keyshot-mcp 0.13.0 → 0.13.5

package/CHANGELOG.md

@@ -4,6 +4,88 @@ All notable changes to KeyShot MCP are documented in this file.
 
 ## [Unreleased]
 
+## [0.13.5] - 2026-10-20
+
+### Installation and Diagnostics / 安装与诊断
+
+- Isolate each bridge request in a private temporary subdirectory, clean it after execution, and return structured failures for local filesystem errors. Preserve completed diagnostic checks when startup throws; check temporary storage before launching KeyShot.
+- 每次桥接请求使用独立临时子目录并在执行后清理；本地文件系统出错时返回结构化结果。启动抛异常时保留已完成的诊断，并在启动 KeyShot 前检查临时目录。
+
+- Store bridge request/result files in the system temporary directory instead of the installed package, avoiding Windows path-length failures in nested installations.
+- 将桥接请求与结果文件移到系统临时目录，避免 Windows 嵌套安装路径过长导致 KeyShot 无法写回结果。
+
+### Publication Privacy / 发布隐私
+
+- Add a redacted public-content check to CI and publication, including credential
+  patterns, private paths, file names and PNG metadata. Reject unreviewed binary
+  assets; extend ignore rules for local environment, credential, scene and license files.
+- 为 CI 与发布流程增加脱敏的公开内容检查，覆盖疑似凭据、私人路径、文件名及 PNG 元数据；
+  拦截未经复核的二进制素材，补全本地环境、凭据、场景和许可证文件忽略规则。
+- Bound preview file reads before allocation and while reading, reject special-file
+  output destinations, and check case variants and malformed PNG metadata containers.
+- 预览读取在分配内存前和读取过程中均限制大小，拒绝特殊文件输出目标，并补查文件名
+  大小写变体及损坏的 PNG 元数据容器。
+
+### Output Safety / 输出安全
+
+- Apply default no-overwrite protection to single renders, queued jobs, imports,
+  scene edits and saves. Add optional `overwrite` to low-level writing tools without
+  renaming tools or removing inputs. Declared input files and linked aliases remain
+  protected even with overwrite enabled; scene and image outputs must be distinct.
+- 将默认不覆盖保护统一到单张渲染、队列、导入、场景编辑与保存。底层写入工具增加可选
+  `overwrite`，不改工具名称或删除参数；即使允许覆盖，也不能替换本次声明的输入文件及其
+  链接别名，场景与图片不能写入同一文件。
+- Recheck every generated camera output inside the bridge, protect every queue input,
+  disambiguate selected-camera filenames and avoid deleting rejected preview outputs.
+- bridge 在逐相机写入前重新检查路径，保护整个队列的输入场景，为清理后同名的指定相机
+  生成不同文件名，并避免误删被拒绝的预览输出。
+
+### Documentation / 文档
+
+- Clarify the roles of the MCP client's Agent, client configuration and model provider in privacy notices; distinguish client-managed transmission from the local KeyShot MCP service.
+- 明确隐私提示中 MCP 客户端 Agent、客户端配置与模型服务的职责，区分客户端处理的数据传输与本机 KeyShot MCP 服务。
+
+## [0.13.1] - 2026-10-15
+
+### Release Safety / 发布安全
+
+- Validate bilingual release notes, built runtime version and current comparison links before npm publication. Block the release workflow while documentation still marks the version as pending. Add a bilingual 1.0 readiness checklist; external client and user validation remain pending.
+- 在 npm 发布前校验双语更新说明、构建版本和当前比较链接；文档仍标记待发布时阻止正式发布。增加双语 1.0 验收清单，客户端及外部用户验证仍待完成。
+- Add an opt-in material smoke test using generated geometry, an unsupported Wavefront MTL fixture, preset assignments, saved-scene reinspection, invalid-name rejection and source-file hashes. A native KeyShot material file can be tested locally without bundling it.
+- 增加可选材质实机测试，覆盖生成模型、不支持的 Wavefront MTL、预设赋值、保存后复查、错误名称拒绝及源文件哈希保护。可在本地验证 KeyShot 原生材质文件，不随包分发。
+- Classify empty/unsupported material-file loads as `MATERIAL_FILE_INVALID` and explain the difference between KeyShot native MTL and Wavefront companion files.
+- 将空加载或不支持的材质文件归类为 `MATERIAL_FILE_INVALID`，解释 KeyShot 原生 MTL 与 OBJ 配套 Wavefront 文件的区别。
+
+### Documentation / 文档
+
+- Restore TypeScript and M8ven header badges, preset guidance, import-only and lens/environment examples, task serialization and early privacy reminders after auditing the README redesign.
+- 核对改版前后内容，补回 TypeScript、M8ven 徽章，预设说明、仅导入及镜头/环境示例、任务串行说明，并前置隐私提醒。
+
+- Add a bilingual request-to-render diagram with desktop and mobile layouts, using an object-level material change as the example.
+- 增加中英文“一句话到出图”流程图，适配桌面和手机，以指定对象的材质替换说明预览、确认和输出流程。
+
+### Changed / 变更
+
+- Reorganize the bilingual README around designer setup, saved-scene workflows and
+  a real component-material comparison. Replace the cube showcase with credited
+  local renders of a Poly Haven CC0 lantern, retain the cube as a test fixture,
+  and document reproduction and GUI boundaries separately. Add documentation,
+  navigation, installation JSON and demo-image checks.
+  围绕设计师安装、已保存场景流程与真实材质对比重整双语 README；展示改用注明来源的
+  Poly Haven CC0 灯具实测图，立方体仅保留为测试夹具。独立补充复现与 GUI 边界说明，
+  增加文档链接、导航、安装 JSON 和演示图片检查。
+
+### Fixed / 修复
+
+- Verify material names and actual object assignments before reporting success.
+  Load single-material MTL files with KeyShot's in-project `loadMaterials` API;
+  reject empty or ambiguous loads instead of treating file paths as material names.
+  Correct the default clear-glass and matte-black-plastic library references while
+  retaining existing preset labels. Add structured material error guidance.
+  返回成功前校验材质名称与对象的实际材质；通过 KeyShot 的 `loadMaterials` 在场景内
+  加载单材质 MTL 文件，空加载或多材质文件明确报错，不再把路径当成材质名称。
+  保留预设名称，修正默认透明玻璃与哑光黑色塑料的材质库引用，并补充结构化修复建议。
+
 ## [0.13.0] - 2026-09-30
 
