html2pptx-local-mcp 1.1.18 → 1.1.20

package/cli/dist/commands/edit.js

@@ -2,14 +2,34 @@ import { createHash, randomBytes, timingSafeEqual } from "node:crypto";
 import { spawn } from "node:child_process";
 import { createServer } from "node:http";
 import { platform } from "node:os";
-import { mkdir, readFile, realpath, stat, writeFile, } from "node:fs/promises";
+import { mkdir, readdir, readFile, realpath, stat, writeFile, } from "node:fs/promises";
 import { dirname, extname, join, relative, resolve, sep, } from "node:path";
 import * as p from "@clack/prompts";
 import pc from "picocolors";
 const AUTO_PORT = 0;
 const MAX_WRITE_BYTES = 5 * 1024 * 1024;
+const MAX_ASSET_BYTES = 8 * 1024 * 1024;
 const ALLOWED_EXTENSIONS = [".html", ".htm"];
 const ALLOWED_EXT = new Set(ALLOWED_EXTENSIONS);
+const ASSET_IMAGE_EXTENSIONS = [".png", ".jpg", ".jpeg", ".gif", ".webp", ".svg", ".avif"];
+const ASSET_IMAGE_EXT = new Set(ASSET_IMAGE_EXTENSIONS);
+const ASSET_CONTENT_TYPES = {
+    ".png": "image/png",
+    ".jpg": "image/jpeg",
+    ".jpeg": "image/jpeg",
+    ".gif": "image/gif",
+    ".webp": "image/webp",
+    ".svg": "image/svg+xml",
+    ".avif": "image/avif",
+};
+const ASSET_CONTENT_TYPE_EXT = {
+    "image/png": ".png",
+    "image/jpeg": ".jpg",
+    "image/gif": ".gif",
+    "image/webp": ".webp",
+    "image/svg+xml": ".svg",
+    "image/avif": ".avif",
+};
 const DISALLOWED_TOP_DIRECTORIES = [
     "public",
     ".next",
@@ -32,6 +52,9 @@ const EDITOR_BASE_URL_EXAMPLE = "http://localhost:<port>";
 function sha256(content) {
     return createHash("sha256").update(content).digest("hex");
 }
+function sha256Buffer(buf) {
+    return createHash("sha256").update(buf).digest("hex");
+}
 function generateSessionToken() {
     return randomBytes(32).toString("base64url");
 }
@@ -278,13 +301,13 @@ function validateWriteRequest(req, ctx, reqUrl) {
     return (req.headers["x-edit-slide-local"] === "1" ||
         req.headers["x-open-slide-local"] === "1");
 }
-async function readBody(req) {
+async function readBody(req, maxBytes = MAX_WRITE_BYTES) {
     const chunks = [];
     let total = 0;
     for await (const chunk of req) {
         const buf = Buffer.isBuffer(chunk) ? chunk : Buffer.from(chunk);
         total += buf.length;
-        if (total > MAX_WRITE_BYTES + 1024 * 1024) {
+        if (total > maxBytes + 1024 * 1024) {
             throw new Error("request body too large");
         }
         chunks.push(buf);
@@ -427,6 +450,182 @@ async function handlePost(ctx, req, res) {
         sendJson(res, 400, { error: error?.message || "write failed" });
     }
 }
+async function safeAssetPath(ctx, rel) {
+    if (typeof rel !== "string" || !rel) {
+        throw new Error("missing path");
+    }
+    const normalized = rel.replace(/^\/+/, "");
+    const abs = resolve(ctx.root, normalized);
+    if (abs !== ctx.root && !abs.startsWith(ctx.root + sep)) {
+        throw new Error("path escape");
+    }
+    const ext = extname(abs).toLowerCase();
+    if (!ASSET_IMAGE_EXT.has(ext)) {
+        throw new Error("only image files are allowed");
+    }
+    const real = await resolveReal(abs);
+    if (real !== ctx.root && !real.startsWith(ctx.root + sep)) {
+        throw new Error("path escape via symlink");
+    }
+    for (const candidate of [relative(ctx.root, abs), relative(ctx.root, real)]) {
+        const first = candidate.split(sep)[0];
+        if (DISALLOWED_TOP_DIRS.has(first)) {
+            throw new Error(`assets under ${first}/ are not allowed`);
+        }
+    }
+    return real;
+}
+function assetExt(name, contentType) {
+    const fromName = extname(String(name || "")).toLowerCase();
+    if (ASSET_IMAGE_EXT.has(fromName))
+        return fromName;
+    return ASSET_CONTENT_TYPE_EXT[String(contentType || "").toLowerCase()] || "";
+}
+function assetSlug(name) {
+    const base = String(name || "image").replace(/\.[^.]+$/, "");
+    const slug = base
+        .normalize("NFKD")
+        .replace(/[^\w.-]+/g, "-")
+        .replace(/^[-.]+|[-.]+$/g, "")
+        .toLowerCase();
+    return slug || "image";
+}
+function assetDirRel(scope, htmlDirRel) {
+    if (scope === "global")
+        return "assets";
+    return htmlDirRel ? join(htmlDirRel, "assets") : "assets";
+}
+async function readBytesOrNull(abs) {
