@dpantani/tdmcp 0.3.1 → 0.5.0

package/recipes/pose_skeleton_mediapipe.json

@@ -0,0 +1,67 @@
+{
+  "id": "pose_skeleton_mediapipe",
+  "name": "Pose Skeleton (MediaPipe)",
+  "description": "A live stick-figure skeleton drawn from the 33 MediaPipe body landmarks (the classic body-tracking look). Point the 'posein' Select CHOP at the pose-landmarks CHOP from the free torinmb/mediapipe-touchdesigner plugin. Webcam only — no Kinect or extra hardware. Or use create_pose_skeleton for a self-contained synthetic preview.",
+  "tags": ["mediapipe", "pose", "skeleton", "body-tracking", "camera"],
+  "difficulty": "advanced",
+  "td_version_min": "2022",
+  "nodes": [
+    {
+      "name": "posein",
+      "type": "selectCHOP",
+      "comment": "Set 'chops' to the MediaPipe plugin's pose-landmarks CHOP (33 samples, tx/ty/tz)"
+    },
+    { "name": "geo", "type": "geometryCOMP" },
+    {
+      "name": "skeleton",
+      "type": "scriptSOP",
+      "parent": "geo",
+      "render": true,
+      "comment": "onCook builds a point per landmark + a polyline per bone"
+    },
+    { "name": "skel_cb", "type": "textDAT", "parent": "geo", "comment": "Script SOP callbacks" },
+    {
+      "name": "wire",
+      "type": "lineMAT",
+      "parameters": {
+        "linenearcolorr": 0.2,
+        "linenearcolorg": 1.0,
+        "linenearcolorb": 0.9,
+        "widthnear": 3
+      }
+    },
+    { "name": "cam", "type": "cameraCOMP", "parameters": { "tz": 4.6 } },
+    {
+      "name": "render",
+      "type": "renderTOP",
+      "parameters": {
+        "outputresolution": "custom",
+        "resolutionw": 1280,
+        "resolutionh": 720,
+        "antialias": "3"
+      }
+    },
+    { "name": "out1", "type": "nullTOP" }
+  ],
+  "connections": [{ "from": "render", "to": "out1" }],
+  "parameters": [
+    { "name": "callbacks", "node": "skeleton", "param": "callbacks", "value": "skel_cb" },
+    { "name": "material", "node": "geo", "param": "material", "value": "wire" },
+    { "name": "geometry", "node": "render", "param": "geometry", "value": "geo" },
+    { "name": "camera", "node": "render", "param": "camera", "value": "cam" }
+  ],
+  "python_code": {
+    "skel_cb": "BONES = [[0,1],[1,2],[2,3],[3,7],[0,4],[4,5],[5,6],[6,8],[9,10],[11,12],[11,13],[13,15],[15,17],[15,19],[15,21],[17,19],[12,14],[14,16],[16,18],[16,20],[16,22],[18,20],[11,23],[12,24],[23,24],[23,25],[25,27],[27,29],[27,31],[29,31],[24,26],[26,28],[28,30],[28,32],[30,32]]\n\ndef onCook(scriptOp):\n    scriptOp.clear()\n    pose = op('../posein')\n    if pose is None or pose.numChans < 3 or pose.numSamples < 1:\n        return\n    tx = pose['tx']; ty = pose['ty']; tz = pose['tz']\n    if tx is None or ty is None or tz is None:\n        return\n    n = pose.numSamples\n    pts = []\n    for i in range(n):\n        p = scriptOp.appendPoint()\n        p.x = float(tx[i]); p.y = float(ty[i]); p.z = float(tz[i])\n        pts.append(p)\n    for a, b in BONES:\n        if a < n and b < n:\n            poly = scriptOp.appendPoly(2, closed=False, addPoints=False)\n            poly[0].point = pts[a]\n            poly[1].point = pts[b]\n    return\n"
+  },
+  "controls": [
+    {
+      "name": "LineWidth",
+      "type": "float",
+      "min": 0,
+      "max": 20,
+      "default": 3,
+      "bind_to": ["wire.widthnear"]
+    }
+  ],
+  "preview_description": "A glowing cyan skeleton mirroring the performer's body in real time against black."
+}

