@pinepaper.studio/mcp-server 1.6.20 → 1.6.22

package/dist/tools/handlers.js

@@ -5,6 +5,7 @@
  * Supports i18n for localized error and success messages.
  * Supports browser execution via Puppeteer.
  */
+import { CRAFT_FRAME_JS, generateDrawWeave, generateDrawKnots, generateDrawSashiko, generateDrawSubdivision, generateUiKit, uiKitCallProblems, } from './craft-tools.js';
 import { codeGenerator, generateQueryMutationsCode, SHEET_RUBRIC } from '../types/code-generator.js';
 import { CreateItemInputSchema, ModifyItemInputSchema, DeleteItemInputSchema, AddRelationInputSchema, RemoveRelationInputSchema, QueryRelationsInputSchema, AnimateItemInputSchema, ImportMotionCaptureInputSchema, KeyframeAnimateInputSchema, ExecuteGeneratorInputSchema, ApplyEffectInputSchema, GetItemsInputSchema, PlayTimelineInputSchema, SetBackgroundColorInputSchema, SetCanvasSizeInputSchema, ImportSVGInputSchema, ImportMermaidInputSchema, AddFilterInputSchema, CreateGlossySphereInputSchema, CreateDiagonalStripesInputSchema, BatchCreateInputSchema, BatchModifyInputSchema, CreateGridInputSchema, GeometryInputSchema, EquationPathInputSchema, EventInputSchema, ConstructionSequenceInputSchema, ValidateSceneInputSchema, CaptureFramesInputSchema, InstantiateOntologyInputSchema, LintSceneInputSchema, MediaInputSchema, TextStyleInputSchema, TextEffectInputSchema, DesignMediumInputSchema, RelightInputSchema, ChoreographInputSchema, EmitterInputSchema, MorphSequenceInputSchema, OriginalCharacterInputSchema, LookInputSchema, RenderHookInputSchema, ShaderGraphInputSchema, ShatterImageInputSchema, ImportLayeredCharacterInputSchema, CharacterInputSchema, GameInputSchema, World3DInputSchema, BrandKitInputSchema, ComponentInputSchema, ArtboardInputSchema, CommentInputSchema, ProvenanceInputSchema, SceneDiffInputSchema, AudioBeatsInputSchema, TemplateParamsInputSchema, RenderBatchInputSchema, AccessibilityCheckInputSchema, QueryMutationsInputSchema, ComposeInputSchema, CropImageInputSchema, PathOpInputSchema, MotionInputSchema, SoundInputSchema, InterchangeInputSchema, StickInputSchema, DesignSystemInputSchema, StoryInputSchema, ChromaKeyInputSchema, RiggingInputSchema, GroupInputSchema, CameraDirectorInputSchema, DetectObjectsInputSchema, ExtractObjectInputSchema, ArrangeInputSchema, CreateSceneInputSchema, GetPerformanceMetricsInputSchema, DiagnosticReportInputSchema, SearchAssetsInputSchema, ImportAssetInputSchema, P5DrawInputSchema, 
 // Diagram schemas
@@ -27,7 +28,7 @@ ImportImageInputSchema,
 // Scene management schemas
 ManageScenesInputSchema, ScenePlaybackInputSchema, SceneGraphInputSchema, SequenceInputSchema, StaggerInputSchema, FlipInputSchema, 
 // New consolidated tool schemas
-SelectionInputSchema, TransformInputSchema, HistoryInputSchema, ImageFilterInputSchema, LassoInputSchema, CutoutStyleInputSchema, PrecompInputSchema, BackgroundInputSchema, QueryInputSchema, QueryCapabilitiesInputSchema, DeformInputSchema, SpriteSheetInputSchema, InteractionInputSchema, ExportWidgetInputSchema, ExportWidgetHtmlInputSchema, CreateChartInputSchema, MagicInputSchema, PhysicsInputSchema, MeasurementInputSchema, PlaceOnSurfaceInputSchema, StyledSceneInputSchema, ErrorCodes, } from '../types/schemas.js';
+SelectionInputSchema, TransformInputSchema, HistoryInputSchema, ImageFilterInputSchema, LassoInputSchema, CutoutStyleInputSchema, PrecompInputSchema, BackgroundInputSchema, QueryInputSchema, QueryCapabilitiesInputSchema, DeformInputSchema, HandDrawnInputSchema, PenFigureInputSchema, CreateCharacterInputSchema, CharacterActionInputSchema, CharacterPoseInputSchema, SpriteSheetInputSchema, InteractionInputSchema, ExportWidgetInputSchema, ExportWidgetHtmlInputSchema, CreateChartInputSchema, MagicInputSchema, PhysicsInputSchema, MeasurementInputSchema, PlaceOnSurfaceInputSchema, DrawWeaveInputSchema, DrawKnotsInputSchema, DrawSashikoInputSchema, DrawSubdivisionInputSchema, UiKitInputSchema, StyledSceneInputSchema, ErrorCodes, } from '../types/schemas.js';
 import { ZodError, z } from 'zod';
