hosting the MCP on HF

.claude/settings.local.json

@@ -31,7 +31,8 @@
       "Bash(node test-api.js:*)",
       "Bash(REUBENOS_URL=https://huggingface.co/spaces/MCP-1st-Birthday/Reuben_OS node test-api.js:*)",
       "Bash(curl:*)",
-      "Bash(REUBENOS_URL=https://mcp-1st-birthday-reuben-os.hf.space node test-api.js:*)"
+      "Bash(REUBENOS_URL=https://mcp-1st-birthday-reuben-os.hf.space node test-api.js:*)",
+      "Bash(node test-download.js:*)"
     ],
     "deny": [],
     "ask": []

app/api/download/route.ts

@@ -18,11 +18,14 @@ export async function GET(request: NextRequest) {
       return NextResponse.json({ error: 'File path required' }, { status: 400 })
     }
 
-    const fullPath = path.join(DOCS_DIR, filePath)
+    // Normalize the path to handle both forward and backward slashes
+    const normalizedPath = filePath.replace(/\\/g, '/')
+    const fullPath = path.resolve(path.join(DOCS_DIR, normalizedPath))
+    const resolvedDocsDir = path.resolve(DOCS_DIR)
 
-    // Security check
-    if (!fullPath.startsWith(DOCS_DIR)) {
-      return NextResponse.json({ error: 'Invalid path' }, { status: 400 })
+    // Security check - ensure the resolved path is within the allowed directory
+    if (!fullPath.startsWith(resolvedDocsDir)) {
+      return NextResponse.json({ error: 'Invalid path - access denied' }, { status: 400 })
     }
 
     if (!fs.existsSync(fullPath)) {
@@ -35,7 +38,7 @@ export async function GET(request: NextRequest) {
     }
 
     const fileBuffer = fs.readFileSync(fullPath)
-    const fileName = path.basename(filePath)
+    const fileName = path.basename(normalizedPath)
     const ext = path.extname(fileName).toLowerCase()
 
     // Determine content type
@@ -92,14 +95,14 @@ export async function GET(request: NextRequest) {
 
     // If not preview mode, add download header
     if (!preview) {
-      headers.set('Content-Disposition', `attachment; filename="${fileName}"`)
+      headers.set('Content-Disposition', `attachment; filename="${encodeURIComponent(fileName)}"`)
     } else {
       // For preview, use inline disposition for supported types
       if (['application/pdf', 'text/plain', 'text/markdown', 'application/json'].includes(contentType) ||
           contentType.startsWith('image/') || contentType.startsWith('text/')) {
-        headers.set('Content-Disposition', `inline; filename="${fileName}"`)
+        headers.set('Content-Disposition', `inline; filename="${encodeURIComponent(fileName)}"`)
       } else {
-        headers.set('Content-Disposition', `attachment; filename="${fileName}"`)
+        headers.set('Content-Disposition', `attachment; filename="${encodeURIComponent(fileName)}"`)
       }
     }
 

app/api/sessions/download/route.ts

@@ -25,19 +25,29 @@ export async function GET(request: NextRequest) {
 
         if (isPublic) {
             rootDir = PUBLIC_DIR
-            filePath = path.join(PUBLIC_DIR, fileName)
+            // fileName might be a relative path like "folder/file.txt"
+            // Normalize the path to handle both cases
+            const normalizedPath = fileName.replace(/\\/g, '/')
+            filePath = path.join(PUBLIC_DIR, normalizedPath)
         } else {
             if (!key) {
                 return NextResponse.json({ error: 'Passkey is required for secure files' }, { status: 403 })
             }
             const sanitizedKey = key.replace(/[^a-zA-Z0-9_-]/g, '')
             rootDir = path.join(DATA_DIR, sanitizedKey)
-            filePath = path.join(rootDir, fileName)
+            // fileName might be a relative path like "folder/file.txt"
+            // Normalize the path to handle both cases
+            const normalizedPath = fileName.replace(/\\/g, '/')
+            filePath = path.join(rootDir, normalizedPath)
         }
 