 ### Added / 新增
@@ -102,7 +184,10 @@ All notable changes to KeyShot MCP are documented in this file.
 
 - Documented that scene metadata and preview images may be sent by an MCP client to its configured model provider.
 
-[Unreleased]: https://github.com/truman-t3/keyshot-mcp/compare/v0.12.1...HEAD
+[Unreleased]: https://github.com/truman-t3/keyshot-mcp/compare/v0.13.5...HEAD
+[0.13.5]: https://github.com/truman-t3/keyshot-mcp/compare/v0.13.1...v0.13.5
+[0.13.1]: https://github.com/truman-t3/keyshot-mcp/compare/v0.13.0...v0.13.1
+[0.13.0]: https://github.com/truman-t3/keyshot-mcp/compare/v0.12.1...v0.13.0
 [0.12.1]: https://github.com/truman-t3/keyshot-mcp/compare/v0.12.0...v0.12.1
 [0.12.0]: https://github.com/truman-t3/keyshot-mcp/compare/v0.11.0...v0.12.0
 [0.11.0]: https://github.com/truman-t3/keyshot-mcp/compare/v0.10.0...v0.11.0

package/CONTRIBUTING.md

@@ -22,6 +22,7 @@ Requirements: Node.js 20 or newer, pnpm 10, and Python 3.11 or newer.
 ```bash
 pnpm install --frozen-lockfile
 pnpm run check
+pnpm run check:public-safety
 pnpm test
 python -m unittest discover -s tests -p "test_*.py"
 pnpm run format:check
@@ -33,6 +34,15 @@ npm pack --dry-run
 
 Run `pnpm run smoke:keyshot` only on a computer with a supported, licensed KeyShot
 installation. Record the KeyShot version and operating system in the pull request.
+Run `pnpm run smoke:keyshot:materials` to verify preset assignments, saved-scene
+reinspection, invalid-name rejection and an unsupported Wavefront MTL fixture.
+Optionally pass `--material-file "<native KeyShot MTL>"` to test a trusted local
+single-material file. The native file is read only, never copied into the repository.
+Tests use generated geometry and a new output subfolder, not user scenes.
+Run `pnpm run smoke:keyshot:outputs` to check existing-file rejection, source hashes,
+explicit replacement of a distinct copy and PNG output in a new test subfolder.
+Use a fresh `KEYSHOT_OUTPUT_DIR` when repeating the full smoke test, which uses fixed names.
+`pnpm docs:tools` also synchronizes the platform manifest's input schemas.
 CI on Linux validates the MCP and bridge logic; it does not verify KeyShot itself.
 
 ### Pull requests
@@ -49,6 +59,9 @@ Never include proprietary KeyShot scenes, license data, customer assets, credent
 private paths, or unpublished renders in Issues, Discussions, commits, or pull requests.
 Report vulnerabilities through GitHub's private security reporting form.
 
+Use a GitHub no-reply commit email. Check filenames and image metadata as well as
+visible content; new public images require review in `scripts/check-public-safety.mjs`.
+
 ## 中文
 
 欢迎设计师、开发者、技术美术和测试人员参与。比较有价值的贡献包括：
@@ -69,6 +82,7 @@ Report vulnerabilities through GitHub's private security reporting form.
 ```bash
 pnpm install --frozen-lockfile
 pnpm run check
+pnpm run check:public-safety
 pnpm test
 python -m unittest discover -s tests -p "test_*.py"
 pnpm run format:check
@@ -81,6 +95,12 @@ npm pack --dry-run
 只有在本机已安装并合法授权 KeyShot 时才运行 `pnpm run smoke:keyshot`，并在 PR 中
 注明操作系统和 KeyShot 版本。Linux CI 只验证 MCP 与 Bridge 逻辑，不代表已经实测
 KeyShot。
+运行 `pnpm run smoke:keyshot:materials` 可验证材质预设、保存后复查、无效名称及不支持的
+Wavefront MTL 拒绝；可选传入 `--material-file "<KeyShot 原生 MTL>"` 检查可信本地单材质文件。
+原生文件只读，不复制进仓库；测试仅使用生成模型和新输出子目录，不覆盖用户场景。
+运行 `pnpm run smoke:keyshot:outputs` 可验证重名拒绝、源文件哈希、明确覆盖另一份副本及
+PNG 输出，文件保存在新测试子目录。完整 smoke 使用固定文件名，重复运行时请设置新的
+`KEYSHOT_OUTPUT_DIR`。`pnpm docs:tools` 同时同步平台清单中的输入 Schema。
 
 ### Pull Request
 
@@ -92,3 +112,6 @@ KeyShot。
 
 不要在 Issue、Discussion、提交或 PR 中包含专有 KeyShot 场景、许可证数据、客户资产、
 账号凭据、私人路径或未公开渲染图。安全漏洞请通过 GitHub 私密安全报告提交。
+
+提交使用 GitHub no-reply 邮箱；除可见内容外，也检查文件名和图片元数据。
+新增公开图片需要在 `scripts/check-public-safety.mjs` 中完成复核登记。