flow-codeblock-rust-mcp 0.1.4 → 0.1.6

package/README.md

@@ -7,7 +7,7 @@ Local stdio MCP server for Flow Codeblock Rust+Bun. It calls the server-side Rus
 Bun 1.4.0 or newer is required:
 
 ```bash
-bunx --bun flow-codeblock-rust-mcp@0.1.4
+bunx --bun flow-codeblock-rust-mcp@0.1.6
 ```
 
 Configure the environment:
@@ -26,7 +26,7 @@ export FLOW_CODEBLOCK_TOKEN='<YOUR_INTERNAL_ACCESS_TOKEN>'
   "mcpServers": {
     "flow-codeblock-rust": {
       "command": "bunx",
-      "args": ["--bun", "flow-codeblock-rust-mcp@0.1.4"],
+      "args": ["--bun", "flow-codeblock-rust-mcp@0.1.6"],
       "env": {
         "FLOW_CODEBLOCK_BASE_URL": "https://flow.example.com",
         "FLOW_CODEBLOCK_TOKEN": "<YOUR_INTERNAL_ACCESS_TOKEN>"
@@ -44,6 +44,8 @@ The tools cover code-contract generation, unpublished-code tests, script listing
 
 Final delivery is mode-specific. `non_script` returns complete JavaScript, invocation instructions, request parameters and examples, execution logic, success/error examples, and a complete `execution_url`. `script` omits JavaScript and raw `interface_doc` by default and returns invocation instructions, request parameters and examples, execution logic, success/error examples, and the published `script_url`. Script code and `interface_doc` remain internal inputs to MCP preview, validation, and publication unless the user explicitly requests source or raw documentation.
 
+Execution errors preserve a concise `message` and verified user-code locations in `error.details.line`, `error.details.column`, and `error.details.lineContent` with one-based line and column numbers. Source location, matched text, and source line are not duplicated in security-policy messages. The details are omitted when the location cannot be verified; direct parse and execution-policy failures use `SyntaxError` and `SecurityError` respectively and return HTTP 422 with `retryable: false`.
+
 MCP does not provide script deletion, emergency recovery unlock, token lookup, execution statistics, ownership transfer, or arbitrary HTTP proxy tools. This release provides local stdio only; it does not expose remote HTTP, SSE, or Streamable HTTP transports.
 
