@openfairygui/mcp 0.3.0 → 0.3.1

package/dist/{stdio-9ewjcCag.cjs → stdio-N6Yxacus.cjs}

@@ -1,8 +1,33 @@
+//#region \0rolldown/runtime.js
+var __create = Object.create;
+var __defProp = Object.defineProperty;
+var __getOwnPropDesc = Object.getOwnPropertyDescriptor;
+var __getOwnPropNames = Object.getOwnPropertyNames;
+var __getProtoOf = Object.getPrototypeOf;
+var __hasOwnProp = Object.prototype.hasOwnProperty;
+var __copyProps = (to, from, except, desc) => {
+	if (from && typeof from === "object" || typeof from === "function") for (var keys = __getOwnPropNames(from), i = 0, n = keys.length, key; i < n; i++) {
+		key = keys[i];
+		if (!__hasOwnProp.call(to, key) && key !== except) __defProp(to, key, {
+			get: ((k) => from[k]).bind(null, key),
+			enumerable: !(desc = __getOwnPropDesc(from, key)) || desc.enumerable
+		});
+	}
+	return to;
+};
+var __toESM = (mod, isNodeMode, target) => (target = mod != null ? __create(__getProtoOf(mod)) : {}, __copyProps(isNodeMode || !mod || !mod.__esModule ? __defProp(target, "default", {
+	value: mod,
+	enumerable: true
+}) : target, mod));
+//#endregion
 let _modelcontextprotocol_sdk_server_mcp_js = require("@modelcontextprotocol/sdk/server/mcp.js");
 let _openfairygui_backend_node = require("@openfairygui/backend/node");
 let node_module = require("node:module");
+let _openfairygui_backend = require("@openfairygui/backend");
 let zod = require("zod");
 let _modelcontextprotocol_sdk_server_stdio_js = require("@modelcontextprotocol/sdk/server/stdio.js");
+let node_path = require("node:path");
+node_path = __toESM(node_path);
 let node_url = require("node:url");
 //#region src/prompt-definitions.ts
 const OPENFAIRYGUI_BACKEND_PROMPT_NAMES = [
@@ -144,114 +169,6 @@ function registerOpenFairyGuiBackendResources(server, runtime) {
 	})));
 }
 //#endregion
-//#region src/tool-handler.ts
-function jsonResult(payload, isError = false) {
-	return {
-		content: [{
-			type: "text",
-			text: JSON.stringify(payload, null, 2)
-		}],
-		structuredContent: { backendResult: payload },
-		isError
-	};
-}
-function isBackendFailure(value) {
-	return typeof value === "object" && value !== null && "ok" in value && value.ok === false;
-}
-async function callOpenFairyGuiBackendTool(runtime, name, input) {
-	let result;
-	switch (name) {
-		case "openfairygui_backend_get_capabilities":
-			result = runtime.getCapabilities();
-			break;
-		case "openfairygui_backend_open_session":
-			result = await runtime.openSession({ projectPath: String(input.projectPath) });
-			break;
-		case "openfairygui_backend_open_project_session":
-			result = runtime.openProjectSession({
-				project: input.project,
-				sessionId: input.sessionId === void 0 ? void 0 : String(input.sessionId),
-				canonicalProjectPath: input.canonicalProjectPath === void 0 ? void 0 : String(input.canonicalProjectPath),
-				canonicalPathKey: input.canonicalPathKey === void 0 ? void 0 : String(input.canonicalPathKey)
-			});
-			break;
-		case "openfairygui_backend_get_session":
-			result = runtime.getSession({ sessionId: String(input.sessionId) });
-			break;
-		case "openfairygui_backend_get_project_outline":
-			result = runtime.getProjectOutline({ sessionId: String(input.sessionId) });
-			break;
-		case "openfairygui_backend_validate_session":
-			result = runtime.validateSession({ sessionId: String(input.sessionId) });
-			break;
-		case "openfairygui_backend_apply_transaction":
-			result = await runtime.applyTransaction({
-				sessionId: String(input.sessionId),
-				expectedRevision: Number(input.expectedRevision),