 import { AsyncLocalStorage } from 'node:async_hooks';
 import { effectClass } from './effect-class.js';
@@ -57,6 +58,8 @@ import { buildZip } from '../utils/zip.js';
 import { buildScc } from '../utils/scc.js';
 import { checkContrast, checkFlashes, parseCssColor } from '../utils/a11y.js';
 import { buildHtml5Ad, buildPlayable, externalRequests, pinSceneBackground } from '../utils/ad-package.js';
+import { safeFetch, checkUrl, UnsafeUrlError } from '../utils/safe-fetch.js';
+import { confineAssetPath } from '../utils/asset-paths.js';
 /**
  * Registry of per-domain handler maps. Tools listed here short-circuit the
  * main switch at dispatch time (see handleToolCallInner). New domains are
@@ -175,9 +178,11 @@ const MAX_REMOTE_IMAGE_BYTES = 32 * 1024 * 1024;
 export async function fetchImageAsDataUrl(url) {
     let res;
     try {
-        res = await fetch(url, { redirect: 'follow' });
+        res = await safeFetch(url);
     }
     catch (e) {
+        if (e instanceof UnsafeUrlError)
+            return { error: e.message };
         const why = e instanceof Error ? e.message : 'network request failed';
         return { error: `could not reach ${url} — ${why}. This fetch runs in the MCP server, not the page, so it is not a CSP problem: check the host resolves and any proxy is reachable.` };
     }
@@ -231,14 +236,18 @@ export async function resolveImageSource(input) {
         return { src: raw };
     if (/^https?:/i.test(raw))
         return fetchImageAsDataUrl(raw);
-    const path = raw.startsWith('file://') ? fileURLToPath(raw) : raw;
-    const ext = extname(path).toLowerCase();
+    const asked = raw.startsWith('file://') ? fileURLToPath(raw) : raw;
+    const ext = extname(asked).toLowerCase();
     if (!IMAGE_EXTENSIONS.has(ext)) {
         return {
             error: `"${input}" is neither an http(s) URL nor a path to an image file. `
                 + `Recognised image extensions: ${[...IMAGE_EXTENSIONS].join(', ')}.`,
         };
     }
+    const confined = await confineAssetPath(asked);
+    if ('error' in confined)
+        return confined;
+    const path = confined.path;
     let bytes;
     try {
         const info = await stat(path);
@@ -286,9 +295,11 @@ export async function resolveMediaSource(input) {
     if (/^https?:/i.test(raw)) {
         let res;
         try {
-            res = await fetch(raw, { redirect: 'follow', headers: { 'User-Agent': 'PinePaper-MCP (+https://pinepaper.studio)' } });
+            res = await safeFetch(raw, { headers: { 'User-Agent': 'PinePaper-MCP (+https://pinepaper.studio)' } });
         }
         catch (e) {
+            if (e instanceof UnsafeUrlError)
+                return { error: e.message };
             const why = e instanceof Error ? e.message : 'network request failed';
             return { error: `could not reach ${raw} — ${why}. This fetch runs in the MCP server, not the page, so it is not a CSP problem: check the host resolves and any proxy is reachable.` };
         }
@@ -308,11 +319,15 @@ export async function resolveMediaSource(input) {
             return tooBig(raw, buf.length);
         return { src: `data:${type};base64,${buf.toString('base64')}` };
     }
-    const path = raw.startsWith('file://') ? fileURLToPath(raw) : raw;
-    const type = MEDIA_MIME[extname(path).toLowerCase()];
+    const asked = raw.startsWith('file://') ? fileURLToPath(raw) : raw;
+    const type = MEDIA_MIME[extname(asked).toLowerCase()];
     if (!type) {
         return { error: `"${input}" is neither an http(s) URL, a data: URL, nor a path to an audio/video file. Recognised extensions: ${Object.keys(MEDIA_MIME).join(', ')}.` };
     }
+    const confined = await confineAssetPath(asked);
+    if ('error' in confined)
+        return confined;
+    const path = confined.path;
     try {
         const info = await stat(path);
         if (!info.isFile())
@@ -983,6 +998,15 @@ export async function customCodeRollback(controller, error) {
  * isolated context, so code mode cannot do it and says so.
