v0.5.7 — what a stranger receives

Three defects that were only ever visible from outside, plus the documentation and the gates that let them live here unnoticed.

All three were found by looking at what a stranger receives rather than at what this repository contains: the text an MCP client is actually handed by list_apps, a link a reader on GitHub actually clicks, and the security alerts the public repository page actually shows. None of them had ever failed a test. The runtime's only behavioural change is one line of listing text — the tool surface is otherwise byte-identical to 0.5.6.

Fixed

• list_apps told the model every app was undefined characters long. The rendered row read a field named html_size; the query behind it has produced length(ui) AS ui_size since the manifest split, and a missing property in JavaScript is undefined, not an error. Every row of every listing, in every host, printed (undefined chars, by …) — while the structured half stayed correct, because it spreads the store row rather than naming fields. Found by driving the published npm package the way a client would (npx -y @2nd1st/open-mcp-apps, initialize → save_app → list_apps), which is why the test now asserts on the rendered text.
• A link in the changelog 404'd for every reader (CLA.md, deleted in 0.5.4 with the MIT relicense). It now points at the last release that carried the file.
• TRADEMARKS.md still described the licence in the present tense as AGPL for the engine and MIT for components/. The whole repository has been MIT since 0.5.4. That file ships in the npm tarball as well as the repository.
• Nine Dependabot alerts, not one of them on a dependency we declare — hono and @hono/node-server by two paths at once, ip-address under the sdk's express-rate-limit, fast-uri under its ajv. Every repair was a patch release already inside a ^ range we had written, so npm audit fix without --force was the entire fix: package.json unchanged, package-lock.json twelve lines, npm audit --omit=dev reports 0 afterwards.
• Documentation that had stopped being true: an assertion count, a size comparison whose argument no longer held once measured (the gap had closed from 2.7× to 1.2×), a contributor guide describing three test suites where there are twenty-three, and two places where the Chinese and English READMEs disagreed about whether an endpoint was included.

Added

• Terminal hosts get a section of their own. A host that renders no widgets was described here as "text fallback" — which reads as no UI. Since @live, an app opened from a terminal host appears on a screen beside it, and that screen keeps following whatever the AI opens next. The host table now carries that path, with its cost stated: the conversation still shows no widget, and the viewer binds 127.0.0.1, so a second device needs the tunnel described above it.

Changed

• scripts/publish.mjs checks link closure over the staged snapshot (step 7b): every relative markdown link in a published .md must resolve inside the published file set. It covers the two cases nothing else could — a target deleted from the repository, and a target that exists here but is not in the ALLOWLIST, which no check running against the internal tree can detect by construction.
• The release version now has a machine counting its homes. It lives in six places; two of them — server.json (the MCP Registry contract) and lhm.plugin.json (the LobeHub one) — were checked by nothing, and one of them silently stayed at 0.5.4 through a release, which merged a directory update into an old entry. test/invariants.mjs now pins both, along with the package identifiers they carry.
• A byte count in RUNTIME.md is now derived from source rather than copied by hand; the previous value had been wrong by more than a factor of two.

Verified before publishing: the snapshot's own bytes were run through the public CI steps in Linux containers on node:22 and node:24, on both architectures — 1567 assertions, zero failures, no MCP host present. That check exists because 0.5.5 shipped with a red CI after being "verified" on a machine that had Claude Desktop installed.

Full detail: CHANGELOG.md