@adiholick/nvstudio-mcp 2.2.3 → 2.4.0

package/studio-plugin/security_scanner.lua

@@ -0,0 +1,346 @@
+--!strict
+-- ============================================================================
+-- Module: security_scanner
+-- Deskripsi: Engine Heuristik Pemindaian Keamanan & Backdoor Detection
+-- Standar: Business-Grade, Zero-Execution Isolation, Comprehensive Threat Rules
+-- ============================================================================
+
+local SecurityScanner = {}
+
+-- Daftar nama skrip yang sering digunakan oleh virus/backdoor klasik Roblox
+local SUSPICIOUS_SCRIPT_NAMES = {
+    "[Vv]accine",
+    "[Aa]nti[Ll]ag",
+    "[Ff]ix[Ll]ag",
+    "[Ii]nfection",
+    "[Ff]ire",
+    "[Cc]lean",
+    "[Vv]irus",
+    "4[Dd]",
+    "4[Dd]_[Pp]lugin",
+    "[Ss]pread",
+    "[Ll]ag[Ff]ixer",
+    "[Dd]up",
+}
+
+-- Aturan Pola Heuristik Kode Berbahaya
+local THREAT_PATTERNS = {
+    {
+        id = "BACKDOOR_REQUIRE",
+        pattern = "require%s*%(%s*%d+%s*%)",
+        severity = "HIGH",
+        name = "Backdoor Numeric Require",
+        description = "Memanggil modul eksternal pihak ketiga via Asset ID numerik (indikasi backdoor/remote loader).",
+    },
+    {
+        id = "LOADSTRING_EXEC",
+        pattern = "loadstring%s*%(",
+        severity = "HIGH",
+        name = "Dynamic Code Execution (loadstring)",
+        description = "Mengeksekusi string kode dinamis yang tidak dapat diaudit.",
+    },
+    {
+        id = "GETFENV_SETFENV",
+        pattern = "[gs]etfenv%s*%(",
+        severity = "HIGH",
+        name = "Environment Manipulation (getfenv/setfenv)",
+        description = "Memanipulasi environment global Luau untuk mengelabui analisis statis.",
+    },
+    {
+        id = "DISCORD_WEBHOOK",
+        pattern = "discord[a-z]*%.com/api/webhooks",
+        severity = "HIGH",
+        name = "Discord Webhook Exfiltration",
+        description = "Mencoba mengirimkan data game atau informasi pemain ke webhook eksternal Discord.",
+    },
+    {
+        id = "IP_LOGGER",
+        pattern = "webhook%.site|grabify%.link|iplogger|blasze",
+        severity = "HIGH",
+        name = "External IP/Data Logger",
+        description = "Menghubungi domain pencatat IP atau data capture pihak ketiga.",
+    },
+    {
+        id = "FORCED_PURCHASE",
+        pattern = "MarketplaceService%s*:%s*Prompt[A-Za-z]*Purchase",
+        severity = "MEDIUM",
+        name = "Forced Robux/Product Purchase",
+        description = "Memicu dialog pembelian paksa Gamepass atau Developer Product.",
+    },
+    {
+        id = "FORCED_TELEPORT",
+        pattern = "TeleportService%s*:%s*Teleport",
+        severity = "MEDIUM",
+        name = "Forced Game Teleportation",
+        description = "Memindahkan pemain secara paksa ke game/place lain.",
+    },
+    {
+        id = "CHAR_TABLE_OBFUSCATION",
+        pattern = "string%.char%s*%(%s*%d+%s*,%s*%d+%s*,%s*%d+",
+        severity = "HIGH",
+        name = "Obfuscated string.char Array",
+        description = "Menyusun kode rahasia tersembunyi menggunakan deretan kode karakter ASCII.",
+    },
+}
+
+-- Helper: Pengecekan nama script mencurigakan
+local function checkSuspiciousName(name: string): boolean
+    for _, pattern in ipairs(SUSPICIOUS_SCRIPT_NAMES) do
+        if string.find(name, pattern) then
+            return true
+        end
+    end
+    return false
+end
+
+-- Helper: Deteksi obfuscation byte escape (\108\111\97\100) atau hex (\x6c\x6f)
+local function checkByteObfuscation(source: string): (boolean, string?)
+    local byteCount = 0
+    for _ in string.gmatch(source, "\\[0-9][0-9][0-9]") do
+        byteCount = byteCount + 1
+        if byteCount >= 4 then
+            return true, "Terdeteksi deretan escape byte ASCII (\\ddd) berulang."
+        end
+    end
+
+    local hexCount = 0
+    for _ in string.gmatch(source, "\\x[0-9a-fA-F][0-9a-fA-F]") do
+        hexCount = hexCount + 1
+        if hexCount >= 4 then
+            return true, "Terdeteksi deretan escape hex (\\xHH) berulang."
+        end
+    end
+
+    return false, nil
+end
+
