pmx-canvas 0.1.26 → 0.1.28

package/dist/types/server/index.d.ts

@@ -1,6 +1,8 @@
 import { EventEmitter } from 'node:events';
+import { canvasState } from './canvas-state.js';
 import type { CanvasAnnotation, CanvasNodeState, CanvasEdge, CanvasLayout } from './canvas-state.js';
-import type { PmxAxContext, PmxAxFocusState, PmxAxSource, PmxAxState } from './ax-state.js';
+import type { PmxAxApprovalGate, PmxAxContext, PmxAxEvent, PmxAxEvidence, PmxAxEvidenceKind, PmxAxFocusState, PmxAxHostCapability, PmxAxReviewAnchorType, PmxAxReviewAnnotation, PmxAxReviewKind, PmxAxReviewRegion, PmxAxReviewSeverity, PmxAxReviewStatus, PmxAxSource, PmxAxState, PmxAxSteeringMessage, PmxAxWorkItem, PmxAxWorkItemStatus } from './ax-state.js';
+import type { AxTimelineQuery } from './canvas-db.js';
 import { searchNodes } from './spatial-analysis.js';
 import { diffLayouts } from './mutation-history.js';
 import { fitCanvasView, gcCanvasSnapshots, listCanvasSnapshots } from './canvas-operations.js';
@@ -21,6 +23,11 @@ export declare class PmxCanvas extends EventEmitter {
         automationWebView?: boolean | CanvasAutomationWebViewOptions;
     }): Promise<void>;
     stop(): void;
+    /**
+     * Add a node to the canvas and return the created node (including its `id`,
+     * resolved geometry, and data). Destructure `const { id } = canvas.addNode(...)`
+     * or keep the whole node — both work. (Previously returned a bare id string.)
+     */
     addNode(input: {
         type: CanvasNodeState['type'];
         title?: string;
@@ -40,7 +47,7 @@ export declare class PmxCanvas extends EventEmitter {
         width?: number;
         height?: number;
         strictSize?: boolean;
-    }): string;
+    }): CanvasNodeState;
     addWebpageNode(input: {
         title?: string;
         url: string;
@@ -114,6 +121,85 @@ export declare class PmxCanvas extends EventEmitter {
     setAxFocus(nodeIds: string[], options?: {
         source?: PmxAxSource;
     }): PmxAxFocusState;
+    recordAxEvent(input: {
+        kind: PmxAxEvent['kind'];
+        summary: string;
+        detail?: string | null;
+        nodeIds?: string[];
+        data?: Record<string, unknown> | null;
+    }, options?: {
+        source?: PmxAxSource;
+    }): PmxAxEvent;
+    sendSteering(message: string, options?: {
+        source?: PmxAxSource;
+    }): PmxAxSteeringMessage;
+    markSteeringDelivered(id: string): boolean;
+    getAxTimeline(query?: AxTimelineQuery): ReturnType<typeof canvasState.getAxTimeline>;
+    listWorkItems(): PmxAxWorkItem[];
+    addWorkItem(input: {
+        title: string;
+        status?: PmxAxWorkItemStatus;
+        detail?: string | null;
+        nodeIds?: string[];
+    }, options?: {
+        source?: PmxAxSource;
+    }): PmxAxWorkItem;
+    updateWorkItem(id: string, patch: {
+        title?: string;
+        status?: PmxAxWorkItemStatus;
+        detail?: string | null;
+        nodeIds?: string[];
+    }, options?: {
+        source?: PmxAxSource;
+    }): PmxAxWorkItem | null;
+    listApprovalGates(): PmxAxApprovalGate[];
+    requestApproval(input: {
+        title: string;
+        detail?: string | null;
+        action?: string | null;
+        nodeIds?: string[];
+    }, options?: {
+        source?: PmxAxSource;
+    }): PmxAxApprovalGate;
+    resolveApproval(id: string, decision: 'approved' | 'rejected', options?: {
+        resolution?: string;
+        source?: PmxAxSource;
+    }): PmxAxApprovalGate | null;
+    addEvidence(input: {
+        kind: PmxAxEvidenceKind;
+        title: string;
+        body?: string | null;
+        ref?: string | null;
+        nodeIds?: string[];
+        data?: Record<string, unknown> | null;
+    }, options?: {
+        source?: PmxAxSource;
+    }): PmxAxEvidence;
+    listReviewAnnotations(): PmxAxReviewAnnotation[];
+    addReviewAnnotation(input: {
+        body: string;
+        kind?: PmxAxReviewKind;
+        severity?: PmxAxReviewSeverity;
+        anchorType?: PmxAxReviewAnchorType;
+        nodeId?: string | null;
+        file?: string | null;
+        region?: PmxAxReviewRegion | null;
+        author?: string | null;
+    }, options?: {
+        source?: PmxAxSource;
+    }): PmxAxReviewAnnotation | null;
+    updateReviewAnnotation(id: string, patch: {
+        body?: string;
+        status?: PmxAxReviewStatus;