package/scripts/fetch-shader-park-td.mjs

@@ -0,0 +1,79 @@
+#!/usr/bin/env node
+import { createWriteStream, mkdirSync } from "node:fs";
+import { dirname, resolve } from "node:path";
+import { Readable } from "node:stream";
+import { finished } from "node:stream/promises";
+
+const DEFAULT_URL =
+  "https://github.com/shader-park/shader-park-touchdesigner/releases/latest/download/Shader_Park_TD.tox";
+const DEFAULT_OUT = "vendor/shader-park/Shader_Park_TD.tox";
+
+function usage() {
+  return [
+    "Download the official Shader Park TouchDesigner .tox plugin.",
+    "",
+    "Usage:",
+    "  npm run shader-park:tox",
+    "  node scripts/fetch-shader-park-td.mjs --out vendor/shader-park/Shader_Park_TD.tox",
+    "",
+    "Options:",
+    "  --out <path>  Destination path. Defaults to vendor/shader-park/Shader_Park_TD.tox",
+    "  --url <url>   Override the release asset URL.",
+    "  -h, --help    Show this help.",
+  ].join("\n");
+}
+
+function parseArgs(argv) {
+  const args = { out: DEFAULT_OUT, url: DEFAULT_URL, help: false };
+  for (let i = 0; i < argv.length; i += 1) {
+    const arg = argv[i];
+    if (arg === "-h" || arg === "--help") {
+      args.help = true;
+    } else if (arg === "--out") {
+      const value = argv[i + 1];
+      if (!value) throw new Error("--out requires a path");
+      args.out = value;
+      i += 1;
+    } else if (arg === "--url") {
+      const value = argv[i + 1];
+      if (!value) throw new Error("--url requires a URL");
+      args.url = value;
+      i += 1;
+    } else {
+      throw new Error(`Unknown argument: ${arg}`);
+    }
+  }
+  return args;
+}
+
+async function download(url, outPath) {
+  const response = await fetch(url, {
+    headers: { "user-agent": "tdmcp-fetch-shader-park-td" },
+    redirect: "follow",
+  });
+  if (!response.ok || !response.body) {
+    throw new Error(`Download failed: ${response.status} ${response.statusText}`);
+  }
+
+  mkdirSync(dirname(outPath), { recursive: true });
+  const file = createWriteStream(outPath);
+  await finished(Readable.fromWeb(response.body).pipe(file));
+  return Number(response.headers.get("content-length") ?? 0);
+}
+
+try {
+  const args = parseArgs(process.argv.slice(2));
+  if (args.help) {
+    console.log(usage());
+    process.exit(0);
+  }
+  const outPath = resolve(args.out);
+  const bytes = await download(args.url, outPath);
+  const size = bytes > 0 ? ` (${bytes} bytes)` : "";
+  console.log(`Downloaded Shader_Park_TD.tox to ${outPath}${size}`);
+} catch (error) {
+  console.error(error instanceof Error ? error.message : String(error));
+  console.error("");
+  console.error(usage());
+  process.exit(1);
+}

