@cyanheads/calculator-mcp-server 0.4.0 → 0.4.2

package/changelog/0.1.x/0.1.22.md

@@ -0,0 +1,33 @@
+---
+summary: "Framework bump `@cyanheads/mcp-ts-core` 0.8.15 → 0.9.1. Adopt the new `instructions` field on `createApp()` — server-level orientation now flows to every `initialize` response. Engines: Node ≥24.0.0, Bun ≥1.3.0. CHANGELOG.md migrated to per-version files under `changelog/0.1.x/`."
+breaking: false
+security: false
+---
+
+# 0.1.22 — 2026-05-16
+
+Patch release: framework bump `@cyanheads/mcp-ts-core` `0.8.15 → 0.9.1` and adopt the new server-level [`instructions`](https://github.com/cyanheads/mcp-ts-core/issues/91) field on `createApp()`. The string is included on every `initialize` response and spec-compliant clients SHOULD forward it to the model as session-level system context — preempts per-tool description bloat. Engines bumped to match the framework: **Node ≥24.0.0, Bun ≥1.3.0**.
+
+## Added
+
+- **`createApp({ instructions })`** (`src/index.ts`) — one-paragraph orientation covering the three `operation` modes, supported math domains, `scope` and `precision` usage, and the one-expression-per-call contract. Served on every `initialize` response per [cyanheads/mcp-ts-core#91](https://github.com/cyanheads/mcp-ts-core/issues/91).
+- **Per-version changelog files** under `changelog/0.1.x/` — migrated the 22 historical entries from the monolithic `CHANGELOG.md` to the framework's directory-based format. `CHANGELOG.md` is now a rollup index regenerated by `bun run changelog:build`; per-version files are the source of truth. `scripts/split-changelog.ts` (one-shot migration tool) has been retained for reference.
+
+## Changed
+
+- **Engines** (`package.json`) — `node` `>=22.0.0 → >=24.0.0`, `bun` `>=1.2.0 → >=1.3.0`. Matches the framework's 0.9.0 floor.
+- **Docker base image** (`Dockerfile`) — `oven/bun:1` → `oven/bun:1.3` (build and production stages), pinning to the minor that matches the engines floor.
+- **README prerequisite** — `Bun v1.2.0 → v1.3.0`.
+
+## Meta
+
+- **Dependency bumps:**
+  - `@cyanheads/mcp-ts-core` `^0.8.15 → ^0.9.1` (`instructions` on entry points, Workers `nodejs_compat` boot fix, RFC 8414 §3 well-known mount, SSRF hardening, tenant-id boundary check, cross-vendor JSON Schema portability lint family, definition linting moved to build-time only, `tasks` capability gated on actual task-tool registration)
+  - `@biomejs/biome` `^2.4.14 → ^2.4.15`
+  - `@types/node` `^25.6.0 → ^25.8.0`
+  - `tsx` `^4.21.0 → ^4.22.0`
+  - `vitest` `^4.1.5 → ^4.1.6`
+- **Synced project skills from the package:** `add-tool` (2.8 → 2.9), `api-auth` (1.0 → 1.1), `api-config` (1.3 → 1.4), `api-context` (1.2 → 1.3), `api-errors` (1.5 → 1.6), `api-linter` (1.2 → 1.3), `api-utils` (2.1 → 2.2), `api-workers` (1.3 → 1.4), `design-mcp-server` (2.10 → 2.11), `field-test` (2.3 → 2.4), `maintenance` (2.0 → 2.1), `polish-docs-meta` (1.7 → 1.8), `report-issue-framework` (1.5 → 1.6), `report-issue-local` (1.4 → 1.5), `security-pass` (1.3 → 1.4), `setup` (1.6 → 1.7), `tool-defs-analysis` (1.0 → 1.2). Added new `api-telemetry` (1.0). Refreshed `.claude/skills/` and `.agents/skills/` from `skills/`.
+- **Agent protocol files** (`CLAUDE.md`, `AGENTS.md`) — added `api-telemetry` to the skills table; updated `api-canvas` row to mention the `spillover()` helper; updated `api-utils` row to include telemetry helpers.
+- **Framework scripts resynced:** `scripts/devcheck.ts` (fixed `bun outdated` parser), `scripts/build-changelog.ts` (per-version frontmatter validation + rollup format).
+- Bumped package, server metadata, README badge, and agent protocol files to `0.1.22`.