+    try {
+        return await readFile(abs);
+    }
+    catch (error) {
+        if (error?.code === "ENOENT")
+            return null;
+        throw error;
+    }
+}
+function sendBinary(res, status, contentType, buf) {
+    res.statusCode = status;
+    res.setHeader("content-type", contentType);
+    res.setHeader("cache-control", "no-store");
+    res.setHeader("x-content-type-options", "nosniff");
+    res.setHeader("content-security-policy", "sandbox; default-src 'none'; style-src 'unsafe-inline'");
+    res.end(buf);
+}
+async function handleAssetGet(ctx, req, reqUrl, res) {
+    if (!validateBridgeRequest(req, ctx, reqUrl)) {
+        sendJson(res, 403, { error: "forbidden" });
+        return;
+    }
+    const file = reqUrl.searchParams.get("file") || "";
+    const htmlDirRel = file ? dirname(file) : "";
+    if (reqUrl.searchParams.get("list") === "1") {
+        const scope = reqUrl.searchParams.get("scope") === "global" ? "global" : "project";
+        const dirRel = assetDirRel(scope, htmlDirRel);
+        const absDir = resolve(ctx.root, dirRel);
+        const htmlDirAbs = resolve(ctx.root, htmlDirRel || ".");
+        let assets = [];
+        try {
+            if (absDir === ctx.root || absDir.startsWith(ctx.root + sep)) {
+                const names = await readdir(absDir);
+                assets = names
+                    .filter((name) => ASSET_IMAGE_EXT.has(extname(name).toLowerCase()))
+                    .map((name) => ({
+                    name,
+                    src: toPosixPath(relative(htmlDirAbs, join(absDir, name))),
+                }));
+            }
+        }
+        catch {
+            assets = [];
+        }
+        sendJson(res, 200, { assets, policy: buildPolicy(ctx) });
+        return;
+    }
+    const src = reqUrl.searchParams.get("src") || "";
+    if (!src) {
+        sendJson(res, 400, { error: "missing src" });
+        return;
+    }
+    try {
+        const abs = await safeAssetPath(ctx, join(htmlDirRel, src));
+        const buf = await readFile(abs);
+        const ext = extname(abs).toLowerCase();
+        sendBinary(res, 200, ASSET_CONTENT_TYPES[ext] || "application/octet-stream", buf);
+    }
+    catch (error) {
+        const message = error?.message || "read failed";
+        const status = message.includes("ENOENT") ? 404 : 400;
+        sendJson(res, status, { error: message });
+    }
+}
+async function handleAssetPost(ctx, req, res) {
+    const reqUrl = new URL(req.url || "/", `http://${req.headers.host || "127.0.0.1"}`);
+    if (!validateWriteRequest(req, ctx, reqUrl)) {
+        sendJson(res, 403, { error: "forbidden" });
+        return;
+    }
+    let body;
+    try {
+        body = JSON.parse(await readBody(req, MAX_ASSET_BYTES * 2));
+    }
+    catch (error) {
+        sendJson(res, 400, { error: error?.message || "invalid json" });
+        return;
+    }
+    const { file, scope: rawScope, name, contentType, dataBase64 } = body || {};
+    if (typeof dataBase64 !== "string" || !dataBase64) {
+        sendJson(res, 400, { error: "missing image data" });
+        return;
+    }
+    const buf = Buffer.from(dataBase64, "base64");
+    if (!buf.length) {
+        sendJson(res, 400, { error: "empty image data" });
+        return;
+    }
+    if (buf.length > MAX_ASSET_BYTES) {
+        sendJson(res, 413, { error: "image too large (>8MB)" });
+        return;
+    }
+    const ext = assetExt(name, contentType);
+    if (!ASSET_IMAGE_EXT.has(ext)) {
+        sendJson(res, 400, { error: "unsupported image type" });
+        return;
+    }
+    const scope = rawScope === "global" ? "global" : "project";
+    const htmlDirRel = typeof file === "string" && file ? dirname(file) : "";
+    const htmlDirAbs = resolve(ctx.root, htmlDirRel || ".");
+    const dirRel = assetDirRel(scope, htmlDirRel);
+    const slug = assetSlug(name);
+    try {
+        let fileName = `${slug}${ext}`;
+        let absTarget = await safeAssetPath(ctx, join(dirRel, fileName));
+        const existing = await readBytesOrNull(absTarget);
+        if (existing && !existing.equals(buf)) {
+            fileName = `${slug}-${sha256Buffer(buf).slice(0, 8)}${ext}`;
+            absTarget = await safeAssetPath(ctx, join(dirRel, fileName));
+        }
