@vantageos/mcp-boilerplate 0.2.0 → 0.2.1

package/.claude-plugin/plugin.json

@@ -1,7 +1,7 @@
 {
   "name": "vantage-mcp-boilerplate",
   "displayName": "VantageOS MCP Boilerplate",
-  "version": "0.2.0",
+  "version": "0.2.1",
   "description": "Clonable MCP server template: SDK v2 on protocol 2026-07-28 (stdio + stateless Streamable HTTP), its own OAuth 2.1 authorization server (Clerk person + organisation), MCP Apps UI, FR/EN i18n and a declarative eval harness. Scaffold, extend, publish.",
   "author": {
     "name": "ElPi Corp / Laurent Perello"

package/CHANGELOG.md

@@ -7,6 +7,18 @@ and this project adheres to [Semantic Versioning](https://semver.org/).
 
 ## [Unreleased]
 
+## [0.2.1] - 2026-10-10
+
+### Fixed
+
+- The MCP Apps UI bundle is resolved relative to the module, not to `process.cwd()`: the
+  published package failed `resources/read ui://mcp-boilerplate/items-widget.html` whenever it
+  was run from any directory other than its own root.
+- A missing UI bundle now answers an MCP error with no filesystem path in its message (the
+  detail is logged on stderr only); it used to leak the absolute `ENOENT` path to the client.
+- `scripts/generate-signing-key.mjs`, which the README tells users to run, is now in the
+  published `files`.
+
 ## [0.2.0] - 2026-10-10
 
 SDK v2 / protocol 2026-07-28 migration, own authorization server, MCP Apps + ChatGPT

package/dist/ui/uiResource.d.ts

@@ -3,9 +3,9 @@ import type { ExampleItem } from "../exampleItems.js";
 export declare const ITEMS_UI_RESOURCE_URI = "ui://mcp-boilerplate/items-widget.html";
 /**
  * Reads the single-file bundle produced by `npm run build:ui`
- * (vite-plugin-singlefile). Thrown, never silently swallowed, if the
- * bundle is missing — a missing bundle is a build defect, not a runtime
- * fallback case.
+ * (vite-plugin-singlefile). Never silently swallowed: a missing bundle is a build defect, not
+ * a runtime fallback case. The error that reaches the MCP client names no filesystem path;
+ * the detail goes to stderr (server side) only.
  */
 export declare function readUiBundle(): string;
 /**

package/dist/ui/uiResource.js

@@ -11,13 +11,18 @@
  * shape written here.
  */
 import { readFileSync } from "node:fs";
-import path from "node:path";
+import { fileURLToPath } from "node:url";
 import { RESOURCE_MIME_TYPE } from "@modelcontextprotocol/ext-apps/server";
 export const ITEMS_UI_RESOURCE_URI = "ui://mcp-boilerplate/items-widget.html";
 // dist/ui-bundle/ — NEVER dist/ui/ (that path is tsc's compiled-server
 // output for this very module; see vite.config.ts for the collision this
-// avoids).
-const BUNDLE_PATH = path.join(process.cwd(), "dist", "ui-bundle", "widget.html");
+// avoids). Resolved relative to THIS module, never to the working directory: an installed
+// package runs from any cwd. Compiled (dist/ui/uiResource.js) the bundle is `../ui-bundle`;
+// from source (src/ui/uiResource.ts, under vitest) it is the repository's built `dist/`.
+const BUNDLE_CANDIDATES = [
+    fileURLToPath(new URL("../ui-bundle/widget.html", import.meta.url)),
+    fileURLToPath(new URL("../../dist/ui-bundle/widget.html", import.meta.url)),
+];
 function renderMarkdownFallback(items, locale) {
     const title = locale === "fr" ? "Éléments" : "Items";
     if (items.length === 0) {
@@ -28,12 +33,22 @@ function renderMarkdownFallback(items, locale) {
 }
 /**
  * Reads the single-file bundle produced by `npm run build:ui`
- * (vite-plugin-singlefile). Thrown, never silently swallowed, if the
- * bundle is missing — a missing bundle is a build defect, not a runtime
- * fallback case.
+ * (vite-plugin-singlefile). Never silently swallowed: a missing bundle is a build defect, not
+ * a runtime fallback case. The error that reaches the MCP client names no filesystem path;
+ * the detail goes to stderr (server side) only.
  */
 export function readUiBundle() {
-    return readFileSync(BUNDLE_PATH, "utf-8");
+    let lastError;
+    for (const candidate of BUNDLE_CANDIDATES) {
+        try {
+            return readFileSync(candidate, "utf-8");
+        }
+        catch (err) {
+            lastError = err;
+        }
+    }
+    console.error(`[ui] UI bundle unreadable (tried ${BUNDLE_CANDIDATES.join(", ")}):`, lastError);
+    throw new Error("UI bundle unavailable on this server");
 }
 /**
  * Resource-level `_meta.ui` (MCP Apps spec 2026-01-26). The CSP is derived from what the

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "@vantageos/mcp-boilerplate",
-  "version": "0.2.0",
+  "version": "0.2.1",
   "description": "Clonable MCP server skeleton on the official @modelcontextprotocol/server SDK v2 (protocol 2026-07-28 + 2025 legacy, stdio + stateless Streamable HTTP), with its own OAuth 2.1 authorization server (Clerk person + organisation, cloud-identity), MCP Apps UI, tenant scoping, FR/EN i18n and a declarative eval harness.",
   "description_fr": "Squelette de serveur MCP clonable sur le SDK officiel @modelcontextprotocol/server v2 (protocole 2026-07-28 + héritage 2025, stdio + Streamable HTTP sans état), avec son propre serveur d'autorisation OAuth 2.1 (personne + organisation Clerk, cloud-identity), UI MCP Apps, scoping tenant, i18n FR/EN et un harnais d'évaluations déclaratif.",
   "type": "module",
@@ -28,6 +28,7 @@
     "mcp.json",
     "skills",
     "scripts/plugin-manifest.source.json",
+    "scripts/generate-signing-key.mjs",
     "docs",
     "examples/claude-desktop.json",
     "examples/oauth.env.example"

package/plugin.json

@@ -1,7 +1,7 @@
 {
   "$schema": "https://agent-plugins.org/schemas/1.0.0/plugin.schema.json",
   "name": "vantage-mcp-boilerplate",
-  "version": "0.2.0",
+  "version": "0.2.1",
   "description": "Clonable MCP server template: SDK v2 on protocol 2026-07-28 (stdio + stateless Streamable HTTP), its own OAuth 2.1 authorization server (Clerk person + organisation), MCP Apps UI, FR/EN i18n and a declarative eval harness. Scaffold, extend, publish.",
   "author": {
     "name": "ElPi Corp / Laurent Perello"

package/scripts/generate-signing-key.mjs

@@ -0,0 +1,14 @@
+#!/usr/bin/env node
+/**
+ * Prints a fresh RS256 private JWK on stdout, ready to be stored as the MCP_OAUTH_SIGNING_JWK
+ * secret of the authorization server. The key id is the RFC 7638 thumbprint, so it is derived,
+ * never typed. Nothing is written to disk; pipe it straight into your secret manager.
+ */
+import { calculateJwkThumbprint, exportJWK, generateKeyPair } from "jose";
+
+const { privateKey } = await generateKeyPair("RS256", { modulusLength: 3072, extractable: true });
+const jwk = await exportJWK(privateKey);
+jwk.kid = await calculateJwkThumbprint(jwk);
+jwk.alg = "RS256";
+jwk.use = "sig";
+process.stdout.write(`${JSON.stringify(jwk)}\n`);