+        severity?: PmxAxReviewSeverity;
+        kind?: PmxAxReviewKind;
+    }, options?: {
+        source?: PmxAxSource;
+    }): PmxAxReviewAnnotation | null;
+    getHostCapability(): PmxAxHostCapability | null;
+    reportHostCapability(input: unknown, options?: {
+        source?: PmxAxSource;
+    }): PmxAxHostCapability;
     fitView(options?: {
         width?: number;
         height?: number;
@@ -188,9 +274,13 @@ export declare class PmxCanvas extends EventEmitter {
         jsonRender: {
             rootShape: Record<string, string>;
             components: import("../json-render/catalog.js").JsonRenderComponentDescriptor[];
+            directives: Array<{
+                name: string;
+                usage: string;
+            }>;
         };
         graph: {
-            graphTypes: ("line" | "bar" | "pie" | "area" | "scatter" | "radar" | "composed" | "stacked-bar")[];
+            graphTypes: ("line" | "bar" | "pie" | "area" | "scatter" | "radar" | "composed" | "sparkline" | "bullet" | "slopegraph" | "stacked-bar" | "dot-plot")[];
         };
         htmlPrimitives: import("./html-primitives.js").HtmlPrimitiveDescriptor[];
         mcp: {
@@ -251,6 +341,31 @@ export declare class PmxCanvas extends EventEmitter {
         url: string;
         spec: JsonRenderSpec;
     };
+    /**
+     * Progressively build a json-render node from SpecStream patches. Omit nodeId
+     * to create a new streaming node; pass the same nodeId on later calls to
+     * append more patches. The server accumulates the spec and the browser
+     * reloads the viewer as the specVersion bumps.
+     */
+    streamJsonRenderNode(input: {
+        nodeId?: string;
+        title?: string;
+        patches?: unknown[];
+        done?: boolean;
+        x?: number;
+        y?: number;
+        width?: number;
+        height?: number;
+        strictSize?: boolean;
+    }): {
+        id: string;
+        url: string;
+        applied: number;
+        skipped: number;
+        specVersion: number;
+        elementCount: number;
+        streamStatus: 'open' | 'closed';
+    };
     addHtmlNode(input: {
         html: string;
         title?: string;
@@ -318,3 +433,5 @@ export type { WebArtifactBuildInput, WebArtifactBuildOutput, WebArtifactCanvasBu
 export type { GraphNodeInput, JsonRenderNodeInput, JsonRenderSpec } from '../json-render/server.js';
 export type { HtmlPrimitiveKind, HtmlPrimitiveDescriptor, HtmlPrimitiveInput, HtmlPrimitiveBuildResult } from './html-primitives.js';
 export { traceManager } from './trace-manager.js';
+export type { PmxAxApprovalGate, PmxAxApprovalStatus, PmxAxContext, PmxAxEvent, PmxAxEventKind, PmxAxEvidence, PmxAxEvidenceKind, PmxAxFocusState, PmxAxHostCapability, PmxAxReviewAnchorType, PmxAxReviewAnnotation, PmxAxReviewKind, PmxAxReviewRegion, PmxAxReviewSeverity, PmxAxReviewStatus, PmxAxSource, PmxAxState, PmxAxSteeringMessage, PmxAxTimelineSummary, PmxAxWorkItem, PmxAxWorkItemStatus, } from './ax-state.js';
+export type { AxTimelineQuery } from './canvas-db.js';

package/dist/types/server/mutation-history.d.ts

@@ -12,7 +12,7 @@
  * - _replaying flag prevents undo/redo from recording new entries
  */
 import type { CanvasNodeState, CanvasEdge } from './canvas-state.js';
-export type MutationOp = 'addNode' | 'updateNode' | 'removeNode' | 'addEdge' | 'removeEdge' | 'addAnnotation' | 'removeAnnotation' | 'clear' | 'arrange' | 'restoreSnapshot' | 'setPins' | 'setAxFocus' | 'batch' | 'viewport' | 'groupNodes' | 'ungroupNodes';
+export type MutationOp = 'addNode' | 'updateNode' | 'removeNode' | 'addEdge' | 'removeEdge' | 'addAnnotation' | 'removeAnnotation' | 'clear' | 'arrange' | 'restoreSnapshot' | 'setPins' | 'setAxFocus' | 'addWorkItem' | 'updateWorkItem' | 'requestApproval' | 'resolveApproval' | 'addReviewAnnotation' | 'updateReviewAnnotation' | 'batch' | 'viewport' | 'groupNodes' | 'ungroupNodes';
 export interface MutationEntry {
     id: string;
     timestamp: string;

package/docs/cli.md

@@ -125,6 +125,48 @@ pmx-canvas ax focus node-1 node-2      # Set AX focus
 pmx-canvas ax focus --clear           # Clear AX focus
 ```
 
+### AX primitives
+
+Host-agnostic agent-experience primitives. Timeline commands persist for
+diagnostics (retention-bounded, not snapshotted); work items, approval gates,
+and review annotations are canvas-bound and ride snapshots/restore.