+        const alreadyIdentical = Boolean(existing && existing.equals(buf));
+        if (!alreadyIdentical) {
+            await mkdir(dirname(absTarget), { recursive: true });
+            await writeFile(absTarget, buf);
+        }
+        sendJson(res, 200, {
+            ok: true,
+            scope,
+            name: fileName,
+            path: toPosixPath(relative(ctx.root, absTarget)),
+            src: toPosixPath(relative(htmlDirAbs, absTarget)),
+            bytes: buf.length,
+            reused: alreadyIdentical,
+            policy: buildPolicy(ctx),
+        });
+    }
+    catch (error) {
+        sendJson(res, 400, { error: error?.message || "asset write failed" });
+    }
+}
 function createBridgeServer(ctx) {
     return createServer(async (req, res) => {
         if (!applyCors(req, res, ctx.editorOrigin))
@@ -445,6 +644,18 @@ function createBridgeServer(ctx) {
             sendJson(res, 200, { ok: true, service: "html2pptx edit bridge", root: ctx.root });
             return;
         }
+        if (reqUrl.pathname === "/api/edit-slide/asset") {
+            if (req.method === "GET") {
+                await handleAssetGet(ctx, req, reqUrl, res);
+                return;
+            }
+            if (req.method === "POST") {
+                await handleAssetPost(ctx, req, res);
+                return;
+            }
+            sendJson(res, 405, { error: "method not allowed" });
+            return;
+        }
         if (reqUrl.pathname !== "/api/edit-slide/file") {
             sendJson(res, 404, { error: "not found" });
             return;
@@ -506,24 +717,26 @@ function bail(message, options) {
     process.exit(1);
 }
 export async function editCommand(input, options = {}) {
+    const noOpen = options.noOpen === true || options.open === false;
+    const normalizedOptions = { ...options, noOpen };
     if (!input) {
-        bail("HTML file path is required. Example: html2pptx edit ./html2pptx/slides.html", options);
+        bail("HTML file path is required. Example: html2pptx edit ./html2pptx/slides.html", normalizedOptions);
     }
     const root = await realpath(process.cwd());
     const abs = resolve(root, input);
     const rel = relativeToRoot(root, abs);
     const ext = extname(abs).toLowerCase();
     if (!ALLOWED_EXT.has(ext)) {
-        bail("Only .html/.htm files can be opened in the editor.", options);
+        bail("Only .html/.htm files can be opened in the editor.", normalizedOptions);
     }
     if (abs !== root && !abs.startsWith(root + sep)) {
-        bail("The file must be inside the current working directory.", options);
+        bail("The file must be inside the current working directory.", normalizedOptions);
     }
     try {
         await stat(abs);
     }
     catch {
-        bail(`File not found: ${rel}`, options);
+        bail(`File not found: ${rel}`, normalizedOptions);
     }
     let baseUrl;
     let requestedPort;
@@ -532,7 +745,7 @@ export async function editCommand(input, options = {}) {
         requestedPort = parsePort(options.port);
     }
     catch (error) {
-        bail(error.message, options);
+        bail(error.message, normalizedOptions);
     }
     const ctx = {
         root,
@@ -550,7 +763,7 @@ export async function editCommand(input, options = {}) {
     }
     const bridgeUrl = `http://127.0.0.1:${bridgePort}`;
     const editorUrl = buildEditorUrl(baseUrl, rel, bridgeUrl, ctx.sessionToken);
-    if (options.json) {
+    if (normalizedOptions.json) {
         console.log(JSON.stringify({
             success: true,
             editorUrl: editorUrl.toString(),
@@ -562,7 +775,7 @@ export async function editCommand(input, options = {}) {
     }
     else {
         p.log.success(`Local edit bridge listening on ${pc.cyan(bridgeUrl)} ${pc.dim("(session token required)")}`);
-        if (options.noOpen) {
+        if (normalizedOptions.noOpen) {
             p.log.info(`Open in editor: ${pc.cyan(editorUrl.toString())}`);
         }
         else {
@@ -570,7 +783,7 @@ export async function editCommand(input, options = {}) {
         }
         p.log.info(pc.dim("Press Ctrl+C to stop the bridge."));
     }
-    if (!options.noOpen) {
+    if (!normalizedOptions.noOpen) {
         openUrl(editorUrl.toString());
     }
     stopOnSignal(server);

