tools: add LINE Flex Message live preview (line_flex_* MCP + canvas extension) - #6
Merged
Conversation
…xtension)
Add a LINE Flex Message live-preview capability in two forms that share one
browser renderer ("one renderer, four surfaces"):
Deliverable A — Copilot canvas extension (extensions/line-flex-viewer/): a
self-contained canvas provider plus a zero-dependency Node stdio MCP server and
a standalone client-side HTML viewer (copied verbatim from the contribution
bundle).
Deliverable B — .NET MCP tools (tools/Line.OpenApi.Tools): a line_flex_* tool
group backed by a loopback-only HttpListener + SSE preview server
(FlexPreviewService) reusing the same web/ renderer, embedded as assembly
resources. It makes no LINE API calls and stores no secrets, so it registers
unconditionally alongside ReadTools and is safe under --read-only.
Tools: line_flex_preview / line_flex_get_content / line_flex_validate /
line_flex_open. Env: LINE_FLEX_MCP_NO_OPEN, LINE_FLEX_MCP_STATE_DIR.
Gate review (docs/reviews/2026-09-03-flex-preview-review.md): code/security/
test-arch all non-blocking. Findings applied:
- Open() now truly reopens the tab (explicit user gesture; respects NO_OPEN).
- /api/* Host-header + POST Origin validation (blocks DNS-rebind reads and
cross-origin CSRF writes; returns 403).
- line_flex_validate no longer throws on malformed input; Dispose closes SSE
streams; Normalize message corrected.
- New service-layer unit tests + a byte-identical guard between the two web/
trees; tool-surface snapshot extended to cover the flex tools.
Verification: build 0 warnings/0 errors; full suite green (264 lib + 97 Tools
+ 26 AI + 1 isolation); tools/list shows the four tools under default and
--read-only; loopback server serves viewer + assets + /api/state; pack-verify
12-package contract intact (Tools excluded). No new package dependencies (BCL
only).
Co-Authored-By: Claude Opus 4.8 (1M context) <noreply@anthropic.com>
The line-flex-viewer README was carried over from the contribution bundle and still described private-gist distribution and `.github/extensions/...` paths. This repo places the extension at `extensions/line-flex-viewer/` and (per AGENT_TASK.md A2) the primary channel for a public repo is installing from the repo folder URL. Update both READMEs (EN/JA): - Lead the install/share section with `install_extension https://github.com/pierre3/line-openapi-dotnet/tree/main/extensions/line-flex-viewer`, keeping the gist path only as an alternative. - Fix `.github/extensions/line-flex-viewer/...` → `extensions/line-flex-viewer/...` in the standalone-serve, Claude Desktop, and Claude Code snippets. Co-Authored-By: Claude Opus 4.8 (1M context) <noreply@anthropic.com>
Rework both READMEs (EN/JA) from the bundle's terse reference into a feature-and-usage guide written for the end user: what the tool is for, what you can do with it, the three ways to use it (Copilot canvas / MCP / standalone), install from the repo folder URL, and step-by-step usage for each surface. Facts verified against extension.mjs and mcp/server.mjs (canvas actions set_content/ get_content/validate; MCP tools preview_flex_message/get_flex_content/ validate_flex_message/open_preview; env vars; standalone share-link). The Japanese version is written natively in plain, natural Japanese rather than translated from the English. Co-Authored-By: Claude Opus 4.8 (1M context) <noreply@anthropic.com>
…ternative Reframe the Flex Message viewer docs around the two main scenarios — the Copilot App canvas and the Line.OpenApi.Tools `line_flex_*` MCP tools — and position the bundled Node `mcp/server.mjs` as an alternative for when the .NET tool isn't used. Drop the standalone HTML page and the gist-sharing sections from the extension README, and remove their mentions from the root and tools READMEs (EN/JA). Japanese written natively, not translated. Co-Authored-By: Claude Opus 4.8 (1M context) <noreply@anthropic.com>
Turn the dense paragraph listing supported containers/blocks/components/props into a category table in both READMEs (EN/JA) for readability. Co-Authored-By: Claude Opus 4.8 (1M context) <noreply@anthropic.com>
The section-2 link went to the repo root; point it at tools/Line.OpenApi.Tools instead (EN/JA). Co-Authored-By: Claude Opus 4.8 (1M context) <noreply@anthropic.com>
Point the section-2 link at tools/ so the tool README is shown directly (EN/JA). Co-Authored-By: Claude Opus 4.8 (1M context) <noreply@anthropic.com>
Replace the two dense read-only/mutating bullets with per-category tables (General, Messaging, Flex, Bot, Rich menu, Insight, Manage Audience, Shop, LIFF, Token, Webhook). Columns: tool name, summary, Read-only (✓ = available under --read-only, ✗ = mutating). Summaries taken from each tool's [Description]. Fold the audience by-file and rich-menu image-upload CLI-only notes into their tables. EN and JA. Co-Authored-By: Claude Opus 4.8 (1M context) <noreply@anthropic.com>
