@claudinho/mcp 0.8.18 → 0.8.19

package/dist/index.js

@@ -504,6 +504,33 @@ function shiftUtcDate(dateISO, days) {
   const [y, m, d] = dateISO.slice(0, 10).split("-").map(Number);
   return new Date(Date.UTC(y ?? 1970, (m ?? 1) - 1, (d ?? 1) + days)).toISOString().slice(0, 10);
 }
+var FEED_TEXT_MAX = 100;
+function sanitizeFeedText(value, max = FEED_TEXT_MAX) {
+  let out = "";
+  let count = 0;
+  for (const ch of String(value)) {
+    const cp = ch.codePointAt(0) ?? 0;
+    const isWhitespaceControl = cp === 9 || cp === 10 || cp === 13;
+    if ((cp <= 31 || cp >= 127 && cp <= 159) && !isWhitespaceControl) continue;
+    if (count >= max) break;
+    out += isWhitespaceControl ? " " : ch;
+    count++;
+  }
+  return out;
+}
+var segmenter = new Intl.Segmenter();
+var WIDE_CLUSTER = new RegExp("^(?:\\p{Regional_Indicator}|\\p{Extended_Pictographic})", "u");
+function displayWidth(s) {
+  let w = 0;
+  for (const { segment } of segmenter.segment(s)) {
+    w += WIDE_CLUSTER.test(segment) ? 2 : 1;
+  }
+  return w;
+}
+function padVisible(s, width) {
+  const w = displayWidth(s);
+  return w >= width ? s : s + " ".repeat(width - w);
+}
 function outcomeFromScore(home, away) {
   if (home > away) return "H";
   if (home < away) return "A";
@@ -2881,6 +2908,7 @@ var ESPN_SOCCER = "https://site.api.espn.com/apis/site/v2/sports/soccer";
 var DEFAULT_COMPETITION = "fifa.world";
 var DEFAULT_BASE = `${ESPN_SOCCER}/${DEFAULT_COMPETITION}`;
 var USER_AGENT = "claudinho/0.0 (+https://github.com/arturogarrido/claudinho)";
+var MAX_RESPONSE_BYTES = 5 * 1024 * 1024;
 function competitionBase(slug) {
   return `${ESPN_SOCCER}/${slug}`;
 }
@@ -2924,9 +2952,15 @@ function toInt(s) {
   return Number.isFinite(n) ? n : void 0;
 }
 function toTeam(t2) {
-  const name = t2?.displayName ?? t2?.name ?? t2?.location ?? t2?.shortDisplayName ?? "TBD";
-  const code = (t2?.abbreviation ?? name.slice(0, 3)).toUpperCase();
-  return { code, name, flag: nationToFlag(t2?.displayName ?? t2?.abbreviation ?? name) };
+  const name = sanitizeFeedText(
+    t2?.displayName ?? t2?.name ?? t2?.location ?? t2?.shortDisplayName ?? "TBD"
+  );
+  const code = sanitizeFeedText(t2?.abbreviation ?? name.slice(0, 3)).toUpperCase();
+  return {
+    code,
+    name,
+    flag: nationToFlag(sanitizeFeedText(t2?.displayName ?? t2?.abbreviation ?? name))
+  };
 }
 function mapEspnEvent(ev, ctx = {}) {
   const comp = ev.competitions?.[0];
@@ -2957,9 +2991,9 @@ function mapEspnEvent(ev, ctx = {}) {
     stage,
     group,
     kickoff: ev.date,
-    venue: comp?.venue?.fullName ?? "",
-    city: comp?.venue?.address?.city || void 0,
-    country: comp?.venue?.address?.country || void 0,
+    venue: sanitizeFeedText(comp?.venue?.fullName ?? ""),
+    city: sanitizeFeedText(comp?.venue?.address?.city ?? "") || void 0,
+    country: sanitizeFeedText(comp?.venue?.address?.country ?? "") || void 0,
     home,
     away,
     score: hasScore ? { home: hs, away: as } : void 0,
@@ -3083,11 +3117,18 @@ var EspnAdapter = class {
     try {
