sbuilder-mcp 0.23.0 → 0.23.1

package/CHANGELOG.md

@@ -6,6 +6,17 @@ All notable changes to this project are documented in this file.
 The format is based on [Keep a Changelog](https://keepachangelog.com/en/1.1.0/),
 and this project adheres to [Semantic Versioning](https://semver.org/spec/v2.0.0.html).
 
+## [0.23.1] - 2026-09-10
+
+### Added
+- sb_media_upload now asks the platform to fetch a URL source itself (`POST /api/media/{siteId}/from-url`) before falling back to downloading and re-uploading the bytes, so the file makes one network hop instead of two and its content type comes from the origin's own answer instead of being guessed from a header or extension.
+
+### Changed
+- sb_media_upload now raises rather than working around it when the platform refuses a URL source as `remote_blocked` (an address outside the public internet, such as a private range or the cloud metadata endpoint), since fetching that same URL from this server's own machine would defeat the platform's guard rather than respect it.
+
+### Fixed
+- sb_media_upload now reports the platform's own reason when it cannot reach a URL source (for example, "www.blender.org answered 404") instead of the generic "the platform could not read it".
+
 ## [0.23.0] - 2026-09-10
 
 ### Added

package/CHANGELOG.vi.md

@@ -6,6 +6,17 @@ Mọi thay đổi đáng chú ý của dự án được ghi lại trong file n
 Định dạng dựa trên [Keep a Changelog](https://keepachangelog.com/en/1.1.0/),
 và dự án tuân theo [Semantic Versioning](https://semver.org/spec/v2.0.0.html).
 
+## [0.23.1] - 2026-09-10
+
+### Added
+- sb_media_upload giờ yêu cầu chính nền tảng tải nguồn URL trước (`POST /api/media/{siteId}/from-url`) rồi mới lùi về cách cũ là tải xuống rồi upload lại, nên file chỉ đi một chặng mạng thay vì hai, và content type được lấy từ câu trả lời của chính nguồn thay vì đoán từ header hay phần mở rộng.
+
+### Changed
+- sb_media_upload giờ báo lỗi thay vì tìm cách lách khi nền tảng từ chối một nguồn URL với mã `remote_blocked` (địa chỉ không thuộc internet công khai, như dải private hoặc endpoint metadata của cloud), vì việc tự tải URL đó từ máy chạy server này sẽ phá vỡ lớp bảo vệ của nền tảng thay vì tuân theo nó.
+
+### Fixed
+- sb_media_upload giờ báo đúng lý do của chính nền tảng khi không tải được một nguồn URL (ví dụ "www.blender.org answered 404") thay vì thông báo chung "the platform could not read it".
+
 ## [0.23.0] - 2026-09-10
 
 ### Added

package/dist/transport/media.js

@@ -41,8 +41,87 @@ function typeForName(name) {
     const dot = name.lastIndexOf('.');
     return dot < 0 ? '' : (TYPE_BY_EXT[name.slice(dot).toLowerCase()] ?? '');
 }
+/**
+ * Ask the platform to fetch the URL itself.
+ *
+ * Returns the asset when the server took it, or null when the ROUTE is not
+ * there — an older deployment — which is the one case the caller may answer by
+ * downloading the bytes and posting them the old way.
+ *
+ * A REFUSAL IS TERMINAL, and that is a security rule rather than tidiness. The
+ * server refuses an address that is not on the public internet (`remote_blocked`
+ * — loopback, private ranges, the cloud metadata endpoint), and a client that
+ * answered by fetching that same URL from its OWN machine and uploading the
+ * bytes would walk straight around the guard. The agent's network is not the
+ * server's, but "the caller does it instead" is exactly the bypass the check
+ * exists to prevent, so the error is raised rather than worked around.
+ */
+async function fromUrl(ctx, siteId, url, source) {
+    const doFetch = ctx.fetchImpl ?? fetch;
+    const res = await doFetch(`${ctx.base.replace(/\/$/, '')}/api/media/${encodeURIComponent(siteId)}/from-url`, {
+        method: 'POST',
+        headers: {
+            Authorization: `Bearer ${siteToken(ctx)}`,
+            'Content-Type': 'application/json',
+            Accept: 'application/json',
+            ...identityHeaders(),
+        },
+        body: JSON.stringify({
+            url,
+            ...(source.name ? { name: source.name } : {}),
+            ...(source.folderId ? { folderId: source.folderId } : {}),
+        }),
+    });
+    // 404/405 is "this build has no such route". Anything else is an answer.
+    if (res.status === 404 || res.status === 405)
+        return null;
+    const raw = await res.text();
+    let parsed = {};
+    try {
+        parsed = raw ? JSON.parse(raw) : {};
+    }
+    catch {
+        // A build that routes this path to something else entirely. Fall back rather
+        // than reporting a parse error the caller cannot act on.
+        return null;
+    }
+    if (!res.ok) {
+        const env = (parsed ?? {});
+        if (env.code === 'remote_blocked') {
+            throw new ApiError(res.status, 'remote_blocked', `sbuilder: the platform refuses to fetch ${url} — it is not an address on the public ` +
+                'internet. This server will not fetch it on the platform\'s behalf either: that would ' +
+                'walk around the check rather than satisfy it. Give a public URL, or upload the file ' +
+                'with a local path.');
+        }
+        if (env.code === 'remote_unreachable') {
+            // THE PLATFORM'S OWN REASON, not a sentence of ours over the top of it. It
+            // says which host answered what — a 404 is a wrong URL, a 403 is an origin
+            // refusing this fetcher, a timeout is worth retrying — and replacing that
+            // with "could not read it" sends all of them to check their network.
+            throw new ApiError(res.status, 'remote_unreachable', `sbuilder: the platform could not fetch ${url} — ${env.error ?? 'no reason given'}.`);
+        }
+        // Any OTHER refusal — 401, 403, 413, an unsupported type — is one the older
+        // path answers with its own, better-worded diagnosis. Let it try.
+        return null;
+    }
+    const body = (parsed ?? {});
+    return body.asset ?? parsed;
+}
 export async function uploadMedia(ctx, siteId, source) {
     const doFetch = ctx.fetchImpl ?? fetch;
+    // THE SERVER'S OWN DOOR FIRST, when the source is a URL.
+    //
+    // `POST /api/media/{siteId}/from-url` fetches it where the platform already
+    // guards outbound requests, so the bytes make ONE hop instead of two and the
+    // content type is decided by the origin's own answer rather than reconstructed
+    // here. Everything below this is the older path, kept because a deployment
+    // without that route must still be able to upload — the same shape the partner
+    // -surface retry below has, and for the same reason.
+    if (source.url) {
+        const viaServer = await fromUrl(ctx, siteId, source.url, source);
+        if (viaServer)
+            return viaServer;
+    }
     let bytes;
     let filename;
     let declared = '';

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "sbuilder-mcp",
-  "version": "0.23.0",
+  "version": "0.23.1",
   "description": "MCP server that designs and operates a Store Builder site — pages, data, theme and publish — through the platform's own API and live-edit protocol.",
   "mcpName": "io.github.vuluu2k/sbuilder-mcp",
   "type": "module",