@enfyra/mcp-server 0.1.11 → 0.1.12

package/README.md

@@ -258,7 +258,7 @@ The MCP server includes safety guards for LLM callers:
 - Write tools require `get_enfyra_required_knowledge` acknowledgement before mutating Enfyra state. Discovery, validation, and preview tools remain available without the acknowledgement so agents can read and plan first. If the acknowledgement is missing, the tool error tells the caller to read `get_enfyra_required_knowledge` and pass the required key.
 - Script-backed records validate `sourceCode` through `/admin/script/validate` before saving.
 - `validate_dynamic_script` checks handler, hook, flow, websocket, GraphQL, and bootstrap script source without saving.
-- `validate_extension_code` checks Enfyra admin extension code through `/enfyra_extension/preview` without saving.
+- `validate_extension_code` locally rejects common extension component-resolution mistakes, such as `resolveComponent()` or lowercase auto-injected component tags like `<ubutton>`, then checks Enfyra admin extension code through `/enfyra_extension/preview` without saving.
 - Dynamic script guidance distinguishes secure repositories (`@REPOS.main`, `@REPOS.secure.<table>`) from trusted internal repositories (`@REPOS.<table>`), and tells agents not to return raw trusted records to users.
 - `compiledCode` is generated from `sourceCode` and may differ textually because macros are expanded; the MCP server never accepts hand-written `compiledCode`.
 - Long source/code values in read responses are written to `/tmp/enfyra-mcp-sources` and returned as length/hash/preview/tmpFile metadata so LLM callers can inspect full source from the file path without truncating tool output.

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "@enfyra/mcp-server",
-  "version": "0.1.11",
+  "version": "0.1.12",
   "description": "MCP server for Enfyra - manage Enfyra instances from MCP-compatible coding tools",
   "type": "module",
   "packageManager": "yarn@4.17.0",
@@ -27,4 +27,4 @@
   "publishConfig": {
     "access": "public"
   }
-}
+}

package/src/lib/mcp-instructions.js

@@ -34,6 +34,7 @@ export function buildMcpServerInstructions(apiBaseUrl) {
     '- With non-root API tokens, call `get_permission_profile` before relying on admin helper tools or when debugging 403s. MCP admin helpers require ordinary route permissions for static admin routes such as `/admin/script/validate`, `/admin/test/run`, `/admin/flow/trigger/:id`, and `/admin/reload/*`.',
     '- Prefer the most specific business operation tool over raw metadata CRUD. `discover_enfyra_workflows` provides the current operation-tool map and negative-routing avoidTools.',
     '- Before saving standalone dynamic script or extension code, call `validate_dynamic_script` or `validate_extension_code` unless the chosen ensure/update tool already validates the code.',
+    '- Extension SFCs must use auto-injected components directly in templates, such as `<UButton>`, and must not call `resolveComponent()` for Nuxt UI/eApp components.',
     '- For existing script-backed records, use `trace_metadata_usage` then `get_script_source`; edit with `patch_script_source` or `update_script_source` so source is hash-checked and validated.',
     '- Validate behavior with `test_rest_endpoint`, `run_admin_test`, `test_flow_step`, or the route-specific tool before claiming a dynamic feature works.',
     '',

package/src/lib/platform-operation-tools.js

@@ -12,6 +12,36 @@ import {
   globalRulesAckParam,
 } from './required-knowledge.js';
 
+const AUTO_INJECTED_EXTENSION_COMPONENT_TAGS = [
+  'CommonDrawer',
+  'CommonModal',
+  'EmptyState',
+  'FormEditor',
+  'FormEditorLazy',
+  'NuxtLink',
+  'PermissionGate',
+  'UBadge',
+  'UButton',
+  'UCheckbox',
+  'UDropdownMenu',
+  'UForm',
+  'UFormField',
+  'UIcon',
+  'UInput',
+  'UModal',
+  'USelect',
+  'USelectMenu',
+  'USkeleton',
+  'USwitch',
+  'UTabs',
+  'UTextarea',
+  'UTooltip',
+  'Widget',
+];
+const AUTO_INJECTED_EXTENSION_COMPONENT_BY_LOWERCASE = new Map(
+  AUTO_INJECTED_EXTENSION_COMPONENT_TAGS.map((tag) => [tag.toLowerCase(), tag]),
+);
+
 function unwrapData(result) {
   return Array.isArray(result?.data) ? result.data : [];
 }
@@ -360,6 +390,7 @@ function getExtensionThemeContract() {
     ],
     components: [
       'Use Nuxt UI/eApp components for normal controls: UButton, UInput, UTextarea, USelectMenu/USelect, USwitch, UCheckbox, UTabs, UBadge, UModal, and CommonDrawer when available.',
+      'Use auto-injected components directly in the template with PascalCase names. Do not call resolveComponent() to manually resolve Nuxt UI/eApp components inside extension SFCs; it can compile but render unresolved lowercase DOM tags such as <ubutton>.',
       'Buttons should have stable geometry: hover may change color, border, or shadow but must not move the button or resize its content. Disabled buttons keep disabled cursor/visual state.',
       'Inputs and textareas should not add hover movement or decorative hover states; focus, invalid, disabled, and loading states must be explicit.',
       'Dynamic extensions resolve UModal to the app CommonModal. Do not pass ui.content: "eapp-surface-card" or "surface-card" to UModal/CommonModal; modal content uses the app modal surface and caller ui.content should only append z-index, width, or max-width classes.',
@@ -541,7 +572,66 @@ async function validateDynamicScript(apiUrl, sourceCode, scriptLanguage = 'javas
   };
 }
 
