webflow-mcp 0.3.0

package/dist/src/worker/worker-service.js

@@ -0,0 +1,258 @@
+import { FlowRunner } from '../runner/flow-runner.js';
+import { discoverFlows, loadFlowModule } from '../runner/flow-loader.js';
+import { getProfileStatus, markInteractiveSetup, markLoginRequired } from '../profiles/profile-state.js';
+import { launchBrowserSession } from '../runner/browser-session.js';
+import { readJsonFile } from '../shared/fs.js';
+import { WebFlowError } from '../shared/errors.js';
+import { sanitizeName } from '../shared/paths.js';
+import { translateSchema } from '../schema/translator.js';
+import { loadConfig, setDefaultBrowserMode, setDefaultBrowserVisibility, setFlowBrowserMode, setFlowBrowserVisibility } from '../config/webflow-config.js';
+import { addToRepertoire, listRepertoire, removeFromRepertoire } from '../repertoire/local-repertoire.js';
+import { assessAndRecordPending } from '../security/flow-approvals.js';
+import { isVerifiedRemoteFlow } from '../security/flow-release.js';
+function defaultBrowserModeFromCapability(capability) {
+    if (capability === 'cdp')
+        return 'cdp';
+    if (capability === 'managed' || capability === true)
+        return 'managed';
+    return undefined;
+}
+function flowSupportedBrowserModes(capability, declared) {
+    if (declared && declared.length > 0)
+        return [...new Set(declared)];
+    const fallback = defaultBrowserModeFromCapability(capability);
+    return fallback ? [fallback] : undefined;
+}
+/**
+ * Local, network-agnostic execution surface for the worker transport (RFC 0001,
+ * Fase 0/1). Delegates every bit of actual execution to the existing
+ * FlowRunner/discoverFlows — this class only adds catalog building, a per-profile
+ * lock, and a login pre-check, none of which existed before because a single stdio
+ * client never called runFlow twice concurrently and always ran with a human at the
+ * keyboard to notice a login wall.
+ */
+export class WorkerService {
+    projectRoot;
+    runner;
+    headed;
+    browserMode;
+    browserVisibility;
+    flowsByName = new Map();
+    loginMetaByName = new Map();
+    locks = new Map();
+    constructor(projectRoot, options = {}) {
+        this.projectRoot = projectRoot;
+        this.runner = options.runner ?? new FlowRunner(projectRoot);
+        this.headed = options.headed;
+        this.browserMode = options.browserMode;
+        this.browserVisibility = options.browserVisibility;
+    }
+    /**
+     * Discovers flows, compiles their schemas, and loads each flow module once to read
+     * its `capabilities` (requiresLogin/profile). Refreshes the internal catalog used by
+     * runFlow(). Call again after reconnecting to a relay so a stale catalog (e.g. a flow
+     * removed from disk) never lingers (RFC 0001, section 2.3: reconnection resends the
+     * full catalog; the relay overwrites, never merges).
+     */
+    async buildCatalog() {
+        const { flows } = await discoverFlows(this.projectRoot);
+        this.flowsByName = new Map(flows.map((flow) => [flow.name, flow]));
+        this.loginMetaByName = new Map();
+        const entries = [];
+        for (const flow of flows) {
+            const compiled = translateSchema(await readJsonFile(flow.schemaFile));
+            const module = await loadFlowModule(flow.entryFile);
+            const meta = {
+                requiresLogin: module.capabilities?.requiresLogin ?? false,
+                loginProvider: module.capabilities?.profile,
+                loginUrl: module.capabilities?.startUrl && module.capabilities.startUrl !== 'about:blank' ? module.capabilities.startUrl : undefined
+            };
+            this.loginMetaByName.set(flow.name, meta);
+            entries.push({
+                name: flow.name,
+                description: compiled.jsonSchema.description ?? `Run the ${flow.name} flow.`,
+                inputSchema: compiled.jsonSchema,
+                requiresLogin: meta.requiresLogin,
+                loginProvider: meta.loginProvider,
+                loginUrl: meta.loginUrl,
+                defaultBrowserMode: defaultBrowserModeFromCapability(module.capabilities?.browser),
+                supportedBrowserModes: flowSupportedBrowserModes(module.capabilities?.browser, module.capabilities?.supportedBrowserModes)
+            });
+        }
+        return entries;
+    }
+    /**
+     * Runs a flow by name against the catalog built by buildCatalog(). Two safety nets
+     * that a single local stdio client never needed:
+     *
+     * 1. Login pre-check: if the flow declares `requiresLogin: true` and its resolved
+     *    profile directory does not exist yet, fails fast with a `LOGIN_REQUIRED` error
+     *    instead of letting Playwright launch a fresh, unauthenticated Chrome and time
+     *    out minutes later on a login wall with a confusing generic error.
