fix: misc fixes for pdf-server, map-server, and say-server (#329)

* fix(map-server): simplify location update message format

* fix(say-server): pass host to streamable_http_app for non-localhost deployments

* refactor(pdf-server): simplify to stateless range-query architecture

- Remove caching/indexing in favor of direct HTTP Range requests
- Use HEAD requests to get file size (no full download)
- Use Range requests to proxy byte chunks (no caching)
- Local files: fs.read with offset/length
- Remote files: HTTP Range header
- Zero memory footprint (no PDF caching)
- Truly stateless (no session management needed)
- Single server.ts (~350 lines) + main.ts CLI entry point
- Instant startup (no preloading)
- Security: whitelist local files, allowed origins

Removed files:
- src/pdf-indexer.ts
- src/pdf-loader.ts
- src/types.ts

* feat(pdf-server): add dark mode support

- Add CSS variables with light-dark() function for automatic theme switching
- Sync theme with host via applyDocumentTheme()
- Apply host CSS variables via applyHostStyleVariables()

* feat(pdf-server): add list_pdfs tool back

Lists local files and allowed remote origins.
Also moves CHUNK_SIZE to module level constant.

* feat(pdf-server): improve tool descriptions and increase context limit

- display_pdf: list all allowed domains in description
- Increase MAX_MODEL_CONTEXT_LENGTH to 15000
- Move CHUNK_SIZE to module level constant

* chore(say-server): remove deployment docs from repo

Keep server.py fix for non-localhost deployments.
Deployment docs kept locally but not in repo.

* refactor(pdf-server): simplify updateModelContext format

- Add widget ID for multi-widget disambiguation
- Use concise header: 'PDF viewer (id) | title | Current Page: X/Y'
- Add 'Page content:' prefix before text
- Keep selection markers (<pdf-selection>...</pdf-selection>)

* refactor: rename widgetUUID to viewUUID for consistency

Aligns with main's standardization on 'view' terminology (PR #325).
Also dynamically generate allowed domains in display_pdf description.

* viewUUID

* fix(map-server): fix syntax error in location update message

* fix(pdf-server): restore package.json, improve server docs

- Restore --external pdfjs-dist in build
- Rewrite server.ts header for newcomers (list tools, not implementation details)
- Minimize main.ts diff

* chore(pdf-server): remove unused addAllowedOrigin/addAllowedLocalFile

* docs(pdf-server): update README for new architecture

* docs(pdf-server): restore full README, add theming section, remove get_pdf_info

* rm

* fix(pdf-server): restore createMcpExpressApp and error handling

- Use createMcpExpressApp for DNS rebinding protection
- Restore error callback in app.listen()

* fix(say-server): pass host to streamable_http_app for non-localhost deployments

* chore(say-server): remove deployment docs from repo

* widgetId->tool id

* fix(map-server): add null check for center in location update

chore(pdf-server): dedupe and sort allowed origins

* fix(map-server): use transparent background for rounded corners

* prettier

examples/pdf-server/main.ts

@@ -4,18 +4,24 @@
  * Or: node dist/index.js [--stdio] [pdf-urls...]
  */
 
-/**
- * Shared utilities for running MCP servers with Streamable HTTP transport.
- */
-
+import fs from "node:fs";
 import { StdioServerTransport } from "@modelcontextprotocol/sdk/server/stdio.js";
 import { createMcpExpressApp } from "@modelcontextprotocol/sdk/server/express.js";
 import type { McpServer } from "@modelcontextprotocol/sdk/server/mcp.js";
 import { StreamableHTTPServerTransport } from "@modelcontextprotocol/sdk/server/streamableHttp.js";
 import cors from "cors";
 import type { Request, Response } from "express";
-import { createServer, initializePdfIndex } from "./server.js";
-import { isArxivUrl, toFileUrl, normalizeArxivUrl } from "./src/pdf-indexer.js";
+import {
+  createServer,
+  isArxivUrl,
+  isFileUrl,
+  normalizeArxivUrl,
+  pathToFileUrl,
+  fileUrlToPath,
+  allowedLocalFiles,
+  allowedRemoteOrigins,
+  DEFAULT_PDF,
+} from "./server.js";
 
 export interface ServerOptions {
   port: number;
@@ -24,9 +30,6 @@ export interface ServerOptions {
 
 /**
  * Starts an MCP server with Streamable HTTP transport in stateless mode.
- *
- * @param createServer - Factory function that creates a new McpServer instance per request.
- * @param options - Server configuration options.
  */
 export async function startServer(
   createServer: () => McpServer,
@@ -80,8 +83,6 @@ export async function startServer(
   process.on("SIGTERM", shutdown);
 }
 
-const DEFAULT_PDF = "https://arxiv.org/pdf/1706.03762"; // Attention Is All You Need
-
 function parseArgs(): { urls: string[]; stdio: boolean } {
   const args = process.argv.slice(2);
   const urls: string[] = [];
@@ -98,7 +99,7 @@ function parseArgs(): { urls: string[]; stdio: boolean } {
         !arg.startsWith("https://") &&
         !arg.startsWith("file://")
       ) {
-        url = toFileUrl(arg);
+        url = pathToFileUrl(arg);
       } else if (isArxivUrl(arg)) {
         url = normalizeArxivUrl(arg);
       }
@@ -112,9 +113,23 @@ function parseArgs(): { urls: string[]; stdio: boolean } {
 async function main() {
   const { urls, stdio } = parseArgs();
 
-  console.error(`[pdf-server] Initializing with ${urls.length} PDF(s)...`);
-  await initializePdfIndex(urls);
-  console.error(`[pdf-server] Ready`);
+  // Register local files in whitelist
+  for (const url of urls) {
+    if (isFileUrl(url)) {
+      const filePath = fileUrlToPath(url);
+      if (fs.existsSync(filePath)) {
+        allowedLocalFiles.add(filePath);
+        console.error(`[pdf-server] Registered local file: ${filePath}`);
+      } else {
+        console.error(`[pdf-server] Warning: File not found: ${filePath}`);
+      }
+    }
+  }
+
+  console.error(`[pdf-server] Ready (${urls.length} URL(s) configured)`);
+  console.error(
+    `[pdf-server] Allowed origins: ${[...allowedRemoteOrigins].join(", ")}`,
+  );
 
   if (stdio) {
     await createServer().connect(new StdioServerTransport());