goatedit-mcp 1.1.0 → 1.1.1

package/README.md

@@ -112,6 +112,10 @@ up to 500 files); `/media/<path>` serves from it with byte ranges, so video
 seeks, and paths that resolve outside it are a 404. Generated voiceovers are
 written there too.
 
+`import_local_file` looks in that folder first: a file found there (by name,
+or by the path `list_local_assets` gives) is imported from this server, with no
+GoatEdit bridge needed. Only a miss falls through to the bridge.
+
 ---
 
 ## Tools

package/bundle/goatedit-mcp.js

@@ -3232,8 +3232,8 @@ var require_utils = __commonJS({
       }
       return ind;
     }
-    function removeDotSegments(path2) {
-      let input = path2;
+    function removeDotSegments(path3) {
+      let input = path3;
       const output = [];
       let nextSlash = -1;
       let len = 0;
@@ -3485,8 +3485,8 @@ var require_schemes = __commonJS({
         wsComponent.secure = void 0;
       }
       if (wsComponent.resourceName) {
-        const [path2, query] = wsComponent.resourceName.split("?");
-        wsComponent.path = path2 && path2 !== "/" ? path2 : void 0;
+        const [path3, query] = wsComponent.resourceName.split("?");
+        wsComponent.path = path3 && path3 !== "/" ? path3 : void 0;
         wsComponent.query = query;
         wsComponent.resourceName = void 0;
       }
@@ -6879,12 +6879,12 @@ var require_dist = __commonJS({
         throw new Error(`Unknown format "${name}"`);
       return f;
     };
-    function addFormats(ajv, list, fs2, exportName) {
+    function addFormats(ajv, list, fs3, exportName) {
       var _a3;
       var _b;
       (_a3 = (_b = ajv.opts.code).formats) !== null && _a3 !== void 0 ? _a3 : _b.formats = (0, codegen_1._)`require("ajv-formats/dist/formats").${exportName}`;
       for (const f of list)
-        ajv.addFormat(f, fs2[f]);
+        ajv.addFormat(f, fs3[f]);
     }
     module.exports = exports = formatsPlugin;
     Object.defineProperty(exports, "__esModule", { value: true });
@@ -10811,10 +10811,10 @@ function mergeDefs(...defs) {
 function cloneDef(schema) {
   return mergeDefs(schema._zod.def);
 }
-function getElementAtPath(obj, path2) {
-  if (!path2)
+function getElementAtPath(obj, path3) {
+  if (!path3)
     return obj;
-  return path2.reduce((acc, key) => acc?.[key], obj);
+  return path3.reduce((acc, key) => acc?.[key], obj);
 }
 function promiseAllObject(promisesObj) {
   const keys = Object.keys(promisesObj);
@@ -11223,11 +11223,11 @@ function explicitlyAborted(x, startIndex = 0) {
   }
   return false;
 }
-function prefixIssues(path2, issues) {
+function prefixIssues(path3, issues) {
   return issues.map((iss) => {
     var _a3;
     (_a3 = iss).path ?? (_a3.path = []);
-    iss.path.unshift(path2);
+    iss.path.unshift(path3);
     return iss;
   });
 }
@@ -11374,16 +11374,16 @@ function flattenError(error2, mapper = (issue2) => issue2.message) {
 }
 function formatError(error2, mapper = (issue2) => issue2.message) {
   const fieldErrors = { _errors: [] };
-  const processError = (error3, path2 = []) => {
+  const processError = (error3, path3 = []) => {
     for (const issue2 of error3.issues) {
       if (issue2.code === "invalid_union" && issue2.errors.length) {
-        issue2.errors.map((issues) => processError({ issues }, [...path2, ...issue2.path]));
+        issue2.errors.map((issues) => processError({ issues }, [...path3, ...issue2.path]));
       } else if (issue2.code === "invalid_key") {
-        processError({ issues: issue2.issues }, [...path2, ...issue2.path]);
+        processError({ issues: issue2.issues }, [...path3, ...issue2.path]);
       } else if (issue2.code === "invalid_element") {
-        processError({ issues: issue2.issues }, [...path2, ...issue2.path]);
+        processError({ issues: issue2.issues }, [...path3, ...issue2.path]);
       } else {
-        const fullpath = [...path2, ...issue2.path];
+        const fullpath = [...path3, ...issue2.path];
         if (fullpath.length === 0) {
           fieldErrors._errors.push(mapper(issue2));
         } else {
@@ -19144,8 +19144,8 @@ var import_websocket_server = __toESM(require_websocket_server(), 1);
 // src/index.ts
 import crypto from "crypto";
 import http from "http";
-import fs from "fs";
-import path from "path";
+import fs2 from "fs";
+import path2 from "path";
 import { execFileSync } from "child_process";