+     * 2. Per-profile lock: serializes concurrent calls that resolve to the same profile
+     *    so two jobs never race to launch Chrome against the same user-data-dir (one
+     *    userDataDir = one process at a time; see modules/sessions-y-profiles.md).
+     */
+    async runFlow(name, input, options) {
+        const flow = this.flowsByName.get(name);
+        if (!flow) {
+            throw new WebFlowError('FLOW_NOT_FOUND', `No flow named "${name}" in this worker's catalog. Call buildCatalog() first, or the flow may have been removed.`, { flow: name });
+        }
+        const meta = this.loginMetaByName.get(name);
+        const profileName = this.resolveProfileName(input, options?.profileName, meta?.loginProvider, flow.name);
+        if (meta?.requiresLogin) {
+            const profile = await this.runner.profileManager.resolve(profileName, flow.name);
+            const status = await getProfileStatus(profile, { loginUrl: meta.loginUrl });
+            if (status.probablyValid === false) {
+                if (status.status === 'missing') {
+                    await markLoginRequired(profile, name);
+                }
+                throw new WebFlowError('LOGIN_REQUIRED', `Flow "${name}" requires a logged-in session for profile "${profile.id}", but none was found. Run "${status.setupCommand}" on this machine first.`, { flow: name, profile: profile.id, profileStatus: status.status, loginUrl: meta.loginUrl, setupCommand: status.setupCommand });
+            }
+        }
+        const runOptions = {
+            ...options,
+            headed: options?.headed ?? this.headed,
+            browserMode: options?.browserMode ?? this.browserMode,
+            browserVisibility: options?.browserVisibility ?? this.browserVisibility
+        };
+        const runPromise = this.enqueue(profileName, () => this.runner.run(flow, input, runOptions));
+        return runPromise;
+    }
+    /**
+     * Runs a flow whose code the relay pushed alongside the job (RFC 0001, Fase 3) —
+     * there is no local flow definition to look up at all, by design: nothing, paid or
+     * free, is meant to persist on this machine. Reuses the same login pre-check and
+     * per-profile lock as runFlow(); only where the module comes from differs.
+     */
+    async runVerifiedRemoteFlow(verified, input, options) {
+        if (!isVerifiedRemoteFlow(verified)) {
+            throw new WebFlowError('UNVERIFIED_REMOTE_FLOW', 'Remote flow execution requires a cryptographically verified release.');
+        }
+        const assertApproved = async () => {
+            const approval = await assessAndRecordPending(verified);
+            if (approval.status === 'pending') {
+                throw new WebFlowError('FLOW_UPDATE_APPROVAL_REQUIRED', `Flow "${verified.flowName}" version ${verified.version} is signed but needs local approval before it can run.`, {
+                    flow: verified.flowName,
+                    flowDigest: verified.flowDigest,
+                    releaseId: verified.releaseId,
+                    releaseVersion: verified.version,
+                    releaseSequence: verified.sequence,
+                    signerKeyId: verified.keyId,
+                    trustDomain: verified.trustDomain,
+                    setupCommand: `webflow approvals approve ${verified.flowName}`
+                });
+            }
+        };
+        await assertApproved();
+        const capabilities = verified.capabilities;
+        const flowName = verified.flowName;
+        const loginProvider = typeof capabilities.profile === 'string' ? capabilities.profile : undefined;
