devup-mcp-visual(crates/devup-mcp-visual/Cargo.toml)@0.2.0

devup-mcp-visual@0.1.0 → 0.2.0 - crates/devup-mcp-visual/Cargo.toml

Minor

• Add a Rust-native private Figma Remote MCP with OAuth and verified official-host fallback; exact-node and full-theme one-call acquisition with JSON-string host normalization, atomic failed-root-only legacy fallback, observable fallback progress and a bounded shared upstream session with safe stage deadlines; bounded, ancestor-preserving linked-screen exploration with executable stress fixtures, refresh control, exact/related/superset cache reuse, compatible-request singleflight and current-versus-origin call diagnostics; cancellation-safe bounded memory-only artifact/resource reuse, URI-accurate native MCP resource links, independently readable binary assets and transactional file/resource delivery with verified rollback and retained recovery backups; transactional host-handoff acceptance with bounded consumed/expired tombstones so an invalid continuation call can no longer destroy a session; Section screen selection and deterministic batch export; syntax-validated DevupUI TSX, devup.json, raw snapshot, source maps, requested assets and strictly decoded bounded reference PNG; source-derived typed fidelity impact requiring zero approximated/lossy/failed impacts for strict compatibility, evidence-based absolute-layout fallback reporting, final-output provenance for non-default variants, one-to-one repeated text coverage and strict reports; a pure Rust PNG comparator plus renderer contract; loss-aware legacy large-field continuation; dirty-aware build identity with a local --self-check diagnostic and a real-stdio smoke test; all ten WQUW-151 screens; 268/268 plugin snapshot parity and a zero-not-ported 978-entry ledger; focused server module boundaries; non-duplicating CI snapshot drift enforcement; Rust 1.88-compatible dependency updates; an opencode-compatible MCP tool schema fix replacing boolean JSON Schema with object schemas across all 7 tools plus a raw-stdio schema regression test; and a further oxc/rmcp dependency refresh with the pinned toolchain raised to Rust 1.98

Patch

• Make the direct Figma OAuth path work end to end, so a URL converts to DevupUI TSX without a host Figma MCP or an agent relay in the loop. Three defects each independently blocked it: Dynamic Client Registration always sent a client_name that Figma's catalog allowlist rejects with a plain-text 403, and the name is now configurable through --figma-client-name / DEVUP_FIGMA_CLIENT_NAME with doctor reporting the active value; the client_secret issued by registration was discarded even though Figma advertises only client_secret_basic/client_secret_post, so the token exchange answered a bare 400 after registration and browser consent had both succeeded, and the secret is now kept beside its client_id for the authorization-code exchange and refresh; and auth_network_error dropped the underlying transport error entirely, so every failure surfaced identically with no details, and it now carries kind/status/url/cause-chain with the URL reduced to scheme, host and path so a query string cannot carry a code or token into a log. Also tolerate a relay that re-serializes upstream results: get_metadata is no longer bare XML because Figma prepends a selected-nodes block and appends an instruction footer, and the fast envelope no longer requires integrity.utf8Bytes to equal the received byte length, since truncation is already caught by JSON parsing plus the node, resource-reference and resource-presence checks that read content rather than its serialized form. Every diagnostic and guidance string is now emitted in English, because these are returned to an LLM agent over MCP where Korean prose costs several times the tokens; Korean Figma fixture data is preserved where tests use it deliberately to exercise CJK handling. Consolidates CI and release into the single workflow the other org projects use, driven by changepacks/action: the action cuts draft releases and reports them through pending_releases, a build matrix compiles devup-mcp and devup-mcp-visual for Linux, Windows and a macOS universal binary and uploads them onto those drafts, and a finalize step publishes the drafts only after the uploads succeed, so a release is never visible without its binaries. A changepack-required gate fails any pull request that edits a crate without leaving a changepack log, since such a change never moves the version and therefore never releases. Also fixes output-root resolution for a root reached through a symlink: the root was canonicalised when the policy opened it while the requested outputPath was not, so a caller passing a path under the spelling it was given was refused with outputPath is outside the allowed root. On macOS that was the normal case rather than an edge case, because /tmp and the system temp directory both resolve through /var to /private/var. Fixes Section targets on the direct path: the fast snapshot script throws DEVUP_TARGET_IS_SECTION and MCP delivers a thrown error as a successful call carrying isError, which the direct path handed to accept and then failed with snapshot data not found, so a Section link had no way to reveal the screens inside it. It is now rejected exactly as the handoff path already did, so the collector switches to the section index and answers with selectable screens. Fixes SVG asset export, which failed for every request while PNG worked: Figma's remote MCP returns a written PNG as an image attachment but does not return a written .svg at all, so the bytes never reached devup-mcp. SVG is now exported as a string and carried inline beside the descriptor under a bounded size, and the payload search steps through the JSON encoding of a text block and accepts a text payload as well as base64. The missing-payload error now reports which content shapes and mime types the response actually carried, so an absent attachment, a wrong mime type and an unread field stay distinguishable. Adds server instructions covering that the generated component name and asset paths are starting points rather than contracts, that a fixed asset must be exported through assetRequests with an outputPath instead of referenced by a path that does not exist, and that resource delivery should be preferred over inlining bytes.