-				operations: input.operations
-			});
-			break;
-		case "openfairygui_backend_save_session":
-			result = await runtime.saveSession({
-				sessionId: String(input.sessionId),
-				expectedRevision: input.expectedRevision === void 0 ? void 0 : Number(input.expectedRevision),
-				targetPath: input.targetPath === void 0 ? void 0 : String(input.targetPath),
-				force: input.force === void 0 ? void 0 : Boolean(input.force),
-				mode: input.mode
-			});
-			break;
-		case "openfairygui_backend_materialize_session":
-			result = await runtime.materializeSession({
-				sessionId: String(input.sessionId),
-				expectedRevision: input.expectedRevision === void 0 ? void 0 : Number(input.expectedRevision),
-				mode: input.mode,
-				reason: input.reason === void 0 ? void 0 : String(input.reason)
-			});
-			break;
-		case "openfairygui_backend_close_session":
-			result = await runtime.closeSession({ sessionId: String(input.sessionId) });
-			break;
-		case "openfairygui_backend_get_events":
-			result = runtime.getEvents({
-				sessionId: String(input.sessionId),
-				after: input.after === void 0 ? void 0 : String(input.after),
-				limit: input.limit === void 0 ? void 0 : Number(input.limit)
-			});
-			break;
-		case "openfairygui_backend_get_job":
-			result = runtime.getJob({
-				sessionId: String(input.sessionId),
-				jobId: String(input.jobId)
-			});
-			break;
-		case "openfairygui_backend_list_jobs":
-			result = runtime.listJobs({
-				sessionId: String(input.sessionId),
-				status: input.status,
-				kind: input.kind,
-				limit: input.limit === void 0 ? void 0 : Number(input.limit)
-			});
-			break;
-		case "openfairygui_backend_cancel_job":
-			result = runtime.cancelJob({
-				sessionId: String(input.sessionId),
-				jobId: String(input.jobId)
-			});
-			break;
-		case "openfairygui_backend_get_cache_snapshot":
-			result = runtime.getCacheSnapshot({ sessionId: String(input.sessionId) });
-			break;
-		case "openfairygui_backend_refresh_cache":
-			result = runtime.refreshCache({
-				sessionId: String(input.sessionId),
-				reason: input.reason
-			});
-			break;
-		default: throw new Error(`Unknown OpenFairyGUI backend MCP tool: ${name}`);
-	}
-	return jsonResult(result, isBackendFailure(result));
-}
-//#endregion
 //#region src/tool-definitions.ts
 const OPENFAIRYGUI_BACKEND_TOOL_PREFIX = "openfairygui_backend_";
 const OPENFAIRYGUI_BACKEND_TOOL_NAMES = [
@@ -276,12 +193,316 @@ const sessionId = zod.z.string().min(1);
 const jobId = zod.z.string().min(1);
 const expectedRevision = zod.z.number().int().nonnegative();
 const limit = zod.z.number().int().nonnegative().optional();
-const OPENFAIRYGUI_BACKEND_TOOL_OUTPUT_SCHEMA = zod.z.object({ backendResult: zod.z.object({
-	ok: zod.z.boolean(),
-	data: zod.z.unknown().optional(),
-	error: zod.z.unknown().optional(),
-	meta: zod.z.unknown().optional()
-}).passthrough() });
+const identifier = zod.z.string().min(1).max(256);
+function isOpenFairyGuiMcpPayloadWithinBudget(root) {
+	const pending = [{
+		value: root,
+		depth: 0
+	}];
+	let nodes = 0;
+	while (pending.length > 0) {
+		const { value, depth } = pending.pop();
+		nodes += 1;
+		if (nodes > 1e5 || depth > 32) return false;
+		if (value === null || typeof value === "boolean") continue;
+		if (typeof value === "number") {
+			if (!Number.isFinite(value)) return false;
+			continue;
+		}
+		if (typeof value === "string") {
+			if (value.length > 1e6) return false;
+			continue;
+		}
+		if (value instanceof Uint8Array) {
+			if (value.byteLength > 8 * 1024 * 1024) return false;
+			continue;
+		}
