semiotic 3.7.2 → 3.7.3

package/README.md

@@ -12,17 +12,16 @@ Simple charts in 5 lines. Network graphs, streaming data, and coordinated
 dashboards when you need them. Structured schemas and an MCP server so
 AI coding assistants generate correct chart code on the first try.
 
-## What's New in 3.7.2
+## What's New in 3.7.3
 
-3.7.2 is a deployment and docs-polish patch release:
+3.7.3 is a hosted ChatGPT Apps patch release:
 
-- `semiotic-mcp --http` now runs in stateless Streamable HTTP mode, with JSON responses,
-  health endpoints, optional `MCP_ALLOWED_HOSTS` host-header protection, and serverless-friendly
-  request teardown.
-- `deploy/cloud-run` contains a minimal Google Cloud Run wrapper for publishing the MCP server as a
-  public read-only connector for ChatGPT, Claude, and other MCP clients.
-- The Accessibility docs' visible navigation tree and bidirectional BarChart examples now honor
-  dark mode, and the contested-annotations blog demo renders its editorial-status callouts reliably.
+- `semiotic-mcp --http` can now serve the OpenAI Apps domain verification challenge from
+  `/.well-known/openai-apps-challenge` when `OPENAI_APPS_CHALLENGE_TOKEN` is configured.
+- The Cloud Run wrapper docs now include the exact Challenge Base URL, token environment variable,
+  and `curl` check for ChatGPT Apps verification.
+- MCP HTTP tests now cover the Apps challenge route while preserving the unauthenticated OAuth
+  discovery 404 behavior.
 
 ```jsx
 import { LineChart } from "semiotic/xy"
@@ -423,13 +422,15 @@ Add to your MCP client config (e.g. `claude_desktop_config.json` for Claude Desk
 }
 ```
 
-No API keys or authentication required. The server runs locally via stdio. HTTP mode is also available for inspectors, web clients, and ChatGPT Apps SDK experiments: `npx semiotic-mcp --http --port 3001`. In 3.7.2 HTTP mode is stateless: each request gets a fresh read-only MCP server + transport, so it can autoscale on serverless hosts without sticky sessions.
+No API keys or authentication required. The server runs locally via stdio. HTTP mode is also available for inspectors, web clients, and ChatGPT Apps SDK experiments: `npx semiotic-mcp --http --port 3001`. Since 3.7.2, HTTP mode is stateless: each request gets a fresh read-only MCP server + transport, so it can autoscale on serverless hosts without sticky sessions.
 
 For ChatGPT developer mode, expose the HTTP endpoint over HTTPS with a tunnel and create a connector that points at `https://<your-tunnel>/mcp`. The experimental Apps SDK surface is `renderInteractiveChart`, which returns a `text/html;profile=mcp-app` widget template plus a hidden SVG payload rendered by Semiotic on the MCP server.
 
 For a hosted deployment, see `deploy/cloud-run`. The wrapper runs the published `semiotic-mcp`
 binary, exposes `/mcp` plus health endpoints, and supports `MCP_ALLOWED_HOSTS` for production
-host-header allowlisting.
+host-header allowlisting. For ChatGPT Apps domain verification, set
+`OPENAI_APPS_CHALLENGE_TOKEN` so HTTP mode serves the raw token from
+`/.well-known/openai-apps-challenge`.
 
 ### Tools
 

package/ai/dist/mcp-server.js

@@ -33854,6 +33854,7 @@ var port = Number.isFinite(parsedPort) ? parsedPort : 3001;
 async function main() {
   if (httpMode) {
     const allowedHosts = (process.env.MCP_ALLOWED_HOSTS || "").split(",").map((h) => h.trim().toLowerCase()).filter(Boolean);
+    const openaiAppsChallengeToken = (process.env.OPENAI_APPS_CHALLENGE_TOKEN || "").trim();
     const healthBody = () => JSON.stringify({
       status: "ok",
       name: "semiotic-mcp",
@@ -33895,6 +33896,14 @@ async function main() {
         res.end(healthBody());
         return;
       }
+      if (req.method === "GET" && pathname === "/.well-known/openai-apps-challenge" && openaiAppsChallengeToken) {
+        res.writeHead(200, {
+          "Content-Type": "text/plain; charset=utf-8",
+          "Cache-Control": "no-store"
+        });
+        res.end(openaiAppsChallengeToken);
+        return;
+      }
       if (pathname !== "/" && pathname !== "/mcp") {
         res.writeHead(404, { "Content-Type": "application/json" });
         res.end(JSON.stringify({ error: "Not found" }));

package/ai/schema.json

@@ -1,7 +1,7 @@
 {
   "$schema": "https://json-schema.org/draft/2020-12/schema",
   "name": "semiotic",
-  "version": "3.7.2",
+  "version": "3.7.3",
   "description": "React data visualization library for charts, networks, and beyond",
   "tools": [
     {

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "semiotic",
-  "version": "3.7.2",
+  "version": "3.7.3",
   "mcpName": "io.github.nteract/semiotic",
   "description": "React data visualization library with built-in MCP server for AI-assisted chart generation",
   "main": "dist/semiotic.min.js",