-        // Security check
+        // Resolve the absolute path to prevent directory traversal attacks
+        filePath = path.resolve(filePath)
+        rootDir = path.resolve(rootDir)
+
+        // Security check - ensure the resolved path is within the allowed directory
         if (!filePath.startsWith(rootDir)) {
-            return NextResponse.json({ error: 'Invalid path' }, { status: 400 })
+            return NextResponse.json({ error: 'Invalid path - access denied' }, { status: 400 })
         }
 
         if (!fs.existsSync(filePath)) {
@@ -50,7 +60,9 @@ export async function GET(request: NextRequest) {
         }
 
         const fileBuffer = fs.readFileSync(filePath)
-        const ext = path.extname(fileName).toLowerCase()
+        // Extract the base filename from the path (in case it's a relative path)
+        const baseFileName = path.basename(fileName)
+        const ext = path.extname(baseFileName).toLowerCase()
 
         // Determine content type
         let contentType = 'application/octet-stream'
@@ -92,7 +104,7 @@ export async function GET(request: NextRequest) {
         const headers = new Headers({
             'Content-Type': contentType,
             'Content-Length': fileBuffer.length.toString(),
-            'Content-Disposition': `attachment; filename="${fileName}"`
+            'Content-Disposition': `attachment; filename="${encodeURIComponent(baseFileName)}"`
         })
 
         return new NextResponse(fileBuffer, { headers })

