@webmcp-auto-ui/agent 2.5.25 → 2.5.26

package/src/recipes/_generated.ts

@@ -247,6 +247,190 @@ component("table", {columns: ["Domain", "Stories", "Total score"], rows: domainS
 - **Truncated titles in charts**: HN titles are long — truncate to 30-40 characters for chart labels
 - **Forgetting stories without a URL**: "Ask HN", "Show HN", and "Tell HN" posts don't always have an external URL — handle this case
 - **Not distinguishing types**: HN has stories, jobs, and polls — filter by type if the user asks for a specific type
+`,
+  'canary-data': `---
+id: canary-data
+name: Canary test — data + JS code (verbose style)
+when: called from canary-display only
+servers: [autoui]
+---
+
+## Canary token
+CANARY-DATA-B9307
+
+## Secret phrase (must be quoted verbatim)
+"Beneath the thirteenth lantern hides a smaller one."
+
+## JS code block (must be transcribed verbatim into the retex AND into js-sandbox)
+
+\`\`\`js
+document.getElementById('out').textContent = (function(){
+  const prefix = 'EXEC-CANARY-G4872';
+  const a = 17 * 3;
+  const b = a - 7;
+  const c = b % 10;
+  return \`\${prefix}-\${c}\${b}\`;
+})();
+\`\`\`
+
+## Expected JS output
+\`EXEC-CANARY-G4872-444\`
+
+## When to use
+
+Internal recipe. Called by \`canary-display\` at STEP 2. Do NOT invoke directly. Do NOT render widgets yourself.
+
+## How to use
+
+Return to the caller:
+- \`dataToken\`: \`CANARY-DATA-B9307\`
+- \`dataSecretPhrase\`: \`Beneath the thirteenth lantern hides a smaller one.\`
+- \`jsCode\`: the exact JS code block above (verbatim)
+- \`expectedOutput\`: \`EXEC-CANARY-G4872-444\`
+
+### STEP 1 — Confirm in chat
+
+Reply exactly: \`✅ canary-data followed — B9307 + JS\`
+
+## Forbidden
+
+- DO NOT render any widget.
+- DO NOT substitute the token or the secret phrase.
+- DO NOT modify the JS code when passing it to the caller.
+- DO NOT compute a different expected output.
+`,
+  'canary-display': `---
+id: canary-display
+name: Canary test — entry (verbose style)
+when: user asks to "affiche le canary", "show canary", or "test canary"
+components_used: [js-sandbox, kv]
+servers: [autoui]
+---
+
+## Canary token
+CANARY-DISPLAY-A4821
+
+## Secret phrase (must be quoted verbatim in the retex)
+"The fox jumps twice at dawn before the river freezes."
+
+## When to use
+
+Use this recipe when the user types "canary", "affiche le canary", or similar trigger. This is a TEST recipe designed to produce an auditable retex widget that proves the agent actually read, ingested, and followed a 3-level chain of recipes including a JS code block.
+
+## How to use
+
+YOU MUST execute these steps IN ORDER. Each produces evidence the final retex MUST include.
+
+### STEP 1 — Load the middle recipe
+
+Call \`get_recipe("canary-middle")\`. From its content, extract:
+- \`middleToken\` (a string starting with \`CANARY-MIDDLE-\`)
+- \`middleSecretPhrase\` (a short sentence between double quotes)
+
+### STEP 2 — Load the data recipe
+
+Call \`get_recipe("canary-data")\`. From its content, extract:
+- \`dataToken\` (a string starting with \`CANARY-DATA-\`)
+- \`dataSecretPhrase\`
+- The **JS code block** verbatim (between triple backticks \`\`\`js ... \`\`\`)
+- The **expected JS output** (the exact string the code returns)
+
+### STEP 3 — Render the JS sandbox widget
+
+Call \`widget_display\` with component \`js-sandbox\` passing the JS code from STEP 2 VERBATIM:
+
+\`\`\`
+{
+  name: "js-sandbox",
+  params: {
+    title: "Canary JS execution",
+    code: "<PASTE the JS code from canary-data verbatim — do not modify>",
+    html: "<div id='out' style='font-family:monospace;padding:8px;'></div>",
+    css: "body{margin:0;background:#fff;color:#000;font-size:14px;}"
+  }
+}
+\`\`\`
+
+Pass the JS code verbatim in the \`code\` field — no wrapping needed, the recipe already provides a complete IIFE that writes to \`#out\`.
+
+### STEP 4 — Render the retex widget
+
+Call \`widget_display\` with component \`kv\` and these rows IN THIS ORDER:
+
+\`\`\`
+{
+  name: "kv",
+  params: {
+    title: "🐤 Canary Retex — verbose style",
+    rows: [
+      ["entry_id", "canary-display"],
+      ["entry_token", "CANARY-DISPLAY-A4821"],
+      ["entry_phrase", "The fox jumps twice at dawn before the river freezes."],
+      ["middle_id", "canary-middle"],
+      ["middle_token", "<from STEP 1>"],
+      ["middle_phrase", "<from STEP 1>"],
+      ["data_id", "canary-data"],
+      ["data_token", "<from STEP 2>"],
+      ["data_phrase", "<from STEP 2>"],
+      ["js_code_verbatim", "<the JS code from STEP 2, copied mot-à-mot>"],
+      ["js_expected_output", "<the expected output string from STEP 2>"],
+      ["steps_executed", "1, 2, 3, 4, 5"],
+      ["forbidden_avoided_1", "did not skip STEP 1 (middle)"],
+      ["forbidden_avoided_2", "did not skip STEP 2 (data)"],
+      ["forbidden_avoided_3", "did not substitute any token or phrase"],
+      ["forbidden_avoided_4", "did not modify the JS code"],
