lotus-wisdom-mcp 0.8.5 → 0.9.1

package/README.md

@@ -13,7 +13,7 @@ Available at: https://lotus-wisdom-mcp.linxule.workers.dev/mcp
 * Multi-faceted problem-solving approach inspired by the Lotus Sutra
 * Step-by-step thought process with different thinking techniques
 * Meditation pauses to allow insights to emerge naturally
-* **Interactive visualization** via MCP ext-apps (Claude Desktop, Cursor, ChatGPT) — adapts to the host light/dark theme and is keyboard-accessible
+* **Interactive visualization** via MCP ext-apps (Claude Desktop, Cursor, ChatGPT) — a pixel halo that lights one segment per step, in night and day variants that follow the host theme; keyboard-accessible and respects reduced motion
 * **MCP Prompts** (`contemplate`, `deep-inquiry`) for one-step guided contemplative sessions
 * **Structured tool output** (`structuredContent` + `outputSchema`) alongside the text response
 * Tracks both tag journey and wisdom domain movements
@@ -54,7 +54,7 @@ The server organizes thoughts using wisdom domains (all valid values for the `ta
 
 ### Thought Visualization
 
-In clients that support MCP ext-apps, each step renders inline as an interactive "Living Trace" (see [Interactive Visualization](#interactive-visualization-ext-apps) below). For every client, each step also returns:
+In clients that support MCP ext-apps, each step renders inline as an interactive halo (see [Interactive Visualization](#interactive-visualization-ext-apps) below). For every client, each step also returns:
 
 * Journey tracking showing both the tag path and the wisdom-domain movements
 * Domain-specific labels and the current contemplation text
@@ -92,7 +92,15 @@ A tool for problem-solving using the Lotus Sutra's wisdom framework, with variou
 * `meditationDuration` (integer, optional): Duration for meditation in seconds (1-10)
 * `previousJourney` (string, optional): The `journey` string from a previous response, e.g. `"begin → open → examine"`. Lets the AI carry journey continuity forward in stateless clients (such as the remote Worker), where the server keeps no session state.
 
-**Returns:** a JSON text block and `structuredContent` validated against the tool's `outputSchema`. For `begin`, the full framework is in the text block; structured output contains its status, welcome, and contemplation fields. Other result variants retain their fields in both representations.
+**Returns:** a JSON text block and `structuredContent` validated against the tool's
+`outputSchema`. Every successful response includes `journey` for continuity,
+including `begin` and completion. Completion also retains `finalJourney` for
+compatibility. For `begin`, the full framework is in the text block; structured
+output contains its status, welcome, contemplation, journey, domain journey,
+and step counts. Other result variants retain their fields in both representations.
+
+A meditation step with `nextStepNeeded: false` completes the inquiry with
+`WISDOM_READY`; ongoing meditation steps return `MEDITATION_COMPLETE`.
 
 Response statuses include:
 
@@ -408,16 +416,32 @@ bun install --frozen-lockfile
 bun run typecheck
 bun run test
 bun run build
+bun run test:package
 bun run start
 ```
 
 The build installs the app's locked dependencies and rebuilds the tracked
-`dist/bundle.js` and `dist/journey.html` artifacts. Check app types and build
-regressions with `cd app && bunx tsc --noEmit && bun run test`; see
-[worker validation](worker/README.md#local-dev) for the worker typecheck,
-dry-run build, and local HTTP regression. The app's local Vite plugin inlines
-JavaScript and CSS into one HTML resource, with tests for dynamic imports and
-HTML escaping.
+`dist/bundle.js` and `dist/journey.html` artifacts. Check the app with
+`cd app && bunx tsc --noEmit && bun run test`. The suite covers the single-file
+build (the local Vite plugin inlines JavaScript and CSS into one HTML resource;
+tests cover dynamic imports and HTML escaping) and the journey itself:
+continuity across frames, meditation, reset between inquiries, exploration of
+the completed panel only, and every tag's character rendering from embedded
+outlines. See [worker validation](worker/README.md#local-dev) for the worker
+typecheck, dry-run build, and local HTTP regression.
