instantclips-mcp 1.3.0 → 1.5.0

package/README.es.md

@@ -94,7 +94,10 @@ Aplicación de Claude: añade un conector personalizado con esta dirección e in
 lo pida. ChatGPT en la web: activa el modo de desarrollador en Ajustes, Apps, Avanzado y añade la
 dirección como conector; en un espacio de trabajo Business o Enterprise, un administrador la
 publica como aplicación para todo el equipo. La aplicación de escritorio de ChatGPT acepta la misma
-dirección en Ajustes, Servidores MCP, y la comparte con Codex.
+dirección en Ajustes, Servidores MCP, y la comparte con Codex. En ChatGPT, adjunta las fotos del
+producto a la conversación y pide el vídeo: el plugin recibe los adjuntos directamente
+(`image_files` en `create_product_from_images`, `add_image_files` en `update_product`), así que
+allí las fotos no necesitan adaptador ni token.
 
 ### Cualquier otro cliente o agente MCP
 
@@ -162,6 +165,16 @@ El token solo se acepta mediante `INSTANTCLIPS_TOKEN`, nunca como argumento de l
 por lo que no aparece en la lista de procesos. Es obligatorio para llamar a una herramienta, pero
 no para `initialize`, `ping` ni `tools/list`. Se requiere Node.js 20 o posterior.
 
+Fotos en este equipo: el adaptador puede subirlas por sí mismo, así que se puede hacer un vídeo
+con archivos que nunca salieron de tu portátil. A través del adaptador, `create_product_from_images`
+acepta `image_paths` (rutas a los archivos, hasta 9, de 8 MB cada uno) en lugar de `image_urls`, y
+`update_product` acepta `add_image_paths`. Los archivos se empaquetan y se envían directamente a
+InstantClips como fotos del producto; no se descarga nada de ningún sitio. Arrastra los archivos a
+un cliente que le pase sus rutas al asistente (Claude Code, Cursor, VS Code, agentes de terminal) y
+di qué quieres crear. Envía `image_paths` solo: si en la misma llamada van también `image_urls`, el
+adaptador la rechaza en lugar de descartar las URL; añade las fotos alojadas después con
+`update_product`.
+
 ## Instrucciones para empezar
 
 Cinco para arrancar. Sustituye el enlace o el nombre del producto.
@@ -260,6 +273,20 @@ de nombres de marca `ai.instantclips`; no lo sustituyas por un nombre `io.github
 firma no se guarda en el repositorio: `.gitignore` cubre `*.pem`, y una clave privada incluida en un
 commit es una clave publicada.
 
+Inicia sesión justo antes de publicar — el token del registro caduca en menos de una hora — y el
+dominio se verifica por HTTP, no por DNS: `instantclips.ai/.well-known/mcp-registry-auth`, en el
+sitio de marketing, sirve la mitad pública de esta clave (`v=MCPv1; k=ed25519; p=…`); no hay
+registro TXT, así que `login dns` falla con "no MCP public key found".
+
+```bash
+mcp-publisher login http --domain instantclips.ai \
+  --private-key "$(openssl pkey -in key.pem -text -noout | awk '/priv:/{f=1;next} /pub:/{f=0} f' | tr -d ' :\n')"
+mcp-publisher publish
+```
+
+`test/shim.test.js` fija la versión del servidor de la instantánea y la `version` de `server.json`;
+cada publicación actualiza ambas.
+
 `glama.json` es el archivo independiente y específico de Glama que permite reclamar allí la ficha.
 Un servidor perteneciente a una organización, en lugar de una cuenta personal, solo puede
 reclamarse si ese archivo está presente.

package/README.md

@@ -88,6 +88,9 @@ Claude app: add a custom connector with this address and sign in when it asks. C
 web: turn on Developer mode under Settings, Apps, Advanced, then add the address as a connector;
 on a Business or Enterprise workspace an admin publishes it as an app for everyone instead. The
 ChatGPT desktop app takes the same address under Settings, MCP servers, and shares it with Codex.
+In ChatGPT, attach the product photos to the conversation and ask for the video: the plugin takes
+attachments directly (`image_files` on `create_product_from_images`, `add_image_files` on
+`update_product`), so photos need no adapter and no token there.
 
