAa,QAAO,IAIhC,CAAC;AAEF;;GAEG;AACH,eAAO,MAAM,sBAAsB,GACjC,OAAO;IAAE,KAAK,CAAC,EAAE,MAAM,CAAC;IAAC,IAAI,CAAC,EAAE,MAAM,CAAC;IAAC,GAAG,CAAC,EAAE,MAAM,CAAA;CAAE,KACrD,OAAO,CAAC;IACT,IAAI,EAAE,MAAM,CAAC;IACb,YAAY,EAAE,MAAM,CAAC;IACrB,eAAe,EAAE,MAAM,CAAC;IACxB,WAAW,EAAE,IAAI,CAAC;CACnB,CAaA,CAAC;AAEF;;GAEG;AACH,eAAO,MAAM,kBAAkB,GAC7B,SAAS,MAAM,GAAG,MAAM,KACvB,OAAO,CAAC;IAAE,UAAU,EAAE,MAAM,CAAC;IAAC,EAAE,EAAE,MAAM,CAAC;IAAC,YAAY,EAAE,MAAM,CAAA;CAAE,CAQlE,CAAC"}

package/dist/crypto.js

@@ -78,7 +78,13 @@ const encrypt = async (plaintext, senderPrivateKey, recipientPublicKey) => {
 };
 // ─── File encryption ───
 const encryptFileContent = async (content, senderPrivateKey, recipientPublicKey) => {
-    const buffer = new TextEncoder().encode(content).buffer;
+    // Binary attachments arrive as a Buffer and must be encrypted byte for byte —
+    // running them through TextEncoder would UTF-8 mangle every non-ASCII byte.
+    // Both branches are views; subtle.encrypt honours byteOffset/byteLength, so a
+    // Buffer carved out of Node's pool encrypts only its own bytes.
+    const buffer = typeof content === 'string'
+        ? new TextEncoder().encode(content)
+        : new Uint8Array(content.buffer, content.byteOffset, content.byteLength);
     const fileKey = await crypto.subtle.generateKey({ name: 'AES-GCM', length: 256 }, true, ['encrypt', 'decrypt']);
     const iv = crypto.getRandomValues(new Uint8Array(12));
     const ciphertext = await crypto.subtle.encrypt({ name: 'AES-GCM', iv }, fileKey, buffer);

package/dist/index.js

@@ -49,7 +49,7 @@ const createServer = (config) => {
             '- zeph_dismiss: Mark a push as read',
             '- zeph_dismiss_all: Clear all notifications',
             '- zeph_broadcast: Send to all subscribers of a channel',
-            '- zeph_file: Send a text file (logs, reports, code)',
+            '- zeph_file: Send a file — pass filePath for anything on disk (images, PDFs, logs), or content for generated text',
             '- zeph_prompt: Ask user to choose from options (requires ZEPH_HOOK_ID)',
             '- zeph_input: Request text input from user (requires ZEPH_HOOK_ID)',
             '- zeph_ask: Ask user with buttons + text input combined (requires ZEPH_HOOK_ID). Prefer this over zeph_prompt/zeph_input when you need both options and free-text.',

package/dist/mime.d.ts.map

@@ -1 +1 @@
-{"version":3,"file":"mime.d.ts","sourceRoot":"","sources":["../src/mime.ts"],"names":[],"mappings":"AAAA;;;;;;GAMG;AAkBH,eAAO,MAAM,aAAa,GAAI,UAAU,MAAM,KAAG,MAGhD,CAAC"}
+{"version":3,"file":"mime.d.ts","sourceRoot":"","sources":["../src/mime.ts"],"names":[],"mappings":"AAAA;;;;;;GAMG;AAsCH,eAAO,MAAM,aAAa,GAAI,UAAU,MAAM,KAAG,MAGhD,CAAC"}

