@symbo.ls/mcp-server 3.8.8 → 3.8.9

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "@symbo.ls/mcp-server",
-  "version": "3.8.8",
+  "version": "3.8.9",
   "description": "HTTP proxy for the Symbols MCP server — runs as a Cloudflare Worker",
   "type": "module",
   "main": "index.js",

package/src/mcp-handler.js

@@ -222,6 +222,26 @@ const RULE_CHECKS = [
     /^var\s+\w+\s*=/m,
     'FORBIDDEN: No module-level variables — use el.scope for local state, functions/ for helpers (Rule 33)',
   ],
+  [
+    /window\.location\.href\s*=/,
+    'FORBIDDEN: No window.location for navigation — use el.router(path, el.getRoot()) (Rule 42)',
+  ],
+  [
+    /window\.location\.assign\b/,
+    'FORBIDDEN: No window.location for navigation — use el.router(path, el.getRoot()) (Rule 42)',
+  ],
+  [
+    /window\.location\.replace\b/,
+    'FORBIDDEN: No window.location for navigation — use el.router(path, el.getRoot()) (Rule 42)',
+  ],
+  [
+    /attr\s*:\s*\{\s*href\s*:/,
+    "FORBIDDEN: Never put href in attr — use extends: 'Link' with href as a direct prop (Rule 41)",
+  ],
+  [
+    /\b(?:COLOR|THEME|TYPOGRAPHY|SPACING|TIMING|FONT_FAMILY|ICONS|SHADOW|MEDIA|GRID|ANIMATION|RESET|GRADIENT)\s*[=:{]/,
+    'FORBIDDEN: UPPERCASE design system keys are banned — use lowercase (color, theme, typography, spacing, etc.) (Rule 0)',
+  ],
 ];
 
 function auditCode(code) {
@@ -1416,7 +1436,7 @@ function getPrompt(name, args = {}) {
     return `You are migrating ${framework} code to Symbols.app.\n\nKey conversion rules for ${framework}:\n- Components become plain objects (never functions)\n- NO imports between project files\n- All folders are flat — no subfolders\n- Use extends/childExtends (v3 plural, never v2 singular)\n- Flatten all props directly (no props: {} wrapper)\n- Events use onX prefix (no on: {} wrapper)\n- **MANDATORY: ALL values MUST use design system tokens** — ZERO px values, ZERO hex colors, ZERO rgb/hsl\n- State: state: { key: val } + s.update({ key: newVal })\n- Effects: onRender for mount, onStateUpdate for dependency changes\n- Lists: children: (el, s) => s.items, childrenAs: 'state', childExtends: 'Item'\n- The default library provides Button, Avatar, Field, Modal, etc. — use them via extends\n\nProvide the ${framework} code to convert and I will output clean DOMQL v3.`;
   }
   if (name === 'symbols_project_prompt') {
-    return `Create a complete Symbols.app project:\n\nProject Description: ${args.description || ''}\n\nRequired structure (symbols/ folder):\n- index.js (entry: import create from 'smbls', import context, create(app, context))\n- app.js (root app with routes: (pages) => pages)\n- config.js ({ globalTheme: 'dark' })\n- context.js (re-exports: state, pages, designSystem, components, functions, snippets)\n- state.js (app state)\n- dependencies.js (external packages)\n- components/ (PascalCase files, named exports)\n- pages/ (dash-case files, camelCase exports, route mapping in index.js)\n- functions/ (camelCase, called via el.call())\n- designSystem/ (COLOR, THEME, TYPOGRAPHY, SPACING, FONT, ICONS)\n- snippets/ (reusable snippets)\n\nThe project uses the default library (default.symbo.ls) which provides:\nButton, Avatar, Icon, Field, Modal, Badge, Progress, TabSet, and 120+ more components.\nReference these by PascalCase key name — no imports needed.\n\nRules:\n- v3 syntax only — extends, childExtends, flattened props, onX events\n- Design tokens for all spacing/colors (padding: 'A', not padding: '16px')\n- Components are plain objects, never functions\n- No imports between project files\n- All folders completely flat\n\nGenerate all files with complete, production-ready code.`;
+    return `Create a complete Symbols.app project:\n\nProject Description: ${args.description || ''}\n\nRequired structure (symbols/ folder):\n- index.js (entry: import create from 'smbls', import context, create(app, context))\n- app.js (root app with routes: (pages) => pages)\n- config.js ({ globalTheme: 'dark' })\n- context.js (re-exports: state, pages, designSystem, components, functions, snippets)\n- state.js (app state)\n- dependencies.js (external packages)\n- components/ (PascalCase files, named exports)\n- pages/ (dash-case files, camelCase exports, route mapping in index.js)\n- functions/ (camelCase, called via el.call())\n- designSystem/ (color, theme, typography, spacing, font, icons — ALWAYS lowercase)\n- snippets/ (reusable snippets)\n\nThe project uses the default library (default.symbo.ls) which provides:\nButton, Avatar, Icon, Field, Modal, Badge, Progress, TabSet, and 120+ more components.\nReference these by PascalCase key name — no imports needed.\n\nRules:\n- v3 syntax only — extends, childExtends, flattened props, onX events\n- Design tokens for all spacing/colors (padding: 'A', not padding: '16px')\n- Components are plain objects, never functions\n- No imports between project files\n- All folders completely flat\n\nGenerate all files with complete, production-ready code.`;
   }
   if (name === 'symbols_review_prompt') {
     return `Review this Symbols/DOMQL code for v3 compliance and best practices.\n\nCheck for these violations:\n1. v2 syntax: extend→extends, childExtend→childExtends, props:{}, on:{}\n2. Imports between project files (FORBIDDEN)\n3. Function-based components (must be plain objects)\n4. Subfolders (must be flat)\n5. Hardcoded pixels instead of design tokens\n6. Wrong event handler signatures (lifecycle: (el, s), DOM: (event, el, s))\n7. Default exports for components (should be named)\n8. Standard HTML attrs in attr: {} (should be at root; attr: {} only for data-*/aria-*/custom)\n9. props block CSS trying to override component-level CSS (can't)\n\nProvide:\n- Issues found with line references\n- Corrected code for each issue\n- Overall v3 compliance score (1-10)\n- Improvement suggestions\n\nPaste your code below:`;