@expressivecss/mcp-server 0.3.0 → 0.4.0

package/.claude-plugin/plugin.json

@@ -1,7 +1,7 @@
 {
   "name": "expressivecss-mcp",
   "displayName": "ExpressiveCSS MCP",
-  "version": "0.3.0",
+  "version": "0.4.0",
   "description": "ExpressiveCSS workflow server with Setup Expert, Rules Enforcer, Creative Director, Page Arcjitect, Component Syntax Expert, and Quality Inspector.",
   "author": {
     "name": "BaezFJ",

package/.cursor-plugin/plugin.json

@@ -1,7 +1,7 @@
 {
   "name": "expressivecss-mcp",
   "displayName": "ExpressiveCSS MCP",
-  "version": "0.3.0",
+  "version": "0.4.0",
   "description": "ExpressiveCSS workflow server with Setup Expert, Rules Enforcer, Creative Director, Page Arcjitect, Component Syntax Expert, and Quality Inspector.",
   "author": {
     "name": "BaezFJ",

package/CHANGELOG.md

@@ -1,5 +1,34 @@
 # Changelog
 
+## 0.4.0 - 2026-10-11
+
+- Command-output redaction no longer stalls the server on long token runs.
+  160K characters of hex output took 6 s to redact; it now takes milliseconds.
+- New `EXPRESSIVECSS_MCP_ALLOWED_PROJECT_ROOTS` setting limits which
+  directories a caller can pass as `projectRoot`. It is unset by default, which
+  keeps the current behavior.
+- Calls with a `projectRoot` are 3 to 5 times faster. The server resolves the
+  ExpressiveCSS version once per call and sizes file buffers to the file
+  instead of the read limit.
+- Tool results use compact JSON text, which is about a third smaller.
+- The catalogue, guides and rules cover map, confetti and particles.
+- Bundled framework guidance: ExpressiveCSS 0.14.1.
+
+## 0.3.1 - 2026-10-08
+
+- Fix `npx @expressivecss/mcp-server`, which failed with "could not determine
+  executable to run" from 0.2.0 onward because the package has two bins. A
+  `mcp-server` bin now starts the server, so the documented client config works.
+  The `expressivecss-mcp` bin is unchanged.
+- The server and `expressivecss-lint` start about 0.3 s faster. jsdom now loads
+  the first time a check inspects markup instead of at startup.
+- The catalogue, guides and rules cover 29 more components: accordion, aura,
+  avatar, the eight chart types, command palette, countdown, data table,
+  drop zone, empty state, KPI, marquee, message, message scroller, popover,
+  questionnaire, rating, rich text editor, skeleton, stat, stepper, timeline
+  and tree.
+- Bundled framework guidance: ExpressiveCSS 0.13.1.
+
 ## 0.3.0 - 2026-10-06
 
 - Breaking: guidance tools now cap each result at 64 KiB of UTF-8 by

package/README.md

@@ -619,6 +619,7 @@ network limits, evidence handling, and bounded repair workflow.
 - `EXPRESSIVECSS_MCP_QA_MAX_TOTAL_MB`
 - `EXPRESSIVECSS_MCP_COMMAND_TIMEOUT_MS`
 - `EXPRESSIVECSS_MCP_ALLOWED_COMMAND_ROOTS`
+- `EXPRESSIVECSS_MCP_ALLOWED_PROJECT_ROOTS`
 - `SKIP_SETUP_EXPERT`
 - `SKIP_RULES_ENFORCER`
 - `SKIP_CREATIVE_DIRECTOR`
@@ -642,6 +643,8 @@ EXPRESSIVECSS_MCP_ALLOWED_COMMAND_ROOTS=["/srv/projects/site-a","/srv/projects/s
 
 The real `projectRoot` must equal or be contained by one of those roots. A tool caller cannot expand this policy. Allowed commands receive only the executable path, system/temp/locale variables, `CI=1`, `NO_COLOR=1`, and `HOME`/`USERPROFILE` reset to the project root. API keys, tokens, passwords, cloud credentials, SSH agent variables, and other MCP-process environment values are not forwarded.
 
+Any tool accepts a `projectRoot` by default, and `quality_inspector` reports the existence, size and SHA-256 of files under it. To limit which directories a caller can name, set `EXPRESSIVECSS_MCP_ALLOWED_PROJECT_ROOTS` in the same format. A `projectRoot` whose real path is outside every listed root fails with a tool error. An empty or invalid value denies every caller-supplied root. The default root, from `--project-root` or the working directory, is not checked.
+
 ## Sample client configuration
 
 ### `mcp/expressivecss/mcp.json`