package/cli/dist/index.js

@@ -41,7 +41,7 @@ program
     .action(convertCommand);
 program
     .command("edit")
-    .description("Open a local HTML slide file in the localhost visual editor")
+    .description("Open a local slide HTML file in the html2pptx visual editor")
     .argument("<input>", "Path to HTML file")
     .option("--port <port>", "Local bridge port. Defaults to auto.")
     .option("--no-open", "Print the editor URL without opening a browser")

package/cli/package.json

@@ -1,6 +1,6 @@
 {
   "name": "html2pptx-cli",
-  "version": "0.4.2",
+  "version": "0.4.0",
   "description": "CLI tool to convert HTML/CSS to editable PowerPoint files via html2pptx.app",
   "type": "module",
   "bin": {

package/lib/local-slide-editor-launcher.js

@@ -21,11 +21,22 @@ export function createLocalSlideEditorManager(options = {}) {
 
   async function open(input = {}) {
     const file = await resolveEditableFile(input.filePath, rootCwd);
+    const reuseExisting = input.reuseExisting !== false;
+    if (reuseExisting) {
+      const existing = findReusableSession(file);
+      if (existing) {
+        return {
+          ...redactSessionForResponse(existing),
+          reused: true,
+        };
+      }
+    }
+
     const baseUrl = normalizeEditorBaseUrl(
       input.baseUrl || process.env.HTML2PPTX_EDITOR_BASE_URL || await readRegisteredEditorBaseUrl(file.root),
     );
     const port = normalizePort(input.port, 0);
-    const openBrowser = input.openBrowser !== false;
+    const openBrowser = input.openBrowser === true;
     const invocation = resolveCliInvocation(options);
     const childArgs = [
       ...invocation.baseArgs,
@@ -78,7 +89,25 @@ export function createLocalSlideEditorManager(options = {}) {
 
     const details = await waitForBridgeDetails(session, launchTimeoutMs);
     session.details = details;
-    return redactSessionForResponse(session);
+    return {
+      ...redactSessionForResponse(session),
+      reused: false,
+    };
+  }
+
+  function findReusableSession(file) {
+    for (const session of sessions.values()) {
+      if (
+        session.filePath === file.absolutePath &&
+        session.root === file.root &&
+        session.details &&
+        !session.child.killed &&
+        session.child.exitCode == null
+      ) {
+        return session;
+      }
+    }
+    return null;
   }
 