+        const loginUrl = typeof capabilities.startUrl === 'string' && capabilities.startUrl !== 'about:blank' ? capabilities.startUrl : undefined;
+        const profileName = this.resolveProfileName(input, undefined, loginProvider, flowName);
+        if (capabilities.requiresLogin) {
+            const profile = await this.runner.profileManager.resolve(profileName, flowName);
+            const status = await getProfileStatus(profile, { loginUrl });
+            if (status.probablyValid === false) {
+                if (status.status === 'missing') {
+                    await markLoginRequired(profile, flowName);
+                }
+                throw new WebFlowError('LOGIN_REQUIRED', `Flow "${flowName}" requires a logged-in session for profile "${profile.id}", but none was found. Run "${status.setupCommand}" on this machine first.`, { flow: flowName, profile: profile.id, profileStatus: status.status, loginUrl, setupCommand: status.setupCommand });
+            }
+        }
+        const runOptions = {
+            ...options,
+            profileName,
+            headed: options?.headed ?? this.headed,
+            browserMode: options?.browserMode ?? this.browserMode,
+            browserVisibility: options?.browserVisibility ?? this.browserVisibility
+        };
+        return this.enqueue(profileName, async () => {
+            await assertApproved();
+            return this.runner.runRemote(flowName, verified.code, verified.schema, input, runOptions, capabilities);
+        });
+    }
+    /**
+     * Config/repertoire are worker-local disk state (~/.webflow/config.json,
+     * ~/.webflow/repertoire.json) — never the relay's database, same principle as
+     * login sessions/profiles. These are the only entry points the relay's forwarded
+     * config_request/repertoire_request messages call into (see connection.ts). Reuse
+     * the same enqueue() lock used for flow runs, under fixed keys, so two concurrent
+     * requests never race writing the same file.
+     */
+    async getConfig() {
+        return this.enqueue('config', () => loadConfig());
+    }
+    async setDefaultBrowserVisibility(value) {
+        return this.enqueue('config', () => setDefaultBrowserVisibility(value));
+    }
+    async setFlowBrowserVisibility(flowName, value) {
+        return this.enqueue('config', () => setFlowBrowserVisibility(flowName, value));
+    }
+    async setDefaultBrowserMode(value) {
+        return this.enqueue('config', () => setDefaultBrowserMode(value));
+    }
+    async setFlowBrowserMode(flowName, value) {
+        return this.enqueue('config', () => setFlowBrowserMode(flowName, value));
+    }
+    async listRepertoire() {
+        return this.enqueue('repertoire', () => listRepertoire());
+    }
+    /** Fast, read-only disk check — same status a running flow would see before deciding LOGIN_REQUIRED. */
+    async checkProfileStatus(flowName, loginProvider, loginUrl) {
+        const profile = await this.runner.profileManager.resolve(loginProvider, flowName);
+        return getProfileStatus(profile, { loginUrl });
+    }
+    /**
+     * Opens a real, visible Chrome window on this machine for the human to log in
+     * manually, then returns as soon as the window is up — it does not wait for them
+     * to finish (that can take minutes, far too long for an MCP tool call). The
+     * per-profile lock (same one runFlow/runRemoteFlow use) is still held for the full
+     * session in the background, so an automated run against this profile can't start
+     * mid-login; call checkProfileStatus afterward to see whether it succeeded.
