@dpantani/tdmcp 0.4.0 → 0.6.1

package/recipes/pose_skeleton_mediapipe.json

@@ -0,0 +1,67 @@
+{
+  "id": "pose_skeleton_mediapipe",
+  "name": "Pose Skeleton (MediaPipe)",
+  "description": "A live stick-figure skeleton drawn from the 33 MediaPipe body landmarks (the classic body-tracking look). Point the 'posein' Select CHOP at the pose-landmarks CHOP from the free torinmb/mediapipe-touchdesigner plugin. Webcam only — no Kinect or extra hardware. Or use create_pose_skeleton for a self-contained synthetic preview.",
+  "tags": ["mediapipe", "pose", "skeleton", "body-tracking", "camera"],
+  "difficulty": "advanced",
+  "td_version_min": "2022",
+  "nodes": [
+    {
+      "name": "posein",
+      "type": "selectCHOP",
+      "comment": "Set 'chops' to the MediaPipe plugin's pose-landmarks CHOP (33 samples, tx/ty/tz)"
+    },
+    { "name": "geo", "type": "geometryCOMP" },
+    {
+      "name": "skeleton",
+      "type": "scriptSOP",
+      "parent": "geo",
+      "render": true,
+      "comment": "onCook builds a point per landmark + a polyline per bone"
+    },
+    { "name": "skel_cb", "type": "textDAT", "parent": "geo", "comment": "Script SOP callbacks" },
+    {
+      "name": "wire",
+      "type": "lineMAT",
+      "parameters": {
+        "linenearcolorr": 0.2,
+        "linenearcolorg": 1.0,
+        "linenearcolorb": 0.9,
+        "widthnear": 3
+      }
+    },
+    { "name": "cam", "type": "cameraCOMP", "parameters": { "tz": 4.6 } },
+    {
+      "name": "render",
+      "type": "renderTOP",
+      "parameters": {
+        "outputresolution": "custom",
+        "resolutionw": 1280,
+        "resolutionh": 720,
+        "antialias": "3"
+      }
+    },
+    { "name": "out1", "type": "nullTOP" }
+  ],
+  "connections": [{ "from": "render", "to": "out1" }],
+  "parameters": [
+    { "name": "callbacks", "node": "skeleton", "param": "callbacks", "value": "skel_cb" },
+    { "name": "material", "node": "geo", "param": "material", "value": "wire" },
+    { "name": "geometry", "node": "render", "param": "geometry", "value": "geo" },
+    { "name": "camera", "node": "render", "param": "camera", "value": "cam" }
+  ],
+  "python_code": {
+    "skel_cb": "BONES = [[0,1],[1,2],[2,3],[3,7],[0,4],[4,5],[5,6],[6,8],[9,10],[11,12],[11,13],[13,15],[15,17],[15,19],[15,21],[17,19],[12,14],[14,16],[16,18],[16,20],[16,22],[18,20],[11,23],[12,24],[23,24],[23,25],[25,27],[27,29],[27,31],[29,31],[24,26],[26,28],[28,30],[28,32],[30,32]]\n\ndef onCook(scriptOp):\n    scriptOp.clear()\n    pose = op('../posein')\n    if pose is None or pose.numChans < 3 or pose.numSamples < 1:\n        return\n    tx = pose['tx']; ty = pose['ty']; tz = pose['tz']\n    if tx is None or ty is None or tz is None:\n        return\n    n = pose.numSamples\n    pts = []\n    for i in range(n):\n        p = scriptOp.appendPoint()\n        p.x = float(tx[i]); p.y = float(ty[i]); p.z = float(tz[i])\n        pts.append(p)\n    for a, b in BONES:\n        if a < n and b < n:\n            poly = scriptOp.appendPoly(2, closed=False, addPoints=False)\n            poly[0].point = pts[a]\n            poly[1].point = pts[b]\n    return\n"
+  },
+  "controls": [
+    {
+      "name": "LineWidth",
+      "type": "float",
+      "min": 0,
+      "max": 20,
+      "default": 3,
+      "bind_to": ["wire.widthnear"]
+    }
+  ],
+  "preview_description": "A glowing cyan skeleton mirroring the performer's body in real time against black."
+}

