* feat(mcp): model-free document upload via signed URL (#748)
Adds gnubok_create_document_upload + gnubok_complete_document_upload so
document bytes reach storage through a short-lived signed PUT URL and
never pass through the model context. Fixes silent base64 corruption on
real-size PDFs and the context blowup on batch uploads.
- pending/ staage keys with TTL cleanup; completion validates magic
bytes + SHA-256, moves bytes to the WORM key and adopts the reserved
UUID as document id, making retries and concurrent completions
idempotent
- legacy gnubok_upload_document kept for clients without file access,
description now points to the signed-URL pair; shared mime resolution
and inbox-item creation extracted
- both new tools mapped in TOOL_SCOPE_MAP (transactions:write) and
MCP_TOOL_CAPABILITY_MAP (ai) so the paywall and scope gates hold
- payload guard ceiling 58.5K to 59K after trimming the create tool's
outputSchema to upload_id/upload_url/expires_at
Fixes#748
Co-Authored-By: Claude Fable 5 <noreply@anthropic.com>
* fix(mcp): satisfy capability-map lock and phantom-column scanner
The exact-entries lock in capability-maps.test.ts now includes the
signed-URL pair as dispatch-only AI tools, and the inbox insert uses a
literal payload (explicit UUID instead of a conditional spread) so the
no-phantom-columns scanner can resolve every column.
Co-Authored-By: Claude Fable 5 <noreply@anthropic.com>
---------
Co-authored-by: Claude Fable 5 <noreply@anthropic.com>
Em dashes (—) and en dashes (–) had spread across comments, docs, tests,
and a few UI strings, reading as AI-generated boilerplate rather than
house style. Replaced each with punctuation matching its context: colon
for explanatory clauses, comma for asides, plain hyphen for numeric/legal
ranges (e.g. "21-23§"), "to"/"till" for date ranges, parentheses for
paired-dash asides. messages/en.json and messages/sv.json were fixed by
hand together to keep sv/en in sync.
Left untouched where the dash is the functional subject rather than
decorative punctuation: date-range-parser.ts's separator regex,
charset-repair.ts's CP1252 byte-mapping table (and its test), the SIE
encoding mojibake docs, generic-csv.ts's minus-sign normalizer, the
agent system-prompt files that already instruct against em dashes, and
a golden iXBRL test fixture compared byte-for-byte.
Also fixes two bugs surfaced along the way: an off-by-one in
ApiKeysPanel's scope-label split (a leftover from an earlier partial
pass), and a charset-repair test that had lost the literal en-dash it
exists to verify.
Regenerated the agent atom seed migration (skills:generate) since 27
SKILL.md files changed. Added a CLAUDE.md rule against em/en dashes,
with an explicit carve-out for the functional-dash cases above.
Co-authored-by: Claude Sonnet 5 <noreply@anthropic.com>
* fix(entitlements): gate paid AI document OCR server-side (free-tier leak)
Free/manual-tier companies could trigger paid Bedrock OCR (extractInvoiceFields)
with no `ai` capability check, on every transport:
- invoice-inbox HTTP paths — /upload + email /inbound (shared uploadAndExtract),
/items/:id/attach-document, /items/:id/retry-extraction (4 call sites, zero
capability refs);
- the gnubok_upload_document MCP tool — absent from MCP_TOOL_CAPABILITY_MAP, so a
free-tier API key (incl. the claude.ai connector's minted gnubok_sk_ key) got
unlimited AI extraction. This disproved the keys.ts "no MCP tool invokes AI"
comment.
Fix (money-blocker for the free/paid tier cutover):
- Gate the 3 inbox call sites on hasCapability(CAPABILITY.ai). Upload + attach
degrade gracefully (document still stored; extraction skipped with reason
`no_ai_entitlement`, highest priority in the existing skipReason chain). Retry
is an explicit "run AI now" action, so it hard-blocks with 403
capabilityBlockedResponse.
- Register gnubok_upload_document -> CAPABILITY.ai in MCP_TOOL_CAPABILITY_MAP; the
dispatcher already enforces the map. Correct the stale keys.ts comment and the
misleading "deterministic field extraction" tool description + manifest copy
(the extension migrated regex -> AI OCR).
Tests: no-AI upload/attach skip + retry 403 (sandbox-skip-extraction), retry 403
(retry-extraction), and the MCP map contract + refined dispatch<->commit parity
(capability-maps: upload_document is dispatch-only, no commit counterpart).
Self-hosted stays all-on (hasCapability short-circuits). No migration.
Follow-up (not in scope): capability-blind DashboardNav (free/paid rails identical)
and /chat gated on isVerified not `ai` — see dev_docs/nav_ia_redesign.md Part 4.
Co-Authored-By: Claude Opus 4.8 (1M context) <noreply@anthropic.com>
* test(mcp): assert gnubok_upload_document is ai-gated at dispatch
The gnubok_upload_document handler runs extractInvoiceFields (Bedrock OCR)
inline rather than through the entitlement-gated uploadAndExtract, so the
central MCP_TOOL_CAPABILITY_MAP dispatch check is the only paywall on that
transport. Lock it with a test (flagged by PR review as an untested money
path) so a free-tier connector key can never reach paid OCR.
Co-Authored-By: Claude Opus 4.8 (1M context) <noreply@anthropic.com>
---------
Co-authored-by: Claude Opus 4.8 (1M context) <noreply@anthropic.com>
The HTTP routes call requireCapability at every paid chokepoint, but the
MCP/agent path bypassed the paywall entirely: the three external-service
tools stage operations whose commit calls the email / Skatteverket services
directly, with no capability check. After the 2026-07-07 trial cutover a
trial-connected non-payer using the gnubok MCP connector could still send
invoice emails and file AGI/VAT.
Close the gap with two layers, mirroring the existing TOOL_SCOPE_MAP gate:
- Dispatch gate (mcp-server/server.ts): MCP_TOOL_CAPABILITY_MAP, checked
right after the scope check, blocks a non-entitled company before any
pending op is staged. Emits errorKind='capability_denied' telemetry.
- Commit-time gate (commitPendingOperation): PAID_OPERATION_CAPABILITY_MAP,
checked before the atomic claim. The real external-service chokepoint —
applies to the MCP approve tool AND the UI approval path, and closes the
trial-connected-token window (the grant has expired by commit time). A
blocked op stays 'pending', so it is re-approvable once the company subscribes.
Adds a transport-free capabilityBlockedError() helper (shared bilingual
copy) and locks both maps with tests (maps, dispatch gate, commit gate).
Only the three write/submit tools are gated; SKV read/local tools stay free
per the statutory carve-out. No DB/migration change; self-hosted stays all-on.
Co-authored-by: Claude Opus 4.8 (1M context) <noreply@anthropic.com>
Mattsson