+		if (Array.isArray(value)) {
+			if (value.length > 1e4) return false;
+			for (const child of value) pending.push({
+				value: child,
+				depth: depth + 1
+			});
+			continue;
+		}
+		if (typeof value !== "object") return false;
+		const entries = Object.entries(value);
+		if (entries.length > 1e4 || entries.some(([key]) => key.length > 256)) return false;
+		for (const [, child] of entries) pending.push({
+			value: child,
+			depth: depth + 1
+		});
+	}
+	return true;
+}
+const boundedPayload = zod.z.json();
+const bytes = zod.z.array(zod.z.number().int().min(0).max(255)).max(8 * 1024 * 1024);
+const packageSelector = zod.z.object({ packageId: identifier });
+const resourceSelector = zod.z.object({
+	packageId: identifier,
+	resourceId: identifier
+});
+const componentSelector = zod.z.object({
+	packageId: identifier,
+	componentResourceId: identifier
+});
+const displayNodeSelector = componentSelector.extend({ displayNodeId: identifier });
+const controllerSelector = componentSelector.extend({ controllerName: identifier });
+const transitionSelector = componentSelector.extend({ transitionName: identifier });
+const folderSelector = packageSelector.extend({
+	branch: zod.z.string().max(256).optional(),
+	path: zod.z.string().min(1).max(4096)
+});
+const operationBase = { opId: identifier.optional() };
+const operation = zod.z.discriminatedUnion("kind", [
+	zod.z.object({
+		...operationBase,
+		kind: zod.z.literal("updateProjectSettings"),
+		settings: boundedPayload
+	}),
+	zod.z.object({
+		...operationBase,
+		kind: zod.z.literal("updatePackageSettings"),
+		selector: packageSelector,
+		settings: boundedPayload
+	}),
+	zod.z.object({
+		...operationBase,
+		kind: zod.z.literal("renameResource"),
+		selector: resourceSelector,
+		newName: identifier
+	}),
+	zod.z.object({
+		...operationBase,
+		kind: zod.z.literal("moveResource"),
+		selector: resourceSelector,
+		toPath: zod.z.string().max(4096)
+	}),
+	zod.z.object({
+		...operationBase,
+		kind: zod.z.literal("setResourceFavorite"),
+		selector: resourceSelector,
+		favorite: zod.z.boolean()
+	}),
+	zod.z.object({
+		...operationBase,
+		kind: zod.z.literal("setResourceFolderFavorite"),
+		selector: folderSelector,
+		favorite: zod.z.boolean()
+	}),
+	zod.z.object({
+		...operationBase,
+		kind: zod.z.literal("setResourceFolderAtlas"),
+		selector: folderSelector,
+		atlas: zod.z.string().max(32)
+	}),
+	zod.z.object({
+		...operationBase,
+		kind: zod.z.literal("setResourceExported"),
+		selector: resourceSelector,
+		exported: zod.z.boolean()
+	}),
+	zod.z.object({
+		...operationBase,
+		kind: zod.z.literal("addResourceFolder"),
+		selector: packageSelector,
+		path: zod.z.string().max(4096),
+		branch: zod.z.string().max(256).optional(),
+		favorite: zod.z.boolean().optional(),
+		atlas: zod.z.string().max(32).optional()
+	}),
+	zod.z.object({
+		...operationBase,
+		kind: zod.z.literal("renameResourceFolder"),
+		selector: folderSelector,
+		newName: identifier
+	}),
+	zod.z.object({
+		...operationBase,
+		kind: zod.z.literal("moveResourceFolder"),
+		selector: folderSelector,
+		toPath: zod.z.string().max(4096)
+	}),
+	zod.z.object({
+		...operationBase,
+		kind: zod.z.literal("removeResourceFolder"),
+		selector: folderSelector
+	}),
+	zod.z.object({
+		...operationBase,
+		kind: zod.z.literal("setImageResourceProps"),
+		selector: resourceSelector,
+		props: boundedPayload
+	}),
+	zod.z.object({
+		...operationBase,
+		kind: zod.z.literal("addResource"),
+		selector: packageSelector,
+		resource: boundedPayload,
+		atIndex: zod.z.number().int().nonnegative().optional()
