beplus-mcp 0.40.0 → 0.41.0

package/README.md

@@ -12,6 +12,25 @@ Claude Code/Desktop/Cursor  ──stdio──▶  beplus-mcp  ──HTTPS (Beare
 
 Você se autentica com um **Personal Access Token (PAT)** gerado no painel da BePlus. O MCP só age em nome da SUA conta.
 
+## Jeito mais fácil: conector por URL (sem Node, sem token)
+
+A API da BePlus serve as mesmas ferramentas por HTTP, com login pelo navegador (OAuth).
+
+**Claude Code:**
+
+```bash
+claude mcp add --transport http --scope user beplus https://api.beplus.academy/api/v1/mcp
+claude mcp login beplus
+```
+
+O navegador abre, você entra na BePlus e clica em **Autorizar acesso**. Reinicie o Claude Code.
+
+**Claude Desktop e claude.ai:** Configurações > Conectores > Adicionar conector personalizado, cole
+`https://api.beplus.academy/api/v1/mcp`, clique em Conectar e em Autorizar acesso.
+
+No conector por URL as ferramentas rodam no servidor: arquivo de mídia vai por **URL pública**, não por caminho do
+seu computador. Para subir arquivo local, use o pacote abaixo.
+
 ## 1. Gere um Personal Access Token
 
 No app da BePlus → **Configurações da conta → Tokens de acesso** → *Criar token*. Copie o token (`pat_…`) — ele só aparece uma vez.

package/dist/index.js

@@ -3303,8 +3303,8 @@ var require_utils = __commonJS({
     var HOST_DELIMS = { "@": "%40", "/": "%2F", "?": "%3F", "#": "%23", ":": "%3A" };
     var HOST_DELIM_RE = /[@/?#:]/g;
     var HOST_DELIM_NO_COLON_RE = /[@/?#]/g;
-    function reescapeHostDelimiters(host, isIP) {
-      const re = isIP ? HOST_DELIM_NO_COLON_RE : HOST_DELIM_RE;
+    function reescapeHostDelimiters(host, isIP2) {
+      const re = isIP2 ? HOST_DELIM_NO_COLON_RE : HOST_DELIM_RE;
       re.lastIndex = 0;
       return host.replace(re, (ch) => HOST_DELIMS[ch]);
     }
@@ -3786,7 +3786,7 @@ var require_fast_uri = __commonJS({
         fragment: void 0
       };
       let malformedAuthorityOrPort = false;
-      let isIP = false;
+      let isIP2 = false;
       if (options.reference === "suffix") {
         if (options.scheme) {
           uri = options.scheme + ":" + uri;
@@ -3816,9 +3816,9 @@ var require_fast_uri = __commonJS({
           if (ipv4result === false) {
             const ipv6result = normalizeIPv6(parsed.host);
             parsed.host = ipv6result.host.toLowerCase();
-            isIP = ipv6result.isIPV6;
+            isIP2 = ipv6result.isIPV6;
           } else {
-            isIP = true;
+            isIP2 = true;
           }
         }
         if (parsed.scheme === void 0 && parsed.userinfo === void 0 && parsed.host === void 0 && parsed.port === void 0 && parsed.query === void 0 && !parsed.path) {
@@ -3835,7 +3835,7 @@ var require_fast_uri = __commonJS({
         }
         const schemeHandler = getSchemeHandler(options.scheme || parsed.scheme);
         if (!options.unicodeSupport && (!schemeHandler || !schemeHandler.unicodeSupport)) {
-          if (parsed.host && (options.domainHost || schemeHandler && schemeHandler.domainHost) && isIP === false && nonSimpleDomain(parsed.host)) {
+          if (parsed.host && (options.domainHost || schemeHandler && schemeHandler.domainHost) && isIP2 === false && nonSimpleDomain(parsed.host)) {
             try {
               parsed.host = URL.domainToASCII(parsed.host.toLowerCase());
             } catch (e) {
@@ -3849,7 +3849,7 @@ var require_fast_uri = __commonJS({
               parsed.scheme = unescape(parsed.scheme);
             }
             if (parsed.host !== void 0) {
-              parsed.host = reescapeHostDelimiters(unescape(parsed.host), isIP);
+              parsed.host = reescapeHostDelimiters(unescape(parsed.host), isIP2);
             }
           }
           if (parsed.path) {
@@ -21749,6 +21749,69 @@ async function pollUntilDone(client, generationId, budgetMs, jitterSeed = 0) {
 