+
+To see a journey the way a chat shows it, one frame per call, run
+`cd app && bunx vite build` and open `app/preview.html`. The halo's characters
+are generated into `app/src/glyphs.ts`; `app/scripts/glyphs.py` regenerates
+them from a Noto Serif TC subset and documents how to fetch it.
+
+`bun run test:package` packs the built files, installs the tarball in a temporary
+consumer directory, and starts npm's executable link. It checks the MCP version,
+tool discovery, a complete inquiry ending in meditation, a fresh inquiry reset,
+and the packaged journey HTML. CI runs this check
+after building and before publishing, so a broken launcher or missing package
+asset blocks the release. It requires npm registry access to install production
+dependencies and removes its temporary files on completion.
 
 Dependabot uses the `bun` ecosystem for the root, app, and worker packages so
 updates include their `bun.lock` files. CI verifies all three packages on pull
@@ -428,10 +452,11 @@ If npm publishes successfully but MCP Registry registration fails, retry only
 registration for the existing tag:
 
 ```bash
-gh workflow run publish-mcp.yml --ref main -f registry_tag=v0.8.1
+gh workflow run publish-mcp.yml --ref main -f registry_tag=vX.Y.Z
 ```
 
-This revalidates the tagged source and waits for npm availability before
+Replace `vX.Y.Z` with the existing published version's tag. This revalidates the
+tagged source and waits for npm availability before
 registration. It does not republish npm or move the release tag.
 
 Enable debug mode:
@@ -442,14 +467,15 @@ LOTUS_DEBUG=true bun run start
 
 ## Interactive Visualization (ext-apps)
 
-In MCP clients that support ext-apps (Claude Desktop, Cursor, ChatGPT), the tool renders an interactive "Living Trace" visualization inline in the chat:
+In MCP clients that support ext-apps (Claude Desktop, Cursor, ChatGPT), each step renders inline as a small panel: a ring of pixels modeled on the LED halos (光背) wired behind temple statues, the step's character at its center, and the contemplation beside it. Each tool call gets its own panel, so a journey reads down the conversation one frame at a time.
 
-* **Journey trace**: SVG circles colored by wisdom domain appear as steps arrive
-* **Domain colors**: Process (gold), Skillful Means (amber), Non-Dual (green), Meta-Cognitive (blue), Meditation (teal)
-* **Meditation breathing**: Hollow circles with gentle inhale/exhale animation
-* **Completion**: Journey resolves into a gradient path showing the full domain arc
-* **Click to explore**: Pin any step to read its contemplation text
-* **Collapse for long journeys**: Shows last 8 steps with a "+N" cluster for earlier ones
+* **The ring**: one segment per step, shaded with the ASCII ramp: a ▒ track for steps still estimated to come, ▓ for earlier steps, solid █ for the current one, which dithers in as it arrives. The ring re-divides as `totalSteps` changes and closes exactly when the journey completes.
+* **Color is attention**: only the current step is in color; the rest is ink. The colors are the six of the Buddha's aura from the Buddhist flag: Entry white, Process red, Skillful Means yellow, Non-Dual orange, Meta-Cognitive blue, and Meditation the flag's sixth band, a pixel mosaic of all five. When the circle closes it turns white, every color at once (ink in daylight).
+* **A character for each tag**: every character comes from Kumārajīva's Lotus Sutra or from Tiantai's reading of it, in traditional forms. open, express, recognize and embody spell 開示悟入, the four aims of the Buddha's appearance in chapter 2, the chapter on skillful means, which also gives 巧 (upaya: 巧說諸法, "skillfully expounds the teachings") and 直 (direct: 正直捨方便, "directly setting means aside"). 照 (reflect) is the light across eighteen thousand worlds (ch. 1), 出 (transcend) the children leaving the burning house (ch. 3), 證 (verify) Many Treasures bearing witness (ch. 11), 淨 (refine) the purified senses (ch. 19). examine and meditate make Tiantai's 止觀. Hover a character for its pinyin and source. Characters are drawn from embedded Noto Serif TC outlines (SIL OFL 1.1), so they look the same with or without CJK fonts.
+* **Meditation**: the meditation segment breathes by pixel density three times, then rests.
+* **Completion**: the circle closes and turns white, segment by segment. Nothing is added underneath.
