@expressivecss/mcp-server 0.4.0 → 0.5.0

package/.claude-plugin/plugin.json

@@ -1,7 +1,7 @@
 {
   "name": "expressivecss-mcp",
   "displayName": "ExpressiveCSS MCP",
-  "version": "0.4.0",
+  "version": "0.5.0",
   "description": "ExpressiveCSS workflow server with Setup Expert, Rules Enforcer, Creative Director, Page Arcjitect, Component Syntax Expert, and Quality Inspector.",
   "author": {
     "name": "BaezFJ",

package/.cursor-plugin/plugin.json

@@ -1,7 +1,7 @@
 {
   "name": "expressivecss-mcp",
   "displayName": "ExpressiveCSS MCP",
-  "version": "0.4.0",
+  "version": "0.5.0",
   "description": "ExpressiveCSS workflow server with Setup Expert, Rules Enforcer, Creative Director, Page Arcjitect, Component Syntax Expert, and Quality Inspector.",
   "author": {
     "name": "BaezFJ",

package/CHANGELOG.md

@@ -1,5 +1,68 @@
 # Changelog
 
+## Unreleased
+
+## 0.5.0 - 2026-10-27
+
+- Security: update the locked `body-parser` to 2.4.0, `fast-uri` to 3.1.9,
+  and the `qs` override to 6.16.1 to resolve known dependency advisories.
+- Security: `quality_inspector` skips every `files` entry outside
+  `projectRoot` with the same reason before touching the disk. A missing
+  path used to get "file does not exist", so a client could tell which host
+  paths exist.
+- Security: a nav or control that repeats one id in `aria-labelledby` no
+  longer makes inspection walk the labelled element once per repeat. A
+  snippet of about 136 KB used to block the server for seconds, and a larger
+  one could run it out of memory. Each id now counts once, and only the
+  first 32 are read.
+- Security: version resolution reads crafted lockfiles in linear time. Blank
+  lines inside a pnpm entry, or a long run of `(` in a version, used to stall
+  every project-scoped tool call for as long as minutes or hours.
+- On Windows, a client `projectRoot` that is a network path (`\\host\share`)
+  is refused before it is resolved, unless it sits under an allowed root.
+  Resolving it would contact that host.
+
+- `rules_enforcer` and the lint command flag the class names, color roles
+  and markup paths that ExpressiveCSS 0.16.0 removes, and each finding names
+  the replacement. The new rule IDs start with `legacy-`: material-icons,
+  i-icon, visibility-alias, helper-class, renamed-component, picker-root,
+  sheet-class, variant-alias, markup-path, carousel-flat, color-role,
+  selector, datepicker-range and range-export. Class names match as whole
+  tokens in `class`, JSX `className`, `className={"…"}` and template
+  literals; `legacy-selector` covers CSS selectors and query strings.
+- The three drag-handle rules select `.drag-handle` only; `.handle` is a
+  removed name that `legacy-sheet-class` reports inside a bottom sheet.
+- Static inspection no longer stalls the server on adversarial markup. An
+  unclosed class value full of `btn` took 30 s to check and now takes about
+  100 ms. Markup nested deeper than 256 elements stops early with
+  `markup nesting limit reached`; 4,000 nested `aria-hidden` elements took
+  20 s before.
+- `legacy-renamed-component` no longer stalls on an unclosed tag that
+  repeats `class="range`. A 500,000-character snippet blocked the server
+  for about 10 s.
+- Breaking: with `EXPRESSIVECSS_MCP_ALLOWED_PROJECT_ROOTS` unset, a client
+  `projectRoot` must now sit inside the server's default root, from
+  `--project-root` or the working directory. Before, any directory was
+  accepted, so a prompt-injected call such as `quality_inspector` with
+  `projectRoot: "/"` could report whether a file like `~/.ssh/id_rsa`
+  existed, with its size and SHA-256. A missing `projectRoot` is now an
+  error instead of an `unresolved` result. To pass other projects, list
+  them in `EXPRESSIVECSS_MCP_ALLOWED_PROJECT_ROOTS`.
+- A client `projectRoot` resolves to the real path that passed the root
+  check, so swapping a symlink after the check cannot redirect later reads.
+- Reading a FIFO inside the project fails at once instead of hanging the call.
+- `quality_inspector` stops its typecheck or test command when the call is
+  cancelled or the client closes the session. Before, the command kept
+  running after the server exited.
+- The lint hook exits 2 when inspection throws, so a crash blocks the edit
+  instead of letting the file through unlinted.
+- Bundled framework guidance: ExpressiveCSS 0.16.0.
+
+## 0.4.1 - 2026-10-14
+
+- The catalogue, guides and rules cover keypad and keyboard.
+- Bundled framework guidance: ExpressiveCSS 0.15.0.
+
 ## 0.4.0 - 2026-10-11
 
 - Command-output redaction no longer stalls the server on long token runs.

package/README.md

@@ -643,7 +643,7 @@ EXPRESSIVECSS_MCP_ALLOWED_COMMAND_ROOTS=["/srv/projects/site-a","/srv/projects/s
 
 The real `projectRoot` must equal or be contained by one of those roots. A tool caller cannot expand this policy. Allowed commands receive only the executable path, system/temp/locale variables, `CI=1`, `NO_COLOR=1`, and `HOME`/`USERPROFILE` reset to the project root. API keys, tokens, passwords, cloud credentials, SSH agent variables, and other MCP-process environment values are not forwarded.
 
-Any tool accepts a `projectRoot` by default, and `quality_inspector` reports the existence, size and SHA-256 of files under it. To limit which directories a caller can name, set `EXPRESSIVECSS_MCP_ALLOWED_PROJECT_ROOTS` in the same format. A `projectRoot` whose real path is outside every listed root fails with a tool error. An empty or invalid value denies every caller-supplied root. The default root, from `--project-root` or the working directory, is not checked.
+A tool's `projectRoot` must sit inside the default root, from `--project-root` or the working directory, because `quality_inspector` reports the existence, size and SHA-256 of files under it. To let a caller name other directories, set `EXPRESSIVECSS_MCP_ALLOWED_PROJECT_ROOTS` in the same format; the listed roots then replace the default root as the allowlist. A `projectRoot` that is missing, or whose real path is outside every allowed root, fails with a tool error. An empty or invalid value denies every caller-supplied root. Calls without a `projectRoot` use the default root, which is not checked.
 
 ## Sample client configuration
 
@@ -677,7 +677,7 @@ Hermes uses the top-level `mcp_servers` setting shown in `sample-hermes-config.y
 ## Notes
 
 - Published package scripts are self-contained: `npm test` runs the live MCP protocol smoke test, and `npm pack --dry-run` runs that test through `prepack`.
-- Repository maintainers can verify generated sources with `node ../../scripts/gen-expressivecss-skill.mjs --check` and `node scripts/sync-guides.mjs --check`, then run `npm test`. To refresh them, run those two generator commands without `--check` before packing.
+- Repository maintainers can verify generated sources with `node ../../scripts/gen-expressivecss-skill.mjs --check`, then run `npm test`. To refresh them, run the generator without `--check` before packing.
 - `setup_expert` resolves framework source, an installed package, or supported lockfiles in that order. A manifest range alone is reported as unresolved rather than treated as the installed version. An installed version outside the direct manifest range also blocks contract-dependent guidance.
 - Pass `projectRoot` in tool calls when the target project differs from the MCP process working directory.