 // src/media.ts
 import { readFile as readFile2, stat as stat2 } from "fs/promises";
+
+// src/remote.ts
+import { lookup } from "dns/promises";
+import { isIP } from "net";
+var remote = false;
+function refuseLocalPath(ref) {
+  if (!remote) return;
+  throw new ApiError(
+    0,
+    `"${ref}" \xE9 um caminho de arquivo, e esta conex\xE3o roda no servidor da BePlus, que n\xE3o enxerga o seu computador. Mande uma URL p\xFAblica (http/https) ou suba o arquivo pela plataforma e use o link dele.`
+  );
+}
+var MAX_REDIRECTS = 5;
+function v4Private(ip) {
+  const [a, b] = ip.split(".").map(Number);
+  return a === 0 || a === 10 || a === 127 || a === 169 && b === 254 || a === 172 && b >= 16 && b <= 31 || a === 192 && b === 168 || a === 100 && b >= 64 && b <= 127 || a >= 224;
+}
+function privateAddress(ip) {
+  if (isIP(ip) === 4) return v4Private(ip);
+  const v6 = ip.toLowerCase();
+  const dotted = /^::ffff:(\d+\.\d+\.\d+\.\d+)$/.exec(v6);
+  if (dotted) return v4Private(dotted[1]);
+  const hex = /^::ffff:([0-9a-f]{1,4}):([0-9a-f]{1,4})$/.exec(v6);
+  if (hex) {
+    const hi = parseInt(hex[1], 16);
+    const lo = parseInt(hex[2], 16);
+    return v4Private(`${hi >> 8}.${hi & 255}.${lo >> 8}.${lo & 255}`);
+  }
+  return v6 === "::" || v6 === "::1" || /^f[cd]/.test(v6) || /^fe[89ab]/.test(v6) || /^ff/.test(v6);
+}
+async function assertPublic(url) {
+  if (url.protocol !== "http:" && url.protocol !== "https:") {
+    throw new ApiError(0, `S\xF3 baixo endere\xE7o http ou https: ${url.href}`);
+  }
+  const host = url.hostname.replace(/^\[|\]$/g, "").toLowerCase();
+  if (host === "localhost" || host.endsWith(".localhost") || host.endsWith(".internal") || host.endsWith(".local")) {
+    throw new ApiError(0, `Endere\xE7o interno n\xE3o \xE9 aceito: ${url.host}`);
+  }
+  const addrs = isIP(host) ? [{ address: host }] : await lookup(host, { all: true }).catch(() => []);
+  if (addrs.length === 0) throw new ApiError(0, `N\xE3o encontrei o endere\xE7o ${url.host}.`);
+  if (addrs.some((a) => privateAddress(a.address))) {
+    throw new ApiError(0, `Endere\xE7o de rede privada n\xE3o \xE9 aceito: ${url.host}`);
+  }
+}
+async function safeFetch(input, init = {}) {
+  if (!remote) return fetch(input, init);
+  let url = new URL(input);
+  for (let hop = 0; hop <= MAX_REDIRECTS; hop++) {
+    await assertPublic(url);
+    const res = await fetch(url, { ...init, redirect: "manual" });
+    const location = res.headers.get("location");
+    if (res.status >= 300 && res.status < 400 && location) {
+      await res.body?.cancel().catch(() => {
+      });
+      url = new URL(location, url);
+      continue;
+    }
+    return res;
+  }
+  throw new ApiError(0, `Redirecionamentos demais ao baixar ${input}.`);
+}
+
+// src/media.ts
 import { basename, extname, isAbsolute, resolve } from "path";
 import { homedir as homedir2 } from "os";
 import { fileURLToPath } from "url";
@@ -21836,6 +21899,7 @@ function isRemoteRef(ref) {
   return /^https?:\/\//i.test(ref);
 }
 function toLocalPath(ref) {
+  refuseLocalPath(ref);
   if (ref.startsWith("file://")) return fileURLToPath(ref);