package/dist/mime.js

@@ -22,6 +22,26 @@ const EXT_TO_MIME = {
     js: 'text/javascript',
     py: 'text/x-python',
     sh: 'text/x-shellscript',
+    // Keep this image set in sync with IMAGE_EXTENSIONS in the Zeph client
+    // (`libs/shared/src/utils/file.ts`) — an extension the client calls an image
+    // but this map doesn't will be labelled text/plain and decoded as UTF-8 on
+    // open, which corrupts it. Separate repos, so nothing enforces the match.
+    png: 'image/png',
+    jpg: 'image/jpeg',
+    jpeg: 'image/jpeg',
+    gif: 'image/gif',
+    webp: 'image/webp',
+    heic: 'image/heic',
+    heif: 'image/heif',
+    bmp: 'image/bmp',
+    avif: 'image/avif',
+    ico: 'image/x-icon',
+    tiff: 'image/tiff',
+    tif: 'image/tiff',
+    // No svg entry on purpose: an SVG is a script-bearing document, and the
+    // clients open decrypted attachments from a same-origin blob URL. It falls
+    // through to text/plain, which the text viewer handles fine.
+    pdf: 'application/pdf',
 };
 const inferMimeType = (fileName) => {
     const ext = fileName.split('.').pop()?.toLowerCase();

package/dist/tools/file.d.ts.map

@@ -1 +1 @@
-{"version":3,"file":"file.d.ts","sourceRoot":"","sources":["../../src/tools/file.ts"],"names":[],"mappings":"AACA,OAAO,KAAK,EAAE,SAAS,EAAE,MAAM,yCAAyC,CAAC;AACzE,OAAO,KAAK,EAAE,aAAa,EAAE,MAAM,kBAAkB,CAAC;AACtD,OAAO,EAAmB,KAAK,eAAe,EAAE,MAAM,cAAc,CAAC;AAMrE,eAAO,MAAM,gBAAgB,GAAI,QAAQ,SAAS,EAAE,QAAQ,aAAa,EAAE,QAAQ,eAAe,SAiFjG,CAAC"}
+{"version":3,"file":"file.d.ts","sourceRoot":"","sources":["../../src/tools/file.ts"],"names":[],"mappings":"AAGA,OAAO,KAAK,EAAE,SAAS,EAAE,MAAM,yCAAyC,CAAC;AACzE,OAAO,KAAK,EAAE,aAAa,EAAE,MAAM,kBAAkB,CAAC;AACtD,OAAO,EAAmB,KAAK,eAAe,EAAE,MAAM,cAAc,CAAC;AA4BrE,eAAO,MAAM,gBAAgB,GAAI,QAAQ,SAAS,EAAE,QAAQ,aAAa,EAAE,QAAQ,eAAe,SAoHjG,CAAC"}

