@expressivecss/mcp-server 0.3.1 → 0.4.0

package/.claude-plugin/plugin.json

@@ -1,7 +1,7 @@
 {
   "name": "expressivecss-mcp",
   "displayName": "ExpressiveCSS MCP",
-  "version": "0.3.1",
+  "version": "0.4.0",
   "description": "ExpressiveCSS workflow server with Setup Expert, Rules Enforcer, Creative Director, Page Arcjitect, Component Syntax Expert, and Quality Inspector.",
   "author": {
     "name": "BaezFJ",

package/.cursor-plugin/plugin.json

@@ -1,7 +1,7 @@
 {
   "name": "expressivecss-mcp",
   "displayName": "ExpressiveCSS MCP",
-  "version": "0.3.1",
+  "version": "0.4.0",
   "description": "ExpressiveCSS workflow server with Setup Expert, Rules Enforcer, Creative Director, Page Arcjitect, Component Syntax Expert, and Quality Inspector.",
   "author": {
     "name": "BaezFJ",

package/CHANGELOG.md

@@ -1,5 +1,19 @@
 # Changelog
 
+## 0.4.0 - 2026-10-11
+
+- Command-output redaction no longer stalls the server on long token runs.
+  160K characters of hex output took 6 s to redact; it now takes milliseconds.
+- New `EXPRESSIVECSS_MCP_ALLOWED_PROJECT_ROOTS` setting limits which
+  directories a caller can pass as `projectRoot`. It is unset by default, which
+  keeps the current behavior.
+- Calls with a `projectRoot` are 3 to 5 times faster. The server resolves the
+  ExpressiveCSS version once per call and sizes file buffers to the file
+  instead of the read limit.
+- Tool results use compact JSON text, which is about a third smaller.
+- The catalogue, guides and rules cover map, confetti and particles.
+- Bundled framework guidance: ExpressiveCSS 0.14.1.
+
 ## 0.3.1 - 2026-10-08
 
 - Fix `npx @expressivecss/mcp-server`, which failed with "could not determine

package/README.md

@@ -619,6 +619,7 @@ network limits, evidence handling, and bounded repair workflow.
 - `EXPRESSIVECSS_MCP_QA_MAX_TOTAL_MB`
 - `EXPRESSIVECSS_MCP_COMMAND_TIMEOUT_MS`
 - `EXPRESSIVECSS_MCP_ALLOWED_COMMAND_ROOTS`
+- `EXPRESSIVECSS_MCP_ALLOWED_PROJECT_ROOTS`
 - `SKIP_SETUP_EXPERT`
 - `SKIP_RULES_ENFORCER`
 - `SKIP_CREATIVE_DIRECTOR`
@@ -642,6 +643,8 @@ EXPRESSIVECSS_MCP_ALLOWED_COMMAND_ROOTS=["/srv/projects/site-a","/srv/projects/s
 
 The real `projectRoot` must equal or be contained by one of those roots. A tool caller cannot expand this policy. Allowed commands receive only the executable path, system/temp/locale variables, `CI=1`, `NO_COLOR=1`, and `HOME`/`USERPROFILE` reset to the project root. API keys, tokens, passwords, cloud credentials, SSH agent variables, and other MCP-process environment values are not forwarded.
 
+Any tool accepts a `projectRoot` by default, and `quality_inspector` reports the existence, size and SHA-256 of files under it. To limit which directories a caller can name, set `EXPRESSIVECSS_MCP_ALLOWED_PROJECT_ROOTS` in the same format. A `projectRoot` whose real path is outside every listed root fails with a tool error. An empty or invalid value denies every caller-supplied root. The default root, from `--project-root` or the working directory, is not checked.
+
 ## Sample client configuration
 