   if (ref === "~") return homedir2();
   if (ref.startsWith("~/")) return resolve(homedir2(), ref.slice(2));
@@ -21875,8 +21939,9 @@ async function loadRemote(url) {
   let name = decodeURIComponent(basename(u.pathname)) || "arquivo";
   let res;
   try {
-    res = await fetch(url, { signal: AbortSignal.timeout(DOWNLOAD_TIMEOUT_MS) });
-  } catch {
+    res = await safeFetch(url, { signal: AbortSignal.timeout(DOWNLOAD_TIMEOUT_MS) });
+  } catch (e) {
+    if (e instanceof ApiError) throw e;
     throw new ApiError(0, `N\xE3o consegui baixar ${url} (rede ou tempo esgotado).`);
   }
   if (!res.ok) {
@@ -23218,6 +23283,7 @@ function isRemote(ref) {
   return /^https?:\/\//i.test(ref);
 }
 function toLocalPath2(ref) {
+  refuseLocalPath(ref);
   if (ref.startsWith("file://")) return fileURLToPath2(ref);
   if (ref === "~") return homedir3();
   if (ref.startsWith("~/")) return resolve2(homedir3(), ref.slice(2));
@@ -23243,7 +23309,7 @@ async function readAt(ref, offset, len) {
   const ctrl = new AbortController();
   const timer = setTimeout(() => ctrl.abort(), FETCH_TIMEOUT_MS);
   try {
-    const res = await fetch(ref, {
+    const res = await safeFetch(ref, {
       headers: { Range: `bytes=${offset}-${offset + len - 1}` },
       signal: ctrl.signal
     });
@@ -23286,7 +23352,7 @@ async function readHead(ref, bytes) {
   const ctrl = new AbortController();
   const timer = setTimeout(() => ctrl.abort(), FETCH_TIMEOUT_MS);
   try {
-    const res = await fetch(ref, {
+    const res = await safeFetch(ref, {
       headers: { Range: `bytes=0-${bytes - 1}` },
       signal: ctrl.signal
     });
@@ -23430,7 +23496,7 @@ function probeMp4(b) {
 }
 async function fileSizeOf(ref) {
   if (!isRemote(ref)) return (await stat3(toLocalPath2(ref))).size;
-  const res = await fetch(ref, { method: "HEAD" });
+  const res = await safeFetch(ref, { method: "HEAD" });
   return Number(res.headers.get("content-length") ?? 0);
 }
 var ProbeError = class extends Error {
@@ -26203,10 +26269,10 @@ function withExtension(name, file) {
   return ext && extname3(clean).toLowerCase() !== ext.toLowerCase() ? `${clean}${ext}` : clean;
 }
 async function uploadMedia(cfg, source, name) {
-  const remote = isRemoteRef(source);
-  const loaded = remote ? await loadRemote(source) : await loadLocal(source);
+  const remote2 = isRemoteRef(source);
+  const loaded = remote2 ? await loadRemote(source) : await loadLocal(source);
   const file = { ...loaded, name: withExtension(name, loaded) };
-  const reused = remote && new URL(source).host === BEPLUS_STORAGE_HOST;
+  const reused = remote2 && new URL(source).host === BEPLUS_STORAGE_HOST;
   const url = reused ? source : await uploadBytes(cfg, file);
   const kind = kindOfMime(file.mime);
   let meta = null;
@@ -27757,7 +27823,7 @@ N\xF3s: ${Object.entries(ids).map(([k, v]) => `${k}=${v}`).join(" \xB7 ")}` : ""
 import { createRequire } from "module";
 var require2 = createRequire(import.meta.url);
 function readVersion() {
-  if ("0.40.0") return "0.40.0";
+  if ("0.41.0") return "0.41.0";
   try {
     const pkg = require2("../package.json");
     return pkg.version ?? "0.0.0-unknown";