hermoso 0.1.12 → 0.1.13

package/mcp/client.mjs

@@ -50,6 +50,18 @@ export async function apiPut(p, body = {}) {
   return unwrap(res);
 }
 
+// A hosted-connector call (via mcp/http.mjs) has an mcpCtx store; local stdio/CLI does not. Used to REFUSE local-path
+// file reads on the hosted connector (it runs on the SERVER host, not the user's machine — an LFI/exfil vector).
+export const isRemote = () => !!mcpCtx.getStore();
+// Upload raw file BYTES to /api/upload (150MB, persists → returns {url,kind,bytes}). Overrides the JSON content-type so
+// the server reads the raw body. Lets an agent post ARBITRARY user files (not just Hermoso renders).
+export async function apiUpload(p, buf, { contentType = 'application/octet-stream', fileName = '' } = {}) {
+  const h = headers({ 'Content-Type': contentType });
+  if (fileName) h['x-file-name'] = encodeURIComponent(fileName);
+  const res = await fetch(`${API_BASE}${p}`, { method: 'POST', headers: h, body: buf });
+  return unwrap(res);
+}
+
 // /api/explore/chat streams Server-Sent-Events; collect to the terminal `done` payload {reply, results, actions}.
 export async function apiSSE(p, body = {}) {
   const res = await fetch(`${API_BASE}${p}`, { method: 'POST', headers: headers({ Accept: 'text/event-stream' }), body: JSON.stringify(body) });

package/mcp/tools.mjs

@@ -4,7 +4,8 @@
 // Spend tools hit routes guarded by gateSpend → requireAuth; locally the dev account always resolves (no auth
 // needed today), and the SAME guard becomes authoritative under real auth — so this honors no-anon-spend as-is.
 import { z } from 'zod';
-import { apiGet, apiPost, apiPut, apiSSE, submitJob, getJob, jobResult, pollJob, toRef, API_BASE, PROFILE, mcpCtx } from './client.mjs';
+import { apiGet, apiPost, apiPut, apiSSE, submitJob, getJob, jobResult, pollJob, toRef, apiUpload, isRemote, API_BASE, PROFILE, mcpCtx } from './client.mjs';
+import { readFile } from 'node:fs/promises';
 