+	}),
+	zod.z.object({
+		...operationBase,
+		kind: zod.z.literal("addBranch"),
+		branch: identifier
+	}),
+	zod.z.object({
+		...operationBase,
+		kind: zod.z.literal("renameBranch"),
+		selector: zod.z.object({ branch: identifier }),
+		newName: identifier
+	}),
+	zod.z.object({
+		...operationBase,
+		kind: zod.z.literal("removeBranch"),
+		selector: zod.z.object({ branch: identifier })
+	}),
+	zod.z.object({
+		...operationBase,
+		kind: zod.z.literal("addPackage"),
+		package: boundedPayload,
+		atIndex: zod.z.number().int().nonnegative()
+	}),
+	zod.z.object({
+		...operationBase,
+		kind: zod.z.literal("renamePackage"),
+		selector: packageSelector,
+		newName: identifier
+	}),
+	zod.z.object({
+		...operationBase,
+		kind: zod.z.literal("removePackage"),
+		selector: packageSelector
+	}),
+	zod.z.object({
+		...operationBase,
+		kind: zod.z.literal("addComponent"),
+		selector: packageSelector,
+		component: boundedPayload,
+		atIndex: zod.z.number().int().nonnegative()
+	}),
+	zod.z.object({
+		...operationBase,
+		kind: zod.z.literal("removeComponent"),
+		selector: componentSelector
+	}),
+	zod.z.object({
+		...operationBase,
+		kind: zod.z.literal("moveComponent"),
+		selector: componentSelector,
+		toPackageId: identifier,
+		toIndex: zod.z.number().int().nonnegative()
+	}),
+	zod.z.object({
+		...operationBase,
+		kind: zod.z.literal("replaceResourceBytes"),
+		selector: resourceSelector,
+		sourceBytes: bytes
+	}),
+	zod.z.object({
+		...operationBase,
+		kind: zod.z.literal("removeResource"),
+		selector: resourceSelector
+	}),
+	zod.z.object({
+		...operationBase,
+		kind: zod.z.literal("setDisplayNodeProps"),
+		selector: displayNodeSelector,
+		props: boundedPayload
+	}),
+	zod.z.object({
+		...operationBase,
+		kind: zod.z.literal("setComponentProps"),
+		selector: componentSelector,
+		props: boundedPayload
+	}),
+	zod.z.object({
+		...operationBase,
+		kind: zod.z.literal("attachDisplayNode"),
+		selector: componentSelector,
+		atIndex: zod.z.number().int().nonnegative(),
+		node: boundedPayload
+	}),
+	zod.z.object({
+		...operationBase,
+		kind: zod.z.literal("detachDisplayNode"),
+		selector: displayNodeSelector
+	}),
+	...["addController", "updateController"].map((kind) => zod.z.object({
+		...operationBase,
+		kind: zod.z.literal(kind),
+		selector: controllerSelector,
+		controller: boundedPayload
+	})),
+	zod.z.object({
+		...operationBase,
+		kind: zod.z.literal("removeController"),
+		selector: controllerSelector
+	}),
+	...["addTransition", "updateTransition"].map((kind) => zod.z.object({
+		...operationBase,
+		kind: zod.z.literal(kind),
+		selector: transitionSelector,
+		transition: boundedPayload
+	})),
+	zod.z.object({
+		...operationBase,
+		kind: zod.z.literal("removeTransition"),
+		selector: transitionSelector
+	}),
+	...[
+		"addLookGear",
+		"updateLookGear",
+		"addGear",
+		"updateGear"
+	].map((kind) => zod.z.object({
+		...operationBase,
+		kind: zod.z.literal(kind),
+		selector: displayNodeSelector.extend({
+			kind: identifier,
+			controllerName: identifier
+		}),
+		gear: boundedPayload
+	})),
+	...["removeLookGear", "removeGear"].map((kind) => zod.z.object({
+		...operationBase,
+		kind: zod.z.literal(kind),
+		selector: displayNodeSelector.extend({
+			kind: identifier,
+			controllerName: identifier
+		})
+	}))
+]);
+const project = zod.z.object({
+	projectId: identifier,
+	projectType: zod.z.number().int(),
+	version: zod.z.string().max(256),
+	branches: zod.z.array(zod.z.string().max(256)).max(256),
+	settings: boundedPayload,