+     */
+    async startProfileLogin(flowName, loginProvider, loginUrl) {
+        const profile = await this.runner.profileManager.ensure(loginProvider, flowName);
+        const launched = new Promise((resolveLaunch, rejectLaunch) => {
+            const backgroundTask = this.enqueue(profile.id, async () => {
+                const session = await launchBrowserSession({ userDataDir: profile.dir, headless: false, startUrl: loginUrl });
+                resolveLaunch();
+                await new Promise((done) => session.context.once('close', () => done()));
+                await markInteractiveSetup(profile, flowName);
+            });
+            backgroundTask.catch(rejectLaunch);
+        });
+        await launched;
+        return getProfileStatus(profile, { loginUrl });
+    }
+    async addToRepertoire(flowName) {
+        return this.enqueue('repertoire', () => addToRepertoire(flowName));
+    }
+    async removeFromRepertoire(flowName) {
+        return this.enqueue('repertoire', () => removeFromRepertoire(flowName));
+    }
+    enqueue(lockKey, task) {
+        const key = sanitizeName(lockKey);
+        const previous = this.locks.get(key) ?? Promise.resolve();
+        const next = previous.catch(() => undefined).then(task);
+        this.locks.set(key, next);
+        return next.finally(() => {
+            if (this.locks.get(key) === next) {
+                this.locks.delete(key);
+            }
+        });
+    }
+    resolveProfileName(input, profileNameOverride, loginProvider, flowName) {
+        const inputProfile = input?.profile;
+        if (profileNameOverride) {
+            return profileNameOverride;
+        }
+        if (typeof inputProfile === 'string' && inputProfile.length > 0) {
+            return inputProfile;
+        }
+        if (loginProvider) {
+            return loginProvider;
+        }
+        return `${flowName}-default`;
+    }
+}

package/package.json

@@ -0,0 +1,50 @@
+{
+  "name": "webflow-mcp",
+  "version": "0.3.0",
+  "description": "WebFlow MCP MVP with local flow workspaces and MCP tool exposure",
+  "license": "UNLICENSED",
+  "type": "module",
+  "bin": {
+    "webflow": "dist/src/cli/index.js",
+    "webflow-mcp": "dist/src/mcp/cli.js"
+  },
+  "files": [
+    "dist/src/",
+    ".webflow/flows/_template/",
+    ".webflow/skills/",
+    "taxonomy.json",
+    "README.md",
+    "package.json"
+  ],
+  "engines": {
+    "node": ">=20"
+  },
+  "scripts": {
+    "build": "tsc -p tsconfig.json",
+    "prepublishOnly": "npm run build",
+    "pretest": "node scripts/link-local-flows.mjs",
+    "docs:check": "node scripts/check-project-context.mjs",
+    "test": "vitest run",
+    "flows:keys:init": "tsx scripts/flows-keys-init.ts",
+    "flows:release": "tsx scripts/flows-release.ts",
+    "flows:verify": "tsx scripts/verify-official-flow-release.ts",
+    "smoke": "npm run build && node --import tsx tests/packaging-smoke.ts && vitest run tests/mcp-server.test.ts tests/mvp-smoke.test.ts",
+    "mcp": "node dist/src/mcp/cli.js"
+  },
+  "dependencies": {
+    "@modelcontextprotocol/sdk": "^1.29.0",
+    "playwright-core": "^1.61.1",
+    "ws": "^8.21.0",
+    "zod": "^3.24.3"
+  },
+  "optionalDependencies": {
+    "esbuild": "^0.25.3"
+  },
+  "devDependencies": {
+    "@types/node": "^22.15.17",
+    "@types/ws": "^8.18.1",
+    "tsx": "^4.23.0",
+    "typescript": "^5.8.3",
+    "vitest": "^3.1.1"
+  }
+}

package/taxonomy.json

@@ -0,0 +1,99 @@
+{
+  "sectors": {
+    "productividad-e-ia": {
+      "label": "Productividad e IA",
+      "services": {
+        "chatgpt": { "label": "ChatGPT", "description": "Conversación de texto, generación de imágenes e investigación profunda vía sesión de cuenta persistente." },
+        "gemini": { "label": "Gemini", "description": "Conversación de texto, generación de imágenes, vídeo e investigación profunda vía sesión de cuenta persistente." },
+        "google-ai-studio": { "label": "Google AI Studio", "description": "Generación de audio (texto a voz)." },
+        "adobe-express": { "label": "Adobe Express", "description": "Sincronización de labios entre audio y vídeo." }
+      }
+    },
+    "redes-sociales": {
+      "label": "Redes Sociales",
+      "services": {
+        "twitter": { "label": "Twitter / X", "description": "Navegación progresiva de perfiles, timelines, respuestas, multimedia y búsqueda mediante sesión persistente." },
