makaron-cli 0.6.0 → 0.6.2

package/README.md

@@ -22,15 +22,17 @@ npm install -g makaron-cli
 **Option B: Agent Self-Registration (no human required)**
 ```bash
 # Step 1: Get challenge
-curl -X POST https://www.makaron.app/api/agent/register
+npx makaron-cli register --json
+# → { "challenge_id": "...", "challenge": "...", "expected_format": "numeric, round to 2 decimal places" }
 
-# Step 2: Solve the obfuscated math problem and verify
-curl -X POST https://www.makaron.app/api/agent/register/verify \
-  -H "Content-Type: application/json" \
-  -d '{"challenge_id": "...", "answer": "34.5"}'
-# → { "api_key": "mk_live_...", "credits": 500 }
+# Step 2: Solve the math problem and verify
+npx makaron-cli register --verify --challenge-id <id> --answer 34.5
+# → Key saved to ~/.makaron/auth.json
+# → { "api_key": "mk_live_...", "credits": N, "claim_url": "..." }
 ```
 
+After registration, the key is saved locally — no need to export `MAKARON_API_KEY`.
+
 Discovery endpoint (returns full registration flow + CLI usage as JSON):
 ```bash
 curl https://www.makaron.app/api/agent/register
@@ -46,13 +48,12 @@ Verify: `npx makaron-cli list` should show projects.
 
 ### Let a human claim your account
 
-After registering, you can generate a link for a human to link your API key to their account:
+After registering, generate a link for a human to link your API key to their account:
 ```bash
-curl -X POST https://www.makaron.app/api/agent/claim \
-  -H "Authorization: Bearer mk_live_your_key"
+npx makaron-cli claim
 # → { "claim_url": "https://www.makaron.app/claim?token=clm_..." }
 ```
-Share the `claim_url` with a human. They log in and the API key gets linked to their account.
+Share the `claim_url` with a human. They log in and the API key gets linked to their account. Claim links are valid for 7 days. Run `claim` again anytime to get a new link.
 
 ## Core Workflow
 

package/SKILL.md

@@ -21,23 +21,23 @@ Makaron is a multimodal AI creative agent. You talk to it via `makaron chat`, an
 **Option B: Self-Registration (no human required)**
 ```bash
 # Step 1: Get challenge
-curl -X POST https://www.makaron.app/api/agent/register
-# → { "challenge_id": "uuid", "challenge": "obfuscated math problem" }
+npx makaron-cli register --json
+# → { "challenge_id": "...", "challenge": "...", "expected_format": "numeric, round to 2 decimal places" }
 