pages/api/mcp.ts

@@ -0,0 +1,409 @@
+import { SSEServerTransport } from '@modelcontextprotocol/sdk/server/sse.js';
+import { Server } from '@modelcontextprotocol/sdk/server/index.js';
+import {
+    CallToolRequestSchema,
+    ListToolsRequestSchema,
+} from '@modelcontextprotocol/sdk/types.js';
+import fs from 'fs';
+import path from 'path';
+import fetch from 'node-fetch';
+
+declare global {
+    var mcpTransports: Map<string, any>;
+}
+
+// Global state to store active transports
+// In a serverless environment (like Vercel), this might not work reliably for long-lived connections across requests.
+// But for a persistent container (Hugging Face Spaces), this is fine.
+if (!global.mcpTransports) {
+    global.mcpTransports = new Map();
+}
+
+// Configuration
+const DATA_DIR = process.env.SPACE_ID ? '/data' : path.join(process.cwd(), 'public', 'data');
+const PUBLIC_DIR = path.join(DATA_DIR, 'public');
+const BASE_URL = process.env.REUBENOS_URL || 'http://localhost:3000';
+
+// Helper functions
+function ensureDirectories() {
+    if (!fs.existsSync(DATA_DIR)) fs.mkdirSync(DATA_DIR, { recursive: true });
+    if (!fs.existsSync(PUBLIC_DIR)) fs.mkdirSync(PUBLIC_DIR, { recursive: true });
+}
+
+function isValidPasskey(passkey: string): boolean {
+    return !!passkey && /^[a-zA-Z0-9_-]+$/.test(passkey) && passkey.length >= 4;
+}
+
+function sanitizeFileName(fileName: string): string {
+    return fileName.replace(/[^a-zA-Z0-9._-]/g, '_');
+}
+
+function sanitizePasskey(passkey: string): string {
+    return passkey.replace(/[^a-zA-Z0-9_-]/g, '');
+}
+
+import { NextApiRequest, NextApiResponse } from 'next';
+
+export default async function handler(req: NextApiRequest, res: NextApiResponse) {
+    ensureDirectories();
+
+    if (req.method === 'GET') {
+        // Handle SSE Connection
+        const transport = new SSEServerTransport('/api/mcp', res);
+
+        // Create a new server instance for this connection
+        const server = new Server(
+            {
+                name: 'reubenos-mcp-server',
+                version: '3.0.0',
+            },
+            {
+                capabilities: {
+                    tools: {},
+                },
+            }
+        );
+
+        // Setup tools
+        server.setRequestHandler(ListToolsRequestSchema, async () => ({
+            tools: [
+                {
+                    name: 'save_file',
+                    description: 'Save a file to Reuben OS. Use your passkey for secure storage or save to public folder.',
+                    inputSchema: {
+                        type: 'object',
+                        properties: {
+                            fileName: { type: 'string', description: 'File name' },
+                            content: { type: 'string', description: 'File content' },
+                            passkey: { type: 'string', description: 'Passkey for secure storage' },
+                            isPublic: { type: 'boolean', description: 'Save to public folder' },
+                        },
+                        required: ['fileName', 'content'],
+                    },
+                },
+                {
+                    name: 'list_files',
+                    description: 'List all files in your secure storage or public folder',
+                    inputSchema: {
+                        type: 'object',
+                        properties: {
+                            passkey: { type: 'string', description: 'Passkey' },
+                            isPublic: { type: 'boolean', description: 'List public files' },
+                        },
+                    },
+                },
+                {
+                    name: 'delete_file',
+                    description: 'Delete a specific file',
+                    inputSchema: {
+                        type: 'object',
+                        properties: {
+                            fileName: { type: 'string' },
+                            passkey: { type: 'string' },
+                            isPublic: { type: 'boolean' },
+                        },
+                        required: ['fileName'],
+                    },
+                },
+                {
+                    name: 'read_file',
+                    description: 'Read the content of a file',
+                    inputSchema: {
+                        type: 'object',
+                        properties: {
+                            fileName: { type: 'string' },
+                            passkey: { type: 'string' },
+                            isPublic: { type: 'boolean' },
+                        },
+                        required: ['fileName'],
+                    },
+                },
+                {
+                    name: 'generate_song_audio',
+                    description: 'Generate an AI song with audio',
+                    inputSchema: {
+                        type: 'object',
+                        properties: {
+                            title: { type: 'string' },
+                            style: { type: 'string' },
+                            lyrics: { type: 'string' },
+                        },
+                        required: ['title', 'style', 'lyrics'],
+                    },
+                },
+                {
+                    name: 'generate_story_audio',
+                    description: 'Generate audio narration for a story',
+                    inputSchema: {
+                        type: 'object',
+                        properties: {
+                            title: { type: 'string' },
+                            content: { type: 'string' },
+                        },
+                        required: ['title', 'content'],
+                    },
+                },
+                {
+                    name: 'deploy_quiz',
+                    description: 'Deploy an interactive quiz to Reuben OS Quiz App',
+                    inputSchema: {
+                        type: 'object',
+                        properties: {
+                            passkey: { type: 'string', description: 'Passkey for secure storage' },
+                            isPublic: { type: 'boolean', description: 'Make quiz public' },
+                            quizData: {
+                                type: 'object',
+                                description: 'Quiz configuration',
+                                properties: {
+                                    title: { type: 'string' },
+                                    description: { type: 'string' },
