@rio-cloud/uikit-mcp 1.1.7 → 1.1.9

package/README.md

@@ -6,6 +6,7 @@
 - Ships with the full dataset - no network calls or external services are required at runtime.
 - `search_docs` must always be used before `readResource`; listResources is a static inventory snapshot and not intended for guessing IDs.
 - `readResource` returns rich Markdown (sections, examples, code tabs, props tables) for the URI returned by `search_docs`.
+- Runtime output applies defensive sanitisation for unsafe link schemes and dangerous raw HTML outside fenced code blocks.
 
 ## MCP Client Configuration
 
@@ -20,24 +21,14 @@ startup_timeout_sec = 30
 
 ## Available Resources & Tools
 
+Use this section for standalone MCP usage only (that is, when `$rio-uikit` is not being used).
+
 - **Resource namespace:** `uikit-doc://<route>` (e.g. `uikit-doc://components/button`).
   - Response includes category, section, source URL, captured timestamp, section bodies, rendered example HTML, code tabs, props tables, and See Also links.
   - Resource IDs use the full hash path (e.g. `uikit-doc://start/guidelines/print-css`); always resolve via `search_docs` instead of guessing or hardcoding IDs.
 - **Tools**
   - `search_docs` — FlexSearch-backed keyword lookup. Input `{ query: string; limit?: number }`, output `{ results: [...] }`. Always call `readResource` on returned URIs before acting.
 
-## Suggested Agent Guidelines
-
-Add the short UI Kit usage snippet from `AGENTS.md` to your agent guidelines so coding sessions stay consistent:
-
-```
-## RIO UI Kit usage
-- Prefer components from '@rio-cloud/rio-uikit' and style via the provided classes instead of adding new CSS files.
-- Wrap all app content in ApplicationLayout.
-- Use the MCP server for docs (search_docs → readResource); don't guess resource routes.
-- Best tech stack for the RIO UI Kit is a React application with TypeScript
-```
-
 ---
 
 ## Development
@@ -46,8 +37,9 @@ Add the short UI Kit usage snippet from `AGENTS.md` to your agent guidelines so
 
 ### Requirements
 
-- **Node 22+** (tsdown target)
+- **Node 24+** and **npm 11+**
 - Dev dependencies must be installed (tsx is required for the tsdown build hook and tests)
+- The repository includes a root `.npmrc` with `ignore-scripts=true`; keep installs repo-local so the npm lifecycle-script baseline is enforced consistently.
 
 ### Setup
 
@@ -58,6 +50,21 @@ npm install
 npm run build:server
 ```
 
+If you need Playwright browser binaries for crawling, install them explicitly after `npm install`:
+
+```bash
+npm run setup:crawler
+```
+
+### Development Skills
+
+This repository also keeps repo-versioned Codex skills under `development-skills/` for recurring maintenance workflows:
+
+- `uikit-mcp-vulnerability-check`
+  - Use when checking npm vulnerabilities, assessing whether repository code paths are actually affected, and deciding between remediation, deferral, or accepted risk.
+- `uikit-mcp-dependency-update-check`
+  - Use when checking npm dependency updates and preparing actionable update plans only for policy-compliant candidates.
+
 ### Available Scripts
 
 | Script | Description |
@@ -97,13 +104,12 @@ Crawler scripts live in `crawler/` and stay out of the npm bundle:
 - Download Chromium once: `npm run setup:crawler`
 - One-shot full run: `npm run crawl:full` (ensures Playwright Chromium, runs `crawl:navigation`, `capture:all -- --force --concurrency=5`, then `npm test`)
 - Refresh navigation snapshot: `npm run crawl:navigation`
-- Capture all routes: `npm run capture:all` with optional flags:
-  - `--category=Components` (filter by top-level navigation label)
-  - `--section=Interaction` (filter by sidebar section title)
-  - `--match=button` (substring match across category/section/label/href)
+- Capture the full dataset: `npm run capture:all` with optional flags:
   - `--retries=3` (per-route retry count)
   - `--concurrency=5` (parallel workers; 5 recommended for full crawl)
-  - `--force` (re-write artefacts even when hashes match existing files)
+  - `--force` (run the full crawl even when `data/version.json` already matches the current upstream version)
+  - `capture:all` always performs a transactional full crawl: the current UI Kit version is checked before any mutation, fresh artefacts are written into staging, and `data/` is only replaced after a fully successful run.
+  - `data/version.json` is updated only after a successful full crawl and remains the marker for a complete captured dataset.
 - Route-specific note: `#start/changelog` is captured with a dedicated parser that groups the modern version cards (badges preserved) and ignores the legacy “Show older versions” list.
 
 ### Package Contents