package/scripts/tdmcp-lops.mjs

@@ -0,0 +1,52 @@
+#!/usr/bin/env node
+// Launcher for dotsimulate's LOPs "MCP Client": injects hardening env, then
+// execs the tdmcp stdio server. LOPs' servers_config.json has no documented
+// `env` field, so point its `command` at this file instead.
+//
+//   command: "node"
+//   args: ["/abs/path/to/tdmcp/scripts/tdmcp-lops.mjs"]
+//
+// Sets TDMCP_RAW_PYTHON=off and TDMCP_TOOL_PROFILE=safe so an autonomous in-TD
+// agent gets the curated, non-destructive tool surface. These are FORCED
+// (override anything inherited from the parent) — hardening must win.
+import { spawn } from "node:child_process";
+import { existsSync } from "node:fs";
+import { dirname, resolve } from "node:path";
+import { fileURLToPath } from "node:url";
+
+const root = resolve(dirname(fileURLToPath(import.meta.url)), "..");
+const entry = resolve(root, "dist", "index.js");
+
+if (!existsSync(entry)) {
+  // stderr ONLY — stdout is the MCP stdio channel and must stay clean.
+  process.stderr.write(
+    `[tdmcp-lops] ${entry} not found. Run \`npm run build\` in ${root} first.\n`,
+  );
+  process.exit(1);
+}
+
+const env = {
+  ...process.env,
+  TDMCP_RAW_PYTHON: "off",
+  TDMCP_TOOL_PROFILE: "safe",
+};
+
+const child = spawn(process.execPath, [entry, ...process.argv.slice(2)], {
+  stdio: "inherit", // pipe stdin/stdout/stderr straight through (MCP handshake)
+  env,
+});
+
+// Forward termination so the spawned server's lifecycle matches this wrapper's.
+// MCP clients that stop the configured command by killing this process must not
+// leave an orphaned tdmcp server holding stdio + bridge connections.
+for (const signal of ["SIGTERM", "SIGINT", "SIGHUP"]) {
+  process.on(signal, () => {
+    child.kill(signal);
+  });
+}
+
+child.on("error", (err) => {
+  process.stderr.write(`[tdmcp-lops] failed to start tdmcp: ${err.message}\n`);
+  process.exit(1);
+});
+child.on("close", (code) => process.exit(code ?? 1));

package/td/modules/utils/version.py

@@ -1,3 +1,3 @@
 """Version of the tdmcp TouchDesigner bridge."""
 
-BRIDGE_VERSION = "0.3.0"
+BRIDGE_VERSION = "0.5.0"

