@productmaker/mcp 12.2.6 → 12.2.8
This diff represents the content of publicly available package versions that have been released to one of the supported registries. The information contained in this diff is provided for informational purposes only and reflects changes between package versions as they appear in their respective public registries.
- package/README.md +75 -14
- package/dist/http.js +1426 -1107
- package/dist/stdio.js +1429 -1112
- package/dist/ui/meta-upload-app.html +221 -80
- package/package.json +1 -1
package/README.md
CHANGED
|
@@ -320,20 +320,44 @@ The `base64` field was removed. MCP JSON-RPC transports truncate large tool argu
|
|
|
320
320
|
|
|
321
321
|
## Environment variables
|
|
322
322
|
|
|
323
|
-
| Var
|
|
324
|
-
|
|
|
325
|
-
| `PM_API_KEY`
|
|
326
|
-
| `PM_API_URL`
|
|
327
|
-
| `
|
|
328
|
-
| `
|
|
329
|
-
| `
|
|
330
|
-
| `
|
|
331
|
-
| `
|
|
332
|
-
| `
|
|
333
|
-
| `
|
|
334
|
-
| `
|
|
335
|
-
| `
|
|
336
|
-
| `
|
|
323
|
+
| Var | Runtime default | Configuration requirement |
|
|
324
|
+
| --------------------------------- | ---------------------------------------------------- | -------------------------------------------------------------------------------------- |
|
|
325
|
+
| `PM_API_KEY` | — | required for stdio/local/direct API only |
|
|
326
|
+
| `PM_API_URL` | `https://api.productmaker.app` | optional for both |
|
|
327
|
+
| `PM_MEDIA_UPLOAD_STORAGE_ORIGINS` | official ProductMaker R2 account for the default API | optional JSON array of exact public HTTPS upload origins; configure for custom storage |
|
|
328
|
+
| `PORT` | `8080` | optional for HTTP |
|
|
329
|
+
| `MCP_PROXY_BASE_URL` | `https://mcp.productmaker.app` | optional for HTTP |
|
|
330
|
+
| `PM_PROXY_SECRET` | — | optional for HTTP; 32+ chars enables asset proxy |
|
|
331
|
+
| `MCP_REMOTE_AUTH_MODE` | — | required for hosted HTTP; must be `oauth` |
|
|
332
|
+
| `MCP_AUTH0_ISSUER` | — | required for hosted HTTP OAuth |
|
|
333
|
+
| `MCP_AUTH0_AUDIENCE` | — | required; set to `https://mcp.productmaker.app/mcp` |
|
|
334
|
+
| `MCP_AUTH0_CLIENT_ID` | — | required for hosted HTTP OAuth |
|
|
335
|
+
| `MCP_AUTH0_CLIENT_SECRET` | — | required for hosted HTTP OAuth |
|
|
336
|
+
| `AUTH0_AUDIENCE` | — | required for hosted HTTP OAuth |
|
|
337
|
+
| `PM_API_AUDIENCE` | — | required for hosted HTTP OAuth |
|
|
338
|
+
|
|
339
|
+
### Custom upload storage
|
|
340
|
+
|
|
341
|
+
The inline uploader allows only the exact production R2 account origin when using
|
|
342
|
+
`https://api.productmaker.app`. Custom API/storage operators must configure
|
|
343
|
+
`PM_MEDIA_UPLOAD_STORAGE_ORIGINS`, for example
|
|
344
|
+
`["https://storage.example.com:9443"]`, on their HTTP or stdio process. The value
|
|
345
|
+
replaces the default storage allowance; `[]` adds no storage destinations. Origins
|
|
346
|
+
must be public HTTPS URLs with no wildcard, credentials, path, query or fragment.
|
|
347
|
+
Malformed configuration stops startup without logging the supplied value. Set the
|
|
348
|
+
same public JSON value in the `PM_MEDIA_UPLOAD_STORAGE_ORIGINS` GitHub repository
|
|
349
|
+
variable for managed deployments, or export it for `deploy_mcp.sh`. Both deployment
|
|
350
|
+
paths preserve JSON commas and apply the explicit official account when unset.
|
|
351
|
+
Tool results and user files cannot expand this operator-controlled policy.