  */
 async function brandFromUrl(url, shots, options) {
+    // Same address rules as every server-side fetch, before a browser is started.
+    // The page's own requests are checked as it loads (see intakeBrand).
+    try {
+        await checkUrl(url);
+    }
+    catch (e) {
+        const why = e instanceof Error ? e.message : String(e);
+        return errorResult(e instanceof UnsafeUrlError ? ErrorCodes.INVALID_PARAMS : ErrorCodes.EXECUTION_ERROR, e instanceof UnsafeUrlError ? why : `could not reach ${url}: ${why}`, {}, { toolName: 'pinepaper_brand_kit' });
+    }
     const effectiveExecMode = options.executionMode ?? getExecutionMode();
     if (effectiveExecMode === 'code' || !options.executeInBrowser) {
         return errorResult(ErrorCodes.EXECUTION_ERROR, 'brand_kit from_url reads the site in the MCP server\'s browser, so it needs browser mode; it cannot run as generated code.', {}, { toolName: 'pinepaper_brand_kit' });
@@ -1099,6 +1123,24 @@ async function captureSheet(input, options) {
             }],
     };
 }
+/**
+ * The canvas the craft tools fill when the call gives no bounds. Asked of the
+ * studio, so a portrait or square canvas is filled rather than a 1280x720
+ * corner of it; undefined (the generators' own default) without a studio.
+ */
+async function craftFrame(options) {
+    const ctl = options.browserController;
+    if (!options.executeInBrowser || !ctl || !ctl.connected)
+        return undefined;
+    try {
+        const r = await ctl.executeCode(CRAFT_FRAME_JS, false);
+        const f = r.success ? r.result : null;
+        return f && f.width > 0 && f.height > 0 ? f : undefined;
+    }
+    catch {
+        return undefined;
+    }
+}
 export async function executeOrGenerate(code, description, options, toolName, 
 /**
  * Values too large to live inside the generated code. Written to
@@ -1788,6 +1830,17 @@ async function handleToolCallInner(toolName, args, options, tracker, baseTimerId
                 const code = codeGenerator.generateDeform(input);
                 return executeOrGenerate(code, `Deform: ${input.action}`, options, 'pinepaper_deform');
             }
+            case 'pinepaper_hand_drawn': {
+                const input = HandDrawnInputSchema.parse(args);
+                const code = codeGenerator.generateHandDrawn(input);
+                return executeOrGenerate(code, `Hand-drawn style: ${input.style ?? input.mode ?? 'sketchy'}`, options, 'pinepaper_hand_drawn');
+            }
+            case 'pinepaper_pen_figure': {
+                const input = PenFigureInputSchema.parse(args);
+                const code = codeGenerator.generatePenFigure(input);
+                const what = input.action === 'list' ? 'List the pen figures' : `Draw ${typeof input.figure === 'string' ? input.figure : 'a figure'} with a pen`;
+                return executeOrGenerate(code, what, options, 'pinepaper_pen_figure');
+            }
             case 'pinepaper_sprite_sheet': {
                 const input = SpriteSheetInputSchema.parse(args);
                 const code = codeGenerator.generateSpriteSheet(input);
@@ -1856,6 +1909,60 @@ async function handleToolCallInner(toolName, args, options, tracker, baseTimerId
                 const description = `Places ${input.concept} as ${plan.parts.length} parts with ${plan.tracks} keyframe tracks`;
                 return executeOrGenerate(code, description, options, 'pinepaper_character');
             }
+            case 'pinepaper_create_character': {
+                const input = CreateCharacterInputSchema.parse(args);
+                // If layered bundle provided, use importLayeredCharacter
+                if (input.bundle) {
+                    const bundleInfo = input.bundle.info || input.bundle;
+                    const bundleImages = input.bundle.images || {};
