uno-cli 1.0.4__tar.gz → 1.0.5__tar.gz

{uno_cli-1.0.4 → uno_cli-1.0.5}/.gitignore

@@ -8,6 +8,7 @@ __pycache__/
 node_modules/
 .next/
 frontend/.next/
+frontend/.next-releases/
 frontend/node_modules/
 .DS_Store
 .idea/
@@ -19,6 +20,9 @@ deploy.sh
 data_export/
 data_export_prod/
 scripts/backup_prod*.json
+scripts/probe_all.json
+scripts/probe_200.json
+var/mcp-url-secret-backups/
 .mcp_auth/
 .cursor/
 .worktrees/

{uno_cli-1.0.4 → uno_cli-1.0.5}/PKG-INFO

@@ -1,6 +1,6 @@
 Metadata-Version: 2.5
 Name: uno-cli
-Version: 1.0.4
+Version: 1.0.5
 Summary: Uno CLI — Agent tool gateway by ClawdChat. Access 2000+ real-world tools from the command line.
 Project-URL: Homepage, https://agentools.uno
 Project-URL: Documentation, https://agentools.uno/docs

{uno_cli-1.0.4 → uno_cli-1.0.5}/pyproject.toml

@@ -1,6 +1,6 @@
 [project]
 name = "uno-cli"
-version = "1.0.4"
+version = "1.0.5"
 description = "Uno CLI — Agent tool gateway by ClawdChat. Access 2000+ real-world tools from the command line."
 readme = "README.md"
 requires-python = ">=3.8"

