@overcrow/mcp 0.1.3 → 0.1.5

package/dist/tools/common.js

@@ -8,7 +8,7 @@ import { ConfinementError } from "../confine.js";
 import { NpmError } from "../npm.js";
 import { RunError } from "../run.js";
 import { SetupError } from "../session.js";
-import { bound, DATA_NOTICE } from "../text.js";
+import { bound, clean, DATA_NOTICE, dataText, stripInvisible } from "../text.js";
 /** Most characters a text result carries; Claude Code moves larger results to a file. */
 export const MAX_RESULT_CHARS = 40_000;
 /**
@@ -17,10 +17,8 @@ export const MAX_RESULT_CHARS = 40_000;
  * Results that carry project content are marked as data.
  */
 export function ok(structured, summary, options = {}) {
-    const redact = (text) => (options.redactor ? options.redactor.text(text) : text);
-    const structuredContent = options.redactor
-        ? redactDeep(structured, options.redactor)
-        : structured;
+    const redact = (text) => stripInvisible(options.redactor ? options.redactor.text(text) : text);
+    const structuredContent = redactDeep(structured, redact);
     const json = JSON.stringify(structuredContent);
     const body = options.data
         ? `${DATA_NOTICE}\n<data>\n${json.replaceAll("</data>", "<\\/data>")}\n</data>`
@@ -33,21 +31,29 @@ export function ok(structured, summary, options = {}) {
         structuredContent,
     };
 }
-/** Replaces the user's paths in every string of a JSON value. */
-function redactDeep(value, redactor) {
+/**
+ * Applies `redact` to every string of a JSON value: the user's paths
+ * replaced, invisible characters removed.
+ */
+function redactDeep(value, redact) {
     if (typeof value === "string")
-        return redactor.text(value);
+        return redact(value);
     if (Array.isArray(value))
-        return value.map((item) => redactDeep(item, redactor));
+        return value.map((item) => redactDeep(item, redact));
     if (typeof value === "object" && value !== null) {
-        return Object.fromEntries(Object.entries(value).map(([key, item]) => [key, redactDeep(item, redactor)]));
+        return Object.fromEntries(Object.entries(value).map(([key, item]) => [key, redactDeep(item, redact)]));
     }
     return value;
 }
 /** A failure the model can correct: what went wrong and what to do. */
 export function fail(message, redactor) {
     return {
-        content: [{ type: "text", text: bound(redactor ? redactor.text(message) : message, 4000) }],
+        content: [
+            {
+                type: "text",
+                text: bound(stripInvisible(redactor ? redactor.text(message) : message), 4000),
+            },
+        ],
         isError: true,
     };
 }
@@ -65,7 +71,8 @@ export function failure(error, redactor) {
             .filter((line) => line.trim() !== "")
             .slice(0, 8)
             .join("\n");
-        return fail(`${error.message}${detail ? `\n${DATA_NOTICE}\n${detail}` : ""}`, redactor);
+        // The CLI's output may quote the project: fenced as data, like tool results.
+        return fail(`${error.message}${detail ? `\n${dataText(clean(detail))}` : ""}`, redactor);
     }
     throw error;
 }

package/dist/tools/submission.js

@@ -7,6 +7,7 @@ import { join } from "node:path";
 import { z } from "zod";
 import { auditWidget } from "../audit/index.js";
 import { readWidget } from "../audit/project.js";
+import { mayTypeCheck, TYPECHECK_SKIPPED } from "../typescript.js";
 import { Cli } from "../cli.js";
 import { limit } from "../content.js";
 import { sourcesFingerprint } from "../fingerprint.js";
@@ -94,15 +95,17 @@ export function registerSubmissionTool(env) {
         let review = [];
         if (tools) {
             const cli = new Cli(tools);
-            const check = await cli.check(target, ctx.mcpReq.signal);
+            const typecheck = await mayTypeCheck(session.options.pin.npm.typescript, target);
+            const check = await cli.check(target, ctx.mcpReq.signal, typecheck);
             const errors = check.diagnostics.filter((d) => d.severity === "error").length;
             const warnings = check.diagnostics.length - errors;
+            const result = errors + warnings === 0
+                ? "Clean."
+                : `${errors} error(s), ${warnings} warning(s): the creator space refuses warnings too.`;
             checklist.push({
                 item: "check: no error, no warning",
                 status: errors + warnings === 0 ? "pass" : "fail",
-                detail: errors + warnings === 0
-                    ? "Clean."
-                    : `${errors} error(s), ${warnings} warning(s): the creator space refuses warnings too.`,
+                detail: typecheck ? result : `${result} ${TYPECHECK_SKIPPED}`,
             });
             const report = await cli.admit(target, ctx.mcpReq.signal);
             const diagnostics = Array.isArray(report.diagnostics)

package/dist/typescript.js

@@ -0,0 +1,38 @@
+// check, package and test type-check with the project's own TypeScript: the
+// CLI runs node_modules/typescript/lib/tsc.js with Node.js. A project may
+// come from someone else, so the server lets that run only when those files
+// are the pinned TypeScript's: tsc.js loads _tsc.js, which only loads Node's
+// own modules, and the pin holds the SHA-256 of both (pin.ts). Otherwise the
+// commands run with --no-typecheck and say so.
+import { createHash } from "node:crypto";
+import { lstat, readFile } from "node:fs/promises";
+import { join } from "node:path";
+import { TYPESCRIPT_FILES } from "./bootstrap/pin.js";
+const MAX_FILE_BYTES = 64 * 1024 * 1024;
+/** Said when a command ran without type checking. */
+export const TYPECHECK_SKIPPED = "Types were not checked: node_modules/typescript is not the TypeScript install_sdk installs. To check them, run install_sdk (delete node_modules first if it came with the project).";
+/** Whether `directory` holds the pinned TypeScript, as plain files (no link on the way). */
+export async function mayTypeCheck(pin, directory) {
+    const folders = ["node_modules", "node_modules/typescript", "node_modules/typescript/lib"];
+    try {
+        for (const folder of folders) {
+            if (!(await lstat(join(directory, folder))).isDirectory())
+                return false;
+        }
+        for (const file of TYPESCRIPT_FILES) {
+            const path = join(directory, "node_modules", "typescript", file);
+            const info = await lstat(path);
+            if (!info.isFile() || info.size > MAX_FILE_BYTES)
+                return false;
+            const digest = createHash("sha256")
+                .update(await readFile(path))
+                .digest("hex");
+            if (digest !== pin.files[file])
+                return false;
+        }
+        return true;
+    }
+    catch {
+        return false;
+    }
+}

package/dist/version.js

@@ -1,3 +1,3 @@
 // The package version; scripts/build.mjs refuses a build where it differs
 // from package.json.
-export const VERSION = "0.1.3";
+export const VERSION = "0.1.5";

package/npm-shrinkwrap.json

@@ -1,12 +1,12 @@
 {
   "name": "@overcrow/mcp",
-  "version": "0.1.3",
+  "version": "0.1.5",
   "lockfileVersion": 3,
   "requires": true,
   "packages": {
     "": {
       "name": "@overcrow/mcp",
-      "version": "0.1.3",
+      "version": "0.1.5",
       "license": "MIT",
       "dependencies": {
         "@modelcontextprotocol/server": "2.3.1",

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "@overcrow/mcp",
-  "version": "0.1.3",
+  "version": "0.1.5",
   "description": "MCP server that lets an AI assistant create, check, test, audit and package PlayerVox OverCrow widgets.",
   "license": "MIT",
   "type": "module",