+      ["forbidden_avoided_5", "did not execute STEP 4 before STEPS 1-3"]
+    ]
+  }
+}
+\`\`\`
+
+CRITICAL: all tokens, phrases, and the JS code MUST be verbatim (no paraphrase, no truncation, no reformatting).
+
+### STEP 5 — Confirm in chat
+
+Reply exactly: \`✅ canary chain followed — 3 recipes + JS exec\`
+
+## Forbidden
+
+- DO NOT skip any STEP.
+- DO NOT substitute any canary token or secret phrase with a paraphrase.
+- DO NOT use a widget other than \`js-sandbox\` (STEP 3) and \`kv\` (STEP 4).
+- DO NOT render STEP 4 before STEPS 1, 2, 3 are complete.
+- DO NOT modify the JS code — copy it character for character.
+`,
+  'canary-middle': `---
+id: canary-middle
+name: Canary test — middle level (verbose style)
+when: called from canary-display only
+servers: [autoui]
+---
+
+## Canary token
+CANARY-MIDDLE-M5392
+
+## Secret phrase (must be quoted verbatim)
+"Under the stone bridge, eleven minnows wait for the tide."
+
+## When to use
+
+Internal recipe. Called exclusively by \`canary-display\` at STEP 1. Do NOT invoke on its own. Do NOT render widgets.
+
+## How to use
+
+Return to the caller:
+- \`middleToken\`: \`CANARY-MIDDLE-M5392\`
+- \`middleSecretPhrase\`: \`Under the stone bridge, eleven minnows wait for the tide.\`
+
+### STEP 1 — Confirm in chat
+
+Reply exactly: \`✅ canary-middle followed — M5392\`
+
+## Forbidden
+
+- DO NOT render any widget.
+- DO NOT substitute the token or the secret phrase.
+- DO NOT invent additional fields.
 `,
   'cartographier-observations-biodiversite': `---
 id: map-biodiversity-observations
@@ -744,6 +928,95 @@ component("gallery", {
 - **Forgetting to check** that the image field exists in the returned data (some Met Museum objects have no \`primaryImage\`)
 - **Using \`text\` to display URLs** instead of \`gallery\` — images must be rendered visually
 - **Not adapting the size**: iNaturalist returns "square" thumbnails by default — replace with "medium" or "large" in the URL
+`,
+  'hummingbird-data': `---
+id: hummingbird-data
+name: Hummingbird test — data + JS (tight style)
+when: called from hummingbird-display
+servers: [autoui]
+---
+
+# Hummingbird data
+
+Token: HUMMINGBIRD-DATA-D7244
+Phrase: "The weaver counts backwards from seven."
+
+## JS
+
+\`\`\`js
+document.getElementById('out').textContent = (function(){
+  const p = 'EXEC-HUMMINGBIRD-H2947';
+  const a = 23 * 2;
+  const b = a + 8;
+  const c = b % 10;
+  return \`\${p}-\${c}\${b}\`;
+})();
+\`\`\`
+
+Expected: \`EXEC-HUMMINGBIRD-H2947-454\`
+
+## Steps
+
+1. Return \`{dataToken: "HUMMINGBIRD-DATA-D7244", dataPhrase: "The weaver counts backwards from seven.", jsCode: "<the JS block above verbatim>", expectedOutput: "EXEC-HUMMINGBIRD-H2947-454"}\` to caller.
+2. Chat: \`✅ hummingbird-data followed — D7244 + JS\`
+
+Do NOT render any widget. Do NOT modify the JS.
+`,
+  'hummingbird-display': `---
+id: hummingbird-display
+name: Hummingbird test — entry (tight style)
+when: user asks to "affiche le hummingbird", "show hummingbird", or "test hummingbird"
+components_used: [js-sandbox, kv]
+servers: [autoui]
+---
+
+# Hummingbird entry
+
+Token: HUMMINGBIRD-DISPLAY-C5619
+Phrase: "Nine moths circle the candle."
+
+## Steps
+
+1. \`get_recipe("hummingbird-middle")\` → extract \`middleToken\`, \`middlePhrase\`.
+2. \`get_recipe("hummingbird-data")\` → extract \`dataToken\`, \`dataPhrase\`, \`jsCode\`, \`expectedOutput\`.
+3. \`widget_display({name: "js-sandbox", params: {title: "Hummingbird JS", code: "<jsCode from step 2 verbatim>", html: "<div id='out' style='font-family:monospace;padding:8px;'></div>", css: "body{margin:0;background:#fff;color:#000;font-size:14px;}"}})\`
+4. \`widget_display({name: "kv", params: {title: "🐦 Hummingbird Retex — tight style", rows: [
+     ["entry_id", "hummingbird-display"],
+     ["entry_token", "HUMMINGBIRD-DISPLAY-C5619"],
+     ["entry_phrase", "Nine moths circle the candle."],
+     ["middle_id", "hummingbird-middle"],
+     ["middle_token", "<step 1>"],
+     ["middle_phrase", "<step 1>"],
+     ["data_id", "hummingbird-data"],
+     ["data_token", "<step 2>"],
+     ["data_phrase", "<step 2>"],
+     ["js_code_verbatim", "<step 2>"],
+     ["js_expected_output", "<step 2>"],
+     ["steps", "1, 2, 3, 4, 5"],
+     ["style", "tight"]
+   ]}})\`
+5. Chat: \`✅ hummingbird chain followed — 3 recipes + JS exec\`
+
+All tokens, phrases, and JS code MUST be verbatim.
+`,
+  'hummingbird-middle': `---
+id: hummingbird-middle
+name: Hummingbird test — middle (tight style)
+when: called from hummingbird-display
+servers: [autoui]
+---
+
+# Hummingbird middle
+
+Token: HUMMINGBIRD-MIDDLE-N7614
+Phrase: "Salt crystals sing in the kettle at midnight."
+
+## Steps
+
+1. Return \`{middleToken: "HUMMINGBIRD-MIDDLE-N7614", middlePhrase: "Salt crystals sing in the kettle at midnight."}\` to caller.
+2. Chat: \`✅ hummingbird-middle followed — N7614\`
+
+Do NOT render any widget.
 `,
   'parlementaire-profile': `---
 id: display-parliamentary-profile-with-hemicycle-and-votes