+* **Look back**: only the completed panel is interactive. Hover or focus a segment to see that step in its color with its character and tag; click or press Enter to pin it; arrow keys walk the ring. Panels for steps still in progress are for reading and do not respond to the pointer. Steps carried over from earlier frames show their place; their words stay in those frames.
+* **Quiet by design**: nothing loops, nothing glows, and with `prefers-reduced-motion` every state appears without animation. The design came out of a Lotus Wisdom journey on its own UI; after `cd app && bunx vite build`, open `app/preview.html` to replay that journey as a chat shows it, one frame per call.
 
 Clients without ext-apps support are unaffected — they receive the same JSON tool responses as before.
 
@@ -492,7 +518,48 @@ Contributions are welcome! Please feel free to submit issues or pull requests on
 
 ## Version
 
-Current version: 0.8.1
+Current version: 0.9.1
+
+### What's New in 0.9.1
+
+- Updated the MCP SDK, MCP Apps, Cloudflare Agents, and Worker tooling from
+  the grouped Dependabot updates.
+- Refreshed transitive `@hono/node-server` and `qs` dependencies to patched
+  versions, clearing the dependency audit findings in the server and worker.
+- Retained the SDK v1 compatibility handler and aligned the worker's MCP
+  dependencies with Cloudflare Agents' required peer versions.
+- Removed the temporary Undici override now that Worker tooling requires the
+  patched version directly.
+
+### What's New in 0.9.0
+
+- Redesigned the journey visualization as a pixel halo: one segment per step,
+  a traditional character at its center, and the contemplation beside it.
+  Earlier steps appear in ink, future steps as a dim track, and the current
+  step in its domain color. The completed circle turns white in the night theme.
+- Added embedded Noto Serif TC glyph outlines, with pinyin and source notes on
+  hover, so the characters render without installed CJK fonts or font requests.
+- Gave each event a finite animation and made only the completed panel
+  explorable by hover, focus, pin, and keyboard navigation.
+- Kept completed panels at a steady height while looking back, with internal
+  scrolling for longer earlier text, and fixed a rapid-hover content fade race.
+- Added a daylight palette that follows the host theme, reduced-motion styles,
+  DOM regressions, and a development preview showing one frame per tool call.
+- Includes the journey reliability and dependency security fixes below; 0.8.6
+  was prepared but not published separately.
+
+### Reliability fixes prepared for 0.8.6 (included in 0.9.0)
+
+- Preserved the opening step in stateless journeys by returning continuity
+  metadata from `begin`, including in structured output.
+- Fixed completion on meditation steps and added `journey` to completion
+  responses while retaining `finalJourney`.
+- Reset the visualization between inquiries in reused iframes, including
+  pending animations, collapsed steps, pins, and completion effects.
+- Added response-driven journey regressions for the installed CLI and worker,
+  plus DOM tests for consecutive inquiries and animation races.
+- Updated dependencies and patched vulnerable transitive packages. The worker
+  temporarily overrides Undici until Wrangler's Miniflare dependency is patched.
