flow-codeblock-rust-mcp 0.1.6 → 0.1.8

package/README.md

@@ -7,7 +7,7 @@ Local stdio MCP server for Flow Codeblock Rust+Bun. It calls the server-side Rus
 Bun 1.4.0 or newer is required:
 
 ```bash
-bunx --bun flow-codeblock-rust-mcp@0.1.6
+bunx --bun flow-codeblock-rust-mcp@0.1.8
 ```
 
 Configure the environment:
@@ -26,7 +26,7 @@ export FLOW_CODEBLOCK_TOKEN='<YOUR_INTERNAL_ACCESS_TOKEN>'
   "mcpServers": {
     "flow-codeblock-rust": {
       "command": "bunx",
-      "args": ["--bun", "flow-codeblock-rust-mcp@0.1.6"],
+      "args": ["--bun", "flow-codeblock-rust-mcp@0.1.8"],
       "env": {
         "FLOW_CODEBLOCK_BASE_URL": "https://flow.example.com",
         "FLOW_CODEBLOCK_TOKEN": "<YOUR_INTERNAL_ACCESS_TOKEN>"
@@ -42,7 +42,7 @@ The code contract follows the current Rust+Bun module allowlist. `crypto-js` has
 
 The tools cover code-contract generation, unpublished-code tests, script listing, version reads, documentation validation/preview/save, script creation/update, locking/unlocking, and published-script execution. Creates and code updates can submit a complete interface document or RFC 6902 `interface_doc_patch`; preview calls `/flow/scripts/validate`, and apply re-submits patches with transactional `expected_version` conflict detection. Every script write requires a preview and explicit `confirm: true`.
 
-Final delivery is mode-specific. `non_script` returns complete JavaScript, invocation instructions, request parameters and examples, execution logic, success/error examples, and a complete `execution_url`. `script` omits JavaScript and raw `interface_doc` by default and returns invocation instructions, request parameters and examples, execution logic, success/error examples, and the published `script_url`. Script code and `interface_doc` remain internal inputs to MCP preview, validation, and publication unless the user explicitly requests source or raw documentation.
+The authoring context treats forbidden identifiers as forbidden in properties and method calls too; for example, generated code uses `text.match(regex)` or `regex.test(text)` instead of `RegExp.exec`. When generated code and the available safe input are sufficient for a meaningful runtime test, the client executes it immediately without waiting for user confirmation. If required input or credentials are missing, it reports that runtime verification was not performed instead of inventing them. Final delivery is mode-specific. Every initial `non_script` generation and every later revision returns the complete latest generated JavaScript, never only a patch, diff, or partial snippet, even after runtime verification; it also includes invocation instructions, request parameters and examples, execution logic, success/error examples, and a complete `execution_url`. `script` omits JavaScript and raw `interface_doc` by default and returns invocation instructions, request parameters and examples, execution logic, success/error examples, and the published `script_url`. Script code and `interface_doc` remain internal inputs to MCP preview, validation, and publication unless the user explicitly requests source or raw documentation.
 
 Execution errors preserve a concise `message` and verified user-code locations in `error.details.line`, `error.details.column`, and `error.details.lineContent` with one-based line and column numbers. Source location, matched text, and source line are not duplicated in security-policy messages. The details are omitted when the location cannot be verified; direct parse and execution-policy failures use `SyntaxError` and `SecurityError` respectively and return HTTP 422 with `retryable: false`.
 

