@cloudgrid-io/mcp 0.21.16 → 0.21.18

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "@cloudgrid-io/mcp",
-  "version": "0.21.16",
+  "version": "0.21.18",
   "description": "MCP access to CloudGrid — the live runtime environment where the user's apps run WITH the infrastructure they need out of the box: managed MongoDB, Redis (cache/queues/pub-sub), a pgvector store, persistent disk, and built-in AI with no API keys, in any language or stack, no Docker or Kubernetes to manage. Brainstorm, build, plug, and improve apps, games, dashboards, and tools; instant single-page publishes and full runtime-app deploys with a live URL — for developers and non-technical users. Three editions: local stdio (full toolset), hosted web (light, CLI-free), and a public docs-search server.",
   "type": "module",
   "bin": {

package/src/tools/constants.js

@@ -27,7 +27,10 @@ export const ANON_HTML_MAX_BYTES = 2_000_000;
 // ~6x stricter by design — a normal page is well under 1 MB, and past
 // 25 MB the right shape is a folder plug (multipart, see deploy.js:756).
 export const AUTHED_HTML_MAX_BYTES = 25_000_000;
-export const CONSOLE_URL = "https://console.cloudgrid.io/";
+// The Console's canonical host is my.cloudgrid.io (cloudgrid-io/cloudgrid#4135).
+// console.cloudgrid.io stays as a permanent redirect, so links printed by
+// earlier releases still land.
+export const CONSOLE_URL = "https://my.cloudgrid.io/";
 
 // The console link handed to a user AFTER a plug. When the grid slug is known it
 // points at THAT grid (verified live: /home?grid=<slug> -> 200) instead of the
@@ -64,25 +67,36 @@ export const VISIBILITY_LABELS = {
 // the widget HTML is verified to render. The resources stay registered either
 // way (harmless when no tool references them via outputTemplate).
 //
-// 2026-08-25 (#308): the black frame was diagnosed as a MIME mismatch. ChatGPT
-// discovers an Apps-SDK widget by a tool carrying openai/outputTemplate PLUS a
-// ui:// resource whose mimeType is `text/html+skybridge` (verified against
-// OpenAI's shipped example servers — openai/openai-apps-sdk-examples
-// solar-system/shopping_cart/kitchen_sink main.py). Our two ChatGPT widgets
-// declared `text/html;profile=mcp-app` — the SEP-1865/MCP-Apps MIME that CLAUDE
-// reads (RESOURCE_MIME_TYPE in @modelcontextprotocol/ext-apps). ChatGPT saw the
-// outputTemplate pointer, opened the skybridge iframe (dark chrome), but the
-// resource was not a skybridge document, so the HTML/bridge never populated —
-// the empty dark frame covering the text. CHATGPT_WIDGET_MIME below is the
-// correct type. The flag STAYS OFF until a card is seen rendering in real
-// ChatGPT (Developer Mode custom connector against staging); this only makes the
-// machinery correct for that verification.
+// 2026-08-31 (#308, corrected): the widgets targeted a RETIRED MIME. At DevDay
+// (Oct 2025) ChatGPT's Apps SDK used `text/html+skybridge`, and #309 switched us
+// to it. But the Apps SDK merged with MCP Apps into SEP-1865, ratified
+// 2026-01-26, and OpenAI's CURRENT docs (developers.openai.com/apps-sdk
+// build/custom-ux, deploy/troubleshooting) now specify `text/html;profile=mcp-app`
+// — the same MIME Claude reads. skybridge is not mentioned anywhere in the
+// current docs. So ChatGPT opened the iframe on our skybridge resource, could not
+// recognise it, and never populated it — the empty frame over the text.
+//
+// The clincher: our own Claude sign-in card (#303) RENDERS, and it declares
+// `text/html;profile=mcp-app`. The MIME that renders is the standard one; the one
+// that does not is skybridge. The two hosts converged; the old separation was the
+// defect. CHATGPT_WIDGET_MIME below now equals RESOURCE_MIME_TYPE by value. The
+// widget bridge (window.openai.toolOutput / openExternal / callTool /
+// ui/notifications/tool-result) is already current — verified against
+// developers.openai.com/apps-sdk/reference — so only the MIME changes.
+//
+// The flag stays where the platform sets it; this only makes the resource the
+// type ChatGPT now expects. Done is a card seen rendering in real ChatGPT.
 export const APPS_WIDGETS_ENABLED = process.env.MCP_APPS_WIDGETS === "1";
 // The mimeType ChatGPT's Apps-SDK renderer requires for a ui:// widget resource.
-// Distinct from RESOURCE_MIME_TYPE (`text/html;profile=mcp-app`, the SEP-1865
-// key Claude reads) — the two hosts key off different MIME types, so the ChatGPT
-// widgets and the Claude sign-in card must NOT share one.
-export const CHATGPT_WIDGET_MIME = "text/html+skybridge";
+// Since SEP-1865 (2026-01-26) this EQUALS RESOURCE_MIME_TYPE (`text/html;profile=
+// mcp-app`): both hosts now render the standard MCP-Apps MIME. Both hosts also
+// read the SAME binding key, `_meta.ui.resourceUri`; ChatGPT honors
+// `openai/outputTemplate` only as a compatibility alias (OpenAI's own
+// deploy/troubleshooting page). So our two mechanisms stay separate not because
+// the hosts key off different MIMEs or different keys, but because WE bind them
+// on different keys: the ChatGPT widget via `openai/outputTemplate` (the alias,
+// which Claude ignores), the Claude card via `_meta.ui.resourceUri`.
+export const CHATGPT_WIDGET_MIME = "text/html;profile=mcp-app";
 export const LIVE_RESULT_URI = "ui://cloudgrid/live-result.html";
 // URI/resource-name/filename stay `org-picker` — that's the stable contract the
 // web card is registered under; only the JS identifier moves toward grid.