 
 ### What's New in 0.8.1
 

package/dist/bundle.js

@@ -3337,6 +3337,37 @@ var require_utils = __commonJS({
       }
       return output2.join("");
     }
+    function removeDotSegmentsRelative(path) {
+      if (path === "" || path[0] === "/") {
+        return removeDotSegments(path);
+      }
+      const segments = path.split("/");
+      const last = segments.length - 1;
+      const output2 = [];
+      let trailingDirectory = false;
+      for (let i = 0; i <= last; i++) {
+        const segment = segments[i];
+        if (segment === "." || segment === "..") {
+          if (segment === "..") {
+            if (output2.length !== 0 && output2[output2.length - 1] !== "..") {
+              output2.pop();
+            } else {
+              output2.push("..");
+            }
+          }
+          trailingDirectory = i === last;
+        } else {
+          output2.push(segment);
+        }
+      }
+      if (trailingDirectory && output2[output2.length - 1] !== "..") {
+        output2.push("");
+      }
+      if (output2.length === 0 || output2[0] === "" || output2[0].includes(":")) {
+        output2.unshift(".");
+      }
+      return output2.join("/");
+    }
     var HOST_DELIMS = { "@": "%40", "/": "%2F", "?": "%3F", "#": "%23", ":": "%3A" };
     var HOST_DELIM_RE = /[@/?#:]/g;
     var HOST_DELIM_NO_COLON_RE = /[@/?#]/g;
@@ -3597,6 +3628,7 @@ var require_utils = __commonJS({
       encodeFragment,
       escapePreservingEscapes,
       removeDotSegments,
+      removeDotSegmentsRelative,
       isIPv4,
       isUUID,
       normalizeIPv6,
@@ -3820,16 +3852,18 @@ var require_schemes = __commonJS({
 var require_fast_uri = __commonJS({
   "node_modules/fast-uri/index.js"(exports, module) {
     "use strict";
-    var { normalizeIPv6, removeDotSegments, recomposeAuthority, normalizePercentEncoding, normalizePathEncoding, serializePathEncoding, normalizeQueryFragmentEncoding, encodeQuery, encodeFragment, reescapeHostDelimiters, isIPv4, nonSimpleDomain } = require_utils();
+    var { normalizeIPv6, removeDotSegments, removeDotSegmentsRelative, recomposeAuthority, normalizePercentEncoding, normalizePathEncoding, serializePathEncoding, normalizeQueryFragmentEncoding, encodeQuery, encodeFragment, reescapeHostDelimiters, isIPv4, nonSimpleDomain } = require_utils();
     var { SCHEMES, getSchemeHandler } = require_schemes();
     var VALID_SCHEME = /^[A-Za-z][A-Za-z0-9+.-]*$/u;
     var MALFORMED_SCHEME_ERROR = "URI scheme is malformed.";
-    function decodeValidScheme(scheme) {
-      const decodedScheme = unescape(String(scheme));
-      if (!VALID_SCHEME.test(decodedScheme)) {
+    var MALFORMED_HOST_ERROR = "URI host is malformed.";
+    var FORBIDDEN_DOMAIN_HOST_CHARACTER = /[\0-\x20"#/:<>?@[\\\]^`{|}\x7F]/u;
+    function validateScheme(scheme) {
+      const stringScheme = String(scheme);
+      if (!VALID_SCHEME.test(stringScheme)) {
         throw new TypeError(MALFORMED_SCHEME_ERROR);
       }
-      return decodedScheme;
+      return stringScheme;
     }
     function normalize(uri, options) {
       if (typeof uri === "string") {
@@ -3866,6 +3900,9 @@ var require_fast_uri = __commonJS({
       const resolvedSchemeHandler = getSchemeHandler(options && options.scheme || resolved.scheme);
       const resolvedHost = resolved.host;
       const resolvedHostIsIP = resolvedHost !== void 0 && resolvedHost !== "" && (isIPv4(resolvedHost) || normalizeIPv6(resolvedHost).isIPV6);
+      if (hasForbiddenDomainHost(resolved, options || {}, resolvedSchemeHandler, resolvedHostIsIP)) {
+        throw new Error(MALFORMED_HOST_ERROR);
+      }
       canonicalizeHost(resolved, options || {}, resolvedSchemeHandler, resolvedHostIsIP);
       const encodedASCIIHost = resolvedHost && resolvedHost.indexOf("%") !== -1 && !/\P{ASCII}/u.test(resolvedHost);
       if (resolved.error && !encodedASCIIHost) {
@@ -3907,14 +3944,15 @@ var require_fast_uri = __commonJS({
             if (relative.path[0] === "/") {
               target.path = removeDotSegments(relative.path);
             } else {
-              if ((base.userinfo !== void 0 || base.host !== void 0 || base.port !== void 0) && !base.path) {