package/safeskill.manifest.json

@@ -0,0 +1,37 @@
+{
+  "name": "@dpantani/tdmcp",
+  "version": "0.6.1",
+  "summary": "TouchDesigner MCP server for local creative-control workflows.",
+  "expectedCapabilities": {
+    "filesystem": {
+      "read": [
+        "project recipes, docs, package manifests and optional user-selected vault/package folders",
+        "tdmcp config files from the current project or user config directory"
+      ],
+      "write": [
+        "generated bridge files under the user's selected install directory",
+        "optional user-selected vault notes and exported media"
+      ]
+    },
+    "network": {
+      "loopback": [
+        "TouchDesigner bridge on the configured host and port",
+        "optional local LLM endpoint for tdmcp chat"
+      ],
+      "remote": [
+        "GitHub release/package downloads when the user installs optional library packages",
+        "OpenAI-compatible LLM endpoint only when the user configures a remote base URL"
+      ]
+    },
+    "process": [
+      "opens the local chat UI in a browser",
+      "starts local Ollama only when auto-start is enabled and the endpoint is local",
+      "uses the platform zip utility when extracting user-requested package archives"
+    ]
+  },
+  "securityNotes": [
+    "Secrets are loaded from explicit environment/config fields and redacted before diagnostic printing.",
+    "Archive extraction validates paths and rejects traversal or symlink entries before unpacking.",
+    "Raw Python tools can be disabled with TDMCP_RAW_PYTHON=off or hidden with TDMCP_TOOL_PROFILE=safe."
+  ]
+}

package/scripts/fetch-shader-park-td.mjs

@@ -0,0 +1,79 @@
+#!/usr/bin/env node
+import { createWriteStream, mkdirSync } from "node:fs";
+import { dirname, resolve } from "node:path";
+import { Readable } from "node:stream";
+import { finished } from "node:stream/promises";
+
+const DEFAULT_URL =
+  "https://github.com/shader-park/shader-park-touchdesigner/releases/latest/download/Shader_Park_TD.tox";
+const DEFAULT_OUT = "vendor/shader-park/Shader_Park_TD.tox";
+
+function usage() {
+  return [
+    "Download the official Shader Park TouchDesigner .tox plugin.",
+    "",
+    "Usage:",
+    "  npm run shader-park:tox",
+    "  node scripts/fetch-shader-park-td.mjs --out vendor/shader-park/Shader_Park_TD.tox",
+    "",
+    "Options:",
+    "  --out <path>  Destination path. Defaults to vendor/shader-park/Shader_Park_TD.tox",
+    "  --url <url>   Override the release asset URL.",
+    "  -h, --help    Show this help.",
+  ].join("\n");
+}
+
+function parseArgs(argv) {
+  const args = { out: DEFAULT_OUT, url: DEFAULT_URL, help: false };
+  for (let i = 0; i < argv.length; i += 1) {
+    const arg = argv[i];
+    if (arg === "-h" || arg === "--help") {
+      args.help = true;
+    } else if (arg === "--out") {
+      const value = argv[i + 1];
+      if (!value) throw new Error("--out requires a path");
+      args.out = value;
+      i += 1;
+    } else if (arg === "--url") {
+      const value = argv[i + 1];
+      if (!value) throw new Error("--url requires a URL");
+      args.url = value;
+      i += 1;
+    } else {
+      throw new Error(`Unknown argument: ${arg}`);
+    }
+  }
+  return args;
+}
+
+async function download(url, outPath) {
+  const response = await fetch(url, {
+    headers: { "user-agent": "tdmcp-fetch-shader-park-td" },
+    redirect: "follow",
+  });
+  if (!response.ok || !response.body) {
+    throw new Error(`Download failed: ${response.status} ${response.statusText}`);
+  }
+
+  mkdirSync(dirname(outPath), { recursive: true });
+  const file = createWriteStream(outPath);
+  await finished(Readable.fromWeb(response.body).pipe(file));
+  return Number(response.headers.get("content-length") ?? 0);
+}
+
+try {
+  const args = parseArgs(process.argv.slice(2));
+  if (args.help) {
+    console.log(usage());
+    process.exit(0);
+  }
+  const outPath = resolve(args.out);
+  const bytes = await download(args.url, outPath);
+  const size = bytes > 0 ? ` (${bytes} bytes)` : "";
+  console.log(`Downloaded Shader_Park_TD.tox to ${outPath}${size}`);
+} catch (error) {
+  console.error(error instanceof Error ? error.message : String(error));
+  console.error("");
+  console.error(usage());
+  process.exit(1);
+}