 import os from "os";
 import { fileURLToPath } from "url";
@@ -19356,7 +19356,7 @@ var TOOLS = [
   },
   {
     name: "get_timeline",
-    description: 'Get just the timeline \u2014 all tracks with their clips, ids, start times and durations. Cheaper than get_project_state; use it before any edit so you have current clip ids. Animation data (keyframes, motion tracking, masks, per-word caption timings) is reported as counts under *Summary keys rather than in full, so a clip showing keyframeSummary is animated even though the keyframes themselves are not listed. By default the view is lean: a field at its usual value is left out (no volume means 1, no isMuted means false, no opacity means 1), and effects are listed by id and type only. Pass detail: "full" when you need effect parameters.',
+    description: 'Get just the timeline \u2014 all tracks with their clips, ids, start times and durations. Cheaper than get_project_state; use it before your first edit so you have current clip ids. After that, each edit\u2019s reply lists the clips it added, changed and removed under timelineChanges, so a re-read is only needed when that says it was truncated. Animation data (keyframes, motion tracking, masks, per-word caption timings) is reported as counts under *Summary keys rather than in full, so a clip showing keyframeSummary is animated even though the keyframes themselves are not listed. By default the view is lean: a field at its usual value is left out (no volume means 1, no isMuted means false, no opacity means 1), and effects are listed by id and type only. Pass detail: "full" when you need effect parameters.',
     inputSchema: {
       type: "object",
       properties: {
@@ -19780,6 +19780,67 @@ var TOOLS = [
     },
     method: "describeEffect"
   },
+  {
+    name: "list_presets",
+    description: "List animation presets. The user\u2019s own saved presets always come back in full; the built-in library (a couple of hundred title moves, lower thirds, logo reveals, backgrounds and more) is summarised by category unless you pass category or query. Apply one with apply_preset.",
+    inputSchema: {
+      type: "object",
+      properties: {
+        category: {
+          type: "string",
+          enum: ["text", "motion", "paper", "liquid", "glitch", "logo", "lower-third", "transition", "bg"],
+          description: "List the built-in presets of one category."
+        },
+        query: str("Search built-in presets by name, description or tag.")
+      }
+    },
+    method: "listPresets"
+  },
+  {
+    name: "save_preset",
+    description: "Save clips as a reusable preset: their transform keyframes (stored as fractions of the clip, so the move stretches to whatever it is applied to), effects, transition, and text or shape styling. It is kept in this browser and shows under My Presets in the Presets panel, across reloads. One clip makes a preset that can be laid onto another clip; several make a group that is added as new clips.",
+    inputSchema: {
+      type: "object",
+      properties: {
+        clipIds: { type: "array", items: { type: "string" }, description: "The clips to capture." },
+        name: str("Preset name."),
+        category: {
+          type: "string",
+          enum: ["text", "motion", "paper", "liquid", "glitch", "logo", "lower-third", "transition", "bg"],
+          description: "Shelf it is filed under. Defaults to motion."
+        },
+        tags: { type: "array", items: { type: "string" }, description: "Optional search tags." },
+        description: str("Optional one-line description.")
+      },
+      required: ["clipIds", "name"]
+    },
+    method: "savePreset"
+  },
+  {
+    name: "apply_preset",
+    description: "Apply a preset (saved or built-in; ids from list_presets). With clipId, a one-clip preset is laid onto that clip, keeping its media and place and replacing animation only on the properties the preset sets. Without clipId, the preset\u2019s clips are added as new clips at time (default: the playhead).",
+    inputSchema: {
+      type: "object",
+      properties: {
+        presetId: str("Preset id from list_presets."),
+        clipId: str("Optional clip to apply it to."),
+        time: num("Where new clips start, in seconds, when clipId is not given. Defaults to the playhead."),
+        trackId: str("Optional track for new clips.")