 ### `mcp/expressivecss/mcp.json`

package/capability-roadmap.json

@@ -1,16 +1,16 @@
 {
   "schemaVersion": 1,
-  "frameworkVersion": "0.13.1",
-  "sourceRevision": "3ed93f73a1e5a5ab9d201993b132fd64d81478ca",
+  "frameworkVersion": "0.14.1",
+  "sourceRevision": "e48e958c184d2de2a972028a06c3a03e0e802197",
   "basis": "Reviewed checkout snapshot, not proof of published package contents or target-browser conformance. Implemented means only the named scope. Full Material parity remains unassessed.",
   "browserRun": {
-    "recordedOn": "2026-10-08",
+    "recordedOn": "2026-10-10",
     "engine": "chromium",
     "engineVersion": "153.0.8010.12",
     "nodeVersion": "v24.21.0",
     "status": "passed",
     "inputsCurrent": false,
-    "reportSha256": "b2f7a499810474b2448e87bde25fa13c969ab79a096d7281b84990803d624c47",
+    "reportSha256": "901697c1476a6369682ffc54fd0de71c0eed9db9a738b7f16d2c1780956ea287",
     "collector": "scripts/record-capability-evidence.mjs"
   },
   "entries": [
@@ -1432,22 +1432,22 @@
           "file": "tests/message-scroller-browser.test.js",
           "name": "chromium: message scroller follows output, keeps its place on prepend and anchors new turns",
           "scope": "Opening at the end, following streamed text, release on a wheel scroll up, the inert button and resuming from it, following kept through a click on a message, scrollToMessage with a peek and with a missing id, prepend preservation, an appended anchor at the peek with a spacer that clears as the reply grows, and destroy. No spoken-output assertion.",
-          "state": "not-recorded"
+          "state": "stale"
         },
         {
           "file": "tests/message-scroller-browser.test.js",
           "name": "chromium: message scroller opens saved transcripts at the requested position",
           "scope": "last-anchor on a long last turn, last-anchor falling back to the end, and start.",
-          "state": "not-recorded"
+          "state": "stale"
         },
         {
           "file": "tests/message-scroller-browser.test.js",
           "name": "chromium: message scroller jumps to a message inside a shadow root",
           "scope": "scrollToMessage called right after init finds a message in a shadow root and scrolls it one peek below the top; pressing the button from the keyboard there moves focus to the viewport as the button goes inert.",
-          "state": "not-recorded"
+          "state": "stale"
         }
       ],
-      "browserEvidence": "incomplete",
+      "browserEvidence": "needs-rerun",
       "recheckWhen": [
         "A reviewed source changes",
         "A mapped test or its recorded inputs change",
@@ -1933,9 +1933,9 @@
       "slug": "pie-chart",
       "title": "Pie chart",
       "kind": "component",
-      "support": "implemented",
+      "support": "unassessed",
       "lastReviewedSupport": "implemented",
-      "sourceReview": "source-reviewed",
+      "sourceReview": "needs-review",
       "reviewedOn": "2026-10-07",
       "scope": "Slices drawn clockwise from the top from a figure's data table, with a legend of each row's cell and share, donut, values and sparkline modifiers, a <tfoot> total in the donut hole, further columns in the tooltip, and a pointer and keyboard tooltip that highlights the slice.",
       "adaptation": "The <table> stays in the page as the text alternative and the no-JavaScript fallback; the slices, values, total and legend are aria-hidden and the plot is one Tab stop with a polite live tooltip.",
@@ -2006,9 +2006,9 @@
       "slug": "heatmap-chart",
       "title": "Heatmap chart",
       "kind": "component",
-      "support": "implemented",
+      "support": "unassessed",
       "lastReviewedSupport": "implemented",
-      "sourceReview": "source-reviewed",
+      "sourceReview": "needs-review",
       "reviewedOn": "2026-10-07",
       "scope": "Every body cell of a figure's data table drawn as a shaded grid cell, with row headers beside the grid, column headers below, a scale naming the lowest and highest cells, values, data-label short or hidden labels, data-min and data-max, gaps, and a pointer and keyboard tooltip that moves cell by cell.",
       "adaptation": "The <table> stays in the page as the text alternative and the no-JavaScript fallback; the grid, labels and scale are aria-hidden and the plot is one Tab stop with a polite live tooltip.",
@@ -3242,10 +3242,118 @@
