feat: Let the Actor store provide proxied Actor picture URLs

[MQ37]

Why

Part of #804. fetch-actor-details gets the Actor picture from the Store search (resized imgproxy URL) because the raw S3 URL from the Apify API has no CORS headers and breaks the widget avatar (#459). That costs an extra request per call and does not work for private or unlisted Actors. The hosted server can sign the same URL itself.

What changed

• Before: fetchActorDetails always searched the Store for the picture URL.
• Now: ActorStore has an optional getProxiedPictureUrl(). If the host provides it, the search is skipped and its URL is used. Without it (stdio) nothing changes.
• fetchActorDetails takes { cardOptions, actorStore } to stay at 3 positional params (not exported from ./internals).

Notes for reviewers (human-written)

• Internal impact: apify-mcp-server-internal#807 implements the method; it needs this released first.
• Deliberate: one request less per call on hosted, and private Actors get a working URL.
• Alternative considered: a new server option, about 8 files of threading; actorStore already reaches every tool.
• Out of scope: tool-list icons (image/png hard-coded). Supersedes fix: Drop redundant store-search call in fetchActorDetails #1377.
• AI assistance: Claude Code helped write and test this change.

Proof it works

Internal server with this build, container, real api.apify.com:

$ mcpc @pr tools-call fetch-actor-details actor:=apify/instagram-scraper
  pictureUrl = https://images.apifyusercontent.com/…/rs:fill:76:76/cb:1/….webp  (== Store API URL)
$ curl -sI -H 'Origin: https://claude.ai' <pictureUrl>
  200 image/webp, access-control-allow-origin: *, 1.4 KB  (raw S3 PNG: ~200 KB)

Same for web-scraper and rag-web-browser. No /v2/store call on the hosted path, one in the stdio fallback.

[pkg-pr-new]

Open in StackBlitz

npm i https://pkg.pr.new/@apify/actors-mcp-server@1467

commit: 85cd683

[jirispilka]

I want have time to test it myself, so I don't want to block this.
I posted a comment here, relevant also for this PR: https://github.com/apify/apify-mcp-server-internal/pull/807#issuecomment-5941910021

[vojtechj-apify]

LGTM.

Minor, to check: getProxiedPictureUrl runs inside the try in fetchActorDetails, whose catch rethrows non-404/400 errors, so a throwing signer would fail the whole fetch-actor-details call over an avatar URL. Unlikely with the current HMAC signer; not blocking.

---

Generated by Claude Code