+                    const code = codeGenerator.generateImportLayeredCharacter({ info: bundleInfo, images: bundleImages });
+                    return executeOrGenerate(code, `Import layered character: ${input.name || input.characterId || 'bundle'}`, options, 'pinepaper_create_character');
+                }
+                // If concept/preset matches a planCharacter concept, plan it
+                const conceptName = input.concept || input.preset;
+                if (conceptName) {
+                    const formattedConcept = conceptName.startsWith('pp:') ? conceptName : `pp:${conceptName.charAt(0).toUpperCase() + conceptName.slice(1)}`;
+                    const plan = planCharacter({
+                        concept: formattedConcept,
+                        at: { x: input.x, y: input.y },
+                        scale: input.scale,
+                    });
+                    if (plan.ok) {
+                        const code = generateCharacterCode(plan, {
+                            generateCreateItem: (i) => codeGenerator.generateCreateItem(i),
+                            generateKeyframeAnimate: (i) => codeGenerator.generateKeyframeAnimate(i),
+                        }, {
+                            createItem: (a) => CreateItemInputSchema.parse(a),
+                            keyframeAnimate: (a) => KeyframeAnimateInputSchema.parse(a),
+                        });
+                        return executeOrGenerate(code, `Places character ${formattedConcept}`, options, 'pinepaper_create_character');
+                    }
+                }
+                const code = codeGenerator.generateCreateCharacter(input);
+                return executeOrGenerate(code, `Create character: ${input.name || input.characterId || 'Character'}`, options, 'pinepaper_create_character');
+            }
+            case 'pinepaper_character_action': {
+                const input = CharacterActionInputSchema.parse(args);
+                const act = String(input.action || 'walk').toLowerCase();
+                const FACES = ['blink', 'frown', 'smile', 'surprise', 'talk', 'wink'];
+                if (FACES.includes(act)) {
+                    return {
+                        content: [{
+                                type: 'text',
+                                text: `"${act}" is a facial expression — use pinepaper_character_pose with { expression: "${act}" }. Actions: walk, run, locomotion, wave, dance, jump, idle`,
+                            }],
+                        isError: true,
+                    };
+                }
+                const code = codeGenerator.generateCharacterAction(input);
+                return executeOrGenerate(code, `Character action: ${act}`, options, 'pinepaper_character_action');
+            }
+            case 'pinepaper_character_pose': {
+                const input = CharacterPoseInputSchema.parse(args);
+                const expr = String(input.expression || 'smile').toLowerCase();
+                const code = codeGenerator.generateCharacterPose(input);
+                return executeOrGenerate(code, `Character pose/expression: ${expr}`, options, 'pinepaper_character_pose');
+            }
             case 'pinepaper_batch_create': {
                 const input = BatchCreateInputSchema.parse(args);
                 const code = codeGenerator.generateBatchCreate(input);
@@ -2061,6 +2168,44 @@ async function handleToolCallInner(toolName, args, options, tracker, baseTimerId
                 const input = StyledSceneInputSchema.parse(args);
                 return executeOrGenerate(codeGenerator.generateStyledScene(input), `Styled scene${input.style ? `: ${input.style}` : ''}`, options, 'pinepaper_styled_scene');
             }
+            // The cloud's craft tools, shared (craft-tools.ts says what differs locally).