   async function stop(sessionId) {

package/lib/pptx-studio-mcp-core.js

@@ -416,7 +416,7 @@ export const LOCAL_TOOL_DEFINITIONS = [
     name: 'html2pptx_open_local_slide_editor',
     title: 'Open Local Slide Editor',
     description:
-      'Local stdio MCP only. Start the same localhost edit bridge used by `html2pptx edit` for a .html/.htm slide file inside the MCP server working directory, then return the tokenized editor URL. This does not publish or upload the HTML file.',
+      'Local stdio MCP only. Start the html2pptx CLI local edit bridge for a .html/.htm slide file inside the MCP server working directory, then return the tokenized editor URL. This does not publish or upload the HTML file.',
     inputSchema: {
       type: 'object',
       properties: {
@@ -437,7 +437,11 @@ export const LOCAL_TOOL_DEFINITIONS = [
         },
         openBrowser: {
           type: 'boolean',
-          description: 'When true (default), the CLI opens the editor in the browser. Set false to only return the URL.',
+          description: 'When true, open the editor in the browser. Defaults to false for MCP calls so agents can return one URL without spawning extra tabs.',
+        },
+        reuseExisting: {
+          type: 'boolean',
+          description: 'When true (default), reuse an active editor bridge for the same file instead of starting another bridge and browser tab.',
         },
       },
       required: ['filePath'],
@@ -595,7 +599,7 @@ function buildPromptMessages(name, args) {
               `3. Save the complete HTML document to a project-local .html file, preferably "${fileName}" or another clear path under html2pptx/.`,
               '4. Open only a loopback editor UI. First ensure the local editor app is running with node scripts/dev-studio.mjs; it will choose an available port and register the editor URL under .html2pptx/edit-slide/editor-server.json in the current project.',
               '5. Call html2pptx_open_local_slide_editor with { filePath: <path> }. Pass baseUrl only when the user supplied a specific loopback editor URL. Do not use https://html2pptx.app/edit-slide for local file editing.',
-              '6. If that local editor tool is not available, use direct `html2pptx edit <path>` when the local editor app is running, or ask the user to install the local MCP with: npx -y -p https://html2pptx.app/downloads/html2pptx-local-mcp-1.1.16.tgz html2pptx-install-mcp claude.',
+              '6. If that local editor tool is not available, do not pretend the editor was opened. Return the saved HTML path and the local-UI CLI fallback command: npx --yes https://html2pptx.app/downloads/html2pptx-cli-0.4.0.tgz edit <path>. If the CLI reports that the editor is not registered, start node scripts/dev-studio.mjs first.',
               '7. Do not export PPTX from this prompt. In the editor, the export button should only show a prompt telling the user to ask Claude Code or another agent to use the html2pptx skills for PowerPoint export.',
             ].join('\n'),
           },
@@ -647,7 +651,18 @@ export function negotiateProtocol(requestedProtocol) {
 }
 
 export function getToolDefinitions(client = {}, { localOnly = false } = {}) {
-  const tools = localOnly ? [] : [...TOOL_DEFINITIONS];
+  if (localOnly) {
+    const localTools = [];
+    if (typeof client.openLocalSlideEditor === 'function') {
+      localTools.push(LOCAL_TOOL_DEFINITIONS[0]);
+    }
+    if (typeof client.stopLocalSlideEditor === 'function') {
+      localTools.push(LOCAL_TOOL_DEFINITIONS[1]);
+    }
+    return localTools;
+  }
+
+  const tools = [...TOOL_DEFINITIONS];
   if (typeof client.openLocalSlideEditor === 'function') {
     tools.push(LOCAL_TOOL_DEFINITIONS[0]);
   }
@@ -660,12 +675,11 @@ export function getToolDefinitions(client = {}, { localOnly = false } = {}) {
 function buildServerInstructions(client = {}, { localOnly = false } = {}) {
   if (localOnly) {
     return [
-      'html2pptx local MCP opens local slide HTML in the loopback edit-slide visual editor.',
-      '',
-      'This server intentionally exposes only local editor tools. Use the remote html2pptx MCP server at https://html2pptx.app/mcp for PPTX exports, docs, usage, plans, templates, and publishing.',
-      '',
-      'When the user asks to open or visually edit local slides, save the deck as a project-local .html/.htm file and call html2pptx_open_local_slide_editor with { filePath: <path> }.',
-      'The tool starts a localhost bridge and does not publish or upload the HTML file.',
+      'html2pptx local MCP opens local slide HTML files in the no-code edit-slide editor.',
+      'Use this stdio server only for local visual editing. Use the remote html2pptx MCP server for PPTX export, docs, usage, templates, and publishing workflows.',
+      'When the user asks to open, preview, no-code edit, visually edit, or launch an editing screen for generated slides, save the deck as a local .html/.htm file first, usually under html2pptx/<name>.html.',
+      'Then call html2pptx_open_local_slide_editor with the project-relative file path.',
+      'The tool starts the html2pptx CLI localhost bridge and does not publish or upload the HTML file.',
     ].join('\n');
   }
 