+-- Helper: Deteksi kode yang sengaja disembunyikan dengan spasi/baris kosong berlebih
+local function checkOffscreenHiding(source: string): (boolean, string?)
+    -- Cek spasi horizontal masif (> 80 spasi berturut-turut)
+    if string.find(source, "   " .. string.rep(" ", 80)) then
+        return true, "Kode sengaja didorong ke kanan dengan lebih dari 80 spasi agar tersembunyi dari layar Studio."
+    end
+
+    -- Cek baris kosong masif di awal skrip (> 15 baris kosong)
+    local leadingNewlines = 0
+    for line in string.gmatch(source, "([^\r\n]*)\r?\n") do
+        if string.gsub(line, "%s+", "") == "" then
+            leadingNewlines = leadingNewlines + 1
+            if leadingNewlines >= 15 then
+                return true, "Terdapat lebih dari 15 baris kosong di awal skrip untuk menyembunyikan payload di baris bawah."
+            end
+        else
+            break
+        end
+    end
+
+    return false, nil
+end
+
+-- Analisis Source Code dari sebuah Script
+local function scanScriptSource(scriptInstance: Instance, source: string): { any }
+    local threats = {}
+    local lines = string.split(source, "\n")
+
+    -- 1. Scan pola heuristik baris per baris
+    for lineIdx, line in ipairs(lines) do
+        -- Skip baris komentar murni
+        local trimmed = string.match(line, "^%s*(.-)%s*$") or ""
+        if not string.sub(trimmed, 1, 2) == "--" then
+            for _, rule in ipairs(THREAT_PATTERNS) do
+                local s, e = string.find(line, rule.pattern)
+                if s then
+                    local snippet = string.sub(line, math.max(1, s - 30), math.min(#line, e + 30))
+                    table.insert(threats, {
+                        severity = rule.severity,
+                        ruleId = rule.id,
+                        name = rule.name,
+                        scriptName = scriptInstance.Name,
+                        scriptPath = scriptInstance:GetFullName(),
+                        scriptClass = scriptInstance.ClassName,
+                        line = lineIdx,
+                        snippet = string.match(snippet, "^%s*(.-)%s*$") or snippet,
+                        description = rule.description,
+                    })
+                end
+            end
+        end
+    end
+
+    -- 2. Cek Obfuscation
+    local isObf, obfReason = checkByteObfuscation(source)
+    if isObf then
+        table.insert(threats, {
+            severity = "HIGH",
+            ruleId = "BYTE_OBFUSCATION",
+            name = "Byte / Hex Obfuscation Payload",
+            scriptName = scriptInstance.Name,
+            scriptPath = scriptInstance:GetFullName(),
+            scriptClass = scriptInstance.ClassName,
+            line = 1,
+            snippet = string.sub(source, 1, 60) .. "...",
+            description = obfReason or "Payload kode disamarkan menggunakan escape bytes.",
+        })
+    end
+
+    -- 3. Cek Off-screen Code Hiding
+    local isHidden, hideReason = checkOffscreenHiding(source)
+    if isHidden then
+        table.insert(threats, {
+            severity = "HIGH",
+            ruleId = "OFFSCREEN_HIDING",
+            name = "Off-Screen Hidden Code",
+            scriptName = scriptInstance.Name,
+            scriptPath = scriptInstance:GetFullName(),
+            scriptClass = scriptInstance.ClassName,
+            line = 1,
+            snippet = "[Whitespace Padding Terdeteksi]",
+            description = hideReason or "Kode disembunyikan menggunakan whitespace ekstrem.",
+        })
+    end
+
+    return threats
+end
+
+-- ============================================================================
+-- PUBLIC API
+-- ============================================================================
+
+-- Memindai Instance secara rekursif
+function SecurityScanner.scanInstance(rootInstance: Instance, deepScan: boolean?)
+    local shouldDeepScan = (deepScan ~= false)
+    local allThreats = {}
+    local stats = {
+        totalInstances = 1,
+        models = 0,
+        parts = 0,
+        meshParts = 0,
+        textures = 0,
+        scripts = {
+            total = 0,