 ### Any other MCP client or agent
 
@@ -152,6 +155,15 @@ The token is accepted only through `INSTANTCLIPS_TOKEN`, never as a command-line
 does not appear in the process list. It is required for tool calls, but not for `initialize`,
 `ping`, or `tools/list`. Node.js 20 or newer is required.
 
+Photos on this machine: the adapter can upload them itself, so a video can be made from files
+that never left your laptop. Through the adapter, `create_product_from_images` takes `image_paths`
+(paths to the files, up to 9, 8 MB each) in place of `image_urls`, and `update_product` takes
+`add_image_paths`. The files are packaged and posted straight to InstantClips as the product's
+photos — nothing is downloaded from anywhere. Drag the files into a client that hands the
+assistant their paths (Claude Code, Cursor, VS Code, terminal agents) and say what you want made.
+Send `image_paths` on its own: with hosted `image_urls` in the same call the adapter refuses
+rather than dropping the URLs; add hosted photos afterwards with `update_product`.
+
 ## Starter prompts
 
 Five to begin with. Swap in a link or a product name.
@@ -242,6 +254,20 @@ Publish the npm package first, then re-publish this same registry entry with
 `ai.instantclips` namespace; do not replace it with an `io.github.*` name. The signing key stays out
 of the repository — `.gitignore` covers `*.pem`, and a committed private key is a published one.
 
+Log in right before publishing — the registry token expires within the hour — and the domain is
+verified over HTTP, not DNS: `instantclips.ai/.well-known/mcp-registry-auth` on the marketing site
+serves this key's public half (`v=MCPv1; k=ed25519; p=…`), and there is no TXT record, so
+`login dns` fails with "no MCP public key found".
+
+```bash
+mcp-publisher login http --domain instantclips.ai \
+  --private-key "$(openssl pkey -in key.pem -text -noout | awk '/priv:/{f=1;next} /pub:/{f=0} f' | tr -d ' :\n')"
+mcp-publisher publish
+```
+
+`test/shim.test.js` pins the snapshot's server version and `server.json`'s `version`; a release
+moves both.
+
 `glama.json` is the separate, Glama-specific file that claims the listing there. A server under an
 organisation rather than a personal account can only be claimed with that file present.
 It carries ownership only. In Glama's Dockerfile form, use build steps

package/README.zh-CN.md

@@ -78,7 +78,9 @@ url = "https://app.instantclips.ai/mcp"
 
 Claude 应用：用这个地址添加自定义连接器，按提示登录。网页版 ChatGPT：在 设置 › Apps › 高级 中
 开启开发者模式，再把地址添加为连接器；Business 或 Enterprise 工作区则由管理员发布为全员可用的
-应用。ChatGPT 桌面版在 设置 › MCP 服务器 中填入同一地址，并与 Codex 共享配置。
+应用。ChatGPT 桌面版在 设置 › MCP 服务器 中填入同一地址，并与 Codex 共享配置。在 ChatGPT 里，把商品照片
+作为附件添加到对话中并提出需求即可：插件会直接接收附件（`create_product_from_images` 的 `image_files`、
+`update_product` 的 `add_image_files`），因此在那里传照片不需要适配器，也不需要令牌。
 
 ### 其他 MCP 客户端或智能体
 
@@ -139,6 +141,13 @@ INSTANTCLIPS_TOKEN="your-token" npx -y instantclips-mcp --check --json
 令牌只能通过 `INSTANTCLIPS_TOKEN` 提供，不能作为命令行参数传入，因此不会出现在进程列表中。
 工具调用需要令牌，但 `initialize`、`ping` 和 `tools/list` 不需要。需要 Node.js 20 或更高版本。
 