+      },
+      required: ["presetId"]
+    },
+    method: "applyPreset"
+  },
+  {
+    name: "delete_preset",
+    description: "Delete one of the user\u2019s saved presets. Built-in presets cannot be deleted.",
+    inputSchema: {
+      type: "object",
+      properties: { presetId: str("Saved preset id from list_presets.") },
+      required: ["presetId"]
+    },
+    method: "deletePreset"
+  },
   {
     name: "set_text_animation",
     description: "Give a text clip a staggered entrance \u2014 the words rising one after another, letters typing on, a karaoke highlight sweeping through, a mask wipe travelling over the glyphs. The compositor animates per letter, word or line, so a title arrives instead of cutting on. Naming a preset alone uses the timing it was designed with; unit, stagger and durationIn override it. The response reports how long the entrance takes and warns when it outlasts the clip.",
@@ -19824,7 +19885,7 @@ var TOOLS = [
   },
   {
     name: "import_local_file",
-    description: 'Import a media file from the user\'s own computer by FILENAME, through the local bridge. Use this when someone refers to a file they have rather than a URL \u2014 add_media_file cannot reach a path, because a browser tab cannot read one. The bridge searches only the folders its operator shared with --allow-dir, and only video, audio and image files inside them; anything else is not refused so much as invisible. Pass a bare filename ("interview-take-3.mp4"), not a path: the bridge does the finding, and a caller that cannot name a directory cannot be steered out of one. Requires the bridge to be running \u2014 `uvx goatedit-bridge --allow-dir <folder>` \u2014 with its token pasted into the editor.',
+    description: 'Import a media file from the user\'s own computer by FILENAME, through the local bridge. Use this when someone refers to a file they have rather than a URL \u2014 add_media_file cannot reach a path, because a browser tab cannot read one. The bridge searches only the folders its operator shared with --allow-dir, and only video, audio and image files inside them; anything else is not refused so much as invisible. Pass a bare filename ("interview-take-3.mp4"), not a path: the bridge does the finding, and a caller that cannot name a directory cannot be steered out of one. Requires the bridge to be running \u2014 `uvx goatedit-bridge --allow-dir <folder>` \u2014 with its token pasted into the editor. The local goatedit-mcp server needs no bridge for files in its own assets folder: it finds them itself, and also takes a path relative to that folder as list_local_assets gives it.',
     inputSchema: {
       type: "object",
       properties: {
@@ -20174,6 +20235,51 @@ function toContent(result) {
   return blocks;
 }
 
+// src/find-local-file.ts
+import fs from "fs";
+import path from "path";
+function findLocalFile(root, wanted, maxDepth) {
+  const name = wanted.trim();
+  if (!name || !fs.existsSync(root)) return null;
+  if (name.includes("/") || name.includes(path.sep)) {
+    const full = path.resolve(root, name);
+    if (!full.startsWith(root + path.sep)) return null;
+    try {
+      return fs.statSync(full).isFile() ? full : null;
+    } catch {
+      return null;
+    }
+  }
+  const target = name.toLowerCase();
+  let level = [root];
+  for (let depth = 0; depth <= maxDepth && level.length; depth++) {
+    const hits = [];
+    const next = [];
+    for (const dir of level) {
+      let entries;
+      try {
+        entries = fs.readdirSync(dir, { withFileTypes: true });
+      } catch {
+        continue;
+      }
+      for (const entry of entries) {