+            server = 0,
+            localScript = 0,
+            module = 0,
+        },
+    }
+
+    local function inspectItem(item: Instance)
+        stats.totalInstances = stats.totalInstances + 1
+
+        if item:IsA("Model") then
+            stats.models = stats.models + 1
+        elseif item:IsA("MeshPart") then
+            stats.meshParts = stats.meshParts + 1
+            stats.parts = stats.parts + 1
+        elseif item:IsA("BasePart") then
+            stats.parts = stats.parts + 1
+        elseif item:IsA("Texture") or item:IsA("Decal") or item:IsA("SurfaceAppearance") then
+            stats.textures = stats.textures + 1
+        end
+
+        if item:IsA("LuaSourceContainer") then
+            stats.scripts.total = stats.scripts.total + 1
+            if item:IsA("Script") then
+                stats.scripts.server = stats.scripts.server + 1
+            elseif item:IsA("LocalScript") then
+                stats.scripts.localScript = stats.scripts.localScript + 1
+            elseif item:IsA("ModuleScript") then
+                stats.scripts.module = stats.scripts.module + 1
+            end
+
+            -- Cek nama mencurigakan
+            if checkSuspiciousName(item.Name) then
+                table.insert(allThreats, {
+                    severity = "HIGH",
+                    ruleId = "SUSPICIOUS_SCRIPT_NAME",
+                    name = "Known Malicious Script Name Pattern",
+                    scriptName = item.Name,
+                    scriptPath = item:GetFullName(),
+                    scriptClass = item.ClassName,
+                    line = 0,
+                    snippet = item.Name,
+                    description = string.format("Nama skrip '%s' cocok dengan pola nama virus/backdoor klasik.", item.Name),
+                })
+            end
+
+            -- Deep scan isi source code
+            if shouldDeepScan then
+                local success, source = pcall(function()
+                    return (item :: any).Source
+                end)
+                if success and typeof(source) == "string" and #source > 0 then
+                    local scriptThreats = scanScriptSource(item, source)
+                    for _, t in ipairs(scriptThreats) do
+                        table.insert(allThreats, t)
+                    end
+                end
+            end
+        end
+    end
+
+    inspectItem(rootInstance)
+    for _, desc in ipairs(rootInstance:GetDescendants()) do
+        inspectItem(desc)
+    end
+
+    -- Hitung Level Risiko
+    local riskLevel = "SAFE"
+    local highCount = 0
+    local medCount = 0
+
+    for _, t in ipairs(allThreats) do
+        if t.severity == "HIGH" then
+            highCount = highCount + 1
+        elseif t.severity == "MEDIUM" then
+            medCount = medCount + 1
+        end
+    end
+
+    if highCount > 0 then
+        riskLevel = "DANGEROUS"
+    elseif medCount > 0 or stats.scripts.total > 0 then
+        riskLevel = "WARNING"
+    end
+
+    return {
+        riskLevel = riskLevel,
+        threats = allThreats,
+        stats = stats,
+        highThreats = highCount,
+        mediumThreats = medCount,
+    }
+end
+
+-- Menghapus seluruh skrip dari sebuah instance (Sanitasi Total)
+function SecurityScanner.stripScripts(rootInstance: Instance): { any }
+    local removed = {}
+
+    for _, desc in ipairs(rootInstance:GetDescendants()) do
+        if desc:IsA("LuaSourceContainer") then
+            table.insert(removed, {
+                name = desc.Name,
+                className = desc.ClassName,
+                path = desc:GetFullName(),
+            })
+            pcall(function()
+                desc:Destroy()
+            end)
+        end
+    end
+
+    if rootInstance:IsA("LuaSourceContainer") then
+        table.insert(removed, {
+            name = rootInstance.Name,
+            className = rootInstance.ClassName,
+            path = rootInstance:GetFullName(),
+        })
+        pcall(function()
+            rootInstance:Destroy()
+        end)
+    end
+
+    return removed
+end
+
+return SecurityScanner
+