+
+```bash
+# Timeline
+pmx-canvas ax event add --kind tool-start --summary "ran tests"
+pmx-canvas ax steer "focus on the failing test first"
+pmx-canvas ax evidence add --kind test-output --title "unit pass"
+pmx-canvas ax timeline --limit 50
+
+# Work items (canvas-bound)
+pmx-canvas ax work add --title "Wire up auth" --status in-progress node-1
+pmx-canvas ax work update <id> --status done
+pmx-canvas ax work list
+
+# Approval gates (canvas-bound; pending → approved/rejected)
+pmx-canvas ax approval request --title "Deploy to prod" --action deploy.prod
+pmx-canvas ax approval resolve <id> --decision approved
+pmx-canvas ax approval list
+
+# Review annotations (canvas-bound)
+pmx-canvas ax review add --body "off-by-one" --kind finding --severity error --file src/x.ts
+pmx-canvas ax review list
+
+# Host capability (own partition; survives clear)
+pmx-canvas ax host report --host copilot --canvas --session-messaging
+pmx-canvas ax host status
+```
+
+## Copilot adapter
+
+Install the bundled GitHub Copilot extension adapter into a repo. The adapter
+maps onto the same neutral AX surfaces (it never makes the core GitHub-specific).
+
+```bash
+pmx-canvas copilot install-extension --dry-run   # Preview target, writes nothing
+pmx-canvas copilot install-extension --yes        # Install/overwrite into .github/extensions/pmx-canvas/
+```
+
 ## WebView automation
 
 Drive a headless Bun.WebView (Chromium or WebKit) pointed at the workbench:

package/docs/http-api.md

@@ -117,6 +117,70 @@ curl -X PATCH http://localhost:4313/api/canvas/ax \
   -d '{"focus":{"nodeIds":["node-1"],"source":"api"}}'
 ```
 
+## AX primitives (timeline, work, host)
+
+Host-agnostic agent-experience primitives across three state partitions.
+Canvas-bound state (work items, approval gates, review annotations) rides
+canvas snapshots; timeline state (events, evidence, steering) persists for
+diagnostics but is retention-bounded and not restored by snapshots; the host
+capability is reported by adapters and survives `canvas_clear`.