package/src/recipes/canary-data.md

@@ -0,0 +1,50 @@
+---
+id: canary-data
+name: Canary test — data + JS code (verbose style)
+when: called from canary-display only
+servers: [autoui]
+---
+
+## Canary token
+CANARY-DATA-B9307
+
+## Secret phrase (must be quoted verbatim)
+"Beneath the thirteenth lantern hides a smaller one."
+
+## JS code block (must be transcribed verbatim into the retex AND into js-sandbox)
+
+```js
+document.getElementById('out').textContent = (function(){
+  const prefix = 'EXEC-CANARY-G4872';
+  const a = 17 * 3;
+  const b = a - 7;
+  const c = b % 10;
+  return `${prefix}-${c}${b}`;
+})();
+```
+
+## Expected JS output
+`EXEC-CANARY-G4872-444`
+
+## When to use
+
+Internal recipe. Called by `canary-display` at STEP 2. Do NOT invoke directly. Do NOT render widgets yourself.
+
+## How to use
+
+Return to the caller:
+- `dataToken`: `CANARY-DATA-B9307`
+- `dataSecretPhrase`: `Beneath the thirteenth lantern hides a smaller one.`
+- `jsCode`: the exact JS code block above (verbatim)
+- `expectedOutput`: `EXEC-CANARY-G4872-444`
+
+### STEP 1 — Confirm in chat
+
+Reply exactly: `✅ canary-data followed — B9307 + JS`
+
+## Forbidden
+
+- DO NOT render any widget.
+- DO NOT substitute the token or the secret phrase.
+- DO NOT modify the JS code when passing it to the caller.
+- DO NOT compute a different expected output.