package/dist/index.js

@@ -28295,8 +28295,9 @@ function codeWriterContext(mode, requirement, inputExample, includeFullSchema, b
     code_rules: [
       "Read all business data from the global input only; do not read environment variables, persistent globals, or other external state. Return values must be JSON-serializable.",
       "Use top-level return by default. Use qf_output only for event-style/asynchronous flows or when explicitly requested, and assign it as a bare qf_output = { ... } object literal. Never mix it with top-level return or shadow the identifier.",
-      "Prefer standard JavaScript, server-side fetch, and node:crypto. Use a whitelisted CommonJS literal require only when native capabilities cannot meet the requirement and the user explicitly requests it. crypto-js has been removed and must not be generated.",
+      "Prefer standard JavaScript, Bun-native fetch, real axios, and node:crypto. Network requests use Bun's native network stack. Use a whitelisted CommonJS literal require only when native capabilities cannot meet the requirement and the user explicitly requests it. crypto-js has been removed and must not be generated.",
       "Do not use import/export, dynamic require, browser APIs, timers, forbidden identifiers or members, or blacklisted Node modules. Never write real credentials.",
+      "Treat every forbidden identifier as forbidden in every syntactic position, including property names and method calls. Never generate RegExp.exec or .exec(...); use text.match(regex) for capture groups or regex.test(text) for boolean checks. Review the complete source and rewrite every forbidden identifier, member, or module before execution.",
       "Put business logic and asynchronous operations in try-catch; return errors as strings or plain objects.",
       "Do not create unbounded loops, unsettled Promises, or background tasks that outlive execution; every request must be awaited or returned.",
       "Validate external URLs, headers, query parameters, and request bodies for type, length, and allowed ranges. Check HTTP status and handle JSON, text, and empty responses separately."
@@ -28315,6 +28316,7 @@ function codeWriterContext(mode, requirement, inputExample, includeFullSchema, b
         "eval",
         "Function",
         "Proxy",
+        "constructor",
         "__proto__",
         "child_process",
         "exec",
@@ -28335,6 +28337,7 @@ function codeWriterContext(mode, requirement, inputExample, includeFullSchema, b
         "Reflect.apply",
         "Reflect.get",
         "Reflect.set",
+        "process.env",
         "process.exit",
         "process.kill",
         "process.binding",
@@ -28346,6 +28349,8 @@ function codeWriterContext(mode, requirement, inputExample, includeFullSchema, b
         "cluster",
         "dgram",
         "dns",
+        "fs",
+        "node:fs",
         "http",
         "http2",
         "https",
@@ -28374,6 +28379,7 @@ function codeWriterContext(mode, requirement, inputExample, includeFullSchema, b
       "Return only plain serializable values or Promises; do not return circular references, BigInt, functions, Symbols, unhandled complex class instances, or unbounded arrays/strings.",
       "The platform places immediate-interface return values in the outer HTTP response's result field; script interfaces usually return the business value directly. Prefer { success: true, data: value } or { success: false, error: message }."
     ],
+    verification_rule: "After generating code, run a meaningful execution test immediately when the available requirement and safe input are sufficient; execution-only verification does not require user confirmation. If required input or credentials are missing, state that runtime verification was not performed instead of inventing them.",
     allowed_modules: allowedModules
   };
   if (mode === "non_script") {
@@ -28389,12 +28395,12 @@ function codeWriterContext(mode, requirement, inputExample, includeFullSchema, b
         "Generate immediate non_script mode when the user does not specify a mode.",
         "If the requirement includes an HTTP redirect, use script mode with /flow/codeblock/{{script_id}}."
       ],
-      deliverables: ["A javascript code block containing executable JavaScript only", "Input and output contracts"],
+      deliverables: ["The complete latest javascript code block containing executable JavaScript only", "Input and output contracts"],
       test_tool: { name: "flow_execute_code", arguments: { code: "<JavaScript>", input: inputExample ?? {}, timeout_ms: 3000 } },
-      rule: "Do not call flow_execute_code unless the user explicitly requests a test.",
+      rule: "Call flow_execute_code immediately when the available requirement and safe input are sufficient for a meaningful test; do not wait for user confirmation.",
       response_format: [
         "Unless the user explicitly requests code only, explain the mode and output first, then provide the JavaScript code block, followed by request/response examples.",