@@ -715,11 +729,7 @@ function buildServerInstructions(client = {}, { localOnly = false } = {}) {
   return lines.join('\n');
 }
 
-export async function executeTool(name, args, client, { sendNotification, progressToken, localOnly = false } = {}) {
-  if (localOnly && !LOCAL_TOOL_DEFINITIONS.some((tool) => tool.name === name)) {
-    throw new Error(`${name} is available from the remote html2pptx MCP server, not the local stdio MCP server.`);
-  }
-
+export async function executeTool(name, args, client, { sendNotification, progressToken } = {}) {
   switch (name) {
     case 'html2pptx_list_export_plans': {
       const data = await client.listExportPlans();
@@ -902,7 +912,8 @@ export async function executeTool(name, args, client, { sendNotification, progre
         filePath: args.filePath,
         baseUrl: typeof args.baseUrl === 'string' ? args.baseUrl : undefined,
         port: Number.isFinite(args.port) ? args.port : undefined,
-        openBrowser: args.openBrowser !== false,
+        openBrowser: args.openBrowser === true,
+        reuseExisting: args.reuseExisting !== false,
       });
       return buildToolResponse(renderLocalSlideEditorText(data), data);
     }
@@ -919,7 +930,7 @@ export async function executeTool(name, args, client, { sendNotification, progre
   }
 }
 
-export async function handleMcpMessage(message, { protocolVersion = DEFAULT_PROTOCOL, client, sendNotification, localOnly = false, serverInfo = SERVER_INFO }) {
+export async function handleMcpMessage(message, { protocolVersion = DEFAULT_PROTOCOL, client, sendNotification, serverInfo = SERVER_INFO, localOnly = false }) {
   if (!message || typeof message !== 'object') {
     return { protocolVersion, response: null };
   }
@@ -1151,7 +1162,7 @@ export async function handleMcpMessage(message, { protocolVersion = DEFAULT_PROT
     try {
       const toolArgs = params?.arguments ?? {};
       const progressToken = toolArgs._meta?.progressToken ?? params?._meta?.progressToken;
-      const payload = await executeTool(params?.name, toolArgs, client, { sendNotification, progressToken, localOnly });
+      const payload = await executeTool(params?.name, toolArgs, client, { sendNotification, progressToken });
       return {
         protocolVersion,
         response: {
@@ -1438,7 +1449,7 @@ function renderAnimationCatalogText(catalog) {
 
 function renderLocalSlideEditorText(data) {
   const lines = [
-    '# Local slide editor started',
+    data.reused ? '# Local slide editor reused' : '# Local slide editor started',
     '',
     `File: ${data.file || 'unknown'}`,
     `Bridge: ${data.bridgeUrl || 'unknown'}`,

package/mcp/pptx-studio-mcp-server.mjs

@@ -13,7 +13,7 @@ import {
 
 let inputBuffer = Buffer.alloc(0);
 let negotiatedProtocol = DEFAULT_PROTOCOL;
-let outputFraming = 'lines';
+let wireMode = 'content-length';
 
 process.stdin.on('data', (chunk) => {
   inputBuffer = Buffer.concat([inputBuffer, chunk]);
@@ -36,16 +36,22 @@ process.stdout.on('error', (error) => {
 function drainMessages() {
   while (true) {
     const headerEnd = inputBuffer.indexOf('\r\n\r\n');
-    if (headerEnd === -1) {
-      const newlineEnd = inputBuffer.indexOf('\n');
-      if (newlineEnd === -1) return;
-      const rawLine = inputBuffer.slice(0, newlineEnd).toString('utf8').trim();
-      inputBuffer = inputBuffer.slice(newlineEnd + 1);
+    const lineEnd = inputBuffer.indexOf('\n');
+
+    if (headerEnd === -1 || (lineEnd !== -1 && lineEnd < headerEnd)) {
+      if (lineEnd === -1) return;
+
+      const rawLine = inputBuffer.slice(0, lineEnd).toString('utf8').trim();
+      inputBuffer = inputBuffer.slice(lineEnd + 1);
       if (!rawLine) continue;
+
+      wireMode = 'line';
       handleRawMessage(rawLine);
       continue;
     }
 
