feat: media preview as image content and download as embedded resource

lit/media-preview downscales an image attachment via wp_get_image_editor
and returns it as ImageContent; lit/media-download returns a file (full
or a named size) as an embedded resource, rejecting files above the
upload limit. Both are direct tools (ruling Q6: embedded resources, like
ImageContent, only become content blocks for tools called directly).
Adds MediaFiles::isWithinUploads() so neither tool ever reads a file
outside wp_upload_dir()'s basedir.

Co-Authored-By: Claude Opus 5.5 (1M context) <noreply@anthropic.com>
Claude-Session: https://claude.ai/code/session_01At3V6SjwbMe6eMzVGW3Hs7

tests/Unit/Integrations/Media/MediaDownloadAbilityTest.php

@@ -0,0 +1,85 @@
+<?php
+
+declare(strict_types=1);
+
+namespace LIT\MCP\Tests\Unit\Integrations\Media;
+
+use Brain\Monkey\Functions;
+use LIT\MCP\Integrations\Media\MediaDownloadAbility;
+use LIT\MCP\Limits;
+use LIT\MCP\Tests\Unit\TestCase;
+use WP_Post;
+
+final class MediaDownloadAbilityTest extends TestCase
+{
+    private string $file = '';
+
+    protected function setUp(): void
+    {
+        parent::setUp();
+        $this->file = (string) tempnam(sys_get_temp_dir(), 'lit-download');
+        file_put_contents($this->file, 'PDFDATA');
+        Functions\when('get_post')->justReturn(new WP_Post([
+            'ID' => 40,
+            'post_type' => 'attachment',
+            'post_mime_type' => 'application/pdf',
+        ]));
+        Functions\when('current_user_can')->justReturn(true);
+        Functions\when('get_attached_file')->justReturn($this->file);
+        Functions\when('wp_get_attachment_url')->justReturn('https://kunde.de/wp-content/uploads/preise.pdf');
+        Functions\when('wp_basename')->alias('basename');
+        Functions\when('wp_check_filetype')->justReturn(['ext' => 'pdf', 'type' => 'application/pdf']);
+        Functions\when('wp_upload_dir')->justReturn(['basedir' => sys_get_temp_dir()]);
+    }
+
+    protected function tearDown(): void
+    {
+        if (is_file($this->file)) {
+            unlink($this->file);
+        }
+        parent::tearDown();
+    }
+
+    public function testReturnsTheFileAsEmbeddedBlobResource(): void
+    {
+        Functions\when('get_option')->justReturn([]);
+
+        $result = (new MediaDownloadAbility(new Limits()))->execute(['id' => 40]);
+
+        self::assertSame('resource', $result['type']);
+        self::assertSame('https://kunde.de/wp-content/uploads/preise.pdf', $result['resource']['uri']);
+        self::assertSame('application/pdf', $result['resource']['mimeType']);
+        self::assertSame(base64_encode('PDFDATA'), $result['resource']['blob']);
+    }
+
+    public function testFilesAboveTheLimitAreRefused(): void
+    {
+        Functions\when('get_option')->justReturn(['upload_mb' => 1]);
+        file_put_contents($this->file, str_repeat('x', 1024 * 1024 + 1));
+
+        $result = (new MediaDownloadAbility(new Limits()))->execute(['id' => 40]);
+
+        self::assertSame('lit_unsupported', $result->get_error_code());
+    }
+
+    public function testUnknownSizeIsNotFound(): void
+    {
+        Functions\when('get_option')->justReturn([]);
+        Functions\when('image_get_intermediate_size')->justReturn(false);
+
+        $result = (new MediaDownloadAbility(new Limits()))->execute(['id' => 40, 'size' => 'huge']);
+
+        self::assertSame('lit_not_found', $result->get_error_code());
+        self::assertNull((new MediaDownloadAbility(new Limits()))->outputSchema());
+    }
+
+    public function testFilesOutsideTheUploadsDirectoryAreRefused(): void
+    {
+        Functions\when('get_option')->justReturn([]);
+        Functions\when('wp_upload_dir')->justReturn(['basedir' => sys_get_temp_dir() . '/lit-elsewhere']);
+
+        $result = (new MediaDownloadAbility(new Limits()))->execute(['id' => 40]);
+
+        self::assertSame('lit_not_found', $result->get_error_code());
+    }
+}