package/scripts/tdmcp-lops.mjs

@@ -0,0 +1,52 @@
+#!/usr/bin/env node
+// Launcher for dotsimulate's LOPs "MCP Client": injects hardening env, then
+// execs the tdmcp stdio server. LOPs' servers_config.json has no documented
+// `env` field, so point its `command` at this file instead.
+//
+//   command: "node"
+//   args: ["/abs/path/to/tdmcp/scripts/tdmcp-lops.mjs"]
+//
+// Sets TDMCP_RAW_PYTHON=off and TDMCP_TOOL_PROFILE=safe so an autonomous in-TD
+// agent gets the curated, non-destructive tool surface. These are FORCED
+// (override anything inherited from the parent) — hardening must win.
+import { spawn } from "node:child_process";
+import { existsSync } from "node:fs";
+import { dirname, resolve } from "node:path";
+import { fileURLToPath } from "node:url";
+
+const root = resolve(dirname(fileURLToPath(import.meta.url)), "..");
+const entry = resolve(root, "dist", "index.js");
+
+if (!existsSync(entry)) {
+  // stderr ONLY — stdout is the MCP stdio channel and must stay clean.
+  process.stderr.write(
+    `[tdmcp-lops] ${entry} not found. Run \`npm run build\` in ${root} first.\n`,
+  );
+  process.exit(1);
+}
+
+const env = {
+  ...process.env,
+  TDMCP_RAW_PYTHON: "off",
+  TDMCP_TOOL_PROFILE: "safe",
+};
+
+const child = spawn(process.execPath, [entry, ...process.argv.slice(2)], {
+  stdio: "inherit", // pipe stdin/stdout/stderr straight through (MCP handshake)
+  env,
+});
+
+// Forward termination so the spawned server's lifecycle matches this wrapper's.
+// MCP clients that stop the configured command by killing this process must not
+// leave an orphaned tdmcp server holding stdio + bridge connections.
+for (const signal of ["SIGTERM", "SIGINT", "SIGHUP"]) {
+  process.on(signal, () => {
+    child.kill(signal);
+  });
+}
+
+child.on("error", (err) => {
+  process.stderr.write(`[tdmcp-lops] failed to start tdmcp: ${err.message}\n`);
+  process.exit(1);
+});
+child.on("close", (code) => process.exit(code ?? 1));

package/td/README.md

@@ -19,7 +19,7 @@ idempotent, and can be undone with `from mcp import install; install.uninstall()
 (`Dialogs → Textport and DATs`):
 
 ```python
-import urllib.request; exec(urllib.request.urlopen("https://raw.githubusercontent.com/Pantani/tdmcp/main/td/bootstrap.py").read().decode())
+import urllib.request; exec(urllib.request.urlopen("https://github.com/Pantani/tdmcp/raw/main/td/bootstrap.py").read().decode())
 ```
 
 It downloads the bridge to `~/tdmcp-bridge/modules` and starts it on port 9980.

package/td/bootstrap.py

@@ -3,7 +3,7 @@
 Paste this single line into the Textport (Dialogs -> Textport and DATs) and the
 bridge installs itself and starts:
 