package/changelog/0.1.x/0.1.23.md

@@ -0,0 +1,32 @@
+---
+summary: "Framework `@cyanheads/mcp-ts-core` `^0.9.1 → ^0.9.4`. Explicit `zod` dep (peerDep change in 0.9.2). New scripts: `audit:refresh`, `list-skills`, `lint:packaging`, `bundle`, `changelog:build`, `changelog:check`. TypeScript exhaustiveness fix in `calculate.tool.ts`."
+breaking: false
+security: false
+---
+
+# 0.1.23 — 2026-05-22
+
+Maintenance release: framework update to 0.9.4, `zod` added as an explicit dependency (required by the 0.9.2 peerDep change), and a batch of tooling and documentation updates.
+
+## Added
+
+- **`zod` explicit dependency** (`package.json`) — required since `@cyanheads/mcp-ts-core` 0.9.2 moved `zod` from a bundled re-export to a peerDep; adding it explicitly prevents resolution ambiguity.
+- **`MCP_GC_PRESSURE_INTERVAL_MS`** documented in `.env.example` — opt-in Bun GC pressure loop for HTTP deployments. Set to `0` to disable (default off).
+- **Scripts** (`package.json`) — `audit:refresh`, `list-skills`, `lint:packaging`, `bundle`, `changelog:build`, `changelog:check`.
+
+## Changed
+
+- **`@cyanheads/mcp-ts-core`** `^0.9.1 → ^0.9.4`.
+- **`@types/node`** `^25.8.0 → ^25.9.1`.
+- **`tsx`** `^4.22.0 → ^4.22.3`.
+- **`vitest`** `^4.1.6 → ^4.1.7`.
+- **README** — action-first description rewrite; badge layout restructured (install badges, Framework spotlight row).
+- **`package.json` / `server.json` descriptions** — rewritten to action-first form.
+- **Skills synced:** `maintenance` (2.1 → 2.3), `field-test` (2.4 → 2.5), `polish-docs-meta` (1.8 → 2.0), `release-and-publish` (2.3 → 2.4).
+- **`CLAUDE.md` / `AGENTS.md`** — updated with new script commands and framework conventions.
+- **`devcheck.config.json`** — framework script ignores updated.
+
+## Fixed
+
+- **`calculate.tool.ts`** — default branch added to `operation` switch for TypeScript exhaustiveness.
+- **`qs` transitive advisory** — cleared via lockfile refresh (`bun.lock`).

package/changelog/0.1.x/0.1.24.md

@@ -0,0 +1,16 @@
+---
+summary: "Framework `@cyanheads/mcp-ts-core` `^0.9.4 → ^0.9.6`. Skills synced: maintenance (2.3 → 2.4), polish-docs-meta (2.0 → 2.2), release-and-publish (2.4 → 2.5). lint:packaging updated."
+breaking: false
+security: false
+---
+
+# 0.1.24 — 2026-05-23
+
+Maintenance release: framework update to `^0.9.6` and skill sync pass.
+
+## Changed
+
+- **`@cyanheads/mcp-ts-core`** `^0.9.4 → ^0.9.6`.
+- **Skills synced:** `maintenance` (2.3 → 2.4), `polish-docs-meta` (2.0 → 2.2), `release-and-publish` (2.4 → 2.5).
+- **`lint:packaging`** updated.
+- **`CLAUDE.md` / `AGENTS.md`** — framework version reference updated to `^0.9.6`.

package/changelog/0.1.x/0.1.25.md

@@ -0,0 +1,23 @@
+---
+summary: "@cyanheads/mcp-ts-core ^0.9.6 → ^0.9.13: HTTP 413 body cap, session-init gate, quieter 401/403/400/404 logs, GET /mcp keywords; MCPB placeholder stripping in server config"
+breaking: false
+security: false
+---
+
+# 0.1.25 — 2026-05-28
+
+## Changed
+
+- **`@cyanheads/mcp-ts-core`** ^0.9.6 → ^0.9.13 — picks up HTTP transport hardening and DX improvements:
+  - **`MCP_HTTP_MAX_BODY_BYTES`** — inbound request body capped at 1 MiB by default; oversized requests rejected with HTTP 413 before body is parsed. ([#157](https://github.com/cyanheads/mcp-ts-core/issues/157))
+  - **HTTP session-init gate** — stateful HTTP mode now rejects requests without `Mcp-Session-Id` (pre-`initialize`) with HTTP 400. ([#154](https://github.com/cyanheads/mcp-ts-core/issues/154))
+  - **Expected client errors** (401, 403, 400, 404) logged at warning level instead of full error pipeline with stack traces. ([#158](https://github.com/cyanheads/mcp-ts-core/issues/158))
+  - **`GET /mcp`** now surfaces `package.json` `keywords` on the status JSON. ([#165](https://github.com/cyanheads/mcp-ts-core/issues/165))
+- **`package.json` keywords** — added `bun`, `stdio`, `streamable-http` to surface via `GET /mcp` discovery.
+- **`server-config.ts`** — MCPB `user_config` placeholder stripping: `z.preprocess(stripPlaceholder, ...)` guards each field so `${user_config.X}` pass-through strings fall back to the schema default instead of crashing the coercion.
+- **`src/index.ts`** — `requireAuth: false` made explicit.
+
+## Dependencies
+
+- `@cyanheads/mcp-ts-core` ^0.9.6 → ^0.9.13
+- `@biomejs/biome` ^2.4.15 → ^2.4.16