+	packages: zod.z.array(zod.z.object({
+		id: identifier,
+		name: identifier,
+		compressPNG: zod.z.boolean().nullable(),
+		jpegQuality: zod.z.number().finite().nullable(),
+		publish: boundedPayload.nullable(),
+		branchNames: zod.z.array(zod.z.string().max(256)).max(256),
+		folders: zod.z.array(boundedPayload).max(1e4),
+		resources: zod.z.array(boundedPayload).max(1e5)
+	})).max(1e3)
+});
+const OPENFAIRYGUI_BACKEND_TOOL_OUTPUT_SCHEMA = zod.z.object({ backendResult: zod.z.discriminatedUnion("ok", [zod.z.object({
+	ok: zod.z.literal(true),
+	data: boundedPayload,
+	meta: boundedPayload
+}), zod.z.object({
+	ok: zod.z.literal(false),
+	error: zod.z.object({
+		code: identifier,
+		message: zod.z.string().max(1e6)
+	}).passthrough(),
+	meta: boundedPayload,
+	session: boundedPayload.optional()
+})]) });
 const OPENFAIRYGUI_BACKEND_TOOL_DEFINITIONS = [
 	{
 		name: "openfairygui_backend_get_capabilities",
@@ -315,7 +536,7 @@ const OPENFAIRYGUI_BACKEND_TOOL_DEFINITIONS = [
 		title: "Open Project Session",
 		description: "Open a browser-safe backend session from an already loaded UAM project without filesystem access.",
 		inputSchema: zod.z.object({
-			project: zod.z.unknown(),
+			project,
 			sessionId: zod.z.string().min(1).optional(),
 			canonicalProjectPath: zod.z.string().min(1).optional(),
 			canonicalPathKey: zod.z.string().min(1).optional()
@@ -370,11 +591,11 @@ const OPENFAIRYGUI_BACKEND_TOOL_DEFINITIONS = [
 		name: "openfairygui_backend_apply_transaction",
 		backendMethod: "applyTransaction",
 		title: "Apply UAM Transaction",
-		description: "Apply a backend revision-checked UAM operation batch without redefining selector or operation grammar.",
+		description: "Apply a bounded, revision-checked UAM operation batch using the Core transaction discriminants.",
 		inputSchema: zod.z.object({
 			sessionId,
 			expectedRevision,
-			operations: zod.z.array(zod.z.unknown())
+			operations: zod.z.array(operation).min(1).max(1e3)
 		}),
 		outputSchema: OPENFAIRYGUI_BACKEND_TOOL_OUTPUT_SCHEMA,
 		annotations: {
@@ -388,7 +609,7 @@ const OPENFAIRYGUI_BACKEND_TOOL_DEFINITIONS = [
 		name: "openfairygui_backend_save_session",
 		backendMethod: "saveSession",
 		title: "Save Backend Session",
-		description: "Write the current backend session back through the backend coordinated non-atomic save path.",
+		description: "Write the current backend session through its coordinated save path; Node uses an atomic staged directory swap.",
 		inputSchema: zod.z.object({
 			sessionId,
 			expectedRevision: expectedRevision.optional(),
@@ -546,10 +767,149 @@ const OPENFAIRYGUI_BACKEND_TOOL_DEFINITIONS = [
 	}
 ];
 //#endregion
+//#region src/tool-handler.ts
+function jsonResult(payload, isError = false) {
+	const text = JSON.stringify(payload, null, 2);
+	const wirePayload = JSON.parse(text);
+	return {
+		content: [{
+			type: "text",
+			text
+		}],
+		structuredContent: { backendResult: wirePayload },
+		isError
+	};
+}
+function isBackendFailure(value) {
+	return typeof value === "object" && value !== null && "ok" in value && value.ok === false;
+}
+function unhandledBackendFailure(startedAt) {
+	return {
+		ok: false,
+		meta: {
+			requestId: crypto.randomUUID(),
+			durationMs: Math.max(0, Date.now() - startedAt),
+			warnings: [],
+			diagnostics: [],
+			stage: "runtime",
+			contractVersion: _openfairygui_backend.BACKEND_CONTRACT_VERSION,
+			capabilitySchemaVersion: _openfairygui_backend.BACKEND_CAPABILITY_SCHEMA_VERSION
+		},
+		error: {
+			code: "backend_unhandled_error",
+			message: "Backend tool execution failed."