 ## MCP tool contract

package/dist/index.js

@@ -28272,6 +28272,26 @@ function codeWriterContext(mode, requirement, inputExample, includeFullSchema, b
       input_bytes: 2 * 1024 * 1024,
       result_bytes: 10 * 1024 * 1024
     },
+    execution_error_contract: {
+      source_location: {
+        fields: ["line", "column", "lineContent"],
+        indexing: "line and column are one-based",
+        message_policy: "message contains the concise rule or runtime reason; source location is not duplicated in message",
+        included_for: [
+          "pre-execution syntax errors",
+          "dangerous-pattern policy failures",
+          "verified Bun user-code runtime failures"
+        ],
+        omitted_when: "the source location cannot be verified"
+      },
+      direct_execution_types: {
+        parse_failure: "SyntaxError",
+        execution_policy_failure: "SecurityError",
+        user_code_http_status: 422,
+        retryable: false
+      },
+      script_validation_policy_type: "ValidationError"
+    },
     code_rules: [
       "Read all business data from the global input only; do not read environment variables, persistent globals, or other external state. Return values must be JSON-serializable.",
       "Use top-level return by default. Use qf_output only for event-style/asynchronous flows or when explicitly requested, and assign it as a bare qf_output = { ... } object literal. Never mix it with top-level return or shadow the identifier.",
@@ -28504,6 +28524,7 @@ var result = (value) => ({
 var serverInstructions = [
   "This is the Flow Codeblock Rust+Bun MCP server. All tools except flow_write_code call the server-side REST API; flow_write_code returns an authoring contract only. Do not guess REST paths or put MCP credentials in business arguments.",
   "User code runs in a server-side Bun async function context with modern JavaScript, async/await, Promises, arrow functions, and top-level return. Default limits are 100 ms minimum timeout, 15,000 ms maximum timeout, 65,535 code bytes, 2 MiB input, and 10 MiB result.",
+  "User-code execution failures preserve the server error type, concise message, and stack when available. Verified source locations are in error.details with one-based line, column, and lineContent; details are omitted when the location cannot be verified. Security-policy messages contain the rule reason only; do not parse source locations from message or expect duplicated location text. Direct execution uses SyntaxError for parse failures and SecurityError for execution policy failures; these user-code failures are non-retryable HTTP 422 responses. Script-save validation may retain ValidationError for policy failures.",
   "Tool routing: flow_write_code only generates code and its contract; flow_execute_code is for explicitly requested tests of unpublished non-script code; flow_execute_script runs only published scripts.",
   "Script workflow: read the current version with flow_get_script before updates; creates require a complete interface_doc, while code or document updates may use a complete interface_doc or an RFC 6902 interface_doc_patch (never both, and patches require expected_version). Preview with flow_preview_script_change, then call flow_apply_script_change(confirm=true) only after explicit user confirmation. Documentation-only changes use flow_preview_script_documentation -> flow_apply_script_documentation.",
   "Preview IDs are single-use and time-limited. On a version conflict, expired preview, or validation failure, stop, read again, and preview again; never retry an old preview_id. Every flow_apply_* call requires confirm=true.",
@@ -28747,7 +28768,7 @@ function assertPreview(record3, operation) {
   return record3;
 }
 function createMcpServer({ api: api2, previews = new PreviewStore }) {
-  const server = new McpServer({ name: "flow-codeblock-rust", version: "0.1.4" }, { instructions: serverInstructions });
+  const server = new McpServer({ name: "flow-codeblock-rust", version: "0.1.6" }, { instructions: serverInstructions });
   server.registerTool("flow_write_code", {
     title: "Get the Flow JavaScript authoring contract",
     description: "Call this before writing Flow Codeblock JavaScript. It returns the mode-specific authoring contract and never writes the database, publishes a script, or executes code. Use non_script for immediate POST /flow/codeblock code and return a complete execution_url; use script for persistent GET/POST /flow/codeblock/{{script_id}} code with a complete script-interface-doc.v1 for preview, validation, and publication. Script delivery includes invocation instructions, parameters/examples, logic, success/error examples, and script_url rather than source or raw interface_doc unless requested. Set base_url only when a caller-facing URL template is needed.",
@@ -29001,7 +29022,7 @@ function createMcpServer({ api: api2, previews = new PreviewStore }) {
   const queryValueSchema = exports_external.union([exports_external.string(), exports_external.number(), exports_external.boolean(), exports_external.array(exports_external.union([exports_external.string(), exports_external.number(), exports_external.boolean()]))]);
   server.registerTool("flow_execute_script", {
     title: "Execute published script",
-    description: "Execute a published script only when the user explicitly requests a test or call. method must be GET or POST; the result includes a complete script_url built from FLOW_CODEBLOCK_BASE_URL and script_id. Array query values become repeated parameters, and a POST body is sent as JSON. MCP authentication, cookies, CSRF, proxy-source headers, and test-tool markers are filtered; qingcodeToken and qingcodeTimeout cannot be supplied as business parameters.",
+    description: "Execute a published script only when the user explicitly requests a test or call. method must be GET or POST; the result includes a complete script_url built from FLOW_CODEBLOCK_BASE_URL and script_id. Array query values become repeated parameters, and a POST body is sent as JSON. User-code failures preserve verified error.details source locations when available. MCP authentication, cookies, CSRF, proxy-source headers, and test-tool markers are filtered; qingcodeToken and qingcodeTimeout cannot be supplied as business parameters.",
     inputSchema: {
       script_id: exports_external.string().min(1).describe("Published script ID; the tool calls /flow/codeblock/{script_id}."),
       method: exports_external.enum(["GET", "POST"]).default("POST").describe("Script request method, either GET or POST; defaults to POST."),
@@ -29038,7 +29059,7 @@ function createMcpServer({ api: api2, previews = new PreviewStore }) {
   }));
   server.registerTool("flow_execute_code", {
     title: "Execute unpublished code",
-    description: "Execute unpublished non-script JavaScript only when the user explicitly requests a test. The result includes a complete execution_url. The request is always POST /flow/codeblock, and body.input is injected unchanged as global input; provide exactly one of code or code_base64. MCP authentication is never written into user input, and this tool does not create or publish scripts.",
+    description: "Execute unpublished non-script JavaScript only when the user explicitly requests a test. The result includes a complete execution_url. The request is always POST /flow/codeblock, and body.input is injected unchanged as global input; provide exactly one of code or code_base64. User-code failures preserve verified error.details source locations when available. MCP authentication is never written into user input, and this tool does not create or publish scripts.",
     inputSchema: {
       code: exports_external.string().min(1).optional().describe("UTF-8 JavaScript source, mutually exclusive with code_base64."),
       code_base64: exports_external.string().min(1).optional().describe("Non-empty Base64-encoded JavaScript source, mutually exclusive with code."),

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "flow-codeblock-rust-mcp",
-  "version": "0.1.4",
+  "version": "0.1.6",
   "description": "Flow Codeblock Rust+Bun stdio MCP Server for script management and execution.",
   "license": "MIT",
   "repository": {