package/changelog/0.1.x/0.1.26.md

@@ -0,0 +1,16 @@
+---
+summary: "@cyanheads/mcp-ts-core ^0.9.13 → ^0.9.16: skills and scripts synced to framework version"
+breaking: false
+security: false
+---
+
+# 0.1.26 — 2026-05-30
+
+## Changed
+
+- **`@cyanheads/mcp-ts-core`** ^0.9.13 → ^0.9.16 — framework dependency updated; skills and build scripts synced to the new framework version.
+- **`skills/`** — all framework-managed skill files synced to ^0.9.16 (context API, linter rules, tool scaffolding, maintenance, setup, and others).
+- **`scripts/check-skills-sync.ts`** — detects stale framework skills in agent mirrors (skills deleted upstream but never pruned from `.claude/skills/` or `.agents/skills/`).
+- **`scripts/build-changelog.ts`** — minor wording fix in missing-summary warning.
+- **`package.json`** — `format` script restricted to safe fixes only; `format:unsafe` added for Biome's unsafe autofixes.
+- **`.mcpbignore`** — `skills/` excluded from MCPB bundles.

package/changelog/0.1.x/0.1.3.md

@@ -0,0 +1,19 @@
+---
+summary: "Input validation hardening, resource listing support, and documentation updates."
+breaking: false
+security: false
+---
+
+# 0.1.3 — 2026-03-29
+
+Input validation hardening, resource listing support, and documentation updates.
+
+## Changed
+
+- Added `.min(1)` validation to `expression` input — empty strings now rejected at schema level
+- Changed `precision` minimum from 0 to 1 (significant digits must be at least 1)
+- Added empty-expression guard in `MathService.validateInput()`
+- Added `list` callback to `calculator://help` resource for resource listing support
+- Updated `server.json` description wording
+- Added floating-point rounding note to help content for unit conversions
+- Added `migrate-mcp-ts-template` skill and `bun run lint:mcp` command to agent protocol

package/changelog/0.1.x/0.1.4.md

@@ -0,0 +1,20 @@
+---
+summary: "Dependency update, input validation tightening, and error message improvements."
+breaking: false
+security: false
+---
+
+# 0.1.4 — 2026-03-30
+
+Dependency update, input validation tightening, and error message improvements.
+
+## Changed
+
+- Upgraded `@cyanheads/mcp-ts-core` from `^0.2.8` to `^0.2.9`
+- Reduced max `precision` parameter from 64 to 16 significant digits
+- Updated `resultType` output description to use `DenseMatrix` (matching math.js actual type name)
+- Added guard for non-finite evaluation results (Infinity, NaN) — now throws `InvalidParams` with an actionable message
+- Improved error messages for expression evaluation failures with `Invalid expression:` prefix
+- Removed explicit `list` callback from `calculator://help` resource (framework handles resource listing)
+- Aligned `server.json` description with README tagline
+- Removed "STDIO & Streamable HTTP" from README tagline

package/changelog/0.1.x/0.1.5.md

@@ -0,0 +1,19 @@
+---
+summary: "Trigonometric simplification rules and stricter non-finite result handling."
+breaking: false
+security: false
+---
+
+# 0.1.5 — 2026-03-30
+
+Trigonometric simplification rules and stricter non-finite result handling.
+
+## Added
+
+- Trigonometric simplification rules — Pythagorean identities, double-angle identities, and tan/sec/csc/cot relationships applied during `simplify` operations
+- Tests for trig simplification (Pythagorean, double-angle, `1 - sin^2`, `tan^2 + 1`)
+
+## Changed
+
+- Updated `simplify` operation description to mention algebraic and trigonometric identity support
+- Non-finite results (Infinity, NaN) from division (e.g., `1/0`, `0/0`) now throw instead of returning silently — tests updated to expect throws

package/changelog/0.1.x/0.1.6.md

@@ -0,0 +1,26 @@
+---
+summary: "Security hardening: scope sanitization, result type/size validation, newline separator blocking, and prototype pollution prevention."
+breaking: false
+security: false
+---
+
+# 0.1.6 — 2026-03-30
+
+Security hardening: scope sanitization, result type/size validation, newline separator blocking, and prototype pollution prevention.
+
+## Added
+
+- `CALC_MAX_RESULT_LENGTH` env var — configurable maximum result string length (default 100,000 characters)
+- Blocked result types (`function`, `Function`, `ResultSet`, `Parser`) — prevents leaking internal source code or multi-expression bypass
+- Blocked scope keys — rejects prototype-polluting keys (`__proto__`, `constructor`, `prototype`, etc.) in variable scope
+- Result size validation on all output paths (evaluate, simplify, derivative)
+- Redacted `version` constant in expression scope — prevents math.js version fingerprinting
+- `parser` added to disabled functions list
+
+## Changed
+
+- Upgraded `@cyanheads/mcp-ts-core` from `^0.2.9` to `^0.2.10`
+- Renamed `hasTopLevelSemicolon` → `hasExpressionSeparator` — now also blocks newline (`\n`, `\r`) expression separators
+- Added `.max(50)` and alphanumeric regex validation to `variable` input parameter
+- Added `.int()`, `.min()`, `.max()` constraints to `maxExpressionLength` and `evaluationTimeoutMs` config fields
+- Updated error message for multi-expression rejection to cover newlines