…_preview Move the "Building messages with an AI agent" section to after the Flex preview section and rewrite it as a build → preview → adjust → send loop: schema builds a shape-valid message, line_flex_preview shows it like the LINE app for in-browser tweaks (read back via line_flex_get_content), and dryRun is the final pre-send check. EN and JA. Co-Authored-By: Claude Opus 4.8 (1M context) <noreply@anthropic.com>
The line_message_schema note referenced "$ref + $defs" with no explanation. Reword it to say the schema uses named definitions ($defs) referenced by pointer ($ref) instead of inlining, and why (a Flex box is self-recursive, so inlining would nest forever). EN and JA. Co-Authored-By: Claude Opus 4.8 (1M context) <noreply@anthropic.com>
The Flex viewer was a nested subsection under "CLI / MCP tool". Promote it to its own top-level "LINE Flex Message viewer" section and describe the two ways to use it side by side — the line_flex_* MCP tools and the Copilot App canvas extension (with the bundled Node MCP server as an alternative). EN and JA. Co-Authored-By: Claude Opus 4.8 (1M context) <noreply@anthropic.com>
- Bump the tool package version 1.1.0 → 1.2.0. - CHANGELOG (EN/JA): add the 1.2.0 Tools entry (line_flex_* live preview) and its compare link. - release.yml: fix the publish-tool version desync — build/test the test project (which references the tool) with -p:Version, test --no-build, then pack --no-build, so the packaged assembly's AssemblyVersion matches the .nupkg version (mirrors the AI job). Previously the Test step rebuilt the tool without -p:Version and pack --no-build shipped a mis-stamped assembly. Verified locally: pack produces Line.OpenApi.Tools.1.2.0.nupkg with a 1.2.0.0 assembly and all five web assets embedded. Tag push (tools-v1.2.0) is deferred. Co-Authored-By: Claude Opus 4.8 (1M context) <noreply@anthropic.com>
This file contains hidden or bidirectional Unicode text that may be interpreted or compiled differently than what appears below. To review, open the file in an editor that reveals hidden Unicode characters.
Learn more about bidirectional Unicode characters
Sign up for free
to join this conversation on GitHub.
Already have an account?
Sign in to comment
1 participant
Add this suggestion to a batch that can be applied as a single commit.This suggestion is invalid because no changes were made to the code.Suggestions cannot be applied while the pull request is closed.Suggestions cannot be applied while viewing a subset of changes.Only one suggestion per line can be applied in a batch.Add this suggestion to a batch that can be applied as a single commit.Applying suggestions on deleted lines is not supported.You must change the existing code in this line in order to create a valid suggestion.Outdated suggestions cannot be applied.This suggestion has been applied or marked resolved.Suggestions cannot be applied from pending reviews.Suggestions cannot be applied on multi-line comments.Suggestions cannot be applied while the pull request is queued to merge.Suggestion cannot be applied right now. Please check back later.
Summary
Adds a LINE Flex Message live preview in two forms that share a single browser renderer — one renderer, four surfaces: Copilot canvas · bundled Node stdio MCP · .NET
line_flex_*· standalone HTML.Deliverable A — Copilot canvas extension (
extensions/line-flex-viewer/)Self-contained canvas provider + a zero-dependency Node stdio MCP server (
mcp/server.mjs, for Claude Desktop/Code) + a no-server standalone HTML viewer. Renders Flex JSON like the LINE app in a side panel or the browser.Deliverable B — .NET MCP tools (
tools/Line.OpenApi.Tools)A
line_flex_*tool group backed by a loopback-onlyHttpListener+ SSE preview server (FlexPreviewService), reusing the sameweb/renderer (embedded as assembly resources).line_flex_preview{ ok, url, valid, warnings, opened }line_flex_get_content{ content }line_flex_validate{ valid, warnings }line_flex_open{ ok, url }Env:
LINE_FLEX_MCP_NO_OPEN(URL only, no auto-open),LINE_FLEX_MCP_STATE_DIR(state location).Read-only safety
No LINE API calls, no secrets. Registered unconditionally alongside
ReadTools, so the flex tools are available under--read-only.Gate review
docs/reviews/2026-09-03-flex-preview-review.md— code / security / test-arch all non-blocking. Findings applied:Open()now truly reopens the tab (explicit user gesture; respectsNO_OPEN)./api/*gets a Host-header check and a POSTOrigincheck — blocks DNS-rebinding reads and cross-origin CSRF writes (returns 403; verified e2e).line_flex_validateno longer throws on malformed input;Disposecloses open SSE streams;Normalizemessage corrected.FlexPreviewServiceTests) + a byte-identical guard between the twoweb/trees (FlexWebAssetsParityTests); the tool-surface snapshot now covers the flex tools.Verification
System.Net.HttpListener,System.Text.Json).tools/listadvertises the four tools under both default and--read-only.renderer.js/flex.css+/api/state; Host/Origin guard rejects spoofed Host and cross-origin POST with 403.pack-verify12-package library contract intact (Line.OpenApi.Toolsexcluded viaExcludeToolFromPack).🤖 Generated with Claude Code