 const JOB_TIMEOUT = +(process.env.HERMOSO_JOB_TIMEOUT_MS || 10 * 60 * 1000);
 const abs = (u) => (u && u.startsWith('/') ? API_BASE + u : u); // /generated/x.mp4 → clickable absolute URL
@@ -499,13 +500,42 @@ export function registerTools(server) {
     const pages = pg.pages || [], adAccounts = aa.adAccounts || [];
     return ok(`Pages: ${pages.map(p => p.name + (p.instagram ? ` (IG @${p.instagram.username})` : '')).join(', ') || 'none'}\nAd accounts: ${adAccounts.map(a => `${a.name} (act_${a.accountId}, ${a.currency}${a.active ? '' : ', inactive'})`).join(', ') || 'none'}`, { pages, adAccounts });
   }));
+  // Ingest an ARBITRARY user file (desktop media, etc. — nothing to do with a Hermoso render) into Hermoso and get back a
+  // durable public URL to feed post_to_meta / upload_meta_asset / create_meta_ad. This is what makes the publishing tools
+  // work on the user's OWN files, not just generated ones.
+  const EXT_MIME = { jpg: 'image/jpeg', jpeg: 'image/jpeg', png: 'image/png', gif: 'image/gif', webp: 'image/webp', mp4: 'video/mp4', mov: 'video/quicktime', webm: 'video/webm', m4v: 'video/mp4' };
+  server.registerTool('upload_file', {
+    title: 'Upload a local file → durable public URL',
+    description: 'Persist an ARBITRARY user file (image or video, up to 150MB) into Hermoso and get back a durable public URL you can pass to post_to_meta / upload_meta_asset / create_meta_ad — including files that have NOTHING to do with a Hermoso render (e.g. media on the user\'s desktop). Provide exactly ONE source: `path` (a local file — works ONLY when Hermoso runs locally over stdio/CLI; the hosted connector can\'t see the user\'s machine), or `dataUri` (a base64 data: URI — keep under ~15MB on the hosted connector). If the file is ALREADY at a public https URL you do NOT need this — pass that URL straight to post_to_meta/upload_meta_asset and the server re-hosts it safely. Returns {url, kind, bytes}.',
+    inputSchema: {
+      path: z.string().optional().describe('local filesystem path (stdio/CLI only — refused on the hosted connector)'),
+      dataUri: z.string().optional().describe('base64 data: URI of the file bytes (data:<mime>;base64,<…>)'),
+      name: z.string().optional().describe('original file name — helps pick the right extension'),
+    },
+    outputSchema: { url: z.string().optional(), kind: z.string().optional(), bytes: z.number().optional() },
+    annotations: { readOnlyHint: false, destructiveHint: false, idempotentHint: false, openWorldHint: true },
+  }, wrap(async (a) => {
+    let buf, contentType = 'application/octet-stream', fileName = a.name || '';
+    if (a.dataUri) {
+      const m = /^data:([^;]+);base64,(.*)$/s.exec(String(a.dataUri).trim());
+      if (!m) throw new Error('dataUri must be a base64 data: URI: data:<mime>;base64,<…>');
+      buf = Buffer.from(m[2], 'base64'); contentType = m[1];
+    } else if (a.path) {
+      if (isRemote()) throw new Error('`path` only works when Hermoso runs on your own machine (stdio/CLI). On the hosted connector I can\'t read your files — pass `dataUri`, or give the publishing tool a public https URL.');
+      buf = await readFile(a.path);
+      fileName = fileName || String(a.path).split(/[\\/]/).pop();
+      contentType = EXT_MIME[(fileName.split('.').pop() || '').toLowerCase()] || 'application/octet-stream';
+    } else throw new Error('Provide exactly one source: `path` (local file) or `dataUri`.');
+    const d = await apiUpload('/api/upload', buf, { contentType, fileName });
+    return ok(`Uploaded ${d.kind || 'file'} (${d.bytes || buf.length} bytes) → ${d.url}. Pass this url to post_to_meta / upload_meta_asset / create_meta_ad.`, { url: d.url, kind: d.kind, bytes: d.bytes });
+  }));
   server.registerTool('post_to_meta', {
     title: 'Post to Facebook, Instagram or Threads',
-    description: 'Publish to a connected Facebook Page, its linked Instagram, OR the brand’s Threads account — text/link/image/VIDEO (public https URLs). target:"facebook" (default) posts to the Page; target:"instagram" publishes a photo or Reel to the linked IG business account (needs an image or video); target:"threads" posts to the connected Threads account (text, image, or video). Perfect for shipping a finished Hermoso ad straight to the brand’s socials. This PUBLISHES immediately — confirm the copy + media with the user first. Needs a connected Meta account (Settings ▸ Connectors ▸ Meta) with posting permission; Threads needs its own connection (Settings ▸ Connectors ▸ Threads).',