package/changelog/0.1.x/0.1.7.md

@@ -0,0 +1,19 @@
+---
+summary: "Public hosted instance and distribution metadata."
+breaking: false
+security: false
+---
+
+# 0.1.7 — 2026-03-30
+
+Public hosted instance and distribution metadata.
+
+## Added
+
+- Public hosted server section in README with streamable-http config example (`https://calculator.caseyjhand.com/mcp`)
+- npm and Docker badges in README header
+- `remotes` array in `server.json` with public streamable-http endpoint
+
+## Changed
+
+- Reorganized Getting Started section — "Public Hosted Instance" before "Self-Hosted / Local"

package/changelog/0.1.x/0.1.8.md

@@ -0,0 +1,18 @@
+---
+summary: "Package metadata and dev dependency updates."
+breaking: false
+security: false
+---
+
+# 0.1.8 — 2026-03-30
+
+Package metadata and dev dependency updates.
+
+## Added
+
+- Funding metadata — GitHub Sponsors and Buy Me a Coffee links in `package.json`
+
+## Changed
+
+- Expanded `author` field with email and homepage URL
+- Bumped `@biomejs/biome` from `^2.4.9` to `^2.4.10`

package/changelog/0.1.x/0.1.9.md

@@ -0,0 +1,29 @@
+---
+summary: "Dependency refresh, form-client input normalization, and metadata updates."
+breaking: false
+security: false
+---
+
+# 0.1.9 — 2026-04-14
+
+Dependency refresh, form-client input normalization, and metadata updates.
+
+## Added
+
+- `AGENTS.md` to the published package file list
+- `skills/add-app-tool/` from the latest `@cyanheads/mcp-ts-core` skill sync
+
+## Changed
+
+- Upgraded `@cyanheads/mcp-ts-core` from `^0.2.10` to `^0.3.5`
+- Upgraded `mathjs` from `^15.1.1` to `^15.2.0`
+- Upgraded `@biomejs/biome` from `^2.4.10` to `^2.4.12`, `@types/node` from `^25.5.0` to `^25.6.0`, and `vitest` from `^4.1.2` to `^4.1.4`
+- Synced project skills with the newer framework skill set
+- Normalized blank optional `variable` and `precision` inputs from form-based MCP clients so they are treated as omitted
+- Removed the `calculator://help` reference from the `calculate` tool description and rewrote schema descriptions as single strings without `+` concatenation
+- Regenerated `bun.lock` and `docs/tree.md`
+- Bumped package, server metadata, README badge, and agent protocol files to `0.1.9`
+
+## Fixed
+
+- Cleared `bun audit` warnings by regenerating the lockfile against the updated dependency graph

package/changelog/0.2.x/0.2.0.md

@@ -0,0 +1,18 @@
+---
+summary: "Output context fields (operation/scopeVars/precisionUsed), standard notation aliases (ln, arc*), and non-finite guard extended to matrices and complex numbers"
+breaking: false
+security: false
+---
+
+# 0.2.0 — 2026-05-30
+
+## Added
+
+- **`operation`** echoed in `calculate` output — the operation applied (`evaluate`, `simplify`, `derivative`), present on every response so callers can self-verify the dispatch. ([#12](https://github.com/cyanheads/calculator-mcp-server/issues/12))
+- **`scopeVars`** echoed in `calculate` output — keys from the active scope, or `null` when no scope was provided; values are omitted to keep output compact. ([#12](https://github.com/cyanheads/calculator-mcp-server/issues/12))
+- **`precisionUsed`** echoed in `calculate` output — the significant-digit precision applied, or `null` for full-precision or symbolic operations. ([#12](https://github.com/cyanheads/calculator-mcp-server/issues/12))
+- **Standard notation aliases** — `ln` → `log` and `arc*` → `a*` (full inverse-trig family: `arcsin`/`arccos`/`arctan`, `arcsinh`/`arccosh`/`arctanh`, `arcsec`/`arccsc`/`arccot`, `arcsech`/`arccsch`/`arccoth`) normalized pre-parse across `evaluate`, `simplify`, and `derivative`. ([#13](https://github.com/cyanheads/calculator-mcp-server/issues/13))
+
+## Fixed
+
+- **`undefined_result` guard** now fires for non-finite values inside `DenseMatrix`/`SparseMatrix` elements and `Complex` real/imaginary parts, not only scalar `number` results. Previously `[1/0, 2]` returned `[Infinity, 2]` and `1/0 + 2i` returned `Infinity + Infinityi`; both now throw `undefined_result`. ([#11](https://github.com/cyanheads/calculator-mcp-server/issues/11))