+本机上的照片：适配器可以自行上传，因此可以用从未离开你笔记本电脑的文件制作视频。通过适配器，
+`create_product_from_images` 可用 `image_paths`（文件路径，最多 9 个，每个不超过 8 MB）代替
+`image_urls`，`update_product` 可用 `add_image_paths`。文件会被打包并直接发送到 InstantClips 作为商品照片，
+不会从任何地方下载。把文件拖进会把路径交给助手的客户端（Claude Code、Cursor、VS Code、终端智能体），
+然后说出你想要的视频即可。`image_paths` 请单独发送：同一次调用里若还带有 `image_urls`，适配器会拒绝，
+而不是悄悄丢弃这些 URL；托管照片可以之后用 `update_product` 添加。
+
 ## 入门提示语
 
 先从这五句开始，替换成你的链接或商品名即可。
@@ -224,6 +233,18 @@ npm 软件包中的 `mcpName` 必须与该注册表名称完全一致。仓库
 域名身份验证会保留品牌命名空间 `ai.instantclips`；请勿将其替换为 `io.github.*` 名称。签名密钥不
 存放在仓库中：`.gitignore` 已忽略 `*.pem`，因为一旦提交私钥，就等于公开了私钥。
 
+发布前再登录一次——注册表令牌不到一小时就会过期——域名验证走的是 HTTP 而非 DNS：营销站点上的
+`instantclips.ai/.well-known/mcp-registry-auth` 提供这把密钥的公钥部分（`v=MCPv1; k=ed25519; p=…`），
+没有 TXT 记录，所以 `login dns` 会报 "no MCP public key found"。
+
+```bash
+mcp-publisher login http --domain instantclips.ai \
+  --private-key "$(openssl pkey -in key.pem -text -noout | awk '/priv:/{f=1;next} /pub:/{f=0} f' | tr -d ' :\n')"
+mcp-publisher publish
+```
+
+`test/shim.test.js` 固定了快照的服务器版本和 `server.json` 的 `version`；每次发布都要同时更新这两处。
+
 `glama.json` 是 Glama 专用的独立文件，用于认领该平台上的条目。归属于组织而非个人账户的服务器，
 只有在该文件存在时才能完成认领。
 该文件只用于证明所有权。在 Glama 的 Dockerfile 表单中，将构建步骤设为

package/bin/instantclips-mcp.js

@@ -1,6 +1,8 @@
 #!/usr/bin/env node
 
 import { readFileSync } from "node:fs";
+import { readFile } from "node:fs/promises";
+import { basename, extname } from "node:path";
 
 import {
   Client,
@@ -129,6 +131,200 @@ function writeDiagnostic(failure) {
   process.stderr.write(`instantclips-mcp: ${failure.message}\n`);
 }
 