package/td/tests/test_api_controller.py

@@ -1,307 +0,0 @@
-"""Unit tests for the tdmcp bridge HTTP router.
-
-The bridge normally runs inside TouchDesigner, where `td`, `op`, `app` and the
-operator classes are injected globals. To exercise the router's pure logic —
-auth, the arbitrary-code gate, request parsing, path decoding and route
-dispatch — off-TD, we install a stub `td` module before importing the package
-and replace the service layer with recorders for dispatch assertions.
-
-Run from the repo root: `python3 -m unittest discover -s td/tests`
-(or `npm run test:bridge`). No third-party dependencies — stdlib only.
-"""
-
-import os
-import sys
-import types
-import unittest
-from unittest import mock
-
-# --- Make the bridge importable without TouchDesigner --------------------------
-_HERE = os.path.dirname(os.path.abspath(__file__))
-_MODULES = os.path.abspath(os.path.join(_HERE, "..", "modules"))
-if _MODULES not in sys.path:
-    sys.path.insert(0, _MODULES)
-
-# `mcp.services.*` bind `op/app/project` from `td` at import time; a stub suffices.
-_td_stub = types.ModuleType("td")
-_td_stub.op = mock.MagicMock(name="op")
-_td_stub.app = mock.MagicMock(name="app")
-_td_stub.project = mock.MagicMock(name="project")
-sys.modules.setdefault("td", _td_stub)
-
-from mcp.controllers import api_controller as ac  # noqa: E402
-
-
-def _clear_exec_env():
-    os.environ.pop("TDMCP_BRIDGE_ALLOW_EXEC", None)
-
-
-def _clear_token_env():
-    os.environ.pop("TDMCP_BRIDGE_TOKEN", None)
-
-
-class AuthTests(unittest.TestCase):
-    def tearDown(self):
-        _clear_token_env()
-
-    def test_no_token_means_auth_off(self):
-        _clear_token_env()
-        # Should not raise even with no Authorization header.
-        ac._check_auth({"method": "GET"})
-
-    def test_valid_bearer_token_passes(self):
-        os.environ["TDMCP_BRIDGE_TOKEN"] = "s3cret"
-        ac._check_auth({"Authorization": "Bearer s3cret"})
-
-    def test_invalid_token_raises(self):
-        os.environ["TDMCP_BRIDGE_TOKEN"] = "s3cret"
-        with self.assertRaises(PermissionError):
-            ac._check_auth({"Authorization": "Bearer wrong"})
-
-    def test_missing_header_raises_when_token_required(self):
-        os.environ["TDMCP_BRIDGE_TOKEN"] = "s3cret"
-        with self.assertRaises(PermissionError):
-            ac._check_auth({"method": "GET"})
-
-    def test_header_lookup_is_case_insensitive_and_nested(self):
-        os.environ["TDMCP_BRIDGE_TOKEN"] = "s3cret"
-        # Header nested under a 'headers' dict with odd casing — must still match.
-        ac._check_auth({"headers": {"authorization": "Bearer s3cret"}})
-
-
-class ExecGateTests(unittest.TestCase):
-    def tearDown(self):
-        _clear_exec_env()
-        _clear_token_env()
-
-    def test_allowed_by_default(self):
-        _clear_exec_env()
-        self.assertTrue(ac._exec_allowed())
-
-    def test_disabled_values(self):
-        for value in ("0", "false", "FALSE", "no", "off", " Off "):
-            os.environ["TDMCP_BRIDGE_ALLOW_EXEC"] = value
-            self.assertFalse(ac._exec_allowed(), value)
-
-    def test_enabled_values(self):
-        for value in ("1", "true", "yes", "on", "", "anything"):
-            os.environ["TDMCP_BRIDGE_ALLOW_EXEC"] = value
-            self.assertTrue(ac._exec_allowed(), value)
-
-    def test_route_blocks_exec_when_disabled(self):
-        os.environ["TDMCP_BRIDGE_ALLOW_EXEC"] = "0"
-        with self.assertRaises(PermissionError):
-            ac._route("POST", "/api/exec", {}, {"script": "print(1)"})
-
-    def test_route_blocks_node_method_when_disabled(self):
-        os.environ["TDMCP_BRIDGE_ALLOW_EXEC"] = "0"
-        with self.assertRaises(PermissionError):
-            ac._route("POST", "/api/nodes/project1/geo1/method", {}, {"method": "cook"})
-
-
-class RoutingTests(unittest.TestCase):
-    """Dispatch logic, with the service layer swapped for recorders."""
-
-    def setUp(self):
-        _clear_exec_env()
-        self._saved = {
-            "api": ac.api_service,
-            "batch": ac.batch_service,
-            "analysis": ac.analysis_service,
-            "preview": ac.preview_service,
-        }
-        ac.api_service = mock.MagicMock(name="api_service")
-        ac.batch_service = mock.MagicMock(name="batch_service")
-        ac.analysis_service = mock.MagicMock(name="analysis_service")
-        ac.preview_service = mock.MagicMock(name="preview_service")