-        "For non_script interfaces, deliver complete JavaScript, invocation instructions, request parameters and examples, execution logic, success/error output examples, and execution_url."
+        "For every initial generation and every later revision of a non_script interface, always deliver the complete latest generated JavaScript in the final response, even after runtime verification; never deliver only a patch, diff, or partial snippet. Also include invocation instructions, request parameters and examples, execution logic, success/error output examples, and execution_url."
       ]
     };
   }
@@ -28448,7 +28454,7 @@ function codeWriterContext(mode, requirement, inputExample, includeFullSchema, b
       "For updates, call flow_get_script first to read the current version; for documentation updates, flow_get_script_documentation may be called first.",
       "Generate code and a complete interface_doc together; call flow_preview_script_change once for a create or code update.",
       "Call flow_apply_script_change or flow_apply_script_documentation only after explicit user confirmation, with confirm=true.",
-      "Call flow_execute_script only when the user requests a test of a published script; call flow_execute_code only to test unpublished code.",
+      "When the available requirement and safe input are sufficient for a meaningful test, immediately call flow_execute_code for unpublished code or flow_execute_script for published code; execution-only verification does not require user confirmation.",
       "On a version conflict, expired preview, or validation failure, stop and read/preview again; never retry an old preview_id."
     ],
     response_format: [
@@ -28525,15 +28531,15 @@ var serverInstructions = [
   "This is the Flow Codeblock Rust+Bun MCP server. All tools except flow_write_code call the server-side REST API; flow_write_code returns an authoring contract only. Do not guess REST paths or put MCP credentials in business arguments.",
   "User code runs in a server-side Bun async function context with modern JavaScript, async/await, Promises, arrow functions, and top-level return. Default limits are 100 ms minimum timeout, 15,000 ms maximum timeout, 65,535 code bytes, 2 MiB input, and 10 MiB result.",
   "User-code execution failures preserve the server error type, concise message, and stack when available. Verified source locations are in error.details with one-based line, column, and lineContent; details are omitted when the location cannot be verified. Security-policy messages contain the rule reason only; do not parse source locations from message or expect duplicated location text. Direct execution uses SyntaxError for parse failures and SecurityError for execution policy failures; these user-code failures are non-retryable HTTP 422 responses. Script-save validation may retain ValidationError for policy failures.",
-  "Tool routing: flow_write_code only generates code and its contract; flow_execute_code is for explicitly requested tests of unpublished non-script code; flow_execute_script runs only published scripts.",
+  "Tool routing: flow_write_code only generates code and its contract; flow_execute_code tests unpublished generated code; flow_execute_script runs published scripts. When the generated code and available safe input are sufficient for a meaningful runtime test, execute it immediately without waiting for user confirmation. If required input or credentials are missing, report that runtime verification was not performed instead of inventing them.",
   "Script workflow: read the current version with flow_get_script before updates; creates require a complete interface_doc, while code or document updates may use a complete interface_doc or an RFC 6902 interface_doc_patch (never both, and patches require expected_version). Preview with flow_preview_script_change, then call flow_apply_script_change(confirm=true) only after explicit user confirmation. Documentation-only changes use flow_preview_script_documentation -> flow_apply_script_documentation.",
   "Preview IDs are single-use and time-limited. On a version conflict, expired preview, or validation failure, stop, read again, and preview again; never retry an old preview_id. Every flow_apply_* call requires confirm=true.",
   "script-interface-doc.v1 requires schema_version, title, summary, endpoint, request, responses, and logic_description. endpoint requires methods and description; request.query and request.headers are required arrays (use [] when empty); POST requires request.body and GET-only documents must omit it. JSON Patch supports at most 256 add/remove/replace/move/copy/test operations; preview responses show operation counts and paths, not merged documents.",