package/changelog/0.3.x/0.3.0.md

@@ -0,0 +1,19 @@
+---
+summary: "Omit null context fields from output, block function-source leak via toString/toLocaleString, string-literal-aware separator scan"
+breaking: false
+security: true
+---
+
+# 0.3.0 — 2026-05-31
+
+## Changed
+
+- **`calculate` output** — `scopeVars` and `precisionUsed` are now omitted entirely when they carry no information: `scopeVars` is absent when no `scope` was supplied; `precisionUsed` is absent when no `precision` was applied or the operation is symbolic (`simplify`/`derivative`). Both were previously emitted as `null`. Output schema marks both fields `.optional()` (was `.nullable()`). Backward-compatible — an absent field and a `null` field are both "no value" signals; consumers that check `if (result.scopeVars)` are unaffected. ([#14](https://github.com/cyanheads/calculator-mcp-server/issues/14))
+
+## Fixed
+
+- **String-literal-aware separator scan** — single expressions whose `;` or newline is inside a double-quoted string literal (e.g. `"hello;world"`, `concat("a;b", "c")`) are no longer falsely rejected as "multiple expressions." The scan now skips quoted spans including escaped characters (`\"`). Also fixes a benign converse: a `[` inside a string no longer corrupts the bracket-depth counter. ([#16](https://github.com/cyanheads/calculator-mcp-server/issues/16))
+
+## Security
+
+- **Function-to-string source blocked** — `cos.toString()`, `import.toString()`, their `.toLocaleString()` equivalents, and bracket forms (`cos["toString"]()`) now reject with `disallowed_result_type`. These calls returned internal function source as a plain string, slipping past the result-type guard (which inspects the value after stringification). The fix is a parse-time AST check (`validateNoFunctionStringification`) that rejects `.toString`/`.toLocaleString` access on any operand before evaluation — information disclosure, no code-execution path. ([#15](https://github.com/cyanheads/calculator-mcp-server/issues/15))

package/changelog/0.3.x/0.3.1.md

@@ -0,0 +1,30 @@
+---
+summary: "@cyanheads/mcp-ts-core ^0.9.16 → ^0.9.21; HTTP log context fix; fetchWithTimeout secret redaction; withRetry fail-fast on non-retryable errors; release:github script added"
+breaking: false
+security: false
+agent-notes: |
+  Framework adoption: ^0.9.16 → ^0.9.21. Key changes: HTTP transport per-request log/trace context
+  fix (fresh request + trace/span IDs per request instead of frozen boot context); fetchWithTimeout
+  strips query-string secrets from error messages; withRetry now fail-fasts on non-retryable errors
+  and ctx.fail auto-populates the retryable flag. No source changes needed — runtime behavior
+  improvements only.
+---
+
+# 0.3.1 — 2026-06-02
+
+## Changed
+
+- **`@cyanheads/mcp-ts-core`** bumped `^0.9.16 → ^0.9.21`. Notable changes adopted:
+  - HTTP transport per-request log context fix — per-request logs and traces now carry fresh request + trace/span IDs instead of the frozen boot context.
+  - **`fetchWithTimeout`** strips query-string secrets (e.g. `?api_key=`) from error messages and logs.
+  - **`withRetry`** fail-fast on non-retryable errors; `ctx.fail` auto-populates the retryable flag.
+- Skills re-synced to framework 0.9.21 (`add-tool`, `add-service`, `api-canvas`, `api-context`, `api-linter`, `api-utils`, `design-mcp-server`, `release-and-publish`); new `api-mirror` and `orchestrations` skills added.
+- `scripts/devcheck.ts` refreshed with framework-aligned checks; `scripts/check-skill-versions.ts` and `scripts/release-github.ts` added.
+- **`release:github`** script added to `package.json`.
+- README client-config key renamed to full package name; `.claude-plugin` and `.codex-plugin` manifest args simplified.
+
+## Dependencies
+
+- `@cyanheads/mcp-ts-core` ^0.9.16 → ^0.9.21
+- `tsx` ^4.22.3 → ^4.22.4
+- `vitest` ^4.1.7 → ^4.1.8

package/changelog/0.3.x/0.3.2.md

@@ -0,0 +1,18 @@
+---
+summary: "simplify unchanged detection (#1); numericType parameter for BigNumber/Fraction evaluate paths (#7)"
+breaking: false
+security: false
+---
+
+# 0.3.2 — 2026-06-04
+
+## Added
+
+- **`numericType`** input parameter on `calculate` — `"number"` (default, IEEE 754), `"BigNumber"` (arbitrary precision), `"Fraction"` (exact rational). Lets callers escalate past 64-bit float overflow without changing the default path. Three pre-initialized hardened instances (one per type) selected at evaluation time — no per-request reconfiguration overhead. ([#7](https://github.com/cyanheads/calculator-mcp-server/issues/7))
+- **`unchanged`** boolean field in `simplify` output — `true` when the simplifier returned the expression without reduction (e.g. rational expressions requiring polynomial factoring); `false` when simplification made structural progress. Absent for `evaluate` and `derivative`. ([#1](https://github.com/cyanheads/calculator-mcp-server/issues/1))
+- Help text updated: `numericType` documented under `evaluate`; known simplifier limits (no polynomial factoring / rational cancellation) documented under `simplify`.
+
+## Fixed
+
+- **`simplify`** no longer returns a result indistinguishable from a no-op: the `unchanged` flag distinguishes "already simplified" from "simplifier made no progress". Detection compares AST-normalized input and output (formatting-only diffs don't count as progress). ([#1](https://github.com/cyanheads/calculator-mcp-server/issues/1))
+- **Large factorial ratios** (e.g. `10000! / 9999!`) that overflow IEEE 754 can now be evaluated via `numericType: "BigNumber"`. Default `"number"` path behavior unchanged. ([#7](https://github.com/cyanheads/calculator-mcp-server/issues/7))