uno_cli-1.0.5/tests/test_reference_upload.py

@@ -0,0 +1,165 @@
+"""Reference images are uploaded before they enter ``--args``."""
+
+from __future__ import annotations
+
+import argparse
+import base64
+import json
+
+import pytest
+
+from uno_cli import cli
+from uno_cli.references import split_reference_list
+
+
+def _args(raw):
+    return argparse.Namespace(
+        tool="gpt-image-2.gpt_image2_submit",
+        args=raw,
+        timeout=60,
+        dry_run=False,
+        base_url="https://agentools.uno",
+    )
+
+
+class _API:
+    def __init__(self):
+        self.uploads = []
+        self.call = None
+
+    def post_bytes(self, path, data, content_type, timeout=120):
+        self.uploads.append({"path": path, "data": data, "content_type": content_type})
+        file_id = "f_" + f"{len(self.uploads):02x}" + ("ab" * 15)
+        url = f"https://agentools.uno/v1/files/{file_id}"
+        assert "," not in file_id
+        assert "," not in url
+        return {"file_id": file_id, "url": url}
+
+    def post(self, path, data, timeout=60):
+        self.call = {"path": path, "data": data}
+        return {"data": {"status": "pending", "job_id": "job1"}, "meta": {}}
+
+
+def test_oversized_data_uri_does_not_enter_call_args(monkeypatch, capsys):
+    image = b"\xff\xd8\xff" + (b"x" * 80000)
+    encoded = base64.b64encode(image).decode()
+    data_uri = f"data:image/jpeg;base64,{encoded}"
+    raw = json.dumps({"prompt": "cat", "reference_image_urls": data_uri})
+    assert len(raw) > 102400
+    assert "," in data_uri
+
+    api = _API()
+    monkeypatch.delenv("UNO_ALLOWED_TOOLS", raising=False)
+    monkeypatch.setattr(cli, "_get_api", lambda args: api)
+
+    cli.cmd_call(_args(raw))
+
+    assert api.call["path"] == "/v1/call"
+    sent = api.call["data"]["arguments"]
+    ref = sent["reference_image_urls"]
+    assert encoded not in json.dumps(sent)
+    assert "base64" not in ref
+    assert data_uri not in json.dumps(sent)
+    assert "," not in ref
+    assert ref.startswith("https://agentools.uno/v1/files/f_")
+    assert len(json.dumps(sent, ensure_ascii=False)) <= 102400
+    assert api.uploads[0]["data"] == image
+    assert api.uploads[0]["content_type"] == "image/jpeg"
+    out = json.loads(capsys.readouterr().out)
+    assert out["success"] is True
+
+
+def test_local_paths_upload_separately(monkeypatch, capsys, tmp_path):
+    first = tmp_path / "a.jpg"
+    second = tmp_path / "b.png"
+    first.write_bytes(b"\xff\xd8\xff\xd9")
+    second.write_bytes(b"\x89PNG\r\n")
+    raw = json.dumps({"prompt": "keep the subject", "reference_image_urls": f"{first},{second}"})
+
+    api = _API()
+    monkeypatch.delenv("UNO_ALLOWED_TOOLS", raising=False)
+    monkeypatch.setattr(cli, "_get_api", lambda args: api)
+    cli.cmd_call(_args(raw))
+
+    assert len(api.uploads) == 2
+    refs = api.call["data"]["arguments"]["reference_image_urls"].split(",")
+    assert len(refs) == 2
+    assert all("," not in item for item in refs)
+    assert all(item.startswith("https://agentools.uno/v1/files/f_") for item in refs)
+    assert str(first) not in json.dumps(api.call["data"]["arguments"])
+
+
+def test_data_uri_comma_is_not_a_second_image():
+    raw = "data:image/jpeg;base64," + ("QUJD" * 30)
+    assert split_reference_list(raw) == [raw]
+    mixed = raw + ",https://cdn.example/b.png"
+    parts = split_reference_list(mixed)
+    assert parts == [raw, "https://cdn.example/b.png"]
+
+
+def test_plain_prompt_comma_is_not_uploaded(monkeypatch, capsys):
+    api = _API()
+    monkeypatch.delenv("UNO_ALLOWED_TOOLS", raising=False)
+    monkeypatch.setattr(cli, "_get_api", lambda args: api)
+    cli.cmd_call(_args(json.dumps({"prompt": "a cat, a dog"})))
+    assert api.uploads == []
+    assert api.call["data"]["arguments"]["prompt"] == "a cat, a dog"
+
+
+def test_base64_fields_keep_the_data_uri(monkeypatch, capsys):
+    encoded = base64.b64encode(b"\xff\xd8\xff\xd9").decode()
+    data_uri = f"data:image/jpeg;base64,{encoded}"
+    raw = json.dumps({
+        "prompt": "cat",
+        "reference_image_base64": data_uri,
+        "reference_images_base64": [data_uri],
+        "image_base64": data_uri,
+        "reference_image_urls": data_uri,
+    })
+    api = _API()
+    monkeypatch.delenv("UNO_ALLOWED_TOOLS", raising=False)
+    monkeypatch.setattr(cli, "_get_api", lambda args: api)
+    cli.cmd_call(_args(raw))
+    sent = api.call["data"]["arguments"]
+    assert sent["reference_image_base64"] == data_uri
+    assert sent["reference_images_base64"] == [data_uri]
+    assert sent["image_base64"] == data_uri
+    assert data_uri not in sent["reference_image_urls"]
+    assert sent["reference_image_urls"].startswith("https://agentools.uno/v1/files/f_")
+    assert len(api.uploads) == 1
+
+
+def test_non_whitelist_tool_does_not_upload(monkeypatch, capsys):
+    encoded = base64.b64encode(b"\xff\xd8\xff\xd9").decode()
+    data_uri = f"data:image/jpeg;base64,{encoded}"
+    raw = json.dumps({"prompt": "cat", "reference_image_urls": data_uri})
+    api = _API()
+    monkeypatch.delenv("UNO_ALLOWED_TOOLS", raising=False)
+    monkeypatch.setattr(cli, "_get_api", lambda args: api)
+    args = _args(raw)
+    args.tool = "seedream.generate"
+    cli.cmd_call(args)
+    assert api.uploads == []
+    assert api.call["data"]["arguments"]["reference_image_urls"] == data_uri
+
+
+def test_prompt_path_and_data_uri_are_not_uploaded(monkeypatch, capsys, tmp_path):
+    image = tmp_path / "cat.jpg"
+    image.write_bytes(b"\xff\xd8\xff\xd9")
+    data_uri = "data:image/jpeg;base64," + base64.b64encode(b"\xff\xd8\xff\xd9").decode()
+    prompt = f"use {image} and {data_uri} as the subject"
+    raw = json.dumps({"prompt": prompt})
+    api = _API()
+    monkeypatch.delenv("UNO_ALLOWED_TOOLS", raising=False)
+    monkeypatch.setattr(cli, "_get_api", lambda args: api)
+    cli.cmd_call(_args(raw))
+    assert api.uploads == []
+    assert api.call["data"]["arguments"]["prompt"] == prompt
+
+
+def test_upload_locator_rejects_comma():
+    from uno_cli.references import ReferenceUploadError, locator_from_upload
+
+    with pytest.raises(ReferenceUploadError):
+        locator_from_upload({"url": "https://example.com/a,b.png", "file_id": "f_ab,cd"})
+    assert "," not in locator_from_upload({"file_id": "f_" + "ab" * 16, "url": ""})