           "file": "tests/marquee-browser.test.js",
           "name": "chromium: marquee loops its two groups, pauses, follows direction and stops under reduced motion",
           "scope": "A short group filling the strip, the copy one gap after it, the half-cycle position horizontally, in RTL and vertically, reverse, pausing on hover, focus and .paused, one link per item in the accessibility tree and the reduced-motion stop with the copy hidden. No spoken-output assertion.",
-          "state": "not-recorded"
+          "state": "stale"
+        }
+      ],
+      "browserEvidence": "needs-rerun",
+      "recheckWhen": [
+        "A reviewed source changes",
+        "A mapped test or its recorded inputs change",
+        "Google revises the linked guidance or before claiming a new release matches it"
+      ]
+    },
+    {
+      "slug": "confetti",
+      "title": "Confetti",
+      "kind": "component",
+      "support": "implemented",
+      "lastReviewedSupport": "implemented",
+      "sourceReview": "source-reviewed",
+      "reviewedOn": "2026-10-09",
+      "scope": "Bursts from a button's center over the page, inside an authored canvas, or from script, with count, angle, spread, speed, decay, gravity, drift, lifetime, origin, colors, square, circle and star shapes, and size options, theme colors by default and a promise that resolves when the burst ends.",
+      "adaptation": "A canvas drawn with requestAnimationFrame. The page canvas is an aria-hidden manual popover with pointer events off, so it draws above modal dialogs without blocking clicks. Reduced motion draws nothing.",
+      "upstream": {
+        "source": "https://m3.material.io/components",
+        "reviewedOn": "2026-10-09",
+        "scope": "web-extension-inventory-reviewed",
+        "note": "Requirements and boundaries: design reference web-extensions-review. The inventory page renders client-side, so this review relies on the 2026-09-13 inventory review. Full visual parity and spoken output unverified.",
+        "sections": [
+          "No standalone Material component"
+        ],
+        "sources": [],
+        "requirements": "Keep the effect decorative and out of the accessibility tree, never block input, state the outcome in text and draw nothing when reduced motion is requested."
+      },
+      "relationship": "none",
+      "sources": [
+        {
+          "path": "src/sass/components/_confetti.scss",
+          "sha256": "0dc01d28e2bf26877ab57e5d5504b6dbd734b3ef64f593bf67e34753922a3d63"
+        },
+        {
+          "path": "src/ts/components/confetti.ts",
+          "sha256": "c5f6f8782548d71bce17e1f701b7f7c1376c2a88252fc3e07238699125c6503e"
+        }
+      ],
+      "gaps": [
+        {
+          "kind": "verification",
+          "description": "The burst origin on a button and on a canvas, theme colors, manualStart, the page canvas in the top layer above a modal dialog with pointer events off and aria-hidden, its removal when the burst ends, destroy and the reduced-motion skip are checked in a browser; frame rate on low-end devices and forced colors remain unverified.",
+          "nextStep": "Watch a burst on a low-end phone and in forced colors, and confirm a screen reader announces nothing for it."
+        }
+      ],
+      "browserChecks": [
+        {
+          "file": "tests/confetti-browser.test.js",
+          "name": "chromium: confetti bursts from its trigger in theme colors, on its own canvas, above a modal dialog and not under reduced motion",
+          "scope": "A canvas bursting at its center on init, manualStart waiting for fire(), a button bursting from its center in the theme primary color, the page canvas covering the viewport in the top layer with aria-hidden and no pointer events, fire() resolving after it is removed, a burst over an open modal dialog, destroy and the reduced-motion skip. No spoken-output assertion.",
+          "state": "stale"
+        }
+      ],
+      "browserEvidence": "needs-rerun",
+      "recheckWhen": [
+        "A reviewed source changes",
+        "A mapped test or its recorded inputs change",
+        "Google revises the linked guidance or before claiming a new release matches it"
+      ]
+    },
+    {
+      "slug": "particles",
+      "title": "Particles",
+      "kind": "component",
+      "support": "unassessed",
+      "lastReviewedSupport": "implemented",
+      "sourceReview": "needs-review",