+        "reddit": { "label": "Reddit", "description": "Navegación pública progresiva de búsqueda, comunidades, posts y comentarios acotados, sin sesión." }
+      }
+    },
+    "investigacion-academica": {
+      "label": "Investigación Académica",
+      "services": {
+        "arxiv": { "label": "arXiv", "description": "Búsqueda y descarga de artículos científicos publicados, sin sesión." },
+        "nature": { "label": "Nature", "description": "Investigación progresiva: búsqueda relevante, metadatos e índice, lectura acotada y descarga completa vía sesión persistente." },
+        "pubmed": { "label": "PubMed", "description": "Búsqueda e inspección progresiva de literatura biomédica, abstracts, términos MeSH, artículos relacionados y texto disponible en PubMed Central." }
+      }
+    },
+    "financiero": {
+      "label": "Financiero",
+      "services": {
+        "yahoo-finance": { "label": "Yahoo Finance", "description": "Navegación progresiva por búsqueda, cotizaciones, noticias, análisis, estadísticas, estados financieros, históricos, opciones, holders y perfiles públicos." },
+        "finviz": { "label": "Finviz", "description": "Operaciones públicas de insiders, actividad reciente y enlaces a filings SEC." },
+        "dailyfx": { "label": "DailyFX", "description": "Calendario macroeconómico por período, impacto, país y texto, con datos reales, previstos y anteriores." },
+        "sec-edgar": { "label": "SEC EDGAR", "description": "Filings corporativos oficiales, índices, documentos principales, anexos y archivos XBRL publicados ante la SEC." },
+        "companies-house": { "label": "Companies House", "description": "Registro público británico de empresas, administradores, secretarios y presentaciones corporativas." }
+      }
+    },
+    "software-y-desarrollo": {
+      "label": "Software y Desarrollo",
+      "services": {
+        "official-docs": { "label": "Official Documentation Sites", "description": "Exploración, lectura por secciones, descarga selectiva y búsqueda textual local de documentación técnica pública." },
+        "github": { "label": "GitHub", "description": "Navegación pública progresiva de repositorios, código visible, issues, pull requests, releases, perfiles y trending." },
+        "hugging-face": { "label": "Hugging Face", "description": "Búsqueda y colección progresiva de modelos con filtros visibles, datasets, Spaces, papers diarios, cards y archivos textuales seleccionados." },
+        "stack-overflow": { "label": "Stack Overflow", "description": "Navegación pública progresiva de preguntas, respuestas, comentarios, etiquetas y búsquedas." },
+        "npm": { "label": "npm", "description": "Navegación pública progresiva de paquetes, README, versiones, dependencias, metadatos y procedencia." },
+        "pypi": { "label": "PyPI", "description": "Navegación pública progresiva de paquetes Python, releases, archivos, hashes, descripciones y metadatos." }
+      }
+    },
+    "salud": { "label": "Salud", "services": {
+      "cima": { "label": "CIMA", "description": "Búsqueda, inspección y lectura progresiva de medicamentos, principios activos, presentaciones, fichas técnicas y prospectos oficiales de la AEMPS." },
+      "ema-medicines": { "label": "EMA Medicines", "description": "Catálogo público de medicamentos, fichas regulatorias y documentos publicados por la Agencia Europea de Medicamentos." }
+    } },
+    "inmobiliario": { "label": "Inmobiliario", "services": {} },
+    "legal": { "label": "Legal", "services": {
+      "boe": { "label": "BOE", "description": "Búsqueda y lectura progresiva de publicaciones, legislación consolidada, versiones históricas y documentos oficiales del Boletín Oficial del Estado." }
+    } },
+    "educacion": { "label": "Educación", "services": {
+      "todofp": { "label": "TodoFP", "description": "Consulta progresiva de familias profesionales, ciclos, cursos de especialización, requisitos, planes formativos, documentos y buscadores autonómicos de centros." },
+      "qedu": { "label": "QEDU", "description": "Oferta universitaria publicada por el Ministerio de Ciencia, Innovación y Universidades, con titulaciones, universidades, centros, notas de corte y curso académico cuando está disponible." }
+    } },
+    "comercio-y-retail": { "label": "Comercio y Retail", "services": {