package/changelog/0.3.x/0.3.3.md

@@ -0,0 +1,27 @@
+---
+summary: "Adopt @cyanheads/mcp-ts-core ^0.10.6: explicit name/title server identity, Dockerfile image.version label + /healthz HEALTHCHECK, post-pack bundle cleaner, devcheck identity/antipattern/packaging checks."
+breaking: false
+security: false
+---
+
+# 0.3.3 — 2026-06-15
+
+Framework maintenance release: adopts `@cyanheads/mcp-ts-core` `^0.9.21 → ^0.10.6`. No change to the `calculate` tool or `calculator://help` resource surface.
+
+## Added
+
+- **`scripts/clean-mcpb.ts`** — post-pack `.mcpb` bundle cleaner, wired into the `bundle` script after `mcpb pack`. Runs `mcpb clean` (dev-dependency prune) then strips `node_modules/**` agent-doc entries (`skills/`, `.claude/`, `.agents/` trees and `SKILL.md` files) that root-anchored `.mcpbignore` patterns cannot reach. ([mcp-ts-core#230](https://github.com/cyanheads/mcp-ts-core/issues/230))
+- **`techniques` skill** — catalog of reusable response/data-shaping patterns; the first reference documents outline-on-overflow. ([mcp-ts-core#204](https://github.com/cyanheads/mcp-ts-core/issues/204))
+
+## Changed
+
+- **Server identity** — `createApp()` now sets explicit `name: 'calculator-mcp-server'` and `title: 'calculator-mcp-server'`, forwarded to `initialize` serverInfo and `/.well-known/mcp.json`; `.codex-plugin/plugin.json` `displayName` dropped its npm scope to match. ([mcp-ts-core#213](https://github.com/cyanheads/mcp-ts-core/issues/213), [mcp-ts-core#231](https://github.com/cyanheads/mcp-ts-core/issues/231))
+- **`Dockerfile`** — stamps `org.opencontainers.image.version` from an `APP_VERSION` build arg (passed by the release `docker buildx` command), and adds a `HEALTHCHECK` that probes `/healthz` via bun-native `fetch` (no `curl`/`wget` in the slim image). ([mcp-ts-core#202](https://github.com/cyanheads/mcp-ts-core/issues/202), [mcp-ts-core#217](https://github.com/cyanheads/mcp-ts-core/issues/217))
+- **`devcheck`** — gains three checks active on this upgrade: the `coerce-boolean-env-flag` antipattern rule (flags `z.coerce.boolean()` in `src/`, recommends `z.stringbool()`), and `lint:packaging` checks 8 (post-bundle content guard) and 9 (`name`/`title`/`display_name` identity must equal the unscoped package name). ([mcp-ts-core#201](https://github.com/cyanheads/mcp-ts-core/issues/201), [mcp-ts-core#230](https://github.com/cyanheads/mcp-ts-core/issues/230), [mcp-ts-core#231](https://github.com/cyanheads/mcp-ts-core/issues/231))
+- **`.mcpbignore`** — dev-dir patterns re-anchored to root (`/skills/`, `/.claude/`, `/.agents/`, `/Dockerfile`, …) so they cannot strip nested `node_modules` runtime paths. ([mcp-ts-core#207](https://github.com/cyanheads/mcp-ts-core/issues/207))
+- **Project skills re-synced** to the 0.10.x framework and the `devcheck` skill entry replaced by `techniques`.
+- **Dependencies** — `@cyanheads/mcp-ts-core` `^0.9.21 → ^0.10.6`, `@biomejs/biome` `^2.4.16 → ^2.5.0`, `@types/node` `^25.9.1 → ^25.9.3`, `vitest` `^4.1.8 → ^4.1.9`.
+
+## Fixed
+
+- **`scripts/check-skill-versions.ts`** — guards an `ENOENT` crash when a skill file is deleted in the same change set (e.g. the removed `skills/devcheck/SKILL.md`); the version check now skips deleted files instead of reading a missing path.