+// ---- Photos on this machine ------------------------------------------------
+//
+// The hosted server cannot read the caller's disk; this adapter runs on it and
+// can. So two parameters exist only here: `image_paths` on
+// create_product_from_images and `add_image_paths` on update_product. They
+// are added to the advertised schemas at serve time and handled before any
+// proxying, which keeps the bundled manifest exactly what the hosted server
+// serves. The files are read and posted as multipart to the hosted upload
+// endpoints under the same bearer — packaged and uploaded, never downloaded
+// from anywhere.
+//
+// The hosted server also takes the conversation's attachments — `image_files`
+// and `add_image_files`, declared for ChatGPT through `_meta["openai/fileParams"]`
+// — which a stdio client has no way to fill. Those two parameters and the
+// `_meta` are removed from the schemas served here, so the model sees one
+// local-file parameter and not a hosted one it cannot use. A call that sends
+// `image_paths` together with hosted URLs is refused rather than uploading
+// the files and dropping the URLs, which is what 1.4.0 did.
+const MAX_LOCAL_IMAGES = 9;
+const MAX_LOCAL_IMAGE_BYTES = 8 * 1024 * 1024;
+const LOCAL_IMAGE_TYPES = {
+  ".jpg": "image/jpeg",
+  ".jpeg": "image/jpeg",
+  ".png": "image/png",
+  ".webp": "image/webp",
+  ".gif": "image/gif",
+  ".bmp": "image/bmp",
+  ".tif": "image/tiff",
+  ".tiff": "image/tiff",
+  ".heic": "image/heic",
+  ".heif": "image/heif",
+};
+const LOCAL_UPLOAD_PARAMETERS = {
+  create_product_from_images: {
+    name: "image_paths",
+    replaces: "image_urls",
+    hides: "image_files",
+    description:
+      `Paths to photos on this machine, up to ${MAX_LOCAL_IMAGES}, ${MAX_LOCAL_IMAGE_BYTES / 1024 / 1024} MB each. ` +
+      "This adapter uploads the files itself; use it instead of image_urls for local photos, never with them.",
+    note:
+      "Through this adapter, `image_paths` (files on this machine) replaces `image_urls`; the files are uploaded directly. " +
+      "Send one or the other, not both.",
+  },
+  update_product: {
+    name: "add_image_paths",
+    hides: "add_image_files",
+    description:
+      `Paths to photos on this machine to add, up to ${MAX_LOCAL_IMAGES}, ${MAX_LOCAL_IMAGE_BYTES / 1024 / 1024} MB each. ` +
+      "This adapter uploads the files itself. Send it with product_id alone; other fields go in a separate call.",
+    note:
+      "Through this adapter, `add_image_paths` (files on this machine) adds photos; the files are uploaded directly.",
+  },
+};
+
+function withLocalUploads(tools) {
+  return tools.map((tool) => {
+    const extra = LOCAL_UPLOAD_PARAMETERS[tool.name];
+    if (!extra) return tool;
+    const schema = tool.inputSchema || { type: "object", properties: {} };
+    const { [extra.hides]: _hidden, ...kept } = schema.properties || {};
+    const properties = {
+      ...kept,
+      [extra.name]: { type: "array", items: { type: "string" }, minItems: 1, description: extra.description },
+    };
+    const inputSchema = { ...schema, properties };
+    if (extra.replaces && Array.isArray(schema.required)) {
+      inputSchema.required = schema.required.filter((key) => key !== extra.replaces);
+    }
+    const { _meta, ...rest } = tool;
+    return {
+      ...rest,
+      ...withoutFileParam(_meta, extra.hides),
+      description: `${tool.description}\n\n${extra.note}`,
+      inputSchema,
+    };
+  });
+}
+
+// → `{ _meta }` with the hidden file parameter's declaration removed, or `{}`
+// when nothing else was in it.
+function withoutFileParam(meta, hidden) {
+  if (!meta) return {};
+  const { "openai/fileParams": fileParams, ...others } = meta;
+  const remaining = (fileParams || []).filter((name) => name !== hidden);
+  const kept = remaining.length ? { ...others, "openai/fileParams": remaining } : others;
+  return Object.keys(kept).length ? { _meta: kept } : {};
+}
+
+function hasPaths(value) {
+  return Array.isArray(value) && value.length > 0;
+}
+
+// A CliError, so safeFailure relays the message verbatim. Built at call
+// time: CliError is declared further down and class declarations do not hoist.
+function uploadError(message) {
+  return new CliError("upload_failed", message, 1);
+}
+
+async function appendLocalImages(form, paths) {
+  const list = paths.map((path) => String(path).trim()).filter(Boolean);
+  if (list.length === 0) throw uploadError("No image paths were given.");