-    import urllib.request; exec(urllib.request.urlopen("https://raw.githubusercontent.com/Pantani/tdmcp/main/td/bootstrap.py").read().decode())
+    import urllib.request; exec(urllib.request.urlopen("https://github.com/Pantani/tdmcp/raw/main/td/bootstrap.py").read().decode())
 
 It downloads just the bridge modules to ~/tdmcp-bridge/modules, puts them on
 sys.path for this session, and runs install.run() -> a tdmcp_bridge on port 9980.
@@ -15,6 +15,7 @@ private, point REPO_ZIP at a public release asset, or use `install-bridge`
 
 import io
 import os
+import stat
 import sys
 import zipfile
 import urllib.request
@@ -22,6 +23,37 @@ import urllib.request
 REPO_ZIP = "https://github.com/Pantani/tdmcp/archive/refs/heads/main.zip"
 DEST = os.path.expanduser("~/tdmcp-bridge")
 _MARKER = "/td/modules/"
+_SKIP_RUN_ENV = "TDMCP_BOOTSTRAP_SKIP_RUN"
+
+
+def _is_symlink(info):
+    return stat.S_ISLNK((info.external_attr >> 16) & 0o170000)
+
+
+def _safe_module_path(name, modules_dir):
+    idx = name.find(_MARKER)
+    if idx == -1:
+        return None
+
+    rel = name[idx + len(_MARKER):].replace("\\", "/")
+    if not rel or rel.endswith("/"):
+        return None
+
+    parts = rel.split("/")
+    if (
+        rel.startswith("/")
+        or rel.startswith("\\")
+        or (len(parts[0]) >= 2 and parts[0][1] == ":")
+        or any(part in ("", ".", "..") for part in parts)
+    ):
+        raise RuntimeError("[tdmcp] Refusing unsafe archive entry: %s" % name)
+
+    root = os.path.realpath(modules_dir)
+    target = os.path.realpath(os.path.join(modules_dir, *parts))
+    if target != root and not target.startswith(root + os.sep):
+        raise RuntimeError("[tdmcp] Refusing archive entry outside modules: %s" % name)
+
+    return target
 
 
 def fetch_modules(repo_zip=REPO_ZIP, dest=DEST):
@@ -39,16 +71,15 @@ def fetch_modules(repo_zip=REPO_ZIP, dest=DEST):
     zf = zipfile.ZipFile(io.BytesIO(data))
     os.makedirs(modules_dir, exist_ok=True)
     extracted = 0
-    for name in zf.namelist():
+    for info in zf.infolist():
+        name = info.filename
         if name.endswith("/"):
             continue
-        idx = name.find(_MARKER)
-        if idx == -1:
-            continue
-        rel = name[idx + len(_MARKER):]
-        if not rel:
+        target = _safe_module_path(name, modules_dir)
+        if target is None:
             continue
-        target = os.path.join(modules_dir, rel)
+        if _is_symlink(info):
+            raise RuntimeError("[tdmcp] Refusing symlink archive entry: %s" % name)
         os.makedirs(os.path.dirname(target), exist_ok=True)
         with zf.open(name) as src, open(target, "wb") as out:
             out.write(src.read())
@@ -70,4 +101,5 @@ def run(repo_zip=REPO_ZIP, dest=DEST, port=9980):
 
 
 # Running via exec(urlopen(...).read()) or as a script kicks off the install.
-run()
+if os.environ.get(_SKIP_RUN_ENV) != "1":
+    run()

package/td/modules/mcp/controllers/api_controller.py

@@ -13,7 +13,15 @@ import os
 from urllib.parse import parse_qs, unquote, urlparse
 
 from mcp import events
-from mcp.services import analysis_service, api_service, batch_service, preview_service
+from mcp.services import (
+    analysis_service,
+    api_service,
+    batch_service,
+    connect_service,
+    log_service,
+    param_text_service,
+    preview_service,
+)
 
 
 class _Unauthorized(PermissionError):
@@ -158,7 +166,23 @@ def _require(body, *keys):
         raise ValueError("Missing required field(s): %s." % ", ".join(missing))
 