+    wireMode = 'content-length';
+
     const headerText = inputBuffer.slice(0, headerEnd).toString('utf8');
     const contentLengthMatch = headerText.match(/Content-Length:\s*(\d+)/i);
     if (!contentLengthMatch) {
@@ -60,7 +66,6 @@ function drainMessages() {
 
     const rawBody = inputBuffer.slice(headerEnd + 4, messageEnd).toString('utf8');
     inputBuffer = inputBuffer.slice(messageEnd);
-    outputFraming = 'headers';
 
     handleRawMessage(rawBody);
   }
@@ -85,6 +90,35 @@ function handleRawMessage(rawBody) {
 
 async function handleMessage(message) {
   const client = {
+    listExportPlans: async () => requestJson('/api/export/plans'),
+    createExportJob: async (body) =>
+      requestJson('/api/export/jobs', {
+        method: 'POST',
+        requireApiKey: true,
+        body,
+      }),
+    getExportJob: async (jobId) =>
+      requestJson(`/api/export/jobs/${encodeURIComponent(jobId)}`, {
+        requireApiKey: true,
+      }),
+    getUsage: async () =>
+      requestJson('/api/export/usage', {
+        requireApiKey: true,
+      }),
+    listTemplates: async (category) => {
+      const url = category
+        ? `/api/templates?category=${encodeURIComponent(category)}`
+        : '/api/templates';
+      // requireApiKey so the API is treated as authenticated and returns
+      // template prompts (anonymous requests get hasPrompt boolean only).
+      return requestJson(url, { requireApiKey: true });
+    },
+    getTemplateHtml: async (templateId) =>
+      requestJson(`/api/templates/html?id=${encodeURIComponent(templateId)}`, {
+        // /api/templates/html now requires auth (browser session, API key,
+        // or WorkOS JWT) so anonymous curl/browser can't scrape prompts.
+        requireApiKey: true,
+      }),
     openLocalSlideEditor: async (args) => localSlideEditorManager.open(args),
     stopLocalSlideEditor: async (sessionId) => localSlideEditorManager.stop(sessionId),
   };
@@ -92,11 +126,11 @@ async function handleMessage(message) {
   const handled = await handleMcpMessage(message, {
     protocolVersion: negotiatedProtocol,
     client,
-    localOnly: true,
     serverInfo: {
       ...SERVER_INFO,
       name: 'html2pptx-local',
     },
+    localOnly: true,
     sendNotification: (notification) => {
       sendMessage(notification);
     },
@@ -182,13 +216,14 @@ function sendError(id, code, message) {
 
 function sendMessage(message) {
   const json = JSON.stringify(message);
-  if (outputFraming === 'headers') {
-    const headers = `Content-Length: ${Buffer.byteLength(json, 'utf8')}\r\nContent-Type: application/json\r\n\r\n`;
-    process.stdout.write(headers);
-    process.stdout.write(json);
+  if (wireMode === 'line') {
+    process.stdout.write(`${json}\n`);
     return;
   }
-  process.stdout.write(`${json}\n`);
+
+  const headers = `Content-Length: ${Buffer.byteLength(json, 'utf8')}\r\n\r\n`;
+  process.stdout.write(headers);
+  process.stdout.write(json);
 }
 
 function logError(context, error) {

package/package.json

@@ -1,11 +1,12 @@
 {
   "name": "html2pptx-local-mcp",
-  "version": "1.1.18",
+  "version": "1.1.20",
   "type": "module",
   "description": "Local stdio MCP server for opening html2pptx slide HTML in the local edit-slide editor.",
   "bin": {
     "html2pptx-mcp": "./mcp/pptx-studio-mcp-server.mjs",
-    "html2pptx-install-mcp": "./scripts/install-mcp.mjs"
+    "html2pptx-install-mcp": "./scripts/install-mcp.mjs",
+    "html2pptx-comments": "./scripts/extract-html2pptx-comments.mjs"
   },
   "files": [
     "app/docs/content.js",
@@ -16,6 +17,7 @@
     "lib/server/template-html-policy.mjs",
     "mcp/pptx-studio-mcp-server.mjs",
     "scripts/install-mcp.mjs",
+    "scripts/extract-html2pptx-comments.mjs",
     "src/animation-injector.js",
     "src/animation-renderers.js"
   ],