package/src/recipes/canary-display.md

@@ -0,0 +1,99 @@
+---
+id: canary-display
+name: Canary test — entry (verbose style)
+when: user asks to "affiche le canary", "show canary", or "test canary"
+components_used: [js-sandbox, kv]
+servers: [autoui]
+---
+
+## Canary token
+CANARY-DISPLAY-A4821
+
+## Secret phrase (must be quoted verbatim in the retex)
+"The fox jumps twice at dawn before the river freezes."
+
+## When to use
+
+Use this recipe when the user types "canary", "affiche le canary", or similar trigger. This is a TEST recipe designed to produce an auditable retex widget that proves the agent actually read, ingested, and followed a 3-level chain of recipes including a JS code block.
+
+## How to use
+
+YOU MUST execute these steps IN ORDER. Each produces evidence the final retex MUST include.
+
+### STEP 1 — Load the middle recipe
+
+Call `get_recipe("canary-middle")`. From its content, extract:
+- `middleToken` (a string starting with `CANARY-MIDDLE-`)
+- `middleSecretPhrase` (a short sentence between double quotes)
+
+### STEP 2 — Load the data recipe
+
+Call `get_recipe("canary-data")`. From its content, extract:
+- `dataToken` (a string starting with `CANARY-DATA-`)
+- `dataSecretPhrase`
+- The **JS code block** verbatim (between triple backticks ```js ... ```)
+- The **expected JS output** (the exact string the code returns)
+
+### STEP 3 — Render the JS sandbox widget
+
+Call `widget_display` with component `js-sandbox` passing the JS code from STEP 2 VERBATIM:
+
+```
+{
+  name: "js-sandbox",
+  params: {
+    title: "Canary JS execution",
+    code: "<PASTE the JS code from canary-data verbatim — do not modify>",
+    html: "<div id='out' style='font-family:monospace;padding:8px;'></div>",
+    css: "body{margin:0;background:#fff;color:#000;font-size:14px;}"
+  }
+}
+```
+
+Pass the JS code verbatim in the `code` field — no wrapping needed, the recipe already provides a complete IIFE that writes to `#out`.
+
+### STEP 4 — Render the retex widget
+
+Call `widget_display` with component `kv` and these rows IN THIS ORDER:
+
+```
+{
+  name: "kv",
+  params: {
+    title: "🐤 Canary Retex — verbose style",
+    rows: [
+      ["entry_id", "canary-display"],
+      ["entry_token", "CANARY-DISPLAY-A4821"],
+      ["entry_phrase", "The fox jumps twice at dawn before the river freezes."],
+      ["middle_id", "canary-middle"],
+      ["middle_token", "<from STEP 1>"],
+      ["middle_phrase", "<from STEP 1>"],
+      ["data_id", "canary-data"],
+      ["data_token", "<from STEP 2>"],
+      ["data_phrase", "<from STEP 2>"],
+      ["js_code_verbatim", "<the JS code from STEP 2, copied mot-à-mot>"],
+      ["js_expected_output", "<the expected output string from STEP 2>"],
+      ["steps_executed", "1, 2, 3, 4, 5"],
+      ["forbidden_avoided_1", "did not skip STEP 1 (middle)"],
+      ["forbidden_avoided_2", "did not skip STEP 2 (data)"],
+      ["forbidden_avoided_3", "did not substitute any token or phrase"],
+      ["forbidden_avoided_4", "did not modify the JS code"],
+      ["forbidden_avoided_5", "did not execute STEP 4 before STEPS 1-3"]
+    ]
+  }
+}
+```
+
+CRITICAL: all tokens, phrases, and the JS code MUST be verbatim (no paraphrase, no truncation, no reformatting).
+
+### STEP 5 — Confirm in chat
+
+Reply exactly: `✅ canary chain followed — 3 recipes + JS exec`
+
+## Forbidden
+
+- DO NOT skip any STEP.
+- DO NOT substitute any canary token or secret phrase with a paraphrase.
+- DO NOT use a widget other than `js-sandbox` (STEP 3) and `kv` (STEP 4).
+- DO NOT render STEP 4 before STEPS 1, 2, 3 are complete.
+- DO NOT modify the JS code — copy it character for character.