 
-def _route(method, path, query, body):
+def _bridge_error_log_path(webserver):
+    """Resolve the installed Error DAT's path from the webserver that serves this
+    request. The API is served by the webserver DAT INSIDE the bridge container, so
+    the Error DAT is ``webserver.parent().op('error_log')`` regardless of a custom
+    ``parent_path``/``container``. Returns None when it can't be resolved (e.g. the
+    webserver isn't threaded, as in tests) so the caller falls back to the default."""
+    if webserver is None:
+        return None
+    try:
+        bridge = webserver.parent()
+        ed = bridge.op("error_log") if bridge is not None else None
+        return ed.path if ed is not None else None
+    except Exception:  # noqa: BLE001
+        return None
+
+
+def _route(method, path, query, body, webserver=None):
     parts = [p for p in path.split("/") if p]
     if not parts or parts[0] != "api":
         raise ValueError("Not found: %s" % path)
@@ -184,6 +208,36 @@ def _route(method, path, query, body):
     if rest == ["batch"] and method == "POST":
         return batch_service.run(body.get("operations", []))
 
+    # Structured wiring + logs endpoints — NO exec gate (they must survive
+    # TDMCP_BRIDGE_ALLOW_EXEC=0). Top-level paths, so no collision with nodes/network.
+    if rest == ["connect"] and method == "POST":
+        _require(body, "source_path", "target_path")
+        return connect_service.connect(
+            body["source_path"],
+            body["target_path"],
+            int(body.get("source_output", 0)),
+            int(body.get("target_input", 0)),
+        )
+    if rest == ["disconnect"] and method == "POST":
+        _require(body, "to_path")
+        return connect_service.disconnect(
+            body["to_path"], body.get("from_path"), body.get("to_input")
+        )
+    if rest == ["logs"] and method == "GET":
+        # Resolve the Error DAT relative to the webserver's own container so a custom
+        # install (parent_path/container) works; fall back to get_logs' default when
+        # the webserver isn't threaded (e.g. tests).
+        log_kwargs = {}
+        error_dat = _bridge_error_log_path(webserver)
+        if error_dat:
+            log_kwargs["error_dat_path"] = error_dat
+        return log_service.get_logs(
+            _qs(query, "severity", "all"),
+            int(_qs(query, "max_lines", 200)),
+            _qs(query, "scope") or None,
+            **log_kwargs,
+        )
+
     if rest[0] == "nodes" and len(rest) >= 2:
         if rest[-1] == "method" and method == "POST":
             if not _exec_allowed():
@@ -199,6 +253,36 @@ def _route(method, path, query, body):
             )
         if rest[-1] == "errors" and method == "GET":
             return api_service.get_node_errors(_node_path(rest[1:-1]), recursive=False)
+        # Param-mode + DAT-text suffixes — MORE SPECIFIC than the generic node CRUD
+        # below, so they MUST be matched first (else `…/text` GET is swallowed by
+        # get_node). No exec gate — structured endpoints survive ALLOW_EXEC=0.
+        if rest[-1] == "params" and method == "GET" and _qs(query, "modes") == "true":
+            return param_text_service.read_param_modes(
+                _node_path(rest[1:-1]),
+                (_qs(query, "keys").split(",") if _qs(query, "keys") else None),
+                _qs(query, "non_default_only") == "true",
+            )
+        if len(rest) >= 4 and rest[-1] == "mode" and rest[-3] == "params" and method == "PATCH":
+            # /api/nodes/<path…>/params/<param>/mode
+            return param_text_service.set_param_mode(
+                _node_path(rest[1:-3]),
+                unquote(rest[-2]),
+                body.get("mode", "expression"),
+                body.get("expr"),
+                body.get("value"),
+            )
+        if rest[-1] == "text" and method == "GET":
+            # Disambiguate a node literally named "text": the /text suffix only means
+            # "read this DAT's text" when the PARENT is actually a DAT. Otherwise the
+            # WebServer DAT decoded the path's slashes and "text" is the node's own
+            # name, so return that node's detail instead of the parent's DAT text.
+            _txt_parent = _node_path(rest[1:-1])
+            if param_text_service.is_dat(_txt_parent):
+                return param_text_service.get_dat_text(_txt_parent)
+            return api_service.get_node(_node_path(rest[1:]))
+        if rest[-1] == "text" and method == "PUT":
+            _require(body, "text")
+            return param_text_service.put_dat_text(_node_path(rest[1:-1]), body["text"])
         node_path = _node_path(rest[1:])
         if method == "GET":
             return api_service.get_node(node_path)
@@ -294,7 +378,7 @@ def handle(request, response, webserver=None):
         parsed = urlparse(request.get("uri", "/"))
         query = _merge_query(request, parse_qs(parsed.query))
         body = _parse_body(request)
-        data = _route(method, parsed.path, query, body)
+        data = _route(method, parsed.path, query, body, webserver)
         _emit_event(webserver, method, parsed.path, data)
         return _send(response, 200, {"ok": True, "data": data})
     except PermissionError as exc:

package/td/modules/mcp/install.py

@@ -70,6 +70,27 @@ def _event_hooks_source(modules_dir=None):
         "                        emitted += 1\n"
         "                        if emitted >= 10:\n"
         "                            break\n"
+        "        # Edge-triggered cook.error / error.cleared from the bridge Error DAT.\n"
+        "        # Broadcast on a row-count delta OR a newest-row identity change. At\n"
+        "        # the maxlines cap, clamp replaces old rows so numRows stops growing —\n"
+        "        # tracking the newest (absframe, message) too keeps cook.error firing\n"
+        "        # for fresh errors after the buffer fills (still <=1 per frame).\n"
+        "        _ed = me.parent().op('error_log')\n"
+        "        if _ed is not None and _ed.numRows > 0:\n"
+        "            _rows = _ed.numRows - 1   # data rows, minus header\n"
+        "            _prev = getattr(me, '_tdmcp_err_rows', 0)\n"
+        "            _prev_new = getattr(me, '_tdmcp_err_newest', None)\n"
+        "            _new = (str(_ed[_rows, 2]), str(_ed[_rows, 1])) if _rows > 0 else None\n"
+        "            if _rows != _prev or _new != _prev_new:\n"
+        "                me._tdmcp_err_rows = _rows\n"
+        "                me._tdmcp_err_newest = _new\n"
+        "                if _rows == 0:\n"
+        "                    _broadcast('error.cleared', {'count': 0})\n"
+        "                else:\n"
+        "                    _broadcast('cook.error', {\n"
+        "                        'source': str(_ed[_rows, 0]), 'message': str(_ed[_rows, 1]),\n"
+        "                        'severity': str(_ed[_rows, 4]), 'type': str(_ed[_rows, 5]), 'count': _rows,\n"
+        "                    })\n"
         "    except Exception:\n"
         "        pass\n\n"
         "def onProjectPostSave():\n"
@@ -82,7 +103,14 @@ def _event_hooks_source(modules_dir=None):
     )
 
 
-def run(port=9980, parent_path="/project1", container="tdmcp_bridge", modules_dir=None, export_tox=None):
+def run(
+    port=9980,
+    parent_path="/project1",
+    container="tdmcp_bridge",
+    modules_dir=None,
+    export_tox=None,
+    error_scope=None,
+):
     import td  # TouchDesigner globals are only available via the td module here
 
     if modules_dir:
@@ -109,6 +137,26 @@ def run(port=9980, parent_path="/project1", container="tdmcp_bridge", modules_di
     hooks.par.frameend = True
     hooks.par.projectpostsave = True
 