+                                    questions: { type: 'array' },
+                                    timeLimit: { type: 'number' },
+                                },
+                                required: ['title', 'questions'],
+                            },
+                        },
+                        required: ['quizData'],
+                    },
+                },
+                {
+                    name: 'analyze_quiz',
+                    description: 'Analyze quiz answers and provide feedback',
+                    inputSchema: {
+                        type: 'object',
+                        properties: {
+                            passkey: { type: 'string', description: 'Passkey' },
+                            isPublic: { type: 'boolean', description: 'Quiz files in public folder' },
+                        },
+                        required: ['passkey'],
+                    },
+                },
+            ],
+        }));
+
+        server.setRequestHandler(CallToolRequestSchema, async (request) => {
+            const { name, arguments: args } = request.params as { name: string, arguments: any };
+
+            try {
+                switch (name) {
+                    case 'save_file': {
+                        const { fileName, content, passkey, isPublic } = args;
+                        if (!isPublic && !passkey) throw new Error('Passkey required');
+
+                        const targetDir = isPublic ? PUBLIC_DIR : path.join(DATA_DIR, sanitizePasskey(passkey));
+                        if (!fs.existsSync(targetDir)) fs.mkdirSync(targetDir, { recursive: true });
+
+                        const filePath = path.join(targetDir, sanitizeFileName(fileName));
+                        fs.writeFileSync(filePath, typeof content === 'string' ? content : JSON.stringify(content, null, 2));
+
+                        return {
+                            content: [{ type: 'text', text: `Saved ${fileName} to ${isPublic ? 'Public' : 'Secure'} storage.` }],
+                        };
+                    }
+                    case 'list_files': {
+                        const { passkey, isPublic } = args;
+                        if (!isPublic && !passkey) throw new Error('Passkey required');
+
+                        const targetDir = isPublic ? PUBLIC_DIR : path.join(DATA_DIR, sanitizePasskey(passkey));
+                        if (!fs.existsSync(targetDir)) return { content: [{ type: 'text', text: 'No files found.' }] };
+
+                        const files = fs.readdirSync(targetDir);
+                        return {
+                            content: [{ type: 'text', text: `Files:\n${files.join('\n')}` }],
+                        };
+                    }
+                    case 'delete_file': {
+                        const { fileName, passkey, isPublic } = args;
+                        if (!isPublic && !passkey) throw new Error('Passkey required');
+
+                        const targetDir = isPublic ? PUBLIC_DIR : path.join(DATA_DIR, sanitizePasskey(passkey));
+                        const filePath = path.join(targetDir, sanitizeFileName(fileName));
+
+                        if (fs.existsSync(filePath)) {
+                            fs.unlinkSync(filePath);
+                            return { content: [{ type: 'text', text: `Deleted ${fileName}` }] };
+                        }
+                        return { content: [{ type: 'text', text: 'File not found' }] };
+                    }
+                    case 'read_file': {
+                        const { fileName, passkey, isPublic } = args;
+                        if (!isPublic && !passkey) throw new Error('Passkey required');
+
+                        const targetDir = isPublic ? PUBLIC_DIR : path.join(DATA_DIR, sanitizePasskey(passkey));
+                        const filePath = path.join(targetDir, sanitizeFileName(fileName));
+
+                        if (fs.existsSync(filePath)) {
+                            const content = fs.readFileSync(filePath, 'utf8');
+                            return { content: [{ type: 'text', text: content }] };
+                        }
+                        return { content: [{ type: 'text', text: 'File not found' }] };
+                    }
+                    case 'generate_song_audio': {
+                        // Call internal API
+                        const response = await fetch(`${BASE_URL}/api/voice/generate-song`, {
+                            method: 'POST',
+                            headers: { 'Content-Type': 'application/json' },
+                            body: JSON.stringify({ ...args, passkey: 'voice_default' }),
+                        });
+                        const data = await response.json() as any;
+
+                        // Save result
+                        if (data.success) {
+                            await fetch(`${BASE_URL}/api/voice/save`, {
+                                method: 'POST',
+                                headers: { 'Content-Type': 'application/json' },
+                                body: JSON.stringify({ passkey: 'voice_default', content: data.content }),
+                            });
+                            return { content: [{ type: 'text', text: 'Song generated and saved to Voice Studio.' }] };
+                        }
+                        throw new Error(data.error || 'Failed to generate song');
+                    }
+                    case 'generate_story_audio': {
+                        const response = await fetch(`${BASE_URL}/api/voice/generate-story`, {
+                            method: 'POST',
+                            headers: { 'Content-Type': 'application/json' },
+                            body: JSON.stringify({ ...args, passkey: 'voice_default' }),
+                        });
+                        const data = await response.json() as any;
+
+                        if (data.success) {
+                            await fetch(`${BASE_URL}/api/voice/save`, {
+                                method: 'POST',
+                                headers: { 'Content-Type': 'application/json' },
+                                body: JSON.stringify({ passkey: 'voice_default', content: data.content }),
+                            });
+                            return { content: [{ type: 'text', text: 'Story generated and saved to Voice Studio.' }] };
+                        }
+                        throw new Error(data.error || 'Failed to generate story');