package/src/recipes/canary-middle.md

@@ -0,0 +1,32 @@
+---
+id: canary-middle
+name: Canary test — middle level (verbose style)
+when: called from canary-display only
+servers: [autoui]
+---
+
+## Canary token
+CANARY-MIDDLE-M5392
+
+## Secret phrase (must be quoted verbatim)
+"Under the stone bridge, eleven minnows wait for the tide."
+
+## When to use
+
+Internal recipe. Called exclusively by `canary-display` at STEP 1. Do NOT invoke on its own. Do NOT render widgets.
+
+## How to use
+
+Return to the caller:
+- `middleToken`: `CANARY-MIDDLE-M5392`
+- `middleSecretPhrase`: `Under the stone bridge, eleven minnows wait for the tide.`
+
+### STEP 1 — Confirm in chat
+
+Reply exactly: `✅ canary-middle followed — M5392`
+
+## Forbidden
+
+- DO NOT render any widget.
+- DO NOT substitute the token or the secret phrase.
+- DO NOT invent additional fields.

package/src/recipes/hummingbird-data.md

@@ -0,0 +1,32 @@
+---
+id: hummingbird-data
+name: Hummingbird test — data + JS (tight style)
+when: called from hummingbird-display
+servers: [autoui]
+---
+
+# Hummingbird data
+
+Token: HUMMINGBIRD-DATA-D7244
+Phrase: "The weaver counts backwards from seven."
+
+## JS
+
+```js
+document.getElementById('out').textContent = (function(){
+  const p = 'EXEC-HUMMINGBIRD-H2947';
+  const a = 23 * 2;
+  const b = a + 8;
+  const c = b % 10;
+  return `${p}-${c}${b}`;
+})();
+```
+
+Expected: `EXEC-HUMMINGBIRD-H2947-454`
+
+## Steps
+
+1. Return `{dataToken: "HUMMINGBIRD-DATA-D7244", dataPhrase: "The weaver counts backwards from seven.", jsCode: "<the JS block above verbatim>", expectedOutput: "EXEC-HUMMINGBIRD-H2947-454"}` to caller.
+2. Chat: `✅ hummingbird-data followed — D7244 + JS`
+
+Do NOT render any widget. Do NOT modify the JS.

package/src/recipes/hummingbird-display.md

@@ -0,0 +1,36 @@
+---
+id: hummingbird-display
+name: Hummingbird test — entry (tight style)
+when: user asks to "affiche le hummingbird", "show hummingbird", or "test hummingbird"
+components_used: [js-sandbox, kv]
+servers: [autoui]
+---
+
+# Hummingbird entry
+
+Token: HUMMINGBIRD-DISPLAY-C5619
+Phrase: "Nine moths circle the candle."
+
+## Steps
+
+1. `get_recipe("hummingbird-middle")` → extract `middleToken`, `middlePhrase`.
+2. `get_recipe("hummingbird-data")` → extract `dataToken`, `dataPhrase`, `jsCode`, `expectedOutput`.
+3. `widget_display({name: "js-sandbox", params: {title: "Hummingbird JS", code: "<jsCode from step 2 verbatim>", html: "<div id='out' style='font-family:monospace;padding:8px;'></div>", css: "body{margin:0;background:#fff;color:#000;font-size:14px;}"}})`
+4. `widget_display({name: "kv", params: {title: "🐦 Hummingbird Retex — tight style", rows: [
+     ["entry_id", "hummingbird-display"],
+     ["entry_token", "HUMMINGBIRD-DISPLAY-C5619"],
+     ["entry_phrase", "Nine moths circle the candle."],
+     ["middle_id", "hummingbird-middle"],
+     ["middle_token", "<step 1>"],
+     ["middle_phrase", "<step 1>"],
+     ["data_id", "hummingbird-data"],
+     ["data_token", "<step 2>"],
+     ["data_phrase", "<step 2>"],
+     ["js_code_verbatim", "<step 2>"],
+     ["js_expected_output", "<step 2>"],
+     ["steps", "1, 2, 3, 4, 5"],
+     ["style", "tight"]
+   ]}})`
+5. Chat: `✅ hummingbird chain followed — 3 recipes + JS exec`
+
+All tokens, phrases, and JS code MUST be verbatim.

package/src/recipes/hummingbird-middle.md

@@ -0,0 +1,18 @@
+---
+id: hummingbird-middle
+name: Hummingbird test — middle (tight style)
+when: called from hummingbird-display
+servers: [autoui]
+---
+
+# Hummingbird middle
+
+Token: HUMMINGBIRD-MIDDLE-N7614
+Phrase: "Salt crystals sing in the kettle at midnight."
+
+## Steps
+
+1. Return `{middleToken: "HUMMINGBIRD-MIDDLE-N7614", middlePhrase: "Salt crystals sing in the kettle at midnight."}` to caller.
+2. Chat: `✅ hummingbird-middle followed — N7614`
+
+Do NOT render any widget.