   "Every query parameter and request header requires name, type, required, description, and example. Request bodies and responses require content_type=application/json, schema, and example; every response also requires status and description. Every JSON Schema node declares type, and object schemas and examples must cover each other.",
   "Keep endpoint.path relative: omit it on create and use /flow/codeblock/<actual-script-id> on update. Public call URLs use the caller-provided domain plus /flow/codeblock/{{script_id}}; never put real tokens, passwords, cookies, or Authorization values in code, documents, examples, or URLs.",
   "Script input comes from input.query, input.header, input.body, and input.cookies; for immediate non-script POST /flow/codeblock, body.input becomes global input unchanged. Use top-level return by default; use a bare qf_output assignment only for event-style/asynchronous flows or when explicitly requested, never both.",
-  "Non-script delivery includes complete JavaScript, caller-facing invocation instructions, parameters/examples, logic, success/error examples, and execution_url. Script delivery omits JavaScript and raw interface_doc by default and includes invocation instructions, parameters/examples, logic, success/error examples, and the published script_url unless the user asks for source or raw documentation. Code and interface_doc remain internal preview/validation/publication inputs.",
-  "Prefer native JavaScript, URL/URLSearchParams, fetch, and node:crypto; crypto-js has been removed. Do not generate browser APIs, timers, dynamic module loading, blacklisted Node modules, or dangerous identifiers. Excel imports are limited to read-excel-file/node, read-excel-file/universal, write-excel-file/node, write-excel-file/universal, and write-excel-file/utility. Check HTTP status and handle JSON, text, and empty responses; await or return every async task.",
+  "For every initial generation and every later revision in non-script mode, final delivery always includes the complete latest generated JavaScript, even after runtime verification; never return only a patch, diff, or partial snippet. Also include caller-facing invocation instructions, parameters/examples, logic, success/error examples, and execution_url. Script delivery omits JavaScript and raw interface_doc by default and includes invocation instructions, parameters/examples, logic, success/error examples, and the published script_url unless the user asks for source or raw documentation. Code and interface_doc remain internal preview/validation/publication inputs.",
+  "Prefer native JavaScript, URL/URLSearchParams, Bun-native fetch, and node:crypto; crypto-js has been removed. Treat every forbidden identifier as forbidden in every syntactic position, including property names and method calls. Never generate RegExp.exec or .exec(...); use text.match(regex) for capture groups or regex.test(text) for boolean checks. Before execution, review the complete source and rewrite every forbidden identifier, member, or module. Do not generate browser APIs, timers, dynamic module loading, constructor-based code generation, or blacklisted Node modules (including fs/node:fs). Excel imports are limited to read-excel-file/node, read-excel-file/universal, write-excel-file/node, write-excel-file/universal, and write-excel-file/utility. Check HTTP status and handle JSON, text, and empty responses; await or return every async task.",
   "Script execution accepts only GET or POST. MCP authentication, cookies, CSRF, proxy-source headers, and test-tool markers are filtered. There is no script deletion, emergency unlock, or arbitrary HTTP proxy tool; direct those requests to the web UI or controlled REST/operations flow."
 ].join(`
 `);
@@ -28768,10 +28774,10 @@ function assertPreview(record3, operation) {
   return record3;
 }
 function createMcpServer({ api: api2, previews = new PreviewStore }) {
-  const server = new McpServer({ name: "flow-codeblock-rust", version: "0.1.6" }, { instructions: serverInstructions });
+  const server = new McpServer({ name: "flow-codeblock-rust", version: "0.1.8" }, { instructions: serverInstructions });
   server.registerTool("flow_write_code", {
     title: "Get the Flow JavaScript authoring contract",
-    description: "Call this before writing Flow Codeblock JavaScript. It returns the mode-specific authoring contract and never writes the database, publishes a script, or executes code. Use non_script for immediate POST /flow/codeblock code and return a complete execution_url; use script for persistent GET/POST /flow/codeblock/{{script_id}} code with a complete script-interface-doc.v1 for preview, validation, and publication. Script delivery includes invocation instructions, parameters/examples, logic, success/error examples, and script_url rather than source or raw interface_doc unless requested. Set base_url only when a caller-facing URL template is needed.",