+  if (list.length > MAX_LOCAL_IMAGES) {
+    throw uploadError(`At most ${MAX_LOCAL_IMAGES} images per call.`);
+  }
+  for (const path of list) {
+    const type = LOCAL_IMAGE_TYPES[extname(path).toLowerCase()];
+    if (!type) {
+      throw uploadError(`${path} is not an image type the video model takes (jpg, png, webp, gif, bmp, tiff, heic).`);
+    }
+    let bytes;
+    try {
+      bytes = await readFile(path);
+    } catch (error) {
+      throw uploadError(`${path}: ${error.code === "ENOENT" ? "no such file" : error.message}.`);
+    }
+    if (bytes.byteLength > MAX_LOCAL_IMAGE_BYTES) {
+      throw uploadError(`${path} is larger than ${MAX_LOCAL_IMAGE_BYTES / 1024 / 1024} MB.`);
+    }
+    form.append("images[]", new Blob([bytes], { type }), basename(path));
+  }
+}
+
+function uploadsUrl(endpoint, suffix) {
+  const base = endpoint.pathname.replace(/\/$/, "");
+  return new URL(`${base}/${suffix}`, endpoint);
+}
+
+async function uploadForm(config, suffix, form) {
+  if (!config.token) {
+    throw new CliError(
+      "missing_token",
+      `INSTANTCLIPS_TOKEN is required for tool calls. Create a token at ${SETTINGS_URL}.`,
+      78,
+    );
+  }
+  const response = await fetch(uploadsUrl(config.endpoint, suffix), {
+    method: "POST",
+    headers: { Authorization: `Bearer ${config.token}` },
+    body: form,
+  });
+  const text = await response.text();
+  if (response.status === 401) {
+    const error = new Error(`401 ${text}`);
+    error.data = { status: 401 };
+    throw error;
+  }
+  if (!response.ok) return { content: [{ type: "text", text }], isError: true };
+  // The hosted tools declare output schemas, and a validating client refuses
+  // a result that has one but no structuredContent — so the upload's payload
+  // (the same product object get_product returns) travels both ways.
+  const result = { content: [{ type: "text", text }], isError: false };
+  try {
+    const parsed = JSON.parse(text);
+    if (parsed && typeof parsed === "object" && !Array.isArray(parsed)) result.structuredContent = parsed;
+  } catch {
+    // Not JSON: the text block stands alone, as it always did.
+  }
+  return result;
+}
+
+// → a tool result when the call is one this adapter answers itself, else null.
+async function callLocally(config, params) {
+  const args = params.arguments ?? {};
+  if (params.name === "create_product_from_images" && hasPaths(args.image_paths)) {
+    const hosted = ["image_urls", "image_files"].filter((key) => Array.isArray(args[key]) && args[key].length > 0);
+    if (hosted.length > 0) {
+      throw uploadError(
+        `Send image_paths alone: ${hosted.join(", ")} would be dropped. Create the product from image_paths, ` +
+          "then add hosted photos with update_product's add_image_urls.",
+      );
+    }
+    const form = new FormData();
+    for (const key of ["name", "description", "creator_note", "brand_id"]) {
+      if (args[key] !== undefined && args[key] !== null && args[key] !== "") form.append(key, String(args[key]));
+    }
+    await appendLocalImages(form, args.image_paths);
+    return uploadForm(config, "products", form);
+  }
+  if (params.name === "update_product" && hasPaths(args.add_image_paths)) {
+    const others = Object.keys(args).filter((key) => !["product_id", "add_image_paths"].includes(key));
+    if (!args.product_id) throw uploadError("product_id is required with add_image_paths.");
+    if (others.length > 0) {
+      throw uploadError(
+        `Send add_image_paths with product_id alone; ${others.join(", ")} go in a separate update_product call.`,
+      );
+    }
+    const form = new FormData();
+    await appendLocalImages(form, args.add_image_paths);
+    return uploadForm(config, `products/${encodeURIComponent(String(args.product_id))}/images`, form);
+  }
+  return null;
+}
+
 async function startBridge(config) {
   const stdio = new StdioServerTransport();
   const server = new Server(manifest.serverInfo, {
@@ -161,11 +357,13 @@ async function startBridge(config) {
   };
 
   server.setRequestHandler("tools/list", async () => ({
-    tools: manifest.tools,
+    tools: withLocalUploads(manifest.tools),
   }));
 
   server.setRequestHandler("tools/call", async (request) => {
     try {
+      const local = await callLocally(config, request.params);
+      if (local) return local;
       const client = await connectRemote();
       return await client.callTool(request.params);
     } catch (error) {