flow-codeblock-rust-mcp 0.1.8 → 0.1.9

package/README.md

@@ -7,7 +7,7 @@ Local stdio MCP server for Flow Codeblock Rust+Bun. It calls the server-side Rus
 Bun 1.4.0 or newer is required:
 
 ```bash
-bunx --bun flow-codeblock-rust-mcp@0.1.8
+bunx --bun flow-codeblock-rust-mcp@0.1.9
 ```
 
 Configure the environment:
@@ -26,7 +26,7 @@ export FLOW_CODEBLOCK_TOKEN='<YOUR_INTERNAL_ACCESS_TOKEN>'
   "mcpServers": {
     "flow-codeblock-rust": {
       "command": "bunx",
-      "args": ["--bun", "flow-codeblock-rust-mcp@0.1.8"],
+      "args": ["--bun", "flow-codeblock-rust-mcp@0.1.9"],
       "env": {
         "FLOW_CODEBLOCK_BASE_URL": "https://flow.example.com",
         "FLOW_CODEBLOCK_TOKEN": "<YOUR_INTERNAL_ACCESS_TOKEN>"
@@ -38,6 +38,8 @@ export FLOW_CODEBLOCK_TOKEN='<YOUR_INTERNAL_ACCESS_TOKEN>'
 
 ## Tool boundaries
 
+Generated code treats `input` as a reserved, read-only runtime binding: never declare, rebind, or shadow it in any scope; use an alias such as `const payload = input` when a local name is needed. Review the complete source for input shadowing before every execution and retry.
+
 The code contract follows the current Rust+Bun module allowlist. `crypto-js` has been removed; use `node:crypto` for cryptography. Excel imports are limited to `read-excel-file/node`, `read-excel-file/universal`, `write-excel-file/node`, `write-excel-file/universal`, and `write-excel-file/utility`; these modules run in the server's shared heavy execution pool.
 
 The tools cover code-contract generation, unpublished-code tests, script listing, version reads, documentation validation/preview/save, script creation/update, locking/unlocking, and published-script execution. Creates and code updates can submit a complete interface document or RFC 6902 `interface_doc_patch`; preview calls `/flow/scripts/validate`, and apply re-submits patches with transactional `expected_version` conflict detection. Every script write requires a preview and explicit `confirm: true`.

