feat(mcp): add preset shape guide lookup (#9)

[caio-pizzol]

What

Adds ooxml_preset_shape so agents can look up DrawingML preset-shape adjust guides.

This replaces #10 on top of the current main branch. Ben is credited as a co-author.

Why

The PDF corpus does not include the Annex D geometry addendum. For example, round2SameRect requires adj1 and adj2, which cannot be found through PDF search.

The generator downloads the pinned fourth-edition archive, verifies its checksum, extracts presetShapeDefinitions.xml, and builds the lookup from each shape's <avLst>. The generated TypeScript file is bundled with the Worker and is not edited by hand.

The source download and nested-ZIP extraction are reusable for future XML or XSD sources. Parsing remains specific to Annex D because other files use different schemas.

Closes #9

Tested

• Generation from the pinned fourth-edition archive is repeatable
• All 186 unique definitions in the published Annex D XML are generated
• round2SameRect returns adj1 and adj2 through the authenticated MCP request path
• Shapes without guides are distinct from names missing in Annex D
• Text-warp names are not included
• Source verification and nested-ZIP extraction have focused tests
• 45 MCP tests pass in CI
• Typecheck, lint, and Worker dry-run build pass

[qodo-code-review]

Code Review by Qodo

🐞 Bugs (1) 📘 Rule violations (0) 📜 Skill insights (0)

---

View medium (1)

🟠 **Medium**

1. Implicit zip/unzip dependency 🐞

Description

The newly-added mcp:test CI step runs tests and code paths that shell out to system zip/unzip;
environments without these binaries will fail bun run mcp:test (and preset-shape
generation/extraction) with a spawn/extraction error. This introduces an undeclared platform
dependency that can break contributors on minimal images or self-hosted CI runners.

Code

.github/workflows/ci.yml[R32-34]

+      - name: MCP tests
+        run: bun run mcp:test
+

Relevance

●●● Strong

Team often accepts reliability hardening; declaring/installing required tooling for CI avoids
brittle runtime failures.

PR-#17
PR-#20

ⓘ Recommendations generated based on similar findings in past PRs

Evidence

CI now executes bun run mcp:test, and that test suite includes a test that spawns zip; the
shared source-artifact helper shells out to unzip for extraction. On machines/runners without
those executables, the new CI step and related tooling will fail at runtime.

.github/workflows/ci.yml[32-34]
package.json[28-30]
tests/scripts/source-artifact.test.ts[11-17]
scripts/lib/source-artifact.ts[46-57]

Agent prompt

The issue below was found during a code review. Follow the provided context and guidance below and implement a solution

### Issue description
`bun run mcp:test` (now executed in CI) depends on external `zip`/`unzip` executables. If these commands are missing (common on minimal/self-hosted runners), MCP tests and the source-artifact extraction utility will fail.

### Issue Context
- `tests/scripts/source-artifact.test.ts` spawns `zip`.
- `scripts/lib/source-artifact.ts` spawns `unzip`.
- CI now runs `bun run mcp:test`, which includes the above test.

### Fix Focus Areas
- .github/workflows/ci.yml[32-34]
- scripts/lib/source-artifact.ts[46-57]
- tests/scripts/source-artifact.test.ts[11-17]
- package.json[29-29]

### Suggested fixes
Choose one:
1) **Make CI explicit**: add a step before `bun run mcp:test` to install the utilities (e.g., `sudo apt-get update && sudo apt-get install -y zip unzip`).
2) **Remove the external dependency**: replace `Bun.spawn(["unzip", ...])` and the test’s `zip` call with a JS ZIP library (or Bun-native ZIP APIs, if available), so tests and generation are portable.
3) If you keep the dependency, also consider adding a preflight check that throws a clear error message when the binaries are missing (to make failures actionable).

ⓘ Copy this prompt and use it to remediate the issue with your preferred AI generation tools

---

---

Context

Review mode: ⚖️ Balanced: The push adds shared source-download/ZIP extraction logic and changes MCP tool execution behavior; these are real behavioral paths with meaningful build and API risk, but not sufficiently dense across independent paths to justify redundant extended review.

---

Tip of the day

💡 Did you know, you can enable the Remediation agent and Qodo fixes findings in a dedicated fix PR

More tips ↗ | Customize Qodo ↗ | Qodo docs ↗

---

Previous review results

Review updated until commit d3fc37c ⚖️ Balanced

Results up to commit abab484 ⚖️ Balanced

No changes from previous review

Results up to commit 2876bc7 ⚖️ Balanced

No changes from previous review

Powered by Qodo

[cubic-dev-ai]

No issues found across 11 files

_{Re-trigger cubic}

[linear-code]

SD-4209