uno_cli-1.0.5/uno_cli/_version.py

@@ -0,0 +1 @@
+__version__ = "1.0.5"

{uno_cli-1.0.4 → uno_cli-1.0.5}/uno_cli/cli.py

@@ -22,6 +22,13 @@ import urllib.parse
 import urllib.request
 
 from uno_cli._version import __version__
+from uno_cli.references import (
+    CALL_ARGS_MAX_CHARS,
+    RAW_ARGS_MAX_CHARS,
+    ReferenceUploadError,
+    locator_from_upload,
+    rewrite_call_arguments,
+)
 
 DEFAULT_BASE = "https://agentools.uno"
 LEGACY_BASE = "https://clawdtools.uno"
@@ -134,14 +141,22 @@ class UnoAPI:
             h["Authorization"] = f"Bearer {self.api_key}"
         return h
 
-    def _request(self, method, path, data=None, params=None, timeout=60):
+    def _request(self, method, path, data=None, params=None, timeout=60, *, raw=None, content_type=None):
         url = f"{self.base}{path}"
         if params:
             url += "?" + urllib.parse.urlencode(
                 {k: v for k, v in params.items() if v is not None}
             )
-        body = json.dumps(data).encode() if data is not None else None
-        req = urllib.request.Request(url, data=body, headers=self._headers(), method=method)
+        headers = self._headers()
+        if content_type:
+            headers["Content-Type"] = content_type
+        if raw is not None:
+            body = raw
+        elif data is not None:
+            body = json.dumps(data).encode()
+        else:
+            body = None
+        req = urllib.request.Request(url, data=body, headers=headers, method=method)
         try:
             with urllib.request.urlopen(req, timeout=timeout) as resp:
                 raw = resp.read().decode()
@@ -170,6 +185,12 @@ class UnoAPI:
     def post(self, path, data=None, timeout=60):
         return self._request("POST", path, data=data, timeout=timeout)
 
+    def post_bytes(self, path, data, content_type, timeout=120):
+        """POST raw bytes (reference image upload). Not the JSON ``--args`` body."""
+        return self._request(
+            "POST", path, raw=data, content_type=content_type, timeout=timeout,
+        )
+
     def delete(self, path):
         return self._request("DELETE", path)
 
@@ -700,8 +721,8 @@ def cmd_call(args):
     raw_args = getattr(args, "args", None)
     if raw_args:
         raw_args = raw_args.replace("\x00", "")
-        if len(raw_args) > 102400:
-            _fail("Arguments too large (max 100KB)")
+        if len(raw_args) > RAW_ARGS_MAX_CHARS:
+            _fail("Arguments too large to upload")
         try:
             arguments = json.loads(raw_args)
             if not isinstance(arguments, dict):
@@ -735,6 +756,11 @@ def cmd_call(args):
 