+        if (entry.name.startsWith(".")) continue;
+        const full = path.join(dir, entry.name);
+        if (entry.isDirectory()) next.push(full);
+        else if (entry.isFile() && entry.name.toLowerCase() === target) hits.push(full);
+      }
+    }
+    if (hits.length > 1) {
+      throw new Error(
+        `Several files are named "${name}": ${hits.map((h) => path.relative(root, h)).sort().join(", ")}. Pass one of these paths as filename.`
+      );
+    }
+    if (hits.length === 1) return hits[0];
+    level = next;
+  }
+  return null;
+}
+
 // src/index.ts
 var WEBSOCKET_PORT = 9e3;
 var BIND_HOST = "127.0.0.1";
@@ -20201,11 +20307,11 @@ function isLoopbackHost(host) {
   }
 }
 var CONTROLLER_TOKEN = process.env.GOATEDIT_CONTROLLER_TOKEN || crypto.randomBytes(32).toString("hex");
-var CONTROLLER_TOKEN_FILE = path.join(os.homedir(), ".goatedit", "mcp-controller-token");
+var CONTROLLER_TOKEN_FILE = path2.join(os.homedir(), ".goatedit", "mcp-controller-token");
 function writeControllerToken() {
-  fs.mkdirSync(path.dirname(CONTROLLER_TOKEN_FILE), { recursive: true, mode: 448 });
-  fs.writeFileSync(CONTROLLER_TOKEN_FILE, CONTROLLER_TOKEN, { mode: 384 });
-  fs.chmodSync(CONTROLLER_TOKEN_FILE, 384);
+  fs2.mkdirSync(path2.dirname(CONTROLLER_TOKEN_FILE), { recursive: true, mode: 448 });
+  fs2.writeFileSync(CONTROLLER_TOKEN_FILE, CONTROLLER_TOKEN, { mode: 384 });
+  fs2.chmodSync(CONTROLLER_TOKEN_FILE, 384);
 }
 function hasControllerToken(req) {
   const header = req.headers.authorization || "";
@@ -20215,24 +20321,24 @@ function hasControllerToken(req) {
   return a.length === b.length && crypto.timingSafeEqual(a, b);
 }
 var REQUEST_TIMEOUT_MS = 3e4;
-var LOCAL_ASSETS_DIR = path.resolve(
-  process.env.GOATEDIT_ASSETS_DIR || path.join(os.homedir(), "Movies")
+var LOCAL_ASSETS_DIR = path2.resolve(
+  process.env.GOATEDIT_ASSETS_DIR || path2.join(os.homedir(), "Movies")
 );
-var FRAMES_DIR = path.resolve(
-  process.env.GOATEDIT_FRAMES_DIR || path.join(os.homedir(), ".goatedit", "frames")
+var FRAMES_DIR = path2.resolve(
+  process.env.GOATEDIT_FRAMES_DIR || path2.join(os.homedir(), ".goatedit", "frames")
 );
 var VERSION = (() => {
-  const here = path.dirname(fileURLToPath(import.meta.url));
+  const here = path2.dirname(fileURLToPath(import.meta.url));
   for (const rel of ["../package.json", "../../../package.json"]) {
     try {
-      const pkg = JSON.parse(fs.readFileSync(path.join(here, rel), "utf8"));
+      const pkg = JSON.parse(fs2.readFileSync(path2.join(here, rel), "utf8"));
       if (pkg.name === "goatedit-mcp") return String(pkg.version);
     } catch {
     }
   }
   return "0.0.0";
 })();
-var INSTRUCTIONS = `Edits a GoatEdit video project live in the user's browser tab at ai.goatedit.com. Call get_timeline before any edit \u2014 clip ids change after every split, trim or delete, and a stale id is rejected. get_timeline is lean by default; pass detail: "full" only when you need effect parameters, and trackId or from/to to read part of it. Several edits in a row go faster as one run_tools call. With more than one tab open, call list_connected_projects, then use_project to pick one. render_preview_frame and preview_media accept saveToDisk: true, which writes the frame to a file and returns its path instead of the image. If a tool reports the editor is not connected, ask the user to open ai.goatedit.com and switch on Local in the AI status menu.`;