-
-    def tearDown(self):
-        ac.api_service = self._saved["api"]
-        ac.batch_service = self._saved["batch"]
-        ac.analysis_service = self._saved["analysis"]
-        ac.preview_service = self._saved["preview"]
-
-    def test_get_info(self):
-        ac._route("GET", "/api/info", {}, {})
-        ac.api_service.get_info.assert_called_once_with()
-
-    def test_create_node(self):
-        ac._route("POST", "/api/nodes", {}, {"parent_path": "/project1", "type": "noiseTOP"})
-        ac.api_service.create_node.assert_called_once()
-        self.assertEqual(ac.api_service.create_node.call_args.args[0], "/project1")
-        self.assertEqual(ac.api_service.create_node.call_args.args[1], "noiseTOP")
-
-    def test_list_nodes_uses_parent_query(self):
-        ac._route("GET", "/api/nodes", {"parent": ["/project1"]}, {})
-        ac.api_service.get_nodes.assert_called_once_with("/project1")
-
-    def test_exec_dispatch_when_allowed(self):
-        ac._route("POST", "/api/exec", {}, {"script": "x=1", "return_output": False})
-        ac.api_service.exec_script.assert_called_once_with("x=1", False)
-
-    def test_batch_dispatch(self):
-        ops = [{"action": "create", "parent_path": "/p", "type": "noiseTOP"}]
-        ac._route("POST", "/api/batch", {}, {"operations": ops})
-        ac.batch_service.run.assert_called_once_with(ops)
-
-    def test_node_get_patch_delete(self):
-        ac._route("GET", "/api/nodes/project1/noise1", {}, {})
-        ac.api_service.get_node.assert_called_once_with("/project1/noise1")
-
-        ac._route("PATCH", "/api/nodes/project1/noise1", {}, {"parameters": {"period": 4}})
-        ac.api_service.update_parameters.assert_called_once_with("/project1/noise1", {"period": 4})
-
-        ac._route("DELETE", "/api/nodes/project1/noise1", {}, {})
-        ac.api_service.delete_node.assert_called_once_with("/project1/noise1")
-
-    def test_node_method_dispatch(self):
-        ac._route(
-            "POST",
-            "/api/nodes/project1/geo1/method",
-            {},
-            {"method": "cook", "args": [1], "kwargs": {"force": True}},
-        )
-        ac.api_service.call_method.assert_called_once_with("/project1/geo1", "cook", [1], {"force": True})
-
-    def test_node_errors_dispatch(self):
-        ac._route("GET", "/api/nodes/project1/geo1/errors", {}, {})
-        ac.api_service.get_node_errors.assert_called_once_with("/project1/geo1", recursive=False)
-
-    def test_preview_dispatch_with_dimensions(self):
-        ac._route("GET", "/api/preview/project1/out1", {"width": ["800"], "height": ["600"]}, {})
-        ac.preview_service.capture.assert_called_once_with("/project1/out1", 800, 600)
-
-    def test_network_topology_dispatch(self):
-        ac._route("GET", "/api/network/project1/topology", {"recursive": ["true"]}, {})
-        ac.analysis_service.topology.assert_called_once_with("/project1", recursive=True)
-
-    def test_unknown_route_raises(self):
-        with self.assertRaises(ValueError):
-            ac._route("GET", "/api/does-not-exist", {}, {})
-
-    def test_create_node_missing_fields_raises_descriptive(self):
-        with self.assertRaises(ValueError) as cm:
-            ac._route("POST", "/api/nodes", {}, {})
-        self.assertIn("parent_path", str(cm.exception))
-        self.assertIn("type", str(cm.exception))
-
-    def test_exec_missing_script_raises_descriptive(self):
-        with self.assertRaises(ValueError) as cm:
-            ac._route("POST", "/api/exec", {}, {})
-        self.assertIn("script", str(cm.exception))
-
-
-class ParsingTests(unittest.TestCase):
-    def test_parse_body_variants(self):
-        self.assertEqual(ac._parse_body({"data": ""}), {})
-        self.assertEqual(ac._parse_body({"data": None}), {})
-        self.assertEqual(ac._parse_body({"data": '{"a": 1}'}), {"a": 1})
-        self.assertEqual(ac._parse_body({"data": b'{"b": 2}'}), {"b": 2})
-        self.assertEqual(ac._parse_body({"data": {"c": 3}}), {"c": 3})
-
-    def test_node_path_rejoins_and_restores_leading_slash(self):
-        self.assertEqual(ac._node_path(["project1", "noise1"]), "/project1/noise1")
-        # Percent-encoded segment decodes back to a slash-bearing path.
-        self.assertEqual(ac._node_path(["project1%2Fgeo1"]), "/project1/geo1")
-
-    def test_qs_returns_first_or_default(self):