+		}
+	};
+}
+async function callOpenFairyGuiBackendTool(runtime, name, input) {
+	if (!isOpenFairyGuiMcpPayloadWithinBudget(input)) throw new RangeError("MCP input exceeds the depth, node, key, string, or byte budget.");
+	const startedAt = Date.now();
+	let result;
+	try {
+		switch (name) {
+			case "openfairygui_backend_get_capabilities":
+				result = runtime.getCapabilities();
+				break;
+			case "openfairygui_backend_open_session":
+				result = await runtime.openSession({ projectPath: String(input.projectPath) });
+				break;
+			case "openfairygui_backend_open_project_session":
+				result = runtime.openProjectSession({
+					project: input.project,
+					sessionId: input.sessionId === void 0 ? void 0 : String(input.sessionId),
+					canonicalProjectPath: input.canonicalProjectPath === void 0 ? void 0 : String(input.canonicalProjectPath),
+					canonicalPathKey: input.canonicalPathKey === void 0 ? void 0 : String(input.canonicalPathKey)
+				});
+				break;
+			case "openfairygui_backend_get_session":
+				result = runtime.getSession({ sessionId: String(input.sessionId) });
+				break;
+			case "openfairygui_backend_get_project_outline":
+				result = runtime.getProjectOutline({ sessionId: String(input.sessionId) });
+				break;
+			case "openfairygui_backend_validate_session":
+				result = runtime.validateSession({ sessionId: String(input.sessionId) });
+				break;
+			case "openfairygui_backend_apply_transaction": {
+				const operations = input.operations.map((operation) => operation.kind === "replaceResourceBytes" ? {
+					...operation,
+					sourceBytes: new Uint8Array(operation.sourceBytes)
+				} : operation);
+				result = await runtime.applyTransaction({
+					sessionId: String(input.sessionId),
+					expectedRevision: Number(input.expectedRevision),
+					operations
+				});
+				break;
+			}
+			case "openfairygui_backend_save_session":
+				result = await runtime.saveSession({
+					sessionId: String(input.sessionId),
+					expectedRevision: input.expectedRevision === void 0 ? void 0 : Number(input.expectedRevision),
+					targetPath: input.targetPath === void 0 ? void 0 : String(input.targetPath),
+					force: input.force === void 0 ? void 0 : Boolean(input.force),
+					mode: input.mode
+				});
+				break;
+			case "openfairygui_backend_materialize_session":
+				result = await runtime.materializeSession({
+					sessionId: String(input.sessionId),
+					expectedRevision: input.expectedRevision === void 0 ? void 0 : Number(input.expectedRevision),
+					mode: input.mode,
+					reason: input.reason === void 0 ? void 0 : String(input.reason)
+				});
+				break;
+			case "openfairygui_backend_close_session":
+				result = await runtime.closeSession({ sessionId: String(input.sessionId) });
+				break;
+			case "openfairygui_backend_get_events":
+				result = runtime.getEvents({
+					sessionId: String(input.sessionId),
+					after: input.after === void 0 ? void 0 : String(input.after),
+					limit: input.limit === void 0 ? void 0 : Number(input.limit)
+				});
+				break;
+			case "openfairygui_backend_get_job":
+				result = runtime.getJob({
+					sessionId: String(input.sessionId),
+					jobId: String(input.jobId)
+				});
+				break;
+			case "openfairygui_backend_list_jobs":