 # Step 2: Solve and verify
-curl -X POST https://www.makaron.app/api/agent/register/verify \
-  -H "Content-Type: application/json" \
-  -d '{"challenge_id": "...", "answer": "34.5"}'
-# → { "api_key": "mk_live_...", "credits": 500 }
-
-# Step 3: (Optional) Let a human claim this account
-curl -X POST https://www.makaron.app/api/agent/claim \
-  -H "Authorization: Bearer mk_live_your_key"
-# → { "claim_url": "..." } — share with human to link key to their account
+npx makaron-cli register --verify --challenge-id <id> --answer 34.5
+# → Key saved to ~/.makaron/auth.json
+# → { "api_key": "mk_live_...", "credits": N, "claim_url": "..." }
+
+# (Optional) Let a human claim this account
+npx makaron-cli claim
+# → { "claim_url": "..." } — share with human to link key to their account (valid 7 days)
 ```
 
 Discovery endpoint: `GET https://www.makaron.app/api/agent/register` — returns full registration flow + CLI usage as JSON.
 
+After self-registration the key is saved locally — no need to export `MAKARON_API_KEY`.
+
 ```bash
 export MAKARON_API_KEY=mk_live_xxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxx
 ```

package/bin/makaron.mjs

@@ -499,15 +499,11 @@ async function createProject(baseUrl, headers, opts) {
   if (opts.imageUrls?.length) {
     body.imageUrls = opts.imageUrls;
   } else if (opts.images?.length) {
-    body.imageBase64s = opts.images.map(f => {
-      const buf = fs.readFileSync(f);
-      return `data:image/jpeg;base64,${buf.toString('base64')}`;
-    });
+    body.imageBase64s = opts.images.map(f => readImageAsDataUrl(f));
   } else if (opts.imageUrl) {
     body.imageUrl = opts.imageUrl;
   } else if (opts.image) {
-    const buf = fs.readFileSync(opts.image);
-    body.imageBase64 = `data:image/jpeg;base64,${buf.toString('base64')}`;
+    body.imageBase64 = readImageAsDataUrl(opts.image);
   }
   if (opts.title) body.title = opts.title;
 
@@ -567,12 +563,43 @@ async function callMcpTool(baseUrl, headers, toolName, args) {
   return data.result;
 }
 
+// ─── Image Validation ────────────────────────────────────────────────────────
+
+function detectMime(buf) {
+  if (buf[0]===0xFF && buf[1]===0xD8) return 'image/jpeg';
+  if (buf[0]===0x89 && buf[1]===0x50 && buf[2]===0x4E && buf[3]===0x47) return 'image/png';
+  if (buf[0]===0x52 && buf[1]===0x49 && buf[2]===0x46 && buf[3]===0x46 && buf[8]===0x57 && buf[9]===0x45 && buf[10]===0x42 && buf[11]===0x50) return 'image/webp';
+  if (buf[0]===0x47 && buf[1]===0x49 && buf[2]===0x46) return 'image/gif';
+  if (buf.length >= 8 && buf[4]===0x66 && buf[5]===0x74 && buf[6]===0x79 && buf[7]===0x70) return 'image/heic';
+  return null;
+}
+
+function validateImage(filePath) {
+  if (!fs.existsSync(filePath)) return { error: `File not found: ${filePath}` };
+  const stat = fs.statSync(filePath);
+  if (stat.size === 0) return { error: `File is empty: ${filePath}` };
+  if (stat.size > 10 * 1024 * 1024) return { error: `File too large: ${(stat.size/1024/1024).toFixed(1)}MB (max 10MB). Resize before uploading.` };
+  const header = Buffer.alloc(12);
+  const fd = fs.openSync(filePath, 'r');
+  fs.readSync(fd, header, 0, 12, 0);
+  fs.closeSync(fd);
+  const mime = detectMime(header);
+  if (!mime) return { error: `Unsupported format: ${path.extname(filePath)}. Supported: JPEG, PNG, WebP` };
+  if (mime === 'image/heic') return { error: `HEIC format not supported via CLI. Convert first:\n   sips -s format jpeg "${filePath}" --out output.jpg` };
+  if (mime === 'image/gif') return { error: `GIF format not supported. Convert to JPEG or PNG first.` };
+  return { ok: true, mime };
+}
+
+function readImageAsDataUrl(filePath) {
+  const v = validateImage(filePath);
+  if (!v.ok) { console.error(`❌ Cannot upload: ${path.basename(filePath)}\n   ${v.error}`); process.exit(1); }
+  const buf = fs.readFileSync(filePath);
+  return `data:${v.mime};base64,${buf.toString('base64')}`;
+}
+
 function imageToArg(imgPath) {
   if (imgPath.startsWith('http://') || imgPath.startsWith('https://')) return imgPath;
-  const buf = fs.readFileSync(imgPath);
-  const ext = imgPath.split('.').pop()?.toLowerCase();
-  const mime = { jpg: 'image/jpeg', jpeg: 'image/jpeg', png: 'image/png', webp: 'image/webp' }[ext] || 'image/jpeg';
-  return `data:${mime};base64,${buf.toString('base64')}`;
+  return readImageAsDataUrl(imgPath);
 }
 
 function saveMcpImage(result, outputPath) {
@@ -659,8 +686,7 @@ if (command === 'login') {
       // Create project with images
       const base64s = chatImages.map(imgPath => {
         process.stderr.write(`📤 Uploading ${path.basename(imgPath)}...\n`);
-        const buf = fs.readFileSync(imgPath);
-        return `data:image/jpeg;base64,${buf.toString('base64')}`;
+        return readImageAsDataUrl(imgPath);
       });
       const res = await fetch(`${baseUrl}/api/projects/create`, {
         method: 'POST',
@@ -678,8 +704,7 @@ if (command === 'login') {
   if (chatImages.length > 0) {
     const base64s = chatImages.map(imgPath => {
       process.stderr.write(`📤 Uploading ${path.basename(imgPath)}...\n`);
-      const buf = fs.readFileSync(imgPath);
-      return `data:image/jpeg;base64,${buf.toString('base64')}`;
+      return readImageAsDataUrl(imgPath);
     });
     const res = await fetch(`${baseUrl}/api/projects/create`, {
       method: 'POST',

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "makaron-cli",
-  "version": "0.6.0",
+  "version": "0.6.2",
   "description": "Talk to Makaron Agent from the terminal — create projects, edit images, generate videos",
   "type": "module",
   "bin": {