+
+```bash
+# Timeline — record a normalized agent-event
+curl -X POST http://localhost:4313/api/canvas/ax/event \
+  -H "Content-Type: application/json" \
+  -d '{"kind":"tool-start","summary":"ran tests","source":"api"}'
+
+# Timeline — send a steering message to the active agent session
+curl -X POST http://localhost:4313/api/canvas/ax/steer \
+  -H "Content-Type: application/json" \
+  -d '{"message":"focus on the failing test first","source":"api"}'
+
+# Timeline — record an evidence item (logs/tool-result/screenshot/file/diff/test-output)
+curl -X POST http://localhost:4313/api/canvas/ax/evidence \
+  -H "Content-Type: application/json" \
+  -d '{"kind":"test-output","title":"unit pass","source":"api"}'
+
+# Timeline — read the bounded timeline (default limit 50, max 200)
+curl "http://localhost:4313/api/canvas/ax/timeline?limit=50"
+
+# Canvas-bound — add / update a work item
+curl -X POST http://localhost:4313/api/canvas/ax/work \
+  -H "Content-Type: application/json" \
+  -d '{"title":"Wire up auth","status":"in-progress","nodeIds":["node-1"],"source":"api"}'
+curl -X PATCH http://localhost:4313/api/canvas/ax/work/<id> \
+  -H "Content-Type: application/json" \
+  -d '{"status":"done"}'
+curl http://localhost:4313/api/canvas/ax/work
+
+# Canvas-bound — request / resolve an approval gate (pending → approved/rejected)
+curl -X POST http://localhost:4313/api/canvas/ax/approval \
+  -H "Content-Type: application/json" \
+  -d '{"title":"Deploy to prod","action":"deploy.prod","source":"api"}'
+curl -X POST http://localhost:4313/api/canvas/ax/approval/<id>/resolve \
+  -H "Content-Type: application/json" \
+  -d '{"decision":"approved","source":"api"}'
+curl http://localhost:4313/api/canvas/ax/approval
+
+# Canvas-bound — add a review annotation (comment/finding) anchored to node/file/region
+curl -X POST http://localhost:4313/api/canvas/ax/review \
+  -H "Content-Type: application/json" \
+  -d '{"body":"off-by-one","kind":"finding","severity":"error","anchorType":"file","file":"src/x.ts","source":"api"}'
+curl http://localhost:4313/api/canvas/ax/review
+
+# Host/session — report and read host capability
+curl -X PUT http://localhost:4313/api/canvas/ax/host-capability \
+  -H "Content-Type: application/json" \
+  -d '{"host":"copilot","canvas":true,"sessionMessaging":true,"source":"api"}'
+curl http://localhost:4313/api/canvas/ax/host-capability
+```
+
+Validation: `/ax/event` requires a valid `kind` + `summary` (400 otherwise);
+`/ax/evidence` requires `kind` + `title`; `/ax/steer`, `/ax/work`,
+`/ax/approval`, `/ax/review` require their primary field; `PATCH /ax/work/:id`
+and `PATCH /ax/review/:id` return 404 for unknown IDs; approval resolve returns
+404 if the gate is missing or already resolved.
+
 ## Diagrams (Excalidraw preset)
 
 ```bash

package/docs/mcp.md

@@ -1,6 +1,6 @@
 # MCP reference
 
-PMX Canvas ships an MCP stdio server with **45 tools** + **9 core resources**,
+PMX Canvas ships an MCP stdio server with **56 tools** + **12 core resources**,
 plus per-skill resources at `canvas://skills/<name>`. The server emits
 `notifications/resources/updated` when canvas state changes — humans pin
 nodes in the browser, agents are notified immediately.
@@ -35,7 +35,8 @@ The canvas auto-starts on first tool call.
 | `canvas_validate_spec` | Validate a json-render spec, graph payload, or HTML primitive payload without creating a node |
 | `canvas_refresh_webpage_node` | Re-fetch and update a webpage node from its stored URL |
 | `canvas_add_json_render_node` | Create a native json-render node from a validated spec |
-| `canvas_add_graph_node` | Create a native graph node (line, bar, pie, area, scatter, radar, stacked-bar, composed) |
+| `canvas_stream_json_render_node` | Progressively build a json-render node from SpecStream JSON-Patch ops (live/streaming panels) |
+| `canvas_add_graph_node` | Create a native graph node (line, bar, pie, area, scatter, radar, stacked-bar, composed, sparkline, dot-plot, bullet, slopegraph) |
 | `canvas_build_web_artifact` | Build a bundled HTML artifact and open it on the canvas |
 
 `canvas_add_html_node` accepts optional `summary`, `agentSummary`, `embeddedNodeIds`, and
@@ -51,8 +52,19 @@ searchable and readable in pinned/spatial context.