|
|
352
|
+
|
|
353
|
+
The uploader has no remote static assets and declares `resourceDomains: []`.
|
|
354
|
+
ProductMaker API/web proxy origins and the configured API resolver remain allowed.
|
|
355
|
+
The ChatGPT file bridge temporarily retains `https://*.oaiusercontent.com` because
|
|
356
|
+
its documented download helper supplies temporary URLs without a published exact
|
|
357
|
+
hostname contract. Narrowing that scope awaits a real attached-file/library flow;
|
|
358
|
+
this change does not claim the portal finding has cleared. The server emits the
|
|
359
|
+
standard CSP and matching legacy ChatGPT compatibility metadata. It does not set
|
|
360
|
+
a shared `ui.domain`, which breaks hosts with different sandbox-domain rules.
|
|
337
361
|
|
|
338
362
|
## Version history
|
|
339
363
|
|
|
@@ -347,6 +371,43 @@ out on purpose: the integration key is a secret pasted in Integrations. All
|
|
|
347
371
|
nine are MCP-only (`whatsapp: "unavailable"`) and behind the `financial-control`
|
|
348
372
|
admin feature.
|
|
349
373
|
|
|
374
|
+
### 12.2.8 — Result-viewer origin and correction delivery (unreleased)
|
|
375
|
+
|
|
376
|
+
- Declare the shared OpenAI component origin on listed and readable result-viewer
|
|
377
|
+
resources, matching the uploader. Keep the standard host-selected origin and
|
|
378
|
+
fail-closed media CSP unchanged for other MCP Apps hosts.
|
|
379
|
+
- SDK transport tests verify both metadata placements. Native acceptance and the
|
|
380
|
+
cause of a browser sandbox cancellation remain separate checks.
|
|
381
|
+
- Deliver published image corrections from `get_image_edit_status` through the
|
|
382
|
+
same read-only task viewer and protected asset proxy. Preserve operation status,
|
|
383
|
+
degradation and error; queued/processing stay pending and failed stays error.
|
|
384
|
+
Missing or invalid proxy/media configuration stays empty, with no raw storage
|
|
385
|
+
URL or storage key in model-facing content. The original task being done never
|
|
386
|
+
makes an unfinished correction ready. No generation or paid action is added.
|
|
387
|
+
|
|
388
|
+
### 12.2.7 — Upload reliability and media transport hardening (unreleased)
|
|
389
|
+
|
|
390
|
+
- Correct public landing/Shopify publication and Meta creative URL/temporary-asset
|
|
391
|
+
annotations. Keep the legacy video API identifier while labeling its display
|
|
392
|
+
title and canonical summary as custom-script generation using paid credits.
|
|
393
|
+
- Keep host ping/unknown requests separate from matching initialization and
|
|
394
|
+
tool-call responses, even when both directions use the same numeric ID.
|
|
395
|
+
- Retain upload-session identity across asynchronous work; stop obsolete batches,
|
|
396
|
+
settle aborted PUTs and release reservations using their original credentials.
|
|
397
|
+
- Retry transient resolve throttles/timeouts within the existing limit and reject
|
|
398
|
+
oversized signed upload URLs without truncating them.
|
|
399
|
+
- Pin validated public media DNS destinations in the actual HTTPS connection,
|
|
400
|
+
including redirects; keep bounded transfer and cleanup behavior.
|
|
401
|
+
- Restrict upload CSP to the production R2 account or explicit operator storage
|
|
402
|
+
origins, declare the empty static-resource policy, and retain the pending
|
|
403
|
+
ChatGPT file-bridge origin verification described above.
|
|
404
|
+
- Describe upload preparation and status without prescribing host tool timing or
|
|
405
|
+
permission decisions. Preserve private staging, explicit upload refusal and
|
|
406
|
+
separate generation/publication consent; the App never sends a user chat turn.
|
|
407
|
+
- Local protocol, transport and CSP tests remain separate from deployment,
|
|
408
|
+
production acceptance and the portal's current scan result. The earlier
|
|
409
|
+
serialized-browser rendering symptom is not evidence of a ChatGPT outage.
|
|
410
|
+
|
|
350
411
|
### 12.1.7 — Service website challenge recognition
|
|
351
412
|
|
|
352
413
|
- Recognize SiteGround robot challenge pages before accepting service website source content.
|