Files
vectorcraft/crates/engine
dotCooCoo cd262fa6e8 MCP: save, export and package replies leave out paths outside a confined client's read roots
A client confined with --automation-read-root could learn paths it was
not given and may not read from the replies of several commands. Each
one now names such a path only when no read roots are in force or the
path is inside them:

- document.save and file.save, file.saveAs, file.saveCopy and
  file.saveAsTemplate (app.save and engine.execute) without a path:
  the document's own file, the files of separate artboards and linked
  files are left out or named by file name, and the folder a save
  suggests is left out.
- document.exportForScreens with the folder of an exportPreset: the
  ZIP path is left out and files are relative to that folder.
- document.exportSettings, document.exportPresets.list and
  document.exportPresets.export: a kept folder outside the read roots
  is left out of the reply and of the presets file the export writes.
- file.package: warnings, missingLinks and the report name a file
  outside the read roots by its file name. A link's stored path, read
  from the document's folder when it is relative, decides, also when
  its file was found under another path.
- document.info: an image linked to a file outside the read roots has
  link null, and its Linked Images row names the file alone.

docs/mcp.md and the params text describe the rule.
2026-11-11 20:42:57 -08:00
..