 | `canvas_arrange` | Auto-arrange (grid/column/flow) |
 | `canvas_validate` | Validate collisions, containment, and missing edge endpoints |
 | `canvas_focus_node` | Pan viewport to a node; use CLI `focus --no-pan` when you only need to select/raise |
-| `canvas_get_ax` | Read the PMX AX state plus pinned/focused context |
+| `canvas_fit_view` | Fit the canvas viewport to all nodes or a selected subset |
+| `canvas_get_ax` | Read the PMX AX state (focus, work items, approvals, review annotations, host capability) plus pinned/focused context |
 | `canvas_set_ax_focus` | Set the host-agnostic AX focus node set; adapters can pass a source such as `codex` |
+| `canvas_record_ax_event` | Record a normalized timeline `agent-event` (prompt/assistant-message/tool-start/tool-result/failure/approval/steering) |
+| `canvas_send_steering` | Record a `steering-message`: a user instruction from the surface to the active agent session |
+| `canvas_get_ax_timeline` | Read the bounded AX timeline (events, evidence, steering) plus counts |
+| `canvas_add_work_item` | Add a canvas-bound `work-item` (visible task/plan/status tied to nodes) |
+| `canvas_update_work_item` | Update a work item's title/status/detail/nodeIds by ID |
+| `canvas_request_approval` | Request human approval via an `approval-gate` (pending) before a high-impact action |
+| `canvas_resolve_approval` | Resolve a pending approval gate (`approved`/`rejected`) |
+| `canvas_add_evidence` | Record an `evidence-item` on the timeline (logs/tool-result/screenshot/file/diff/test-output) |
+| `canvas_add_review_annotation` | Add a canvas-bound `review-annotation` (comment/finding) anchored to a node, file, or region |
+| `canvas_report_host_capability` | Report a host/session `host-capability` for diagnostics |
 | `canvas_pin_nodes` | Pin nodes to include in agent context |
 | `canvas_clear` | Clear all nodes and edges |
 | `canvas_snapshot` | Save current canvas as a named snapshot |
@@ -82,8 +94,10 @@ Individual bundled skills are also readable at `canvas://skills/<name>`.
 | Resource | Description |
 |----------|-------------|
 | `canvas://pinned-context` | Content of pinned nodes + nearby unpinned neighbors |
-| `canvas://ax` | PMX AX state, currently including persisted focus |
-| `canvas://ax-context` | Agent-readable pinned and focused AX context |
+| `canvas://ax` | PMX AX state: focus, work items, approval gates, review annotations |
+| `canvas://ax-context` | Agent-readable pinned and focused AX context, plus timeline summary and host capability |
+| `canvas://ax-work` | Canvas-bound AX work: work items, approval gates, review annotations |
+| `canvas://ax-timeline` | Bounded AX timeline: recent agent-events, evidence, and steering messages |
 | `canvas://schema` | Running-server create schemas and json-render catalog metadata |
 | `canvas://layout` | Full canvas state (all nodes, edges, viewport) |
 | `canvas://summary` | Compact overview: counts, pinned titles, viewport |
@@ -99,6 +113,10 @@ changes:
 
 - Pin changes notify `canvas://pinned-context`, `canvas://ax`, and `canvas://ax-context`
 - AX focus changes notify `canvas://ax` and `canvas://ax-context`
+- Canvas-bound AX mutations (work items, approval gates, review annotations,
+  host capability) notify `canvas://ax`, `canvas://ax-work`, and `canvas://ax-context`
+- AX timeline mutations (agent-events, evidence, steering) notify
+  `canvas://ax-timeline` and `canvas://ax-context`
 - All mutations notify `canvas://layout`, `canvas://summary`,
   `canvas://spatial-context`, `canvas://history`, and `canvas://code-graph`
 

package/docs/node-types.md

@@ -19,7 +19,7 @@ see [MCP tools](mcp.md), [HTTP API](http-api.md), and [SDK](sdk.md).