+                    }
+                    case 'deploy_quiz': {
+                        const { quizData, passkey, isPublic } = args;
+                        if (!isPublic && !passkey) throw new Error('Passkey required');
+
+                        const fullQuizData = {
+                            ...quizData,
+                            createdAt: new Date().toISOString(),
+                            passkey: passkey || 'public',
+                            version: '1.0',
+                        };
+
+                        const targetDir = isPublic ? PUBLIC_DIR : path.join(DATA_DIR, sanitizePasskey(passkey));
+                        if (!fs.existsSync(targetDir)) fs.mkdirSync(targetDir, { recursive: true });
+
+                        const filePath = path.join(targetDir, 'quiz.json');
+                        fs.writeFileSync(filePath, JSON.stringify(fullQuizData, null, 2));
+
+                        const totalPoints = quizData.questions.reduce((sum: number, q: any) => sum + (q.points || 1), 0);
+                        return {
+                            content: [{ type: 'text', text: `Quiz deployed: ${quizData.title}\n${quizData.questions.length} questions, ${totalPoints} points\nSaved to: ${isPublic ? 'Public' : 'Secure'} storage` }],
+                        };
+                    }
+                    case 'analyze_quiz': {
+                        const { passkey, isPublic } = args;
+                        if (!passkey) throw new Error('Passkey required');
+
+                        const targetDir = isPublic ? PUBLIC_DIR : path.join(DATA_DIR, sanitizePasskey(passkey));
+
+                        const quizPath = path.join(targetDir, 'quiz.json');
+                        const answersPath = path.join(targetDir, 'quiz_answers.json');
+
+                        if (!fs.existsSync(quizPath)) return { content: [{ type: 'text', text: 'quiz.json not found' }] };
+                        if (!fs.existsSync(answersPath)) return { content: [{ type: 'text', text: 'quiz_answers.json not found' }] };
+
+                        const quiz = JSON.parse(fs.readFileSync(quizPath, 'utf8'));
+                        const answers = JSON.parse(fs.readFileSync(answersPath, 'utf8'));
+
+                        let correctCount = 0;
+                        let totalPoints = 0;
+                        let maxPoints = 0;
+                        const feedback: string[] = [];
+
+                        quiz.questions.forEach((question: any, index: number) => {
+                            const userAnswer = answers.answers?.[question.id] || answers[question.id];
+                            const points = question.points || 1;
+                            maxPoints += points;
+
+                            const correctAnswer = question.correctAnswer || question.correct;
+                            const isCorrect = userAnswer === correctAnswer ||
+                                (Array.isArray(correctAnswer) && correctAnswer.includes(userAnswer));
+
+                            if (isCorrect) {
+                                correctCount++;
+                                totalPoints += points;
+                                feedback.push(`✅ Question ${index + 1}: Correct! (+${points} points)`);
+                            } else {
+                                feedback.push(`❌ Question ${index + 1}: Incorrect. Your answer: "${userAnswer}"${question.explanation ? `. ${question.explanation}` : ''}`);
+                            }
+                        });
+
+                        const percentage = ((totalPoints / maxPoints) * 100).toFixed(1);
+                        const result = `Quiz Results:\nScore: ${totalPoints}/${maxPoints} (${percentage}%)\nCorrect: ${correctCount}/${quiz.questions.length}\n\n${feedback.join('\n')}`;
+
+                        return { content: [{ type: 'text', text: result }] };
+                    }
+                    default:
+                        throw new Error(`Unknown tool: ${name}`);
+                }
+            } catch (error: any) {
+                return {
+                    content: [{ type: 'text', text: `Error: ${error.message}` }],
+                    isError: true,
+                };
+            }
+        });
+
+        // Store transport in global map using sessionId
+        // We need to wait for the transport to be ready or just store it.
+        // SSEServerTransport generates a sessionId.
+        // We can access it via `transport.sessionId` AFTER `start()` or `connect()`?
+        // Actually, `SSEServerTransport` handles the request in `start()`.
+
+        await server.connect(transport);
+
+        // After connect, the transport has initialized the session.
+        // We need to store it so POST requests can find it.
+        // The `sessionId` is sent to the client in the `endpoint` event.
+        // The client will send POST requests to `/api/mcp?sessionId=...`
+
+        // We need to intercept the session ID.
+        // Since `SSEServerTransport` is designed for Express, it might not expose sessionId easily in this flow.
+        // But let's look at how we can map it.
+        // We can iterate over `global.mcpTransports` in POST?
+        // No, we need the ID.
+
+        // Hack: We can override `transport.handlePostMessage` or similar if needed, 
+        // but usually we just need to store the transport.
+        // Let's assume `transport.sessionId` is available.
+
+        // For now, let's just store it in the map.
+        // Note: This relies on `transport.sessionId` being accessible.
+        // If not, we might have issues.
+        // But typically it is.
+
+        if (transport.sessionId) {
+            global.mcpTransports.set(transport.sessionId, transport);
+        }
+
+        // Clean up on close
+        transport.onclose = () => {
+            if (transport.sessionId) {
+                global.mcpTransports.delete(transport.sessionId);
+            }
+        };
+
+    } else if (req.method === 'POST') {
+        const sessionId = Array.isArray(req.query.sessionId) ? req.query.sessionId[0] : req.query.sessionId;
+        if (!sessionId) {
+            return res.status(400).send('Missing sessionId');
+        }
+
+        const transport = global.mcpTransports.get(sessionId);
+        if (!transport) {
+            return res.status(404).send('Session not found');
+        }
+
+        await transport.handlePostMessage(req, res);
+    } else {
+        res.status(405).send('Method not allowed');
+    }
+}

