@cloudgrid-io/mcp 0.21.11 → 0.21.12

package/README.md

@@ -84,7 +84,7 @@ posted). `CLOUDGRID_QA_IDLE_MS` overrides the abandoned-idle window (default
 <!-- gen:tools -->
 ## Tools
 
-37 tools registered (15 shared across both editions, 22 local-only). No deprecated aliases. MIN_CLI_VERSION: 0.15.26.
+38 tools registered (16 shared across both editions, 22 local-only). No deprecated aliases. MIN_CLI_VERSION: 0.15.26.
 
 ### Direct-API tools (both editions)
 
@@ -105,6 +105,7 @@ posted). `CLOUDGRID_QA_IDLE_MS` overrides the abandoned-idle window (default
 | `grid_start` | API | Orient before building with CloudGrid — the live runtime environment where the user's apps run WITH the infrastructur... |
 | `grid_get_template` | corpus | Load a specific CloudGrid workflow, template, example, rule, or doc by name — deterministic retrieval from the bundle... |
 | `grid_report` | API | Report a genuine CloudGrid failure to the CloudGrid team — ONLY with the user's explicit consent. |
+| `grid_hello` | API | Create a minimal hello page and plug it into the user's grid, returning the live URL. |
 
 The direct-API tools call the platform without the CLI, so they also work in
 the web edition. `grid_login` writes the same `~/.cloudgrid/credentials` the

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "@cloudgrid-io/mcp",
-  "version": "0.21.11",
+  "version": "0.21.12",
   "description": "MCP access to CloudGrid — the live runtime environment where the user's apps run WITH the infrastructure they need out of the box: managed MongoDB, Redis (cache/queues/pub-sub), a pgvector store, persistent disk, and built-in AI with no API keys, in any language or stack, no Docker or Kubernetes to manage. Brainstorm, build, plug, and improve apps, games, dashboards, and tools; instant single-page publishes and full runtime-app deploys with a live URL — for developers and non-technical users. Three editions: local stdio (full toolset), hosted web (light, CLI-free), and a public docs-search server.",
   "type": "module",
   "bin": {
@@ -32,6 +32,7 @@
     "test:zip-deploy": "node test/zip-deploy.test.mjs",
     "test:create-gates": "node test/create-gates.test.mjs",
     "test:plug-create-grid-choice": "node test/plug-create-grid-choice.test.mjs",
+    "test:hello": "node test/hello.test.mjs",
     "test:grid-provisioning": "node test/grid-provisioning.test.mjs",
     "test:create-project-args": "node test/create-project-args.test.mjs",
     "test:mcpb-boot": "node test/mcpb-boot.test.mjs",

package/src/tools/register.js

@@ -61,6 +61,14 @@ export function buildCreateProjectArgs({ kind, name, type, needs, dir, grid, org
 // exclamation; say "plug" and "grid". The sign-in URL itself lands on its own
 // line later, from grid_login. No structural change — every caller still returns
 // { needs_auth: true }.
+// Escape untrusted text before it is interpolated into a page we publish at a
+// public URL. `&` MUST be replaced first, or the later replacements' own
+// ampersands get double-escaped. Both grid_hello sinks are element text
+// (<title> RCDATA and <body>), which this covers.
+const escapeHtml = (s) =>
+  s.replace(/&/g, "&amp;").replace(/</g, "&lt;").replace(/>/g, "&gt;")
+   .replace(/"/g, "&quot;").replace(/'/g, "&#39;");
+
 const AUTH_ASK_SIGNED_OUT =
   "How would you like to plug this?\n" +
   "  - Sign in to your grid — it stays in your CloudGrid account.\n" +
@@ -1155,6 +1163,80 @@ export function registerTools(server, ctx) {
       }
     },
   );
+    // ── grid_hello — creates a hello page and plugs it (both editions) ────────
+  reg(
+    "grid_hello",
+    {
+      title: "Plug a hello page",
+      description:
+        "Create a minimal hello page and plug it into the user's grid, returning the live URL. " +
+        "If the user has more than one grid and `grid` is not given, this returns needs_grid with " +
+        "the list — ASK the user which grid, then call again with `grid` set. Never guess the grid. " +
+        "Requires sign-in.",
+      inputSchema: {
+        grid: z.string().optional()
+          .describe("Grid slug to plug into. Omit on the first call to be asked."),
+        name: z.string().optional()
+          .describe("Who to greet. Defaults to 'world'."),
+      },
+      outputSchema: {
+        url: z.string().optional().describe("The live URL, once plugged."),
+        entity_id: z.string().optional().describe("Re-plug handle."),
+        needs_auth: z.boolean().optional().describe("True when the user must sign in first."),
+        needs_grid: z.boolean().optional().describe("True when the user must choose a grid."),
+      },
+      annotations: { readOnlyHint: false, destructiveHint: false, openWorldHint: true },
+    },
+    async (input) => {
+      try {
+        // 1. AUTH — same shape as grid_plug (register.js:585). Not an error:
+        //    a result the model acts on by running grid_login.
+        const token = await ctx.getToken();
+        if (!token) {
+          // NOT the shared AUTH_ASK_SIGNED_OUT: that offers a guest path via
+          // `grid_plug` with anon:true, which this tool has no parameter for and
+          // which would send the model to a different tool with no source. Say
+          // only what grid_hello can actually do.
+          return okResult({
+            text:
+              "Plugging a hello page needs an account. Call grid_login to sign in, "
+              + "then re-call grid_hello.",
+            structured: { needs_auth: true },
+          });
+        }
+
+        // 2. GRID — never fall back to the active grid on a create (#327).
+        //    Four outcomes; three of them are handled right here.
+        const decision = await resolveGridOrAsk(ctx, {
+          token,
+          suppliedGrid: input?.grid,
+          edition: ctx.edition,
+        });
+        if (decision.picker) return okResult(decision.picker);   // >1 grid, or 0 grids → ASK
+        const grid = decision.grid || decision.single?.slug;     // matched, or exactly one
+        if (!grid) return fail("Could not resolve a grid. Pass `grid` explicitly.");
+
+        // 3. BUILD — escape user input. This page is published to a public URL.
+        const who = escapeHtml(String(input?.name ?? "world").slice(0, 60));
+        const html = `<!doctype html>
+<html lang="en"><head><meta charset="utf-8">
+<meta name="viewport" content="width=device-width,initial-scale=1">
+<title>Hello, ${who}</title>
+<style>
+  body{margin:0;height:100vh;display:grid;place-items:center;
+       font:600 clamp(2rem,10vw,6rem)/1.1 ui-sans-serif,system-ui,sans-serif;
+       background:#0b0b0f;color:#f4f4f5}
+</style></head>
+<body>Hello, ${who}</body></html>`;
+
+        // 4. PLUG — one inline HTML document is an inspiration. runPlug does the rest.
+        const res = await runPlug(ctx, { html, grid });
+        return okResult(res);
+      } catch (err) {
+        return fail(err.message);
+      }
+    },
+  );
 
   if (ctx.edition !== "local") return; // web edition stops here — no CLI tools