-        self.assertEqual(ac._qs({"k": ["v1", "v2"]}, "k"), "v1")
-        self.assertEqual(ac._qs({}, "missing", "fallback"), "fallback")
-
-    def test_find_header_top_level_and_default(self):
-        self.assertEqual(ac._find_header({"X-Token": "abc"}, "x-token"), "abc")
-        self.assertIsNone(ac._find_header({"other": "v"}, "x-token"))
-
-    def test_find_header_accepts_list_value(self):
-        # A repeated/multi-value header may arrive as a list; take the first str.
-        self.assertEqual(ac._find_header({"Origin": ["http://x", "http://y"]}, "origin"), "http://x")
-        self.assertIsNone(ac._find_header({"Origin": []}, "origin"))
-        self.assertIsNone(ac._find_header({"Origin": [123]}, "origin"))
-
-
-class OriginTests(unittest.TestCase):
-    """The Origin guard blocks browser-driven CSRF / DNS-rebinding."""
-
-    def test_no_origin_is_allowed(self):
-        ac._check_origin({"method": "GET"})  # the Node client sends no Origin
-
-    def test_loopback_origins_allowed(self):
-        for origin in (
-            "http://127.0.0.1:9980",
-            "http://localhost",
-            "https://localhost:3000",
-            "http://[::1]:9980",
-        ):
-            ac._check_origin({"Origin": origin})  # must not raise
-
-    def test_cross_origin_rejected(self):
-        for origin in ("http://evil.com", "https://attacker.example:8443", "http://192.168.1.5"):
-            with self.assertRaises(PermissionError, msg=origin):
-                ac._check_origin({"Origin": origin})
-
-    def test_opaque_null_origin_rejected(self):
-        with self.assertRaises(PermissionError):
-            ac._check_origin({"Origin": "null"})
-
-    def test_origin_lookup_is_case_insensitive_and_nested(self):
-        with self.assertRaises(PermissionError):
-            ac._check_origin({"headers": {"origin": "http://evil.com"}})
-
-    def test_handle_rejects_cross_origin_with_403(self):
-        resp = ac.handle({"method": "GET", "uri": "/api/info", "Origin": "http://evil.com"}, {})
-        self.assertEqual(resp["statusCode"], 403)
-        self.assertIn("cross-origin", resp["data"])
-
-    def test_handle_rejects_list_valued_cross_origin(self):
-        # Some TD builds surface a header as a list; it must not slip the guard.
-        resp = ac.handle({"method": "GET", "uri": "/api/info", "Origin": ["http://evil.com"]}, {})
-        self.assertEqual(resp["statusCode"], 403)
-        self.assertIn("cross-origin", resp["data"])
-
-
-class HandleTests(unittest.TestCase):
-    def tearDown(self):
-        _clear_exec_env()
-        _clear_token_env()
-
-    def _resp(self):
-        return {}
-
-    def test_ok_envelope(self):
-        with mock.patch.object(ac, "_route", return_value={"hello": "world"}):
-            resp = ac.handle({"method": "GET", "uri": "/api/info"}, self._resp())
-        self.assertEqual(resp["statusCode"], 200)
-        self.assertIn('"ok": true', resp["data"])
-        self.assertIn("world", resp["data"])
-
-    def test_auth_failure_is_401(self):
-        os.environ["TDMCP_BRIDGE_TOKEN"] = "s3cret"
-        resp = ac.handle({"method": "GET", "uri": "/api/info"}, self._resp())
-        self.assertEqual(resp["statusCode"], 401)
-        self.assertIn('"ok": false', resp["data"])
-
-    def test_error_is_400(self):
-        with mock.patch.object(ac, "_route", side_effect=ValueError("boom")):
-            resp = ac.handle({"method": "GET", "uri": "/api/info"}, self._resp())
-        self.assertEqual(resp["statusCode"], 400)
-        self.assertIn("boom", resp["data"])
-
-    def test_exec_disabled_surfaces_as_403_with_message(self):
-        os.environ["TDMCP_BRIDGE_ALLOW_EXEC"] = "0"
-        resp = ac.handle(
-            {"method": "POST", "uri": "/api/exec", "data": '{"script": "1"}'}, self._resp()
-        )
-        self.assertEqual(resp["statusCode"], 403)
-        self.assertIn("disabled", resp["data"])
-
-    def test_missing_required_field_surfaces_as_400_with_name(self):
-        # A POST with valid JSON but a missing field gets a descriptive 400,
-        # not a bare KeyError message of just the key name.
-        resp = ac.handle({"method": "POST", "uri": "/api/nodes", "data": "{}"}, self._resp())
-        self.assertEqual(resp["statusCode"], 400)
-        self.assertIn("parent_path", resp["data"])
-        self.assertIn("Missing required field", resp["data"])
-
-
-if __name__ == "__main__":
-    unittest.main()