+            case 'pinepaper_draw_weave': {
+                const input = DrawWeaveInputSchema.parse(args);
+                const code = generateDrawWeave(input, await craftFrame(options));
+                return executeOrGenerate(code, `Draw a ${input.weave ?? 'plain'} weave`, options, 'pinepaper_draw_weave');
+            }
+            case 'pinepaper_draw_knots': {
+                const input = DrawKnotsInputSchema.parse(args);
+                if (!input.points?.length) {
+                    return {
+                        content: [{ type: 'text', text: 'pinepaper_draw_knots: give points — [{x, y}, …], one per knot. The tool places knots where you say and draws nothing without them.' }],
+                        isError: true,
+                    };
+                }
+                return executeOrGenerate(generateDrawKnots(input), `Draw ${input.points.length} embroidered knot(s)`, options, 'pinepaper_draw_knots');
+            }
+            case 'pinepaper_draw_sashiko': {
+                const input = DrawSashikoInputSchema.parse(args);
+                const code = generateDrawSashiko(input, await craftFrame(options));
+                return executeOrGenerate(code, `Draw ${input.pattern ?? 'seigaiha'} sashiko`, options, 'pinepaper_draw_sashiko');
+            }
+            case 'pinepaper_draw_subdivision': {
+                const input = DrawSubdivisionInputSchema.parse(args);
+                const code = generateDrawSubdivision(input, await craftFrame(options));
+                return executeOrGenerate(code, `Draw a ${input.preset ?? 'mondrian'} subdivision`, options, 'pinepaper_draw_subdivision');
+            }
+            case 'pinepaper_ui_kit': {
+                const input = UiKitInputSchema.parse(args);
+                const problems = uiKitCallProblems(input);
+                const code = problems.length ? null : generateUiKit(input);
+                if (!code) {
+                    return {
+                        content: [{ type: 'text', text: `pinepaper_ui_kit: ${problems.join(' ') || 'nothing to draw'}` }],
+                        isError: true,
+                    };
+                }
+                return executeOrGenerate(code, `UI kit: ${input.action}`, options, 'pinepaper_ui_kit');
+            }
             case 'pinepaper_place_on_surface': {
                 const input = PlaceOnSurfaceInputSchema.parse(args);
                 const code = codeGenerator.generatePlaceOnSurface(input);
@@ -2575,13 +2720,15 @@ You can now start creating new items on a clean canvas.${sizeNote}`,
                 let svgWarnings = [];
                 if (input.url) {
                     try {
-                        const res = await fetch(input.url, { redirect: 'follow' });
+                        const res = await safeFetch(input.url);
                         if (!res.ok) {
                             return errorResult(ErrorCodes.EXECUTION_ERROR, `the server refused ${input.url} — HTTP ${res.status} ${res.statusText || ''}`.trim());
                         }
                         svgText = await res.text();
                     }
                     catch (e) {
+                        if (e instanceof UnsafeUrlError)
+                            return errorResult(ErrorCodes.INVALID_PARAMS, e.message);
                         const why = e instanceof Error ? e.message : 'network request failed';
                         return errorResult(ErrorCodes.EXECUTION_ERROR, `could not reach ${input.url} — ${why}. This fetch runs in the MCP server rather than the page, so it is not a CSP problem.`);
                     }
@@ -2593,7 +2740,7 @@ You can now start creating new items on a clean canvas.${sizeNote}`,
                 }
                 const code = codeGenerator.generateImportSVG(svgText, svgText ? undefined : input.url, input.position, input.scale, input.source);
                 const description = svgWarnings.length
-                    ? `Imports SVG onto the canvas (${svgWarnings.length} unreachable image(s) removed)`
+                    ? `Imports SVG onto the canvas (${svgWarnings.length} unreachable image(s) removed: ${svgWarnings.map((w) => w.message).join('; ')})`
                     : 'Imports SVG onto the canvas';
                 return executeOrGenerate(code, description, options, 'pinepaper_import_svg');
             }
@@ -3161,9 +3308,11 @@ You can now start creating new items on a clean canvas.${sizeNote}`,
                         // third-party host under the studio's CSP and this process can.
                         let res;
                         try {
-                            res = await fetch(input.url, { redirect: 'follow' });
+                            res = await safeFetch(input.url);
                         }
                         catch (e) {
+                            if (e instanceof UnsafeUrlError)
+                                return errorResult(ErrorCodes.INVALID_PARAMS, e.message);
                             const why = e instanceof Error ? e.message : 'network request failed';
                             return errorResult(ErrorCodes.EXECUTION_ERROR, `could not reach ${input.url} — ${why}. This fetch runs in the MCP server rather than the page, so it is not a CSP problem.`);
                         }
@@ -4054,6 +4203,8 @@ You can now start creating new items on a clean canvas.${sizeNote}`,
                         'pinepaper_query_capabilities',
                         // Deformation, sprite sheets, interaction
                         'pinepaper_deform',
+                        'pinepaper_hand_drawn',
+                        'pinepaper_pen_figure',
                         'pinepaper_sprite_sheet',
                         'pinepaper_interaction',
                         // Widget export