       const res = await doFetch(url, {
         signal: controller.signal,
+        // ESPN never legitimately redirects; following one would sidestep the
+        // fixed-host guarantee, so treat any redirect as a failure (degraded).
+        redirect: "error",
         headers: { Accept: "application/json", "User-Agent": USER_AGENT }
       });
       if (!res.ok) {
         throw new Error(`ESPN request failed: ${res.status} ${res.statusText}`);
       }
+      const length = Number(res.headers?.get?.("content-length"));
+      if (Number.isFinite(length) && length > MAX_RESPONSE_BYTES) {
+        throw new Error(`ESPN response too large: ${length} bytes`);
+      }
       return await res.json();
     } finally {
       clearTimeout(timer);
@@ -4229,12 +4270,19 @@ var PolymarketProvider = class {
     const doFetch = this.opts.fetchImpl ?? fetch;
     const res = await doFetch(url, {
       signal: AbortSignal.timeout(timeoutMs ?? this.opts.timeoutMs ?? DEFAULT_TIMEOUT_MS),
+      // Gamma never legitimately redirects; following one would sidestep the
+      // host allow-list (it only validates the base URL), so reject redirects.
+      redirect: "error",
       headers: { Accept: "application/json", "User-Agent": USER_AGENT2 }
     });
     if (res.status === 404) return void 0;
     if (!res.ok) {
       throw new Error(`Polymarket request failed: ${res.status} ${res.statusText}`);
     }
+    const length = Number(res.headers?.get?.("content-length"));
+    if (Number.isFinite(length) && length > MAX_RESPONSE_BYTES) {
+      throw new Error(`Polymarket response too large: ${length} bytes`);
+    }
     const data = await res.json();
     const event = Array.isArray(data) ? data[0] : data;
     return event && typeof event === "object" ? event : void 0;
@@ -4677,17 +4725,21 @@ function matchList(matches, empty, opts = {}) {
 }
 function standingsTable(group, rows) {
   const header = `Group ${group}`;
-  const cols = "Team                     P  W  D  L   GD  Pts";
-  const lines = rows.map((r) => {
-    const name = `${r.team.flag} ${r.team.name}`.padEnd(24).slice(0, 24);
-    const gd2 = (r.goalDiff > 0 ? `+${r.goalDiff}` : `${r.goalDiff}`).padStart(3);
-    return `${name} ${pad(r.played)} ${pad(r.won)} ${pad(r.drawn)} ${pad(r.lost)} ${gd2}  ${pad(r.points)}`;
-  });
+  const line = (team, p, w, d, l, gd2, pts) => `${padVisible(team, 24)} ${p.padStart(2)} ${w.padStart(2)} ${d.padStart(2)} ${l.padStart(2)} ${gd2.padStart(3)} ${pts.padStart(3)}`;
+  const cols = line("Team", "P", "W", "D", "L", "GD", "Pts");
+  const lines = rows.map(
+    (r) => line(
+      `${r.team.flag} ${r.team.name}`,
+      String(r.played),
+      String(r.won),
+      String(r.drawn),
+      String(r.lost),
+      r.goalDiff > 0 ? `+${r.goalDiff}` : String(r.goalDiff),
+      String(r.points)
+    )
+  );
   return [header, cols, ...lines].join("\n");
 }
-function pad(n) {
-  return `${n}`.padStart(2);
-}
 var DISCLAIMER = "Claudinho is an independent fan project \u2014 not affiliated with or endorsed by FIFA or Anthropic.";
 