+function readTemplateBlocks(code) {
+  const blocks = [];
+  const lower = String(code || '').toLowerCase();
+  let index = 0;
+  while (index < lower.length) {
+    const openStart = lower.indexOf('<template', index);
+    if (openStart === -1) break;
+    const boundary = lower[openStart + '<template'.length];
+    if (boundary && !/\s|>/.test(boundary)) {
+      index = openStart + 1;
+      continue;
+    }
+    const openEnd = lower.indexOf('>', openStart + '<template'.length);
+    if (openEnd === -1) break;
+    const closeStart = lower.indexOf('</template', openEnd + 1);
+    if (closeStart === -1) break;
+    blocks.push(String(code).slice(openEnd + 1, closeStart));
+    index = closeStart + '</template'.length;
+  }
+  return blocks;
+}
+
+function readTemplateTagName(template, start) {
+  const next = template[start + 1];
+  if (!next || next === '!' || next === '?') return null;
+  let index = start + (next === '/' ? 2 : 1);
+  while (/\s/.test(template[index] || '')) index += 1;
+  const nameStart = index;
+  while (/[\w.-]/.test(template[index] || '')) index += 1;
+  return index > nameStart ? template.slice(nameStart, index) : null;
+}
+
+export function validateExtensionCodeLocally(code) {
+  if (/\bresolveComponent\s*\(/.test(String(code || ''))) {
+    throw new Error('Invalid extension component resolution: do not call resolveComponent() in Enfyra extensions. Use auto-injected components such as <UButton> directly in the template so the app/compiler resolves them correctly.');
+  }
+
+  const violations = [];
+  for (const template of readTemplateBlocks(code)) {
+    let index = 0;
+    while (index < template.length) {
+      const tagStart = template.indexOf('<', index);
+      if (tagStart === -1) break;
+      const tagName = readTemplateTagName(template, tagStart);
+      if (tagName && tagName === tagName.toLowerCase() && !tagName.includes('-')) {
+        const expected = AUTO_INJECTED_EXTENSION_COMPONENT_BY_LOWERCASE.get(tagName);
+        if (expected) violations.push({ tag: tagName, expected });
+      }
+      index = tagStart + 1;
+    }
+  }
+  if (violations.length) {
+    const first = violations[0];
+    throw new Error(`Invalid extension component casing: use <${first.expected}> instead of <${first.tag}>. Enfyra/Nuxt UI auto-injected components must keep PascalCase in extension templates; lowercase tags render as unresolved DOM elements.`);
+  }
+  return { componentCasing: 'passed' };
+}
+
 async function validateExtensionCode(apiUrl, code, name) {
+  const localChecks = validateExtensionCodeLocally(code);
   const result = await fetchAPI(apiUrl, '/enfyra_extension/preview', {
     method: 'POST',
     body: JSON.stringify({ code, name }),
@@ -551,6 +641,7 @@ async function validateExtensionCode(apiUrl, code, name) {
   }
   return {
     valid: true,
+    localChecks,
     extensionId: result?.extensionId || name || null,
     compiledLength: typeof result?.compiledCode === 'string' ? result.compiledCode.length : undefined,
   };

package/src/lib/required-knowledge.js

@@ -175,6 +175,7 @@ export function buildRequiredKnowledgePayload() {
         id: 'extension-runtime-contract',
         rules: [
           'Save extensions as enfyra_extension Vue SFC records; no static import statements in extension code.',
+          'Do not call resolveComponent() in extension SFCs. Use auto-injected components such as <UButton>, <UBadge>, <PermissionGate>, and <Widget> directly in the template so the app/compiler resolves them correctly.',
           'Load app packages with getPackages(["package-name"]) inside extension runtime code.',
           'Prefer FormEditor/FormEditorLazy for direct table-backed forms when the form maps to metadata fields.',
           'For long admin setup workflows, open CommonDrawer immediately and show loading/error/content inside it.',