+      "reviewedOn": "2026-10-09",
+      "scope": "A canvas that covers its positioned ancestor with drifting dots that fade near the edges and lean toward the pointer, with quantity, staticity, ease, size, color and drift options and the theme on-surface color by default.",
+      "adaptation": "A canvas drawn with requestAnimationFrame, aria-hidden with pointer events off. The dot color comes from the canvas's CSS color, read each frame so theme changes apply. Reduced motion draws the dots once without motion.",
+      "upstream": {
+        "source": "https://m3.material.io/components",
+        "reviewedOn": "2026-10-09",
+        "scope": "web-extension-inventory-reviewed",
+        "note": "Requirements and boundaries: design reference web-extensions-review. The inventory page renders client-side, so this review relies on the 2026-09-13 inventory review. Full visual parity and spoken output unverified.",
+        "sections": [
+          "No standalone Material component"
+        ],
+        "sources": [],
+        "requirements": "Keep the effect decorative and out of the accessibility tree, never block input, keep text over it readable and stop motion when reduced motion is requested."
+      },
+      "relationship": "none",
+      "sources": [
+        {
+          "path": "src/sass/components/_particles.scss",
+          "sha256": "5d2d67515f7152d5b86d506e7fe42d9c66f058bd7b9e30a06a7b8fedc4738cc3"
+        },
+        {
+          "path": "src/ts/components/particles.ts",
+          "sha256": "7a22a1f580deb76e59bdeef75e8cfe432ee00743106a3348f5ad3c7f05e1f43b"
         }
       ],
-      "browserEvidence": "incomplete",
+      "gaps": [
+        {
+          "kind": "verification",
+          "description": "The canvas covering its box, the on-surface default and the color option, following the pointer only while it is over the canvas, drift, refitting on resize, destroy and the still drawing under reduced motion are checked in a browser; frame rate on low-end devices, forced colors and contrast of text over the dots remain unverified.",
+          "nextStep": "Watch a full-width hero of particles on a low-end phone and in forced colors, and check text contrast over the densest area."
+        }
+      ],
+      "browserChecks": [
+        {
+          "file": "tests/particles-browser.test.js",
+          "name": "chromium: particles fill their box in the theme color, follow the pointer, drift, refit on resize and stay still under reduced motion",
+          "scope": "The canvas covering its positioned ancestor, a dot fading in where it was placed in the theme on-surface color, following the pointer inside the canvas and holding when it leaves, destroy clearing the canvas, vx drift, the color option, the pixel buffer after a resize and still dots under reduced motion. No spoken-output assertion.",
+          "state": "stale"
+        }
+      ],
+      "browserEvidence": "needs-rerun",
       "recheckWhen": [
         "A reviewed source changes",
         "A mapped test or its recorded inputs change",
@@ -3360,6 +3468,66 @@
         "Google revises the linked guidance or before claiming a new release matches it"
       ]
     },
+    {
+      "slug": "map",
+      "title": "Map",
+      "kind": "component",
+      "support": "unassessed",
+      "lastReviewedSupport": "implemented",
+      "sourceReview": "needs-review",
+      "reviewedOn": "2026-10-09",
+      "scope": "MapLibre map with themed OpenFreeMap styles, markers with labels, tooltips, popups and dragging, routes, arcs, clusters, and zoom, compass, locate and full screen controls.",
+      "adaptation": "The page passes in the maplibre-gl module. Markers, popups and controls are authored HTML moved into MapLibre; routes, arcs and clusters are GeoJSON layers whose colors are read from theme tokens and redrawn when the theme changes.",
+      "upstream": {
+        "source": "https://m3.material.io/components",
+        "reviewedOn": "2026-10-09",
+        "scope": "web-extension-inventory-reviewed",
+        "note": "Requirements and boundaries: design reference web-extensions-review. The inventory page renders client-side, so this review relies on the 2026-09-13 inventory review. Full visual parity and spoken output unverified.",
+        "sections": [
+          "No standalone Material component"
+        ],
+        "sources": [],