 // src/tools.ts
@@ -4928,14 +4980,16 @@ async function toolGetNextFixture(args) {
     const msg = degraded ? `Couldn't reach the data provider \u2014 no upcoming fixture confirmed for ${code}.` : `No upcoming fixture found for ${code}.`;
     return {
       text: withDisclaimer(msg, void 0, args.lang),
-      data: { team: code, fixture: null, degraded }
+      data: { team: code, fixture: null, degraded, source: source ?? null }
     };
   }
   const opts = fmtOpts(args);
   return {
+    // `source` in data mirrors the text's "Live data: …" attribution (parity
+    // with CLI `next --json`); null for a static group fixture (no live source).
     text: withDisclaimer(`Next up for ${code}:
 ${matchLine(fixture, opts)}`, source, args.lang),
-    data: { team: code, fixture, degraded }
+    data: { team: code, fixture, degraded, source: source ?? null }
   };
 }
 function toolGetTeam(args) {
@@ -5219,7 +5273,7 @@ async function toolGetShareSnippet(args) {
 
 // src/server.ts
 var SERVER_NAME = "claudinho";
-var SERVER_VERSION = "0.8.18";
+var SERVER_VERSION = "0.8.19";
 var VOICE = asFlavorLevel(process.env.CLAUDINHO_FLAVOR) === "off" ? "" : `
 Voice: when relaying scores, narrate with lively, regionally-appropriate football-commentary energy in the user's language. Each match line may end with a short exclamation ("\u2014 \xA1GOOOOL!") \u2014 use it as a tone cue. Keep every fact exact; never invent details and never impersonate or name a real commentator.`;
 var INSTRUCTIONS = `Claudinho serves live scores, fixtures, and group standings for the 2026 men's football tournament.
@@ -5234,7 +5288,9 @@ var teamArg = z.string().regex(/^[A-Za-z]{3}$/, "a 3-letter team code, e.g. MEX"
 var flavorArg = z.enum(["off", "subtle", "full"]);
 var commonArgs = {
   tz: z.string().optional().describe("IANA timezone for kickoff times, e.g. America/Mexico_City"),
-  lang: z.string().optional().describe("Locale for formatting: en, es, pt, fr (other locales fall back to en)"),
+  lang: z.string().optional().describe(
+    "Locale for dates, provider attribution, and commentary: en, es, pt, fr (the summary scaffold stays English; other locales fall back to en)"
+  ),
   flavor: flavorArg.optional().describe("Commentary flair: off, subtle, full (default: full)")
 };
 var teamRef = z.object({ code: z.string(), name: z.string(), flag: z.string() }).partial().passthrough();
@@ -5281,7 +5337,12 @@ var bracketOut = {
   standingsDegraded: z.boolean().optional(),
   source: src.optional()
 };
-var nextOut = { team: z.string(), fixture: matchOut.nullable(), degraded: z.boolean() };
+var nextOut = {
+  team: z.string(),
+  fixture: matchOut.nullable(),
+  degraded: z.boolean(),
+  source: src
+};
 var marketOut = {
   matchId: z.string().nullable().optional(),
   team: z.string().optional(),
@@ -5333,7 +5394,7 @@ function buildServer() {
     "get_today",
     {
       title: "Today's matches",
-      description: "All fixtures for a date (default: today), with live score and minute overlaid on any match in play. Use this for a whole day's card; for only in-play matches use get_live, for one team's match use get_next_fixture, for a single match's detail use get_match. Kickoffs render in tz; lang localizes text (en/es/pt/fr); flavor sets commentary tone.",
+      description: "All fixtures for a date (default: today), with live score and minute overlaid on any match in play. Use this for a whole day's card; for only in-play matches use get_live, for one team's match use get_next_fixture, for a single match's detail use get_match. Kickoffs render in tz; lang localizes dates, attribution, and commentary (en/es/pt/fr); flavor sets commentary tone.",
       inputSchema: {
         date: dateArg.optional().describe("Date as YYYY-MM-DD (default: today)"),
         ...commonArgs

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "@claudinho/mcp",
-  "version": "0.8.18",
+  "version": "0.8.19",
   "mcpName": "io.github.arturogarrido/claudinho",
   "description": "MCP server for the 2026 men's football tournament — live scores, fixtures, standings, read-only prediction-market signals, and paste-ready match cards. Works with Claude Code, Cursor, Codex, Windsurf, Zed. Not affiliated with FIFA or Anthropic.",
   "type": "module",
@@ -26,6 +26,7 @@
   },
   "files": [
     "dist",
+    "!dist/*.mcpb",
     "README.md",
     "LICENSE"
   ],
@@ -57,7 +58,7 @@
     "tsup": "^8.0.0",
     "typescript": "^5.7.0",
     "vitest": "^4.1.9",
-    "@claudinho/core": "0.8.18"
+    "@claudinho/core": "0.8.19"
   },
   "scripts": {
     "build": "tsup",