From 1b466afc1286af825e3f910a28beac610916839e Mon Sep 17 00:00:00 2001 From: Steven Pan Date: Thu, 8 Oct 2026 18:48:27 -0700 Subject: [PATCH] feat(skill): use create_upload_url for local files The hosted MCP server gains a free create_upload_url tool (sonilo-api-dashboard#407). The workflow skill told Codex to refuse a local file and ask for a public HTTPS URL, which would leave the new tool unused. Add a "Use a local file" section: upload only a file the user named, PUT it to the returned upload_url, pass file_url as the tool input, and fall back to asking for a public URL when the tool is missing or the PUT cannot be made. Uploading to any third-party host stays prohibited. Co-Authored-By: Claude Opus 5.5 (1M context) --- README.md | 5 +++- .../sonilo/skills/sonilo-workflows/SKILL.md | 30 ++++++++++++++++++- 2 files changed, 33 insertions(+), 2 deletions(-) diff --git a/README.md b/README.md index f0fadf6..edda901 100644 --- a/README.md +++ b/README.md @@ -82,7 +82,10 @@ feature reference, but its local-file and playback tools are not bundled here. - "What is my cash balance, and how many free text-to-music runs remain?" Use real public HTTPS media URLs in place of the labels above. A local file -or attachment is not a hosted media URL. The plugin returns actual result +or attachment is not a hosted media URL: when the hosted `create_upload_url` +tool is available and Codex can run the upload, the plugin uploads a file you +name to temporary storage on your Sonilo Platform account and uses the link it +gets back; otherwise it asks for a public HTTPS URL. The plugin returns actual result links for previews, subtitles, videos, variants, and stems. ### Account status and continuation diff --git a/plugins/sonilo/skills/sonilo-workflows/SKILL.md b/plugins/sonilo/skills/sonilo-workflows/SKILL.md index f02213e..e186428 100644 --- a/plugins/sonilo/skills/sonilo-workflows/SKILL.md +++ b/plugins/sonilo/skills/sonilo-workflows/SKILL.md @@ -46,7 +46,34 @@ user-supplied video, audio, and subtitle URL. - Do not claim that a URL is public merely because it uses HTTPS. The hosted service remains responsible for DNS resolution, redirect validation, and SSRF protections. A filename or local attachment is not a public URL; do not - upload a user's file to an external host without authorization. + upload a user's file to a third-party host to obtain one. The only supported + upload path is the one below. + +## Use a local file + +When the user asks to process a file on their own machine, use the hosted +`create_upload_url` tool if it is among the connected tools and this +environment can send the file's bytes in an HTTP PUT. + +1. Proceed only when the request clearly covers that file, and say that the + file will be uploaded to temporary storage on the user's Sonilo Platform + account. Do not upload files the user did not name. +2. Call `create_upload_url` with the file's name and its exact size in bytes. + It is free and creates no task. It accepts video, audio, `.srt`, and `.vtt` + files up to `max_upload_size_mb` from `get_account_services`. +3. Send the raw bytes to the returned `upload_url` with one HTTP PUT, for + example `curl -T ""`, adding no authorization header. + A 403 means the size did not match or the URL expired: request a new URL + instead of retrying the old one. +4. Once the PUT succeeds, pass the returned `file_url` wherever the chosen + tool takes a media or subtitle URL. A `file_url` from this tool is a valid + input; do not ask for a public URL in its place. + +Treat `upload_url` as a credential for that one upload: never show it to the +user, log it, or reuse it. Do not present `file_url` as a result or download +link; uploads are temporary working files. If the tool is not connected or +the PUT cannot be made here, do not try another upload route: explain that a +public `https://` URL is needed instead. ## Choose the operation @@ -73,6 +100,7 @@ explicit, sufficiently specified generation request. | Cash balance, available services, and trial counts | `get_account_services` | | Historical usage and spend | `get_usage` | | Progress or results of an existing task | `get_generation_task` | +| Make a local video, audio, or subtitle file usable as an input | `create_upload_url` (free; see Use a local file) | Use video-producing tools for a new video with the generated audio mixed in; do not substitute them for an audio-only request. Prefer a single combined