package/studio-plugin/set_properties.lua

@@ -12,6 +12,10 @@ return function(targetInstance, data, ctx, targetPath)
             local currentVal = targetInstance[prop]
             if typeof(currentVal) == "Vector3" and type(val) == "table" and #val == 3 then
                 targetInstance[prop] = Vector3.new(val[1], val[2], val[3])
+            elseif typeof(currentVal) == "Vector2" and type(val) == "table" and #val >= 2 then
+                targetInstance[prop] = Vector2.new(val[1], val[2])
+            elseif typeof(currentVal) == "UDim" and type(val) == "table" and #val >= 2 then
+                targetInstance[prop] = UDim.new(val[1], val[2])
             elseif typeof(currentVal) == "Color3" and type(val) == "table" and #val == 3 then
                 local r, g, b = val[1], val[2], val[3]
                 if r > 1 or g > 1 or b > 1 then
@@ -21,8 +25,87 @@ return function(targetInstance, data, ctx, targetPath)
                 end
             elseif typeof(currentVal) == "UDim2" and type(val) == "table" and #val == 4 then
                 targetInstance[prop] = UDim2.new(val[1], val[2], val[3], val[4])
+            elseif typeof(currentVal) == "NumberRange" and type(val) == "table" then
+                targetInstance[prop] = NumberRange.new(val[1], val[2] or val[1])
+            elseif typeof(currentVal) == "Rect" and type(val) == "table" and #val >= 4 then
+                targetInstance[prop] = Rect.new(val[1], val[2], val[3], val[4])
+            elseif typeof(currentVal) == "BrickColor" and type(val) == "string" then
+                targetInstance[prop] = BrickColor.new(val)
             elseif typeof(currentVal) == "CFrame" and type(val) == "table" then
                 targetInstance[prop] = CFrame.new(unpack(val))
+            elseif typeof(currentVal) == "ColorSequence" or (type(val) == "table" and val.t == "ColorSequence") then
+                local kps = {}
+                local rawList = (type(val) == "table" and val.t == "ColorSequence") and val.v or val
+                if type(rawList) == "table" then
+                    for _, kp in ipairs(rawList) do
+                        local t = kp[1] or 0
+                        local col = kp[2]
+                        local c3
+                        if typeof(col) == "Color3" then
+                            c3 = col
+                        elseif type(col) == "table" and col.t == "Color3" then
+                            c3 = Color3.new(col.v[1], col.v[2], col.v[3])
+                        elseif type(col) == "table" and #col >= 3 then
+                            c3 = (col[1] > 1 or col[2] > 1 or col[3] > 1) and Color3.fromRGB(col[1], col[2], col[3]) or Color3.new(col[1], col[2], col[3])
+                        else
+                            c3 = Color3.new(1, 1, 1)
+                        end
+                        table.insert(kps, ColorSequenceKeypoint.new(math.clamp(t, 0, 1), c3))
+                    end
+                end
+                if #kps >= 2 then
+                    table.sort(kps, function(a, b) return a.Time < b.Time end)
+                    -- Pastikan keypoint pertama t=0 dan terakhir t=1
+                    if kps[1].Time ~= 0 then
+                        kps[1] = ColorSequenceKeypoint.new(0, kps[1].Value)
+                    end
+                    if kps[#kps].Time ~= 1 then
+                        kps[#kps] = ColorSequenceKeypoint.new(1, kps[#kps].Value)
+                    end
+                    -- Pastikan waktu meningkat secara monoton murni
+                    for i = 2, #kps do
+                        if kps[i].Time <= kps[i - 1].Time then
+                            local newT = math.min(1.0, kps[i - 1].Time + 0.001)
+                            kps[i] = ColorSequenceKeypoint.new(newT, kps[i].Value)
+                        end
+                    end
+                    targetInstance[prop] = ColorSequence.new(kps)
+                elseif #kps == 1 then
+                    targetInstance[prop] = ColorSequence.new(kps[1].Value)
+                end
+            elseif typeof(currentVal) == "NumberSequence" or (type(val) == "table" and val.t == "NumberSequence") then
+                local kps = {}
+                local rawList = (type(val) == "table" and val.t == "NumberSequence") and val.v or val
+                if type(rawList) == "table" then
+                    for _, kp in ipairs(rawList) do
+                        if type(kp) == "table" then
+                            local t = kp[1] or 0
+                            local v = kp[2] or 0
+                            local env = kp[3] or 0
+                            table.insert(kps, NumberSequenceKeypoint.new(math.clamp(t, 0, 1), v, env))
+                        end
+                    end
+                end
+                if #kps >= 2 then
+                    table.sort(kps, function(a, b) return a.Time < b.Time end)
+                    -- Pastikan keypoint pertama t=0 dan terakhir t=1
+                    if kps[1].Time ~= 0 then
+                        kps[1] = NumberSequenceKeypoint.new(0, kps[1].Value, kps[1].Envelope)
+                    end
+                    if kps[#kps].Time ~= 1 then
+                        kps[#kps] = NumberSequenceKeypoint.new(1, kps[#kps].Value, kps[#kps].Envelope)
+                    end
+                    -- Pastikan waktu meningkat secara monoton murni
+                    for i = 2, #kps do
+                        if kps[i].Time <= kps[i - 1].Time then
+                            local newT = math.min(1.0, kps[i - 1].Time + 0.001)
+                            kps[i] = NumberSequenceKeypoint.new(newT, kps[i].Value, kps[i].Envelope)
+                        end
+                    end
+                    targetInstance[prop] = NumberSequence.new(kps)
+                elseif #kps == 1 then
+                    targetInstance[prop] = NumberSequence.new(kps[1].Value)
+                end
             elseif typeof(currentVal) == "EnumItem" and type(val) == "string" then
                 local enumType = tostring(currentVal.EnumType)
                 local successEnum, enumValue = pcall(function() return Enum[enumType][val] end)