+    # Error DAT: structured cook-error/warning capture for GET /api/logs + the
+    # edge-triggered cook.error / error.cleared events. Idempotent like the rest.
+    # The path /<container>/error_log must stay in sync with log_service.get_logs'
+    # error_dat_path default and getBridgeLogs' fallback assumption.
+    err = comp.op("error_log") or comp.create(td.errorDAT, "error_log")
+    err.par.active = True
+    err.par.maxlines = 200  # default 10 is too small for a show
+    err.par.clamp = True  # keep newest within maxlines
+    err.par.severity = "*"  # capture errors AND warnings
+    err.par.source = "*"
+    try:
+        # Watch the artist's whole network by default (not just the bridge container).
+        # Set the VALUE directly (a constant op path) — assigning .expr alone would
+        # not switch the par into Expression mode, so it would keep its default/
+        # constant fromop and never watch parent_path/error_scope.
+        scope = error_scope or parent_path
+        err.par.fromop.val = scope
+    except Exception:
+        pass
+
     if export_tox:
         comp.save(export_tox)
 

package/td/modules/mcp/services/api_service.py

@@ -98,6 +98,58 @@ def get_nodes(parent_path=None):
     return {"nodes": [node_ref(c) for c in children]}
 
 
+def _flags(node):
+    out = {}
+    for attr in ("bypass", "render", "display", "lock", "allowCooking", "cloneImmune"):
+        try:
+            v = getattr(node, attr)
+            if isinstance(v, bool):
+                out[attr] = v
+        except Exception:  # noqa: BLE001
+            pass
+    # clone is COMP-only and lives on .par.clone (path to master), NOT op.clone.
+    try:
+        if hasattr(node, "isClone"):
+            out["is_clone"] = bool(node.isClone)
+    except Exception:  # noqa: BLE001
+        pass
+    try:
+        cp = getattr(node.par, "clone", None)
+        if cp is not None:
+            cv = cp.eval()
+            out["clone"] = str(cv) if cv else None
+    except Exception:  # noqa: BLE001
+        pass
+    return out
+
+
+def _indexed_inputs(node):
+    # Faithful, index-aware: iterate inputConnectors (NOT node.inputs, which omits empty
+    # slots). Each wire => {in_index, from, out_index}. Multi-input TOPs pack contiguously,
+    # so the indices reported are the live/current ones.
+    wires = []
+    try:
+        for ic in node.inputConnectors:
+            try:
+                in_index = ic.index
+            except Exception:  # noqa: BLE001
+                in_index = None
+            try:
+                conns = list(ic.connections)
+            except Exception:  # noqa: BLE001
+                conns = []
+            for oc in conns:
+                try:
+                    wires.append(
+                        {"in_index": in_index, "from": oc.owner.path, "out_index": oc.index}
+                    )
+                except Exception:  # noqa: BLE001
+                    pass
+    except Exception:  # noqa: BLE001
+        pass
+    return wires
+
+
 def node_detail(node):
     pars = {}
     try:
@@ -112,6 +164,36 @@ def node_detail(node):
     outputs = [c.path for c in getattr(node, "outputs", []) if c]
     detail = node_ref(node)
     detail.update({"parameters": pars, "inputs": inputs, "outputs": outputs})
+    # --- NEW (node_flags_in_detail): flags + index-aware wiring + position/comment/color/tags ---
+    detail["flags"] = _flags(node)
+    detail["wires_in"] = _indexed_inputs(node)
+    # op.errors() returns a STRING (not a list) — wrap it so a multi-line message is
+    # ONE entry, never iterated char-by-char. Lets get_td_node_flags' REST path flag
+    # "cook error" suspects (and honor only_problems) the same as the exec walk.
+    try:
+        _err = node.errors(recurse=False)
+        detail["errors"] = [str(_err)] if _err else []
+    except Exception:  # noqa: BLE001
+        pass
+    try:
+        detail["nodeX"] = node.nodeX
+        detail["nodeY"] = node.nodeY
+    except Exception:  # noqa: BLE001
+        pass
+    try:
+        if node.comment:
+            detail["comment"] = node.comment
+    except Exception:  # noqa: BLE001
+        pass
+    try:
+        detail["color"] = list(node.color)  # tuple -> JSON list
+    except Exception:  # noqa: BLE001
+        pass
+    try:
+        if node.tags:
+            detail["tags"] = sorted(str(t) for t in node.tags)  # set -> sorted list
+    except Exception:  # noqa: BLE001
+        pass
     return detail