package/dist/index.js

@@ -28294,6 +28294,7 @@ function codeWriterContext(mode, requirement, inputExample, includeFullSchema, b
     },
     code_rules: [
       "Read all business data from the global input only; do not read environment variables, persistent globals, or other external state. Return values must be JSON-serializable.",
+      "Treat input as a reserved, read-only runtime binding. Never declare, redeclare, rebind, or destructure a local binding named input in any scope, including const/let/var declarations, function parameters, catch bindings, and nested callbacks. If a local name is needed, alias it to payload or another name, for example const payload = input. Review the complete source for input shadowing before every execution and retry.",
       "Use top-level return by default. Use qf_output only for event-style/asynchronous flows or when explicitly requested, and assign it as a bare qf_output = { ... } object literal. Never mix it with top-level return or shadow the identifier.",
       "Prefer standard JavaScript, Bun-native fetch, real axios, and node:crypto. Network requests use Bun's native network stack. Use a whitelisted CommonJS literal require only when native capabilities cannot meet the requirement and the user explicitly requests it. crypto-js has been removed and must not be generated.",
       "Do not use import/export, dynamic require, browser APIs, timers, forbidden identifiers or members, or blacklisted Node modules. Never write real credentials.",
@@ -28537,7 +28538,7 @@ var serverInstructions = [
   "script-interface-doc.v1 requires schema_version, title, summary, endpoint, request, responses, and logic_description. endpoint requires methods and description; request.query and request.headers are required arrays (use [] when empty); POST requires request.body and GET-only documents must omit it. JSON Patch supports at most 256 add/remove/replace/move/copy/test operations; preview responses show operation counts and paths, not merged documents.",
   "Every query parameter and request header requires name, type, required, description, and example. Request bodies and responses require content_type=application/json, schema, and example; every response also requires status and description. Every JSON Schema node declares type, and object schemas and examples must cover each other.",
   "Keep endpoint.path relative: omit it on create and use /flow/codeblock/<actual-script-id> on update. Public call URLs use the caller-provided domain plus /flow/codeblock/{{script_id}}; never put real tokens, passwords, cookies, or Authorization values in code, documents, examples, or URLs.",
-  "Script input comes from input.query, input.header, input.body, and input.cookies; for immediate non-script POST /flow/codeblock, body.input becomes global input unchanged. Use top-level return by default; use a bare qf_output assignment only for event-style/asynchronous flows or when explicitly requested, never both.",
+  "Script input comes from input.query, input.header, input.body, and input.cookies; for immediate non-script POST /flow/codeblock, body.input becomes global input unchanged. Treat input as a reserved, read-only runtime binding: never declare, redeclare, rebind, or destructure a local binding named input in any scope, including function parameters and nested callbacks. Use an alias such as const payload = input when a local name is needed. Use top-level return by default; use a bare qf_output assignment only for event-style/asynchronous flows or when explicitly requested, never both.",
   "For every initial generation and every later revision in non-script mode, final delivery always includes the complete latest generated JavaScript, even after runtime verification; never return only a patch, diff, or partial snippet. Also include caller-facing invocation instructions, parameters/examples, logic, success/error examples, and execution_url. Script delivery omits JavaScript and raw interface_doc by default and includes invocation instructions, parameters/examples, logic, success/error examples, and the published script_url unless the user asks for source or raw documentation. Code and interface_doc remain internal preview/validation/publication inputs.",
   "Prefer native JavaScript, URL/URLSearchParams, Bun-native fetch, and node:crypto; crypto-js has been removed. Treat every forbidden identifier as forbidden in every syntactic position, including property names and method calls. Never generate RegExp.exec or .exec(...); use text.match(regex) for capture groups or regex.test(text) for boolean checks. Before execution, review the complete source and rewrite every forbidden identifier, member, or module. Do not generate browser APIs, timers, dynamic module loading, constructor-based code generation, or blacklisted Node modules (including fs/node:fs). Excel imports are limited to read-excel-file/node, read-excel-file/universal, write-excel-file/node, write-excel-file/universal, and write-excel-file/utility. Check HTTP status and handle JSON, text, and empty responses; await or return every async task.",
   "Script execution accepts only GET or POST. MCP authentication, cookies, CSRF, proxy-source headers, and test-tool markers are filtered. There is no script deletion, emergency unlock, or arbitrary HTTP proxy tool; direct those requests to the web UI or controlled REST/operations flow."
@@ -28774,10 +28775,10 @@ function assertPreview(record3, operation) {
   return record3;
 }
 function createMcpServer({ api: api2, previews = new PreviewStore }) {
-  const server = new McpServer({ name: "flow-codeblock-rust", version: "0.1.8" }, { instructions: serverInstructions });
+  const server = new McpServer({ name: "flow-codeblock-rust", version: "0.1.9" }, { instructions: serverInstructions });
   server.registerTool("flow_write_code", {
     title: "Get the Flow JavaScript authoring contract",
-    description: "Call this before writing or revising Flow Codeblock JavaScript. It returns the mode-specific authoring contract, including forbidden-identifier replacement rules, and never writes the database, publishes a script, or executes code. For every non_script generation or revision, always deliver the complete latest generated JavaScript plus execution_url, never only a patch or partial snippet; use script for persistent GET/POST /flow/codeblock/{{script_id}} code with a complete script-interface-doc.v1 for preview, validation, and publication. Script delivery includes invocation instructions, parameters/examples, logic, success/error examples, and script_url rather than source or raw interface_doc unless requested. Set base_url only when a caller-facing URL template is needed.",
+    description: "Call this before writing or revising Flow Codeblock JavaScript. It returns the mode-specific authoring contract, including forbidden-identifier and reserved-input replacement rules, and never writes the database, publishes a script, or executes code. For every non_script generation or revision, always deliver the complete latest generated JavaScript plus execution_url, never only a patch or partial snippet; use script for persistent GET/POST /flow/codeblock/{{script_id}} code with a complete script-interface-doc.v1 for preview, validation, and publication. Script delivery includes invocation instructions, parameters/examples, logic, success/error examples, and script_url rather than source or raw interface_doc unless requested. Set base_url only when a caller-facing URL template is needed.",
     inputSchema: {
       mode: exports_external.enum(["non_script", "script"]).describe("Generation mode. Use non_script for immediate, non-persistent execution; use script for a persistent GET/POST endpoint or HTTP redirects."),
       requirement: exports_external.string().min(1).max(20000).describe("Complete business requirements, input fields, expected output, external APIs, synchronization/async needs, and error behavior. Include only requirements relevant to this code."),
@@ -29065,11 +29066,11 @@ function createMcpServer({ api: api2, previews = new PreviewStore }) {
   }));
   server.registerTool("flow_execute_code", {
     title: "Execute unpublished code",
-    description: "Execute unpublished generated JavaScript when requested or when the available safe input is sufficient for a meaningful runtime test; execution-only verification does not require user confirmation. The result includes a complete execution_url. The request is always POST /flow/codeblock, and body.input is injected unchanged as global input; provide exactly one of code or code_base64. User-code failures preserve verified error.details source locations when available. MCP authentication is never written into user input, and this tool does not create or publish scripts.",
+    description: "Execute unpublished generated JavaScript when requested or when the available safe input is sufficient for a meaningful runtime test; execution-only verification does not require user confirmation. The result includes a complete execution_url. The request is always POST /flow/codeblock, and body.input is injected unchanged as global input; input is a reserved runtime binding and generated code must never declare, rebind, or shadow it; use an alias such as const payload = input. Provide exactly one of code or code_base64. User-code failures preserve verified error.details source locations when available. MCP authentication is never written into user input, and this tool does not create or publish scripts.",
     inputSchema: {
       code: exports_external.string().min(1).optional().describe("UTF-8 JavaScript source, mutually exclusive with code_base64."),
       code_base64: exports_external.string().min(1).optional().describe("Non-empty Base64-encoded JavaScript source, mutually exclusive with code."),
-      input: exports_external.unknown().optional().describe("Business data injected into global input; defaults to {}. Do not include tokens, passwords, cookies, or Authorization values."),
+      input: exports_external.unknown().optional().describe("Business data injected into global input; defaults to {}. Do not include tokens, passwords, cookies, or Authorization values. In generated code, input is a reserved binding; never declare, rebind, or shadow it."),
       timeout_ms: exports_external.number().int().positive().optional().describe("Test execution timeout in milliseconds; it must be within the server's allowed range.")
     }
   }, withApiErrors(async ({ code, code_base64, input, timeout_ms }) => {

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "flow-codeblock-rust-mcp",
-  "version": "0.1.8",
+  "version": "0.1.9",
   "description": "Flow Codeblock Rust+Bun stdio MCP Server for script management and execution.",
   "license": "MIT",
   "repository": {