package/studio-plugin/solve_limb_ik.lua

@@ -0,0 +1,63 @@
+--!strict
+-- ══════════════════════════════════════════════════════════════════════
+-- Skill Module: solve_limb_ik
+-- Deskripsi: Semantic Tool untuk AI Agent menghitung orientasi sendi
+-- lengan / kaki menuju koordinat sasaran 3D secara analitis O(1).
+-- ══════════════════════════════════════════════════════════════════════
+
+local HttpService = game:GetService("HttpService")
+local kinematicsMod = script.Parent:WaitForChild("nv_kinematics")
+local Kinematics = require(kinematicsMod)
+
+return function(targetInstance: Instance?, data: any, ctx: any, targetPath: string?)
+	if not targetInstance then
+		return { status = "error", error = "Target karakter rig untuk solve_limb_ik tidak ditemukan: " .. tostring(targetPath) }
+	end
+
+	local rigInfo = Kinematics.inspectRig(targetInstance:IsA("Model") and targetInstance or targetInstance:FindFirstAncestorOfClass("Model") :: any)
+	if not rigInfo then
+		return { status = "error", error = "Target bukan model karakter rig (R6/R15) yang valid: " .. targetInstance:GetFullName() }
+	end
+
+	local payload: { [string]: any } = {}
+	pcall(function()
+		if type(data) == "table" then payload = data
+		else payload = HttpService:JSONDecode(tostring(data)) end
+	end)
+
+	local limb = tostring(payload.limb or "RightArm")
+	local goalArr = payload.goal
+	if not goalArr or type(goalArr) ~= "table" or #goalArr < 3 then
+		return { status = "error", error = "Parameter 'goal' [X, Y, Z] wajib diisi." }
+	end
+
+	local goalPos = Vector3.new(goalArr[1], goalArr[2], goalArr[3])
+	local polePos: Vector3? = nil
+	if payload.pole and type(payload.pole) == "table" and #payload.pole >= 3 then
+		polePos = Vector3.new(payload.pole[1], payload.pole[2], payload.pole[3])
+	end
+
+	local apply = payload.apply_to_rig ~= false
+	local solved = Kinematics.solveLimb(rigInfo, limb, goalPos, polePos, apply)
+
+	if not solved then
+		return { status = "error", error = "Gagal menyelesaikan IK untuk anggota tubuh: " .. limb }
+	end
+
+	local resultC0: { [string]: any } = {}
+	for mName, cf in pairs(solved) do
+		resultC0[mName] = { t = "CFrame", v = { cf:GetComponents() } }
+	end
+
+	return {
+		status = "success",
+		result = {
+			limb = limb,
+			rigType = rigInfo.isR15 and "R15" or "R6",
+			applied = apply,
+			targetGoal = { goalPos.X, goalPos.Y, goalPos.Z },
+			solvedMotors = resultC0
+		}
+	}
+end
+

package/studio-plugin/ui_manager.lua

@@ -95,7 +95,7 @@ function UIManager.init(pluginInstance, studioId)
 
     -- Version
     local versionLabel = Instance.new("TextLabel")
-    versionLabel.Text = "v2.2.0"
+    versionLabel.Text = "v2.4.0"
     versionLabel.Font = Enum.Font.Gotham
     versionLabel.TextSize = 11
     versionLabel.TextColor3 = Color3.fromRGB(120, 120, 130)