package/changelog/0.3.x/0.3.4.md

@@ -0,0 +1,17 @@
+---
+summary: "Statistics/combinatorics function-name aliases (stdev, stddev, permute, nPr, choose, nCr) and a richer expression description that names canonical functions per advertised category."
+breaking: false
+security: false
+---
+
+# 0.3.4 — 2026-06-15
+
+The `calculate` tool advertises statistics, combinatorics, and matrix support, but its `expression` description named only basic functions and the categorized list lives in the `calculator://help` resource that most clients never expose. Agents fell back to names from other ecosystems that math.js doesn't define. Two complementary changes — additive aliases catch the common guess, the description converges the rest. ([#17](https://github.com/cyanheads/calculator-mcp-server/issues/17))
+
+## Added
+
+- **Function-name aliases** — `stdev`/`stddev` → `std`, `permute`/`nPr` → `permutations`, `choose`/`nCr` → `combinations`, registered via `math.import` alongside the existing `average`/`avg` → `mean`. None are math.js builtins, so the imports are purely additive; statistics/combinatorics functions aren't differentiable, so a value-alias suffices (no `normalizeNotation` rewrite, unlike `ln`/`arc*`). Mirrored into the `calculator://help` Statistics and Combinatorics sections. ([#17](https://github.com/cyanheads/calculator-mcp-server/issues/17))
+
+## Changed
+
+- **`calculate` `expression` description** — now names canonical functions per advertised category (statistics: `mean`, `median`, `std`, `variance`; combinatorics: `factorial`, `permutations`, `combinations`; matrix: `det`, `inv`, `transpose`) and notes that common synonyms resolve to their math.js names, so an agent reaches for a real name instead of guessing. ([#17](https://github.com/cyanheads/calculator-mcp-server/issues/17))

package/changelog/0.3.x/0.3.5.md

@@ -0,0 +1,23 @@
+---
+summary: "Adopt mcp-ts-core ^0.10.9: two new devcheck guards (floating dependency specifiers, plugin marketplace manifest correctness), re-synced skills and tooling scripts."
+breaking: false
+security: false
+---
+
+# 0.3.5 — 2026-06-20
+
+Maintenance pass adopting `@cyanheads/mcp-ts-core` `^0.10.6` → `^0.10.9`. No tool, resource, or runtime behavior changes.
+
+## Added
+
+- **`check-dependency-specifiers` devcheck step** — new `scripts/check-dependency-specifiers.ts` (`Dependency Specifiers` gate) hard-fails on floating specifiers (`latest`, `*`, pre-release dist-tags) in `package.json`'s dependency sections and `bun.lock`'s `workspaces` map, catching a `latest` dist-tag that `bun update --latest` can write into the lock and slip a held dependency past its range. ([mcp-ts-core#246](https://github.com/cyanheads/mcp-ts-core/issues/246))
+- **Plugin marketplace manifest checks** — `scripts/lint-packaging.ts` validates `.claude-plugin`/`.codex-plugin` manifests for non-empty descriptions, unscoped display names, and a full-name `npx -y` install arg; gated by the new `devcheck.config.json` `packaging.pluginManifests` flag (default on). ([mcp-ts-core#240](https://github.com/cyanheads/mcp-ts-core/issues/240))
+
+## Changed
+
+- **Skills + tooling re-synced** — 14 `skills/*/SKILL.md` files and the devcheck script suite (`devcheck.ts`, `build-changelog.ts`, `check-framework-antipatterns.ts`, `check-skill-versions.ts`, `lint-packaging.ts`) mirror the framework's 0.10.7–0.10.9 changes, including fresh-scaffold guards that skip git-dependent and changelog-sync checks cleanly when `.git` is absent ([mcp-ts-core#242](https://github.com/cyanheads/mcp-ts-core/issues/242), [mcp-ts-core#243](https://github.com/cyanheads/mcp-ts-core/issues/243)) and a `check-skill-versions` guard for worktree-deleted skills ([mcp-ts-core#237](https://github.com/cyanheads/mcp-ts-core/issues/237)).
+
+### Dependency bumps
+
+- `@cyanheads/mcp-ts-core` `^0.10.6` → `^0.10.9`
+- `@types/node` `^25.9.3` → `^26.0.0`

package/changelog/0.4.x/0.4.0.md

@@ -0,0 +1,28 @@
+---
+summary: "Security: simplify/derivative now run on the hardened math.js instance (closing a constant-folding bypass), a dedicated fraction_unsupported error for Fraction-mode irrational results, length/len aliases for count, and a lockfile refresh clearing all 9 transitive audit advisories."
+breaking: false
+security: true
+---
+
+# 0.4.0 — 2026-07-02
+
+## Added
+
+- **`fraction_unsupported` error** — evaluating with `numericType: "Fraction"` when the expression has no exact rational value (irrational or transcendental result, e.g. `sqrt(2)`, `sin(1)`, `log(3)`) now throws a dedicated `ValidationError` with retry guidance ("use `number` or `BigNumber`") instead of the misleading, syntax-oriented `parse_failed`. `MathService.runWithTimeout` remaps the math.js implicit-conversion failure only on the Fraction evaluate path; genuine syntax errors still surface as `parse_failed`. ([#19](https://github.com/cyanheads/calculator-mcp-server/issues/19))
+- **`length`/`len` aliases** — both resolve to math.js `count` (element count for arrays/matrices, character count for strings), registered per hardened instance so they work under every `numericType`. Mirrored into the `calculator://help` Statistics section. ([#20](https://github.com/cyanheads/calculator-mcp-server/issues/20))
+
+## Changed
+
+- **`numericType` `"Fraction"` description** — tightened from "without transcendental functions" to "expressions with exactly-rational results", naming the `fraction_unsupported` failure mode and the fallback types, in both the tool schema and `calculator://help`. ([#19](https://github.com/cyanheads/calculator-mcp-server/issues/19))
+- **`expression` description** — now lists `length`/`len` among the synonyms that resolve to math.js names. ([#20](https://github.com/cyanheads/calculator-mcp-server/issues/20))
+
+### Dependency bumps
+
+- `@cyanheads/mcp-ts-core` `^0.10.9` → `^0.10.10`
+- `@biomejs/biome` `^2.5.0` → `^2.5.2`
+- `@types/node` `^26.0.0` → `^26.1.0`
+
+## Security
+
+- **`simplify`/`derivative` hardening bypass closed** — symbolic operations previously ran on a separate, unhardened math.js instance, so constant-folding inside them could execute disabled functions (a folded `evaluate("…")` ran arbitrary sub-expressions) and leak the redacted math.js `version` or function source via `.toString()`. `parse`/`simplify`/`derivative` now reuse the hardened default instance — disabled functions resolve to their throwing stubs and the folder leaves those nodes unevaluated — and both symbolic paths run the same `.toString()`/`.toLocaleString()` AST guard as `evaluate`. ([#18](https://github.com/cyanheads/calculator-mcp-server/issues/18))
+- **`bun audit` advisories cleared** — lockfile re-resolve took the audit from 9 vulnerabilities (2 high, 6 moderate, 1 low) to 0 via transitive bumps: `hono` 4.12.26 → 4.12.27, `vite` 8.0.14 → 8.1.3, `js-yaml` 3.14.2 → 3.15.0.