+var INSTRUCTIONS = `Edits a GoatEdit video project live in the user's browser tab at ai.goatedit.com. Call get_timeline before your first edit \u2014 clip ids change after every split, trim or delete, and a stale id is rejected. Each edit's reply carries timelineChanges (clips added, with their ids and placement; clips changed; ids removed), so take the next ids from there instead of reading the timeline again. get_timeline is lean by default; pass detail: "full" only when you need effect parameters, and trackId or from/to to read part of it. Several edits in a row go faster as one run_tools call. With more than one tab open, call list_connected_projects, then use_project to pick one. render_preview_frame and preview_media accept saveToDisk: true, which writes the frame to a file and returns its path instead of the image. If a tool reports the editor is not connected, ask the user to open ai.goatedit.com and switch on Local in the AI status menu.`;
 var MEDIA_TYPES = {
   ".mp4": { mime: "video/mp4", kind: "video" },
   ".m4v": { mime: "video/mp4", kind: "video" },
@@ -20253,18 +20359,18 @@ var MEDIA_TYPES = {
   ".json": { mime: "application/json", kind: "lottie" }
 };
 function mediaUrl(rel) {
-  return `http://localhost:${WEBSOCKET_PORT}/media/${rel.split(path.sep).map(encodeURIComponent).join("/")}`;
+  return `http://localhost:${WEBSOCKET_PORT}/media/${rel.split(path2.sep).map(encodeURIComponent).join("/")}`;
 }
 var MAX_LISTED_ASSETS = 500;
 var MAX_ASSET_DEPTH = 4;
 async function handleListLocalAssets(args = {}) {
-  if (!fs.existsSync(LOCAL_ASSETS_DIR)) {
+  if (!fs2.existsSync(LOCAL_ASSETS_DIR)) {
     throw new Error(
       `Assets directory does not exist: ${LOCAL_ASSETS_DIR}. Set GOATEDIT_ASSETS_DIR to a folder of media.`
     );
   }
-  const start = path.resolve(LOCAL_ASSETS_DIR, args.folder || "");
-  if (start !== LOCAL_ASSETS_DIR && !start.startsWith(LOCAL_ASSETS_DIR + path.sep)) {
+  const start = path2.resolve(LOCAL_ASSETS_DIR, args.folder || "");
+  if (start !== LOCAL_ASSETS_DIR && !start.startsWith(LOCAL_ASSETS_DIR + path2.sep)) {
     throw new Error("folder must be inside the assets directory.");
   }
   const files = [];
@@ -20272,7 +20378,7 @@ async function handleListLocalAssets(args = {}) {
   const walk = (dir, depth) => {
     let entries;
     try {
-      entries = fs.readdirSync(dir, { withFileTypes: true });
+      entries = fs2.readdirSync(dir, { withFileTypes: true });
     } catch {
       return;
     }
@@ -20283,17 +20389,17 @@ async function handleListLocalAssets(args = {}) {
         return;
       }
       if (entry.name.startsWith(".")) continue;
-      const full = path.join(dir, entry.name);
+      const full = path2.join(dir, entry.name);
       if (entry.isDirectory()) {
         if (depth < MAX_ASSET_DEPTH) walk(full, depth + 1);
         continue;
       }
-      const type = MEDIA_TYPES[path.extname(entry.name).toLowerCase()];
+      const type = MEDIA_TYPES[path2.extname(entry.name).toLowerCase()];
       if (!type || !entry.isFile()) continue;
-      const rel = path.relative(LOCAL_ASSETS_DIR, full);
+      const rel = path2.relative(LOCAL_ASSETS_DIR, full);
       let bytes = 0;
       try {
-        bytes = fs.statSync(full).size;
+        bytes = fs2.statSync(full).size;
       } catch {
       }
       files.push({ name: entry.name, path: rel, type: type.kind, bytes, url: mediaUrl(rel) });
@@ -20306,6 +20412,14 @@ async function handleListLocalAssets(args = {}) {
     ...truncated ? { truncated: true, note: `Stopped at ${MAX_LISTED_ASSETS} files. Pass folder to list one subfolder.` } : {}
   };
 }
+async function handleFindLocalFile(args = {}) {
+  const hit = findLocalFile(LOCAL_ASSETS_DIR, String(args.filename ?? ""), MAX_ASSET_DEPTH);
+  if (!hit) return null;
+  const type = MEDIA_TYPES[path2.extname(hit).toLowerCase()];