+      "pccomponentes": { "label": "PcComponentes", "description": "Búsqueda visible por texto, marca y precio, con orden, continuación, colección acotada, fichas y comparación de productos tecnológicos." },
+      "idealo": { "label": "Idealo", "description": "Búsqueda y comparación de productos, precios, comercios, envío, entrega y especificaciones con filtros visibles y colección progresiva acotada." },
+      "el-corte-ingles": { "label": "El Corte Inglés", "description": "Búsqueda pública de productos por texto, marca y orden, con colección acotada, fichas y comparación de productos." }
+    } },
+    "viajes-y-turismo": { "label": "Viajes y Turismo", "services": {
+      "spain-info": { "label": "Spain.info", "description": "Búsqueda, inspección y lectura progresiva de destinos, eventos, rutas, atracciones y artículos del portal oficial de turismo de España." },
+      "aena": { "label": "Aena", "description": "Consulta progresiva de aeropuertos, páginas operativas y vuelos públicos de la red Aena, con lectura acotada de contenidos aeroportuarios." },
+      "tripadvisor": { "label": "Tripadvisor", "description": "Búsqueda y consulta progresiva de destinos, hoteles, restaurantes, atracciones y experiencias públicas con puntuaciones, opiniones, ubicación y datos visibles." }
+    } },
+    "marketing-y-publicidad": { "label": "Marketing y Publicidad", "services": {
+      "google-trends": { "label": "Google Trends", "description": "Tendencias públicas filtradas y recopiladas por páginas, comparación Explore y navegación Rising/Top de temas y consultas relacionadas." }
+    } },
+    "energia-y-medio-ambiente": { "label": "Energía y Medio Ambiente", "services": {
+      "aemet": { "label": "AEMET", "description": "Búsqueda pública de municipios, predicción meteorológica visible a siete días y avisos meteorológicos oficiales de Península, Baleares y Canarias." }
+    } },
+    "deportes": { "label": "Deportes", "services": {
+      "transfermarkt": { "label": "Transfermarkt", "description": "Navegación pública progresiva de jugadores, clubes, competiciones, valores de mercado, plantillas y fichajes con filtros y paginación nativos." }
+    } },
+    "inmobiliario": { "label": "Inmobiliario", "services": {
+      "fotocasa": { "label": "Fotocasa", "description": "Navegación pública de resultados y fichas inmobiliarias de venta, alquiler y vivienda compartida, con comparación acotada de anuncios." },
+      "pisos-com": { "label": "pisos.com", "description": "Búsqueda pública de anuncios inmobiliarios de compra, alquiler y obra nueva, con filtros visibles, paginación, fichas y comparación acotada." },
+      "idealista": { "label": "Idealista", "description": "Búsqueda y filtrado mediante controles visibles de anuncios inmobiliarios de venta, alquiler y habitaciones, con fichas, comparación acotada y detección de bloqueos anti-bot." }
+    } },
+    "automocion": { "label": "Automoción", "services": {
+      "autoscout24": { "label": "AutoScout24", "description": "Búsqueda pública de vehículos con filtros nativos, paginación progresiva, precios, kilometraje, combustible, transmisión, vendedores, fichas y comparación acotada." }
+    } },
+    "ciberseguridad": { "label": "Ciberseguridad", "services": {
+      "nvd": { "label": "NVD", "description": "Consulta pública de vulnerabilidades CVE, métricas CVSS, productos CPE, debilidades CWE, referencias y estado CISA KEV publicados por NIST." }
+    } },
+    "medios-y-entretenimiento": { "label": "Medios y Entretenimiento", "services": {
+      "justwatch": { "label": "JustWatch", "description": "Búsqueda localizada, descubrimiento y colección paginada por proveedor de películas y series, con disponibilidad, precios y metadatos visibles." },
+      "letterboxd": { "label": "Letterboxd", "description": "Películas, listas populares con colección paginada, diarios y críticas públicas con metadatos, valoraciones y actividad visible." }
+    } },
+    "empleo-y-recursos-humanos": { "label": "Empleo y Recursos Humanos", "services": {
+      "eures": { "label": "EURES", "description": "Búsqueda y consulta progresiva de vacantes oficiales europeas por palabras clave, países, orden y página, sin envío de candidaturas." },
+      "infojobs": { "label": "InfoJobs", "description": "Búsqueda y consulta progresiva de ofertas españolas, empresas, ubicación, modalidad, salario, contrato y requisitos, sin envío de candidaturas." }
+    } }
+  }
+}