public/data/public/test-download.txt

@@ -0,0 +1,3 @@
+This is a test file for download functionality.
+If you can download and read this file, the download feature is working correctly.
+Test date: 2025-11-23

public/data/public/test-folder/nested-file.pdf

@@ -0,0 +1,37 @@
+%PDF-1.4
+%Test PDF for download functionality
+1 0 obj
+<< /Type /Catalog /Pages 2 0 R >>
+endobj
+2 0 obj
+<< /Type /Pages /Kids [3 0 R] /Count 1 >>
+endobj
+3 0 obj
+<< /Type /Page /Parent 2 0 R /MediaBox [0 0 612 792] /Resources 4 0 R /Contents 5 0 R >>
+endobj
+4 0 obj
+<< /Font << /F1 << /Type /Font /Subtype /Type1 /BaseFont /Helvetica >> >> >>
+endobj
+5 0 obj
+<< /Length 100 >>
+stream
+BT
+/F1 12 Tf
+100 700 Td
+(Test PDF - Download functionality test) Tj
+ET
+endstream
+endobj
+xref
+0 6
+0000000000 65535 f
+0000000015 00000 n
+0000000068 00000 n
+0000000125 00000 n
+0000000229 00000 n
+0000000328 00000 n
+trailer
+<< /Size 6 /Root 1 0 R >>
+startxref
+480
+%%EOF

test-download.js

@@ -0,0 +1,61 @@
+import fs from 'fs';
+import path from 'path';
+
+async function testDownload(url, expectedSize) {
+  try {
+    console.log(`Testing: ${url}`);
+    const response = await fetch(url);
+
+    if (!response.ok) {
+      const text = await response.text();
+      console.log(`  ❌ Failed: ${response.status} - ${text}`);
+      return false;
+    }
+
+    const buffer = await response.arrayBuffer();
+    const contentType = response.headers.get('content-type');
+    const contentDisposition = response.headers.get('content-disposition');
+
+    console.log(`  ✓ Status: ${response.status}`);
+    console.log(`  ✓ Content-Type: ${contentType}`);
+    console.log(`  ✓ Content-Disposition: ${contentDisposition}`);
+    console.log(`  ✓ Size: ${buffer.byteLength} bytes`);
+
+    if (expectedSize && buffer.byteLength !== expectedSize) {
+      console.log(`  ⚠ Warning: Expected ${expectedSize} bytes but got ${buffer.byteLength}`);
+    }
+
+    return true;
+  } catch (error) {
+    console.log(`  ❌ Error: ${error.message}`);
+    return false;
+  }
+}
+
+async function runTests() {
+  console.log('🧪 Testing Reuben OS File Download Functionality\n');
+
+  const baseUrl = 'http://localhost:3000';
+
+  // Wait a moment for server to be fully ready
+  await new Promise(resolve => setTimeout(resolve, 2000));
+
+  console.log('1. Testing root-level file download (public):');
+  await testDownload(`${baseUrl}/api/sessions/download?file=test-download.txt&public=true`);
+
+  console.log('\n2. Testing nested file download (public):');
+  await testDownload(`${baseUrl}/api/sessions/download?file=test-folder/nested-file.pdf&public=true`);
+
+  console.log('\n3. Testing with URL encoding (public):');
+  await testDownload(`${baseUrl}/api/sessions/download?file=${encodeURIComponent('test-folder/nested-file.pdf')}&public=true`);
+
+  console.log('\n4. Testing error case - non-existent file:');
+  await testDownload(`${baseUrl}/api/sessions/download?file=non-existent.txt&public=true`);
+
+  console.log('\n5. Testing error case - missing filename:');
+  await testDownload(`${baseUrl}/api/sessions/download?public=true`);
+
+  console.log('\n✅ Download functionality tests completed!');
+}
+
+runTests().catch(console.error);