     api = _get_api(args)
     try:
+        arguments = rewrite_call_arguments(
+            arguments, _reference_uploader(api), tool_slug,
+        )
+        if len(json.dumps(arguments, ensure_ascii=False)) > CALL_ARGS_MAX_CHARS:
+            _fail("Arguments too large (max 100KB)")
         result = api.post("/v1/call", {"tool": tool_slug, "arguments": arguments}, timeout=timeout)
         if result.get("error"):
             out = {"success": False, "error": result["error"]}
@@ -778,6 +804,19 @@ def cmd_call(args):
     except APIError as e:
         _out(_format_api_error(e.status, e.body))
         sys.exit(1)
+    except ReferenceUploadError as e:
+        _fail(str(e))
+
+
+def _reference_uploader(api):
+    """Upload one image and return a comma-free URL or file_id."""
+
+    def upload(data, filename, media_type):
+        del filename
+        result = api.post_bytes("/v1/files", data, media_type, timeout=120)
+        return locator_from_upload(result)
+
+    return upload
 
 
 def cmd_rate(args):

uno_cli-1.0.5/uno_cli/references.py

@@ -0,0 +1,205 @@
+"""Upload local paths and data URIs before they land in ``--args``.
+
+The call payload stays under 100KB. Each upload locator is a public URL or
+``file_id`` and does not contain a comma, so a later comma-split stays intact.
+"""
+
+from __future__ import annotations
+
+import base64
+import os
+
+CALL_ARGS_MAX_CHARS = 102400
+RAW_ARGS_MAX_CHARS = 32 * 1024 * 1024
+MAX_IMAGE_BYTES = 8 * 1024 * 1024
+
+# Link fields only. A name containing "base64" is never uploaded, even if it
+# is later added here. Tools absent from this map are left untouched.
+_LINK_FIELDS = frozenset({
+    "reference_image_urls",
+    "reference_image_url",
+    "image_url",
+    "image_urls",
+})
+_UPLOAD_FIELDS = {
+    "gpt-image-2.gpt_image2_submit": _LINK_FIELDS,
+}
+_IMAGE_EXT = {
+    ".jpg": "image/jpeg",
+    ".jpeg": "image/jpeg",
+    ".png": "image/png",
+    ".webp": "image/webp",
+    ".gif": "image/gif",
+}
+_NEXT_REF = ("http://", "https://", "data:")
+
+
+class ReferenceUploadError(Exception):
+    pass
+
+
+def split_reference_list(raw: str) -> list:
+    """Split comma-separated refs without breaking a data URI on its comma."""
+    text = raw.strip()
+    if not text:
+        return []
+    parts = []
+    index = 0
+    length = len(text)
+    while index < length:
+        while index < length and text[index] in ", \t\r\n":
+            index += 1
+        if index >= length:
+            break
+        if text.startswith("data:", index):
+            comma = text.find(",", index)
+            if comma == -1:
+                token = text[index:].strip()
+                if token:
+                    parts.append(token)
+                break
+            cursor = comma + 1
+            end = length
+            while True:
+                nxt = text.find(",", cursor)
+                if nxt == -1:
+                    break
+                rest = text[nxt + 1:].lstrip()
+                if rest.startswith(_NEXT_REF):
+                    end = nxt
+                    break
+                cursor = nxt + 1
+            token = text[index:end].strip()
+            if token:
+                parts.append(token)
+            index = end
+            continue
+        comma = text.find(",", index)
+        if comma == -1:
+            token = text[index:].strip()
+            if token:
+                parts.append(token)
+            break
+        token = text[index:comma].strip()
+        if token:
+            parts.append(token)
+        index = comma + 1
+    return parts
+
+
+def locator_from_upload(payload) -> str:
+    """Pick the public URL, else file_id. Either must be free of commas."""
+    if not isinstance(payload, dict):
+        raise ReferenceUploadError("reference upload returned no locator")
+    url = payload.get("url") or ""
+    file_id = payload.get("file_id") or ""
+    if isinstance(url, str) and url and "," not in url:
+        return url
+    if isinstance(file_id, str) and file_id and "," not in file_id:
+        return file_id
+    raise ReferenceUploadError("upload locator must not contain a comma")
+
+
+def decode_data_uri(value: str):
+    if not value.startswith("data:") or "," not in value:
+        raise ReferenceUploadError("invalid data uri")
+    header, payload = value.split(",", 1)
+    if ";base64" not in header.lower():
+        raise ReferenceUploadError("data uri must be base64")
+    media = header[5:].split(";", 1)[0].strip().lower() or "application/octet-stream"
+    if media not in _IMAGE_EXT.values():
+        raise ReferenceUploadError("unsupported image type")
+    try:
+        data = base64.b64decode(payload, validate=True)
+    except Exception as exc:
+        raise ReferenceUploadError("invalid base64") from exc
+    return data, media
+
+
+def _is_data_uri(value: str) -> bool:
+    return value.startswith("data:image/") and "," in value
+
+
+def _local_image(value: str):
+    if value.startswith(("http://", "https://", "data:")):
+        return None
+    path = os.path.expanduser(value)
+    ext = os.path.splitext(path)[1].lower()
+    media = _IMAGE_EXT.get(ext)
+    if not media or not os.path.isfile(path):
+        return None
+    return path, media
+
+
+def _should_upload(value: str) -> bool:
+    if _is_data_uri(value):
+        return True
+    return _local_image(value) is not None
+
+
+def _field_allows_upload(field, allowed) -> bool:
+    if not isinstance(field, str) or "base64" in field.lower():
+        return False
+    return field in allowed
+
+
+def _upload_one(value: str, upload) -> str:
+    if _is_data_uri(value):
+        data, media = decode_data_uri(value)
+        filename = "reference." + next(ext.lstrip(".") for ext, kind in _IMAGE_EXT.items() if kind == media)
+    else:
+        found = _local_image(value)
+        if not found:
+            raise ReferenceUploadError("not a reference image")
+        path, media = found
+        filename = os.path.basename(path)
+        with open(path, "rb") as handle:
+            data = handle.read()
+    if not data:
+        raise ReferenceUploadError("reference image is empty")
+    if len(data) > MAX_IMAGE_BYTES:
+        raise ReferenceUploadError("reference image exceeds 8MB")
+    locator = upload(data, filename, media)
+    if not isinstance(locator, str) or not locator or "," in locator:
+        raise ReferenceUploadError("upload locator must not contain a comma")
+    return locator
+
+
+def _rewrite_string(value: str, upload) -> str:
+    if "," not in value and not _is_data_uri(value):
+        if _should_upload(value):
+            return _upload_one(value, upload)
+        return value
+    parts = split_reference_list(value)
+    if len(parts) == 1 and _should_upload(parts[0]):
+        return _upload_one(parts[0], upload)
+    if not any(_should_upload(part) for part in parts):
+        return value
+    rewritten = []
+    for part in parts:
+        if _should_upload(part):
+            rewritten.append(_upload_one(part, upload))
+        else:
+            rewritten.append(part)
+    return ",".join(rewritten)
+
+
+def _rewrite(obj, upload, allowed, field):
+    if isinstance(obj, dict):
+        return {key: _rewrite(val, upload, allowed, key) for key, val in obj.items()}
+    if isinstance(obj, list):
+        return [_rewrite(item, upload, allowed, field) for item in obj]
+    if isinstance(obj, str) and _field_allows_upload(field, allowed):
+        return _rewrite_string(obj, upload)
+    return obj
+
+
+def rewrite_call_arguments(obj, upload, tool_slug=None, field=None):
+    """Replace inline images on whitelisted link fields.
+
+    ``upload(data, filename, media) -> str``. Fields whose names contain
+    ``base64``, every other field (including ``prompt``), and tools that are
+    not listed are returned unchanged.
+    """
+    allowed = _UPLOAD_FIELDS.get(tool_slug or "", frozenset())
+    return _rewrite(obj, upload, allowed, field)

uno_cli-1.0.4/uno_cli/_version.py

@@ -1 +0,0 @@
-__version__ = "1.0.4"