package/changelog/0.4.x/0.4.1.md

@@ -0,0 +1,28 @@
+---
+summary: "MCP SDK v2 compatibility with strict tool inputs, declared error envelopes, 2026 protocol support, and a 24-hour public cache hint for calculator help."
+breaking: false
+security: false
+---
+
+# 0.4.1 — 2026-08-22
+
+## Changed
+
+- **MCP protocol** — `@cyanheads/mcp-ts-core` now serves protocol revision 2026-07-28 while retaining compatibility with 2025-era clients.
+- **`calculate` input and error contracts** — undeclared root fields are rejected, and the advertised output schema includes the structured error envelope so validating clients accept failed calls.
+- **`calculator://help`** — advertises a public 24-hour cache hint to 2026-era clients.
+- **Bun 1.4 container** — the build stage targets `BUILDPLATFORM`; the production image omits optional peers and lifecycle scripts while retaining optional OpenTelemetry installation.
+- **Supply-chain and typecheck gates** — installs use the three-day release hold and Socket scanner, while the TypeScript 7 configuration includes the test tree.
+- **Project templates** — framework skills, build scripts, package metadata, and community-health files are synced to the current scaffold.
+
+## Dependencies
+
+- `@cyanheads/mcp-ts-core` `^0.10.10` → `^0.12.3`
+- `@biomejs/biome` `^2.5.2` → `^2.5.9`
+- `@socketsecurity/bun-security-scanner` added at `^1.1.2`
+- `@types/node` `^26.1.0` → `^26.2.0`
+- `ignore` `^7.0.5` → `^7.0.6`
+- `tsc-alias` `^1.8.17` → `^1.9.2`
+- `tsx` `^4.22.4` removed
+- `typescript` `^6.0.3` → `^7.0.2`
+- `vitest` `^4.1.9` → `^4.1.11`

package/changelog/0.4.x/0.4.2.md

@@ -0,0 +1,26 @@
+---
+summary: "Framework adoption and calculator configuration"
+breaking: false
+security: false
+---
+
+# 0.4.2 — 2026-09-13
+
+## Changed
+
+- **Calculator limits** — Claude Code and Codex plugins now expose the optional expression, timeout, and result limits; blank MCPB settings resolve to the documented defaults.
+- **Configuration validation** — blank and whole-value `${…}` placeholders fall back to the documented defaults (`@cyanheads/mcp-ts-core` 0.13.0), while a malformed partial placeholder now fails startup instead of silently defaulting.
+- **HTTP sessions** — the example configuration selects stateless serving to match the shipped container, while an unset session mode retains the framework's stateful `auto` resolution.
+- **Framework behavior** — `@cyanheads/mcp-ts-core` 0.12.7 returns a structured `InvalidParams` (-32602) envelope for argument rejections; 0.12.8 stops a trailing slash on `MCP_PUBLIC_URL` doubling in advertised links; 0.12.9 closes a cancelled request's SSE stream immediately.
+- **Runtime requirement** — Bun 1.4.0 is now the minimum supported Bun release.
+- **Project tooling** — framework skills moved to `framework-skills/`; `audit:fix` runs `bun audit fix` (0.13.0); devcheck, packaging validation, issue forms, and release guidance were synced to the current framework assets.
+
+## Dependencies
+
+- `@cyanheads/mcp-ts-core` `^0.12.3` → `^0.13.0`
+- `zod` `^4.4.3` → `^4.6.1`
+- `@biomejs/biome` `^2.5.9` → `^2.5.13`
+- `@types/node` `^26.2.0` → `^26.5.1`
+- `ignore` `^7.0.6` → `^7.0.9`
+- `tsc-alias` `^1.9.2` → `^1.9.4`
+- `vitest` `^4.1.11` → `^5.0.0`