+    description: "Call this before writing or revising Flow Codeblock JavaScript. It returns the mode-specific authoring contract, including forbidden-identifier replacement rules, and never writes the database, publishes a script, or executes code. For every non_script generation or revision, always deliver the complete latest generated JavaScript plus execution_url, never only a patch or partial snippet; use script for persistent GET/POST /flow/codeblock/{{script_id}} code with a complete script-interface-doc.v1 for preview, validation, and publication. Script delivery includes invocation instructions, parameters/examples, logic, success/error examples, and script_url rather than source or raw interface_doc unless requested. Set base_url only when a caller-facing URL template is needed.",
     inputSchema: {
       mode: exports_external.enum(["non_script", "script"]).describe("Generation mode. Use non_script for immediate, non-persistent execution; use script for a persistent GET/POST endpoint or HTTP redirects."),
       requirement: exports_external.string().min(1).max(20000).describe("Complete business requirements, input fields, expected output, external APIs, synchronization/async needs, and error behavior. Include only requirements relevant to this code."),
@@ -29022,7 +29028,7 @@ function createMcpServer({ api: api2, previews = new PreviewStore }) {
   const queryValueSchema = exports_external.union([exports_external.string(), exports_external.number(), exports_external.boolean(), exports_external.array(exports_external.union([exports_external.string(), exports_external.number(), exports_external.boolean()]))]);
   server.registerTool("flow_execute_script", {
     title: "Execute published script",
-    description: "Execute a published script only when the user explicitly requests a test or call. method must be GET or POST; the result includes a complete script_url built from FLOW_CODEBLOCK_BASE_URL and script_id. Array query values become repeated parameters, and a POST body is sent as JSON. User-code failures preserve verified error.details source locations when available. MCP authentication, cookies, CSRF, proxy-source headers, and test-tool markers are filtered; qingcodeToken and qingcodeTimeout cannot be supplied as business parameters.",
+    description: "Execute a published script when requested or when the available safe input is sufficient to verify newly generated code; execution-only verification does not require user confirmation. method must be GET or POST; the result includes a complete script_url built from FLOW_CODEBLOCK_BASE_URL and script_id. Array query values become repeated parameters, and a POST body is sent as JSON. User-code failures preserve verified error.details source locations when available. MCP authentication, cookies, CSRF, proxy-source headers, and test-tool markers are filtered; qingcodeToken and qingcodeTimeout cannot be supplied as business parameters.",
     inputSchema: {
       script_id: exports_external.string().min(1).describe("Published script ID; the tool calls /flow/codeblock/{script_id}."),
       method: exports_external.enum(["GET", "POST"]).default("POST").describe("Script request method, either GET or POST; defaults to POST."),
@@ -29059,7 +29065,7 @@ function createMcpServer({ api: api2, previews = new PreviewStore }) {
   }));
   server.registerTool("flow_execute_code", {
     title: "Execute unpublished code",
-    description: "Execute unpublished non-script JavaScript only when the user explicitly requests a test. The result includes a complete execution_url. The request is always POST /flow/codeblock, and body.input is injected unchanged as global input; provide exactly one of code or code_base64. User-code failures preserve verified error.details source locations when available. MCP authentication is never written into user input, and this tool does not create or publish scripts.",
+    description: "Execute unpublished generated JavaScript when requested or when the available safe input is sufficient for a meaningful runtime test; execution-only verification does not require user confirmation. The result includes a complete execution_url. The request is always POST /flow/codeblock, and body.input is injected unchanged as global input; provide exactly one of code or code_base64. User-code failures preserve verified error.details source locations when available. MCP authentication is never written into user input, and this tool does not create or publish scripts.",
     inputSchema: {
       code: exports_external.string().min(1).optional().describe("UTF-8 JavaScript source, mutually exclusive with code_base64."),
       code_base64: exports_external.string().min(1).optional().describe("Non-empty Base64-encoded JavaScript source, mutually exclusive with code."),

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "flow-codeblock-rust-mcp",
-  "version": "0.1.6",
+  "version": "0.1.8",
   "description": "Flow Codeblock Rust+Bun stdio MCP Server for script management and execution.",
   "license": "MIT",
   "repository": {