+				result = runtime.listJobs({
+					sessionId: String(input.sessionId),
+					status: input.status,
+					kind: input.kind,
+					limit: input.limit === void 0 ? void 0 : Number(input.limit)
+				});
+				break;
+			case "openfairygui_backend_cancel_job":
+				result = runtime.cancelJob({
+					sessionId: String(input.sessionId),
+					jobId: String(input.jobId)
+				});
+				break;
+			case "openfairygui_backend_get_cache_snapshot":
+				result = runtime.getCacheSnapshot({ sessionId: String(input.sessionId) });
+				break;
+			case "openfairygui_backend_refresh_cache":
+				result = runtime.refreshCache({
+					sessionId: String(input.sessionId),
+					reason: input.reason
+				});
+				break;
+			default: throw new Error(`Unknown OpenFairyGUI backend MCP tool: ${name}`);
+		}
+	} catch {
+		return jsonResult(unhandledBackendFailure(startedAt), true);
+	}
+	return jsonResult(result, isBackendFailure(result));
+}
+//#endregion
 //#region src/server.ts
 const require$1 = (0, node_module.createRequire)(require("url").pathToFileURL(__filename).href);
 function getInjectedPackageVersion() {
-	const version = "0.3.0";
+	const version = "0.3.1";
 	return typeof version === "string" && true ? version : null;
 }
 function readPackageVersion() {
@@ -563,7 +923,7 @@ function readPackageVersion() {
 }
 const PACKAGE_VERSION = readPackageVersion();
 function createOpenFairyGuiMcpServer(options = {}) {
-	const runtime = options.runtime ?? (0, _openfairygui_backend_node.createNodeBackendRuntime)();
+	const runtime = options.runtime ?? (0, _openfairygui_backend_node.createNodeBackendRuntime)({ allowedProjectRoots: options.allowedProjectRoots ?? [process.cwd()] });
 	const server = new _modelcontextprotocol_sdk_server_mcp_js.McpServer({
 		name: options.name ?? "openfairygui-mcp",
 		version: options.version ?? PACKAGE_VERSION
@@ -586,7 +946,8 @@ function createOpenFairyGuiMcpServer(options = {}) {
 //#endregion
 //#region src/stdio.ts
 async function connectOpenFairyGuiMcpStdio() {
-	await createOpenFairyGuiMcpServer().connect(new _modelcontextprotocol_sdk_server_stdio_js.StdioServerTransport());
+	const configuredRoots = process.env.OPENFAIRYGUI_ALLOWED_PROJECT_ROOTS?.split(node_path.default.delimiter).map((value) => value.trim()).filter(Boolean);
+	await createOpenFairyGuiMcpServer({ allowedProjectRoots: configuredRoots }).connect(new _modelcontextprotocol_sdk_server_stdio_js.StdioServerTransport());
 }
 if (process.argv[1] && require("url").pathToFileURL(__filename).href === (0, node_url.pathToFileURL)(process.argv[1]).href) connectOpenFairyGuiMcpStdio().catch((error) => {
 	console.error(error instanceof Error ? error.stack ?? error.message : String(error));

package/dist/stdio.cjs

@@ -1,3 +1,3 @@
 Object.defineProperty(exports, Symbol.toStringTag, { value: "Module" });
-const require_stdio = require("./stdio-9ewjcCag.cjs");
+const require_stdio = require("./stdio-N6Yxacus.cjs");
 exports.connectOpenFairyGuiMcpStdio = require_stdio.connectOpenFairyGuiMcpStdio;

package/dist/stdio.mjs

@@ -1,2 +1,2 @@
-import { t as connectOpenFairyGuiMcpStdio } from "./stdio-48jCJzS3.mjs";
+import { t as connectOpenFairyGuiMcpStdio } from "./stdio-HOHWH0x4.mjs";
 export { connectOpenFairyGuiMcpStdio };