tests/Unit/Integrations/Media/MediaIntegrationTest.php

@@ -18,6 +18,8 @@ final class MediaIntegrationTest extends TestCase
     private const EXPECTED = [
         'lit/media-search',
         'lit/media-get',
+        'lit/media-preview',
+        'lit/media-download',
     ];
 
     public function testProvidesTheMediaAbilities(): void

tests/Unit/Integrations/Media/MediaPreviewAbilityTest.php

@@ -0,0 +1,92 @@
+<?php
+
+declare(strict_types=1);
+
+namespace LIT\MCP\Tests\Unit\Integrations\Media;
+
+use Brain\Monkey\Functions;
+use LIT\MCP\Integrations\Media\MediaPreviewAbility;
+use LIT\MCP\Tests\Unit\TestCase;
+use Mockery;
+use WP_Post;
+
+final class MediaPreviewAbilityTest extends TestCase
+{
+    private string $source = '';
+
+    protected function setUp(): void
+    {
+        parent::setUp();
+        $this->source = (string) tempnam(sys_get_temp_dir(), 'lit-src');
+        file_put_contents($this->source, 'original');
+        Functions\when('get_post')->justReturn(new WP_Post([
+            'ID' => 33,
+            'post_type' => 'attachment',
+            'post_mime_type' => 'image/jpeg',
+        ]));
+        Functions\when('current_user_can')->justReturn(true);
+        Functions\when('get_attached_file')->justReturn($this->source);
+        Functions\when('wp_upload_dir')->justReturn(['basedir' => sys_get_temp_dir()]);
+        Functions\when('wp_tempnam')->alias(static fn (): string => (string) tempnam(sys_get_temp_dir(), 'lit-prev'));
+        Functions\when('wp_delete_file')->alias(static function (string $file): void {
+            if (is_file($file)) {
+                unlink($file);
+            }
+        });
+    }
+
+    protected function tearDown(): void
+    {
+        if (is_file($this->source)) {
+            unlink($this->source);
+        }
+        parent::tearDown();
+    }
+
+    public function testReturnsADownscaledImageResult(): void
+    {
+        Functions\when('wp_attachment_is_image')->justReturn(true);
+        $editor = Mockery::mock();
+        $editor->allows('get_size')->andReturn(['width' => 2000, 'height' => 1000]);
+        $editor->expects('resize')->with(256, 256, false)->andReturn(true);
+        $editor->expects('save')->andReturnUsing(static function (string $path, string $mime): array {
+            file_put_contents($path, 'JPEGDATA');
+            return ['path' => $path, 'mime-type' => $mime];
+        });
+        Functions\when('wp_get_image_editor')->justReturn($editor);
+
+        $result = (new MediaPreviewAbility())->execute(['id' => 33, 'max_size' => 256]);
+
+        self::assertSame('image', $result['type']);
+        self::assertSame('JPEGDATA', $result['results']);
+        self::assertSame('image/jpeg', $result['mimeType']);
+    }
+
+    public function testNonImagesAreUnsupported(): void
+    {
+        Functions\when('wp_attachment_is_image')->justReturn(false);
+
+        $result = (new MediaPreviewAbility())->execute(['id' => 33]);
+
+        self::assertSame('lit_unsupported', $result->get_error_code());
+    }
+
+    public function testFilesOutsideTheUploadsDirectoryAreRefused(): void
+    {
+        Functions\when('wp_attachment_is_image')->justReturn(true);
+        Functions\when('wp_upload_dir')->justReturn(['basedir' => sys_get_temp_dir() . '/lit-elsewhere']);
+
+        $result = (new MediaPreviewAbility())->execute(['id' => 33]);
+
+        self::assertSame('lit_not_found', $result->get_error_code());
+    }
+
+    public function testIsADirectToolWithoutOutputSchema(): void
+    {
+        $ability = new MediaPreviewAbility();
+
+        self::assertNull($ability->outputSchema());
+        self::assertTrue($ability->isDirect());
+        self::assertTrue($ability->annotations()['readonly']);
+    }
+}