+    description: 'Publish to a connected Facebook Page, its linked Instagram, OR the brand’s Threads account — text/link/image/VIDEO. target:"facebook" (default) posts to the Page; target:"instagram" publishes a photo or Reel to the linked IG business account (needs an image or video); target:"threads" posts to the connected Threads account (text, image, or video). Works with ANY media — a finished Hermoso ad OR an arbitrary user file: imageUrl/videoUrl accept a public https URL, a data: URI, or a Hermoso /generated path; for a LOCAL file (e.g. on the user’s desktop) call upload_file first and pass the url it returns. This PUBLISHES immediately — confirm the copy + media with the user first. Needs a connected Meta account (Settings ▸ Connectors ▸ Meta) with posting permission; Threads needs its own connection.',
     inputSchema: {
       message: z.string().optional().describe('post text / caption'),
-      imageUrl: z.string().optional().describe('public https:// image URL'),
-      videoUrl: z.string().optional().describe('public https:// video URL (FB video post / IG Reel)'),
+      imageUrl: z.string().optional().describe('public https URL, a data: URI, or a Hermoso /generated path (upload_file gives you one for a local file)'),
+      videoUrl: z.string().optional().describe('public https URL, data: URI, or /generated path — FB video post / IG Reel'),
       link: z.string().optional().describe('a URL to attach (FB text post only)'),
       target: z.enum(['facebook', 'instagram', 'threads']).optional().describe('default facebook; instagram → the Page’s linked IG; threads → the brand’s connected Threads account'),
       pageId: z.string().optional().describe('target Page id (from list_meta_pages); omit = first Page'),
@@ -518,18 +548,20 @@ export function registerTools(server) {
   }));
   server.registerTool('upload_meta_asset', {
     title: 'Upload an asset to a Meta ad account',
-    description: 'Upload a finished creative (image or video, public https URL) into a connected ad account’s ASSET LIBRARY so the user — or a later ad-build step — can use it in their OWN campaigns. Great when the user just wants Hermoso to hand off the creative into Meta, not run the campaign. Image returns an image hash; video returns a video id (reference these when building an ad). Pass adAccountId from list_meta_pages.',
+    description: 'Upload creative(s) — a finished Hermoso ad OR arbitrary user files (e.g. a folder of media from the user’s desktop) — into a connected ad account’s ASSET LIBRARY so the user or a later ad-build step can use them in their OWN campaigns. Pass `url` for one file, or `urls` (up to 20) to BULK-upload in a single call. Each accepts a public https URL, a data: URI, or a Hermoso /generated path; for LOCAL files call upload_file first and pass the url(s) it returns. Image → image hash; video → video id. Pass adAccountId from list_meta_pages.',
     inputSchema: {
       adAccountId: z.string().describe('ad account id (digits or act_… — from list_meta_pages)'),
-      url: z.string().describe('public https:// image or video URL'),
+      url: z.string().optional().describe('a single public https URL / data: URI / /generated path'),
+      urls: z.array(z.string()).optional().describe('up to 20 media URLs/paths for a one-call BULK upload'),
       kind: z.enum(['image', 'video']).optional().describe('inferred from the URL if omitted'),
       name: z.string().optional().describe('a label for the asset'),
     },
-    outputSchema: { ok: z.boolean().optional(), kind: z.string().optional(), hash: z.string().optional(), videoId: z.string().optional() },
+    outputSchema: { ok: z.boolean().optional(), kind: z.string().optional(), hash: z.string().optional(), videoId: z.string().optional(), assets: z.array(z.object({ kind: z.string().optional(), hash: z.string().optional(), videoId: z.string().optional() })).optional() },
     annotations: { readOnlyHint: false, destructiveHint: false, idempotentHint: false, openWorldHint: true },
   }, wrap(async (a) => {
     const d = await apiPost('/api/meta/upload-asset', a);
-    return ok(`Uploaded ${d.kind} to the ad account library${d.hash ? ` (image hash ${d.hash})` : d.videoId ? ` (video id ${d.videoId})` : ''}. ${d.note || ''}`, d);
+    const summary = d.assets ? `Uploaded ${d.assets.length} asset${d.assets.length > 1 ? 's' : ''} to the ad account library.` : `Uploaded ${d.kind} to the ad account library${d.hash ? ` (image hash ${d.hash})` : d.videoId ? ` (video id ${d.videoId})` : ''}.`;
+    return ok(`${summary} ${d.note || ''}`.trim(), d);
   }));
   server.registerTool('create_meta_campaign', {
     title: 'Create a Meta ad campaign (paused)',

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "hermoso",
-  "version": "0.1.12",
+  "version": "0.1.13",
   "mcpName": "io.github.hermoso-ai/hermoso",
   "description": "Generate finished VIDEO ADS, image ads and UGC avatar ads for any brand with AI — and spy on competitor ads across the Meta, Google and LinkedIn ad libraries plus TikTok/Instagram/YouTube organic. MCP server, CLI and Claude skills for Hermoso, the AI ad studio: brand onboarding, 30+ image/video models, finished-ad pipeline (script, voiceover, music, brand end card), ad scoring and competitor teardowns.",
   "type": "module",