+              const baseHasAuthority = base.userinfo !== void 0 || base.host !== void 0 || base.port !== void 0;
+              if (baseHasAuthority && !base.path) {
                 target.path = "/" + relative.path;
               } else if (!base.path) {
                 target.path = relative.path;
               } else {
                 target.path = base.path.slice(0, base.path.lastIndexOf("/") + 1) + relative.path;
               }
-              target.path = removeDotSegments(target.path);
+              target.path = base.scheme === void 0 && !baseHasAuthority && target.path[0] !== "/" ? removeDotSegmentsRelative(target.path) : removeDotSegments(target.path);
             }
             target.query = relative.query;
           }
@@ -3952,12 +3990,13 @@ var require_fast_uri = __commonJS({
       const options = Object.assign({}, opts);
       const uriTokens = [];
       if (component.scheme) {
-        component.scheme = decodeValidScheme(component.scheme);
+        component.scheme = validateScheme(component.scheme);
       }
       const schemeHandler = getSchemeHandler(options.scheme || component.scheme);
       if (schemeHandler && schemeHandler.serialize) schemeHandler.serialize(component, options);
       const hasAuthority = component.userinfo !== void 0 || component.host !== void 0 || component.port !== void 0;
-      const pathNoScheme = !options.skipEscape && component.scheme === void 0 && !hasAuthority;
+      const schemelessReference = (component.scheme === void 0 || options.reference === "suffix") && !hasAuthority;
+      const pathNoScheme = !options.skipEscape && schemelessReference;
       if (component.path !== void 0) {
         if (!options.skipEscape) {
           component.path = serializePathEncoding(component.path, pathNoScheme);
@@ -3966,7 +4005,7 @@ var require_fast_uri = __commonJS({
         }
       }
       if (options.reference !== "suffix" && component.scheme) {
-        component.scheme = decodeValidScheme(component.scheme);
+        component.scheme = validateScheme(component.scheme);
         uriTokens.push(component.scheme, ":");
       }
       const authority = recomposeAuthority(component);
@@ -3982,9 +4021,9 @@ var require_fast_uri = __commonJS({
       if (component.path !== void 0) {
         let s = component.path;
         if (!options.absolutePath && (!schemeHandler || !schemeHandler.absolutePath)) {
-          s = removeDotSegments(s);
+          s = schemelessReference && s[0] !== "/" ? removeDotSegmentsRelative(s) : removeDotSegments(s);
         }
-        if (pathNoScheme) {
+        if (schemelessReference) {
           s = serializePathEncoding(s, true);
         }
         if (authority === void 0 && s[0] === "/" && s[1] === "/") {
@@ -4031,16 +4070,34 @@ var require_fast_uri = __commonJS({
       return hasMalformedPercentEncoding(matches[3]) || host !== void 0 && !isIPLiteral(host) && hasMalformedPercentEncoding(host) || hasMalformedPercentEncoding(matches[6]) || hasMalformedPercentEncoding(matches[7]) || hasMalformedPercentEncoding(matches[8]);
     }
     function canonicalizeHost(parsed, options, schemeHandler, isIP) {
+      if (hasForbiddenDomainHost(parsed, options, schemeHandler, isIP)) {
+        parsed.error = parsed.error || MALFORMED_HOST_ERROR;
+        return true;
+      }
       if (!options.unicodeSupport && (!schemeHandler || !schemeHandler.unicodeSupport) && parsed.host && !isIPLiteral(parsed.host) && (options.domainHost || schemeHandler && schemeHandler.domainHost) && isIP === false && nonSimpleDomain(parsed.host)) {
+        let url2;
         try {
-          parsed.host = new URL("http://" + parsed.host).hostname;
+          url2 = new URL("http://" + parsed.host);
         } catch (e) {
           parsed.error = parsed.error || "Host's domain name can not be converted to ASCII: " + e;
           return true;
         }
+        if (!isHostOnlyURL(url2)) {
+          parsed.error = parsed.error || MALFORMED_HOST_ERROR;
+          return true;
+        }
+        parsed.host = url2.hostname;
       }
       return false;
     }
+    function hasForbiddenDomainHost(parsed, options, schemeHandler, isIP) {
+      return Boolean(