+        "requirements": "Name the map region, make interactive markers named buttons, return focus when a popup closes, keep tile attribution visible and give the same information in text."
+      },
+      "relationship": "none",
+      "sources": [
+        {
+          "path": "src/sass/components/_map.scss",
+          "sha256": "3bc9d7ba4dcf2c8d632701d4a6d127dd0e83662b994591260a58581bc2f3d5de"
+        },
+        {
+          "path": "src/ts/components/mapView.ts",
+          "sha256": "eb0804b2b9368c8af1c9e6d6827c8bde42ceb4e01bdd9b3666d13a867bc67b03"
+        }
+      ],
+      "gaps": [
+        {
+          "kind": "verification",
+          "description": "Marker placement, the popup opened from its marker with aria-expanded, Escape and map-click closing with focus back on the marker, zoom limits, the compass bearing, theme-colored routes, arcs and clusters redrawn after a theme swap, removeOverlay and destroy are checked in a browser; the locate and full screen controls, marker dragging, spoken output, touch gestures and forced colors remain unverified.",
+          "nextStep": "Use the map with a screen reader and on a touch device, try locate and full screen with real permissions, drag a marker with the keyboard, and check forced colors."
+        }
+      ],
+      "browserChecks": [
+        {
+          "file": "tests/map-browser.test.js",
+          "name": "chromium: map places markers and popups, runs controls, themes overlays and restores its markup",
+          "scope": "Markers placed with the default dot, the popup without a marker open at init, a marker button opening its popup with aria-expanded, Escape and a map click closing it with focus back on the marker, zoom out disabled at the minimum zoom, zoom in, the compass bearing and reset, route, arcs and clusters in the theme primary color, no count layer without glyphs, all redrawn in the dark primary after a theme change, removeOverlay, destroy restoring the markup and controls, and a location arriving after destroy being ignored. No spoken-output assertion.",
+          "state": "stale"
+        },
+        {
+          "file": "tests/map-browser.test.js",
+          "name": "chromium: a map in a shadow root opens its marker popup",
+          "scope": "A marker button inside a shadow root finding its popup by id, then opening it with aria-expanded. No spoken-output assertion.",
+          "state": "stale"
+        }
+      ],
+      "browserEvidence": "needs-rerun",
+      "recheckWhen": [
+        "A reviewed source changes",
+        "A mapped test or its recorded inputs change",
+        "Google revises the linked guidance or before claiming a new release matches it"
+      ]
+    },
     {
       "slug": "toolbars",
       "title": "Toolbars",
@@ -3660,16 +3828,16 @@
           "file": "tests/rich-text-editor-browser.test.js",
           "name": "chromium: rich text editor formats text, reflects state and keeps the textarea in sync",
           "scope": "Hidden textarea, textbox role and name from the label, starting HTML, label click focus, bold and heading commands with aria-pressed and .active, undo disabled state, textarea value and input event, empty value, and destroy. No spoken-output assertion.",
-          "state": "not-recorded"
+          "state": "stale"
         },
         {
           "file": "tests/rich-text-editor-browser.test.js",
           "name": "chromium: rich text editor follows a disabled textarea",
           "scope": "A disabled textarea makes the editor read-only and disables every toolbar button.",
-          "state": "not-recorded"
+          "state": "stale"
         }
       ],
-      "browserEvidence": "incomplete",
+      "browserEvidence": "needs-rerun",
       "recheckWhen": [
         "A reviewed source changes",
         "A mapped test or its recorded inputs change",
@@ -3680,9 +3848,9 @@
       "slug": "drop-zone",
       "title": "Drop zone",
       "kind": "component",
-      "support": "implemented",
+      "support": "unassessed",
       "lastReviewedSupport": "implemented",
-      "sourceReview": "source-reviewed",
+      "sourceReview": "needs-review",
       "reviewedOn": "2026-10-06",
       "scope": "A label-sized native file input with a dragover state and a list of chosen file names and locale-formatted sizes.",
       "adaptation": "The native input covers the label, so clicks, keys and drops are the browser's; the shared Forms behavior marks the drag and fills the list.",