+  if (!type || type.kind === "lottie") return null;
+  const rel = path2.relative(LOCAL_ASSETS_DIR, hit);
+  return { name: path2.basename(hit), path: rel, url: mediaUrl(rel), contentType: type.mime };
+}
 function audioDuration(file) {
   try {
     const out = execFileSync("afinfo", [file], { encoding: "utf8" });
@@ -20323,10 +20437,10 @@ async function handleGenerateVoiceover(text, projectId) {
     throw new Error("generate_voiceover needs macOS `say`. Not available on this platform.");
   }
   const filename = `voiceover_${Date.now()}.wav`;
-  const filePath = path.join(LOCAL_ASSETS_DIR, filename);
-  fs.mkdirSync(LOCAL_ASSETS_DIR, { recursive: true });
-  const scriptPath = path.join(LOCAL_ASSETS_DIR, `.voiceover_${Date.now()}.txt`);
-  fs.writeFileSync(scriptPath, text, "utf8");
+  const filePath = path2.join(LOCAL_ASSETS_DIR, filename);
+  fs2.mkdirSync(LOCAL_ASSETS_DIR, { recursive: true });
+  const scriptPath = path2.join(LOCAL_ASSETS_DIR, `.voiceover_${Date.now()}.txt`);
+  fs2.writeFileSync(scriptPath, text, "utf8");
   try {
     execFileSync("say", ["-o", filePath, "-f", scriptPath], { stdio: "ignore" });
     const duration3 = audioDuration(filePath) ?? text.split(/\s+/).length * 0.45 + 1;
@@ -20344,7 +20458,7 @@ async function handleGenerateVoiceover(text, projectId) {
     throw new Error(`Failed to generate voiceover: ${err.message}`);
   } finally {
     try {
-      fs.unlinkSync(scriptPath);
+      fs2.unlinkSync(scriptPath);
     } catch {
     }
   }
@@ -20353,14 +20467,14 @@ function saveFramesToDisk(result, label) {
   if (!result || typeof result !== "object") return result;
   const frames = [result._image, ...Array.isArray(result._images) ? result._images : []].filter((f) => f && typeof f.data === "string" && typeof f.mimeType === "string");
   if (!frames.length) return result;
-  fs.mkdirSync(FRAMES_DIR, { recursive: true });
+  fs2.mkdirSync(FRAMES_DIR, { recursive: true });
   const stamp = (/* @__PURE__ */ new Date()).toISOString().replace(/[:.]/g, "-");
   const safe = label.replace(/[^\w.-]+/g, "_").slice(0, 60);
   const saved = frames.map((f, i) => {
     const ext = f.mimeType === "image/png" ? "png" : f.mimeType === "image/webp" ? "webp" : "jpg";
-    const file = path.join(FRAMES_DIR, `${stamp}-${safe}${frames.length > 1 ? `-${i}` : ""}.${ext}`);
+    const file = path2.join(FRAMES_DIR, `${stamp}-${safe}${frames.length > 1 ? `-${i}` : ""}.${ext}`);
     const bytes = Buffer.from(f.data, "base64");
-    fs.writeFileSync(file, bytes);
+    fs2.writeFileSync(file, bytes);
     return { path: file, bytes: bytes.length, ...f.caption ? { caption: f.caption } : {} };
   });
   const { _image, _images, ...rest } = result;
@@ -20371,8 +20485,8 @@ function saveFramesToDisk(result, label) {
   };
 }
 function serveFile(req, res, filePath) {
-  const size = fs.statSync(filePath).size;
-  const type = MEDIA_TYPES[path.extname(filePath).toLowerCase()]?.mime ?? "application/octet-stream";
+  const size = fs2.statSync(filePath).size;
+  const type = MEDIA_TYPES[path2.extname(filePath).toLowerCase()]?.mime ?? "application/octet-stream";
   const headers = { "Content-Type": type, "Accept-Ranges": "bytes" };
   const range = /^bytes=(\d*)-(\d*)$/.exec(req.headers.range || "");
   if (range && (range[1] || range[2])) {
@@ -20395,7 +20509,7 @@ function serveFile(req, res, filePath) {
       res.end();
       return;
     }
-    fs.createReadStream(filePath, { start, end }).pipe(res);
+    fs2.createReadStream(filePath, { start, end }).pipe(res);
     return;
   }
   res.writeHead(200, { ...headers, "Content-Length": size });