 | `webpage` | Persisted webpage snapshot with stored URL, extracted text, refresh |
 | `mcp-app` | Tool-backed hosted MCP App iframes (Excalidraw, etc.) |
 | `json-render` | Structured UI from JSON specs (cards, tables, forms) |
-| `graph` | Charts (line, bar, pie, area, scatter, radar, stacked-bar, composed) |
+| `graph` | Charts (line, bar, pie, area, scatter, radar, stacked-bar, composed, plus Tufte primitives: sparkline, dot-plot, bullet, slopegraph) |
 | `html` | Self-contained HTML/JS in a sandboxed iframe |
 | `web-artifact` | Bundled React/Tailwind artifact (full single-file app) |
 | `group` | Spatial container/frame around other nodes |

package/docs/sdk.md

@@ -15,16 +15,16 @@ import { createCanvas } from 'pmx-canvas';
 const canvas = createCanvas({ port: 4313 });
 await canvas.start({ open: true });
 
-// Add nodes
+// Add nodes — addNode returns the created node (with `.id`, geometry, and data)
 const n1 = canvas.addNode({ type: 'markdown', title: 'Plan', content: '# Step 1\nDo the thing.' });
 const n2 = canvas.addNode({ type: 'status', title: 'Build', content: 'passing' });
 const n3 = canvas.addNode({ type: 'file', content: 'src/index.ts' });
 
-// Connect them
-canvas.addEdge({ from: n1, to: n2, type: 'flow' });
+// Connect them (edges and groups reference node ids)
+canvas.addEdge({ from: n1.id, to: n2.id, type: 'flow' });
 
 // Group related nodes
-canvas.createGroup({ title: 'Build Pipeline', childIds: [n1, n2] });
+canvas.createGroup({ title: 'Build Pipeline', childIds: [n1.id, n3.id] });
 
 // Self-contained HTML in a sandboxed iframe
 canvas.addHtmlNode({
@@ -85,9 +85,27 @@ console.log(canvas.validate());
 console.log(canvas.getLayout());
 
 // AX context for host adapters
-canvas.setAxFocus({ nodeIds: [n1], source: 'sdk' });
+canvas.setAxFocus([n1], { source: 'sdk' });
 console.log(canvas.getAxState());
 console.log(canvas.getAxContext());
+
+// AX primitives — host-agnostic agent-experience layer
+// Timeline (persisted for diagnostics, retention-bounded, not snapshotted)
+canvas.recordAxEvent({ kind: 'tool-start', summary: 'ran tests' }, { source: 'sdk' });
+canvas.addEvidence({ kind: 'test-output', title: 'unit pass' }, { source: 'sdk' });
+canvas.sendSteering('focus on the failing test first', { source: 'sdk' });
+console.log(canvas.getAxTimeline({ limit: 50 }));
+
+// Canvas-bound (rides snapshots + restore, cleared by canvas.clear())
+const work = canvas.addWorkItem({ title: 'Wire up auth', status: 'in-progress', nodeIds: [n1] }, { source: 'sdk' });
+canvas.updateWorkItem(work.id, { status: 'done' });
+const gate = canvas.requestApproval({ title: 'Deploy to prod', action: 'deploy.prod' }, { source: 'sdk' });
+canvas.resolveApproval(gate.id, 'approved', { source: 'sdk' });
+canvas.addReviewAnnotation({ body: 'off-by-one', kind: 'finding', severity: 'error', anchorType: 'file', file: 'src/x.ts' }, { source: 'sdk' });
+
+// Host/session capability (own table, survives clear)
+canvas.reportHostCapability({ host: 'copilot', canvas: true, sessionMessaging: true }, { source: 'sdk' });
+console.log(canvas.getHostCapability());
 ```
 
 ## WebView automation

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "pmx-canvas",
-  "version": "0.1.26",
+  "version": "0.1.28",
   "description": "Spatial canvas workbench for coding agents — infinite 2D canvas with agent-native CLI, MCP integration, nodes, edges, file watching, and snapshots",
   "type": "module",
   "main": "./src/server/index.ts",
@@ -56,18 +56,21 @@
   },
   "dependencies": {
     "@joplin/turndown-plugin-gfm": "^1.0.64",
-    "@json-render/core": "^0.14.1",
-    "@json-render/mcp": "^0.14.1",
-    "@json-render/react": "^0.14.1",
-    "@json-render/shadcn": "^0.14.1",
+    "@json-render/core": "0.19.0",
+    "@json-render/devtools": "0.19.0",
+    "@json-render/devtools-react": "0.19.0",
+    "@json-render/directives": "0.19.0",
+    "@json-render/mcp": "0.19.0",
+    "@json-render/react": "0.19.0",
+    "@json-render/shadcn": "0.19.0",
     "@modelcontextprotocol/ext-apps": "^1.3.1",
     "@modelcontextprotocol/sdk": "^1.0.0",
     "@preact/signals": "^2.0.0",
     "@types/turndown": "^5.0.6",
     "marked": "^15.0.0",
     "preact": "^10.25.0",
-    "react": "^19.2.0",
-    "react-dom": "^19.2.0",
+    "react": "^19.2.3",
+    "react-dom": "^19.2.3",
     "recharts": "^3.2.1",
     "turndown": "^7.2.4",
     "zod": "^4.3.6"