+        parsed.host && isIP === false && !isIPLiteral(parsed.host) && (options.domainHost || schemeHandler && schemeHandler.domainHost) && FORBIDDEN_DOMAIN_HOST_CHARACTER.test(parsed.host)
+      );
+    }
+    function isHostOnlyURL(url2) {
+      return url2.username === "" && url2.password === "" && url2.port === "" && url2.pathname === "/" && url2.search === "" && url2.hash === "" && url2.hostname !== "";
+    }
     function parseWithStatus(uri, opts) {
       const options = Object.assign({}, opts);
       const parsed = {
@@ -4095,9 +4152,8 @@ var require_fast_uri = __commonJS({
         parsed.query = matches[7];
         parsed.fragment = matches[8];
         if (parsed.scheme !== void 0) {
-          const decodedScheme = unescape(parsed.scheme);
-          if (VALID_SCHEME.test(decodedScheme)) {
-            parsed.scheme = decodedScheme.toLowerCase();
+          if (VALID_SCHEME.test(parsed.scheme)) {
+            parsed.scheme = parsed.scheme.toLowerCase();
           } else {
             parsed.error = parsed.error || MALFORMED_SCHEME_ERROR;
             malformedScheme = true;
@@ -4125,7 +4181,7 @@ var require_fast_uri = __commonJS({
             malformedIPLiteral = hasIPLiteralBracket && (!bracketedIPLiteral || ipv6result.error === true);
             parsed.host = isIP ? ipv6result.host : ipv6result.host.toLowerCase();
             if (malformedIPLiteral) {
-              parsed.error = parsed.error || "URI host is malformed.";
+              parsed.error = parsed.error || MALFORMED_HOST_ERROR;
               malformedAuthorityOrPort = true;
             }
           } else {
@@ -4153,7 +4209,7 @@ var require_fast_uri = __commonJS({
           if (!isIP) {
             host = normalizePercentEncoding(host.toLowerCase());
           }
-          parsed.host = reescapeHostDelimiters(host, isIP);
+          parsed.host = isIP || options.scheme !== "null" ? reescapeHostDelimiters(host, isIP) : host;
         }
         if (!schemeHandler || schemeHandler && !schemeHandler.skipNormalize) {
           if (parsed.path) {
@@ -35699,6 +35755,15 @@ var McpServer = class {
     this._promptHandlersInitialized = false;
     this.server = new Server(serverInfo, options);
     this._maxToolInputElements = resolveMaxToolInputElements(options?.maxToolInputElements);
+    if (options?.capabilities?.tools) {
+      this.setToolRequestHandlers();
+    }
+    if (options?.capabilities?.resources) {
+      this.setResourceRequestHandlers();
+    }
+    if (options?.capabilities?.prompts) {
+      this.setPromptRequestHandlers();
+    }
   }
   /**
    * Access experimental features.
@@ -36753,11 +36818,16 @@ function processThought(input2, thoughtProcess) {
   const nextProcess = [...process3, step];
   if (input2.tag === "begin") {
     return {
-      result: buildFrameworkResponse(input2.content),
+      result: {
+        ...buildFrameworkResponse(input2.content),
+        ...buildJourney(nextProcess),
+        stepNumber: input2.stepNumber,
+        totalSteps
+      },
       thoughtProcess: nextProcess
     };
   }
-  if (input2.tag === "meditate") {
+  if (input2.tag === "meditate" && input2.nextStepNeeded) {
     const { journey: journey2 } = buildJourney(nextProcess);
     return {
       result: {
@@ -36785,6 +36855,7 @@ function processThought(input2, thoughtProcess) {
         totalSteps: input2.stepNumber,
         journeyLength: nextProcess.length,
         finalJourney: journey2,
+        journey: journey2,
         domainJourney: domainJourney2
       },
       thoughtProcess: nextProcess
@@ -36826,14 +36897,18 @@ function structuredContentFor(result) {
     return {
       status: result.status,
       contemplation: result.contemplation ?? "",
-      welcome: result.welcome ?? ""
+      welcome: result.welcome ?? "",
+      ...result.journey !== void 0 ? { journey: result.journey } : {},
+      ...result.domainJourney !== void 0 ? { domainJourney: result.domainJourney } : {},
+      ...result.stepNumber !== void 0 ? { stepNumber: result.stepNumber } : {},
+      ...result.totalSteps !== void 0 ? { totalSteps: result.totalSteps } : {}
     };
   }
   return result;
 }
 
 // src/shared/version.ts
-var VERSION = "0.8.5";
+var VERSION = "0.9.1";
 
 // src/shared/tool-defs.ts
 var SERVER_NAME = "lotus-wisdom";