package/dist/tools/file.js

@@ -2,40 +2,95 @@
 Object.defineProperty(exports, "__esModule", { value: true });
 exports.registerFileTool = void 0;
 const zod_1 = require("zod");
+const promises_1 = require("node:fs/promises");
+const node_path_1 = require("node:path");
 const config_js_1 = require("../config.js");
 const error_format_js_1 = require("../error-format.js");
 const crypto_js_1 = require("../crypto.js");
 const e2e_fallback_js_1 = require("../e2e-fallback.js");
 const mime_js_1 = require("../mime.js");
+/**
+ * Collapse the two accepted input shapes into one payload.
+ *
+ * A `filePath` stays a Buffer end to end — images and PDFs only survive the
+ * trip as raw bytes, and reading from disk keeps a several-hundred-KB
+ * attachment out of the tool call itself (base64 in the arguments would
+ * inflate it by a third and burn the agent's context).
+ */
+const resolvePayload = async (args) => {
+    if (args.filePath) {
+        const body = await (0, promises_1.readFile)(args.filePath);
+        return { fileName: args.fileName ?? (0, node_path_1.basename)(args.filePath), body, size: body.byteLength };
+    }
+    return {
+        fileName: args.fileName,
+        body: args.content,
+        size: new TextEncoder().encode(args.content).byteLength,
+    };
+};
 const registerFileTool = (server, client, config) => {
     server.registerTool('zeph_file', {
-        description: 'Send a text file to the user\'s device. The content is uploaded and delivered as a file push. Use for logs, reports, code snippets, or any text content.',
+        description: 'Send a file to the user\'s device. Pass `filePath` to send a file that already exists on disk — images (png/jpg/gif/webp/heic), PDFs, logs, anything. Pass `content` instead to send text you generated. Images render inline on the device.',
         annotations: {
             readOnlyHint: false,
             destructiveHint: false,
             openWorldHint: true,
         },
         inputSchema: {
-            fileName: zod_1.z.string().describe('File name with extension (e.g., "report.txt", "output.json")'),
-            content: zod_1.z.string().describe('Text content of the file'),
+            filePath: zod_1.z
+                .string()
+                .optional()
+                .describe('Absolute path to a local file to send. Required for images, PDFs, and any other binary — never base64 a file into `content`.'),
+            content: zod_1.z.string().optional().describe('Text content of the file. Use only for text you generated; requires `fileName`.'),
+            fileName: zod_1.z
+                .string()
+                .optional()
+                .describe('File name with extension (e.g., "report.txt"). Required with `content`; defaults to the basename of `filePath`.'),
             title: zod_1.z.string().optional().describe('Notification title (defaults to fileName)'),
             targetDeviceId: zod_1.z.string().optional().describe('Target device ID. Omit to use configured default or send to all devices.'),
         },
-    }, async ({ fileName, content, title, targetDeviceId }) => {
+    }, async ({ filePath, fileName: fileNameArg, content, title, targetDeviceId }) => {
+        if (!filePath && content === undefined) {
+            return (0, error_format_js_1.errorResult)({
+                error: 'INVALID_INPUT',
+                message: 'Either filePath or content is required',
+                suggestion: 'Pass filePath for a file on disk (images, PDFs), or content + fileName for generated text',
+            });
+        }
+        if (!filePath && !fileNameArg) {
+            return (0, error_format_js_1.errorResult)({
+                error: 'INVALID_INPUT',
+                message: 'fileName is required when sending content',
+                suggestion: 'Add fileName with an extension, e.g. "report.md"',
+            });
+        }
+        let payload;
+        try {
+            // Resolved once, outside `send`, so the plaintext retry below doesn't
+            // read the file from disk a second time.
+            payload = await resolvePayload({ filePath, content, fileName: fileNameArg });
+        }
+        catch (err) {
+            return (0, error_format_js_1.errorResult)({
+                error: 'FILE_READ_FAILED',
+                message: err instanceof Error ? err.message : String(err),
+                suggestion: 'Check that filePath is an absolute path to a readable file',
+            });
+        }
+        const { fileName, body, size: originalSize } = payload;
         // Runs a second time as plaintext if the server refuses E2E (Pro-only,
         // ADR-0008). The retry re-uploads the file unencrypted, so the whole
         // upload-then-send sequence has to sit inside this closure.
         const send = async (canEncrypt) => {
             let fileType = (0, mime_js_1.inferMimeType)(fileName);
-            const originalSize = new TextEncoder().encode(content).byteLength;
             // Step 1: Optionally encrypt file content
-            let uploadContent = content;
+            let uploadContent = body;
             let uploadSize = originalSize;
             let fileIv;
             let fileEncryptedKey;
             if (canEncrypt) {
                 try {
-                    const encrypted = await (0, crypto_js_1.encryptFileForSelf)(content);
+                    const encrypted = await (0, crypto_js_1.encryptFileForSelf)(body);
                     uploadContent = encrypted.ciphertext;
                     uploadSize = encrypted.ciphertext.length;
                     fileType = 'application/octet-stream';

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "@zeph-to/mcp-server",
-  "version": "1.15.2",
+  "version": "1.16.0",
   "description": "Zeph MCP server — AI agent notifications, prompts, and input via MCP protocol",
   "main": "./dist/index.js",
   "types": "./dist/index.d.ts",