@@ -20403,7 +20517,7 @@ function serveFile(req, res, filePath) {
     res.end();
     return;
   }
-  fs.createReadStream(filePath).pipe(res);
+  fs2.createReadStream(filePath).pipe(res);
 }
 var httpServer = http.createServer((req, res) => {
   const url = new URL(req.url || "/", `http://${req.headers.host}`);
@@ -20441,9 +20555,9 @@ var httpServer = http.createServer((req, res) => {
       res.end("Bad path");
       return;
     }
-    const filePath = path.resolve(LOCAL_ASSETS_DIR, filename);
-    const inRoot = filePath === LOCAL_ASSETS_DIR || filePath.startsWith(LOCAL_ASSETS_DIR + path.sep);
-    if (inRoot && fs.existsSync(filePath) && fs.statSync(filePath).isFile()) {
+    const filePath = path2.resolve(LOCAL_ASSETS_DIR, filename);
+    const inRoot = filePath === LOCAL_ASSETS_DIR || filePath.startsWith(LOCAL_ASSETS_DIR + path2.sep);
+    if (inRoot && fs2.existsSync(filePath) && fs2.statSync(filePath).isFile()) {
       serveFile(req, res, filePath);
     } else {
       res.writeHead(404, { "Content-Type": "text/plain" });
@@ -20640,7 +20754,7 @@ function connectUpstream() {
   upstreamReady = new Promise((resolve, reject) => {
     let token;
     try {
-      token = process.env.GOATEDIT_CONTROLLER_TOKEN || fs.readFileSync(CONTROLLER_TOKEN_FILE, "utf8").trim();
+      token = process.env.GOATEDIT_CONTROLLER_TOKEN || fs2.readFileSync(CONTROLLER_TOKEN_FILE, "utf8").trim();
     } catch {
       reject(new Error(notConnectedMessage()));
       return;
@@ -20712,7 +20826,8 @@ async function sendToBrowser(method, params = {}, projectId) {
 var LOCAL_HANDLERS = {
   list_connected_projects: async () => connectedProjects(),
   list_local_assets: async (args) => handleListLocalAssets(args),
-  generate_voiceover: async (args, projectId) => handleGenerateVoiceover(args.text, projectId)
+  generate_voiceover: async (args, projectId) => handleGenerateVoiceover(args.text, projectId),
+  find_local_file: async (args) => handleFindLocalFile(args)
 };
 async function callLocal(method, args, projectId) {
   await ensureTransport();
@@ -20821,9 +20936,26 @@ async function callTool(name, args) {
   const invalid = validateArgs(tool, forwarded);
   if (invalid) throw new McpError(ErrorCode.InvalidParams, invalid);
   const target = projectId ?? chosenProjectId;
+  if (name === "import_local_file") return importLocalFile(forwarded, target);
   const result = await sendToBrowser(tool.method, forwarded, target);
   return saveToDisk ? saveFramesToDisk(result, name) : result;
 }
+async function importLocalFile(args, target) {
+  const local = await callLocal("find_local_file", { filename: args.filename }, target).catch((err) => {
+    if (/^Several files/.test(err?.message ?? "")) throw err;
+    return null;
+  });
+  if (local) {
+    return sendToBrowser("importLocalFile", { ...args, localUrl: local.url, contentType: local.contentType, name: local.name }, target);
+  }
+  try {
+    return await sendToBrowser("importLocalFile", args, target);
+  } catch (err) {
+    throw new Error(
+      `${err?.message ?? err} It is not in this server's assets directory (${LOCAL_ASSETS_DIR}) either: put it there, or start this server with GOATEDIT_ASSETS_DIR set to its folder. list_local_assets shows what is there.`
+    );
+  }
+}
 async function runTools(args) {
   const calls = args.calls;
   if (!Array.isArray(calls) || !calls.length) {

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "goatedit-mcp",
-  "version": "1.1.0",
+  "version": "1.1.1",
   "description": "Local MCP server for the GoatEdit video editor: drive your open editor tab from Claude Code or any MCP client",
   "license": "UNLICENSED",
   "type": "module",