package/src/tools/register.js

@@ -133,9 +133,10 @@ export function registerTools(server, ctx) {
 
   // ── Widget resources (web edition, ChatGPT Apps SDK) ──────────────────────
   if (ctx.edition === "web") {
-    // ChatGPT Apps-SDK widgets. mimeType MUST be text/html+skybridge
-    // (CHATGPT_WIDGET_MIME) — NOT the MCP-Apps `text/html;profile=mcp-app` the
-    // Claude card uses; that mismatch was the black frame (#308). widgetAccessible
+    // ChatGPT Apps-SDK widgets. mimeType is CHATGPT_WIDGET_MIME, which since
+    // SEP-1865 (2026-01-26) IS `text/html;profile=mcp-app` — the standard MCP-Apps
+    // type. The old `text/html+skybridge` was retired and was the black frame
+    // (#308); the hosts stay separated by binding, not MIME. widgetAccessible
     // lets the widget call tools back over window.openai.callTool (the visibility
     // pills call grid_visibility). These make no direct network requests, so no
     // openai/widgetCSP is declared — the default deny is correct.
@@ -538,11 +539,12 @@ export function registerTools(server, ctx) {
       // live at a public URL in place. Versions + grid rollback exist, but the
       // honest MCP annotation for overwrite-live-state is destructive.
       annotations: { readOnlyHint: false, destructiveHint: true, openWorldHint: true },
-      // ChatGPT-only binding: openai/outputTemplate points at the skybridge
-      // widget. Deliberately NOT the MCP-Apps `ui.resourceUri` key — that is
-      // Claude's, and the live-result resource is now text/html+skybridge, which
-      // Claude cannot render; carrying it here would regress the Claude path when
-      // this flag is flipped. The two mechanisms stay independent (#308/#303).
+      // Bound via openai/outputTemplate, which ChatGPT honors as a compatibility
+      // alias for `_meta.ui.resourceUri` and which Claude ignores — so this
+      // widget renders in ChatGPT only. Deliberately NOT `_meta.ui.resourceUri`:
+      // since SEP-1865 both hosts read THAT key, so binding there would render the
+      // widget in Claude too. The two mechanisms stay independent because they
+      // bind on different keys, not different MIMEs (#308/#303).
       ...(ctx.edition === "web" && APPS_WIDGETS_ENABLED ? {
         _meta: { "openai/outputTemplate": LIVE_RESULT_URI },
       } : {}),
@@ -717,10 +719,11 @@ export function registerTools(server, ctx) {
         login_url: z.string().describe("URL to open in a browser to complete sign-in."),
       },
       annotations: { readOnlyHint: false, destructiveHint: false, openWorldHint: true },
-      // Bind the SEP-1865 sign-in card on the web edition (Claude web). This is
-      // the SEP-1865 key (_meta.ui.resourceUri); ChatGPT reads openai/outputTemplate
-      // and ignores it, and a client without the UI extension ignores it too and
-      // gets the text-first result below. NOT gated behind MCP_APPS_WIDGETS — a
+      // Bind the SEP-1865 sign-in card on the web edition (Claude web) via the
+      // standard `_meta.ui.resourceUri` key. It carries NO openai/outputTemplate
+      // and is not gated by MCP_APPS_WIDGETS, so it is the Claude sign-in card;
+      // a client without the UI extension ignores _meta.ui and gets the
+      // text-first result below. NOT gated behind MCP_APPS_WIDGETS — a
       // second, independent mechanism (see constants.js). The result shape is
       // unchanged: content[0] stays the sign-in URL text so the link is never
       // unreachable if the card does not render.
@@ -1194,6 +1197,13 @@ export function registerTools(server, ctx) {
         error: z.boolean().optional().describe("True when the grid listing failed (network/auth error). The text carries a human-readable message. Do NOT treat this as needs_grid_create."),
       },
       annotations: { readOnlyHint: false, destructiveHint: false, openWorldHint: true },
+      // ChatGPT Apps-SDK card, same binding as grid_plug: grid_hello returns a
+      // runPlug result, so it deserves the same live-result widget. Without this a
+      // grid_hello success renders no card even when the MIME is correct (#308).
+      // openai/outputTemplate is ChatGPT-only; Claude ignores it, so #303 is safe.
+      ...(ctx.edition === "web" && APPS_WIDGETS_ENABLED ? {
+        _meta: { "openai/outputTemplate": LIVE_RESULT_URI },
+      } : {}),
     },
     async (input) => {
       try {