@compr/opscontext-mcp 2.8.0 → 2.8.1

package/CHANGELOG.md

@@ -4,6 +4,34 @@ All notable changes to OpsContext for AI Agents (previously ContextEngine — MC
 
 > Entries for 2.2.0 through 2.4.0 were not backfilled here; see `docs/sessions/SESSION_19` through `SESSION_21` for those releases.
 
+## [2.8.1] 2026-09-07: a push is not done until its CI is read
+
+### Added
+
+- **`end-session` check 3c, CI on HEAD** (`[PUSHED-MEANS-CI-READ]`, `src/ci-status.ts`): every
+  workflow run for the exact HEAD sha through `gh run list`; a failed run is a FAIL item (exit 1).
+  No gh, no remote, or no runs yet is "not checked", never a pass. Why: main's CI had been red
+  on every commit since 2026-09-04 and the Telegram alert fired each time; thirty commits and
+  five releases went by with nobody reading it.
+
+### Changed
+
+- CI installs the activation server's own packages too: the first time the Test step actually
+  ran, `server/src/community-rules-server.test.ts` could not load (`ERR_MODULE_NOT_FOUND`).
+- The Doc Freshness gate fails only when 20 or more source lines change without a doc change; a
+  one-line lint fix is not a documented change (its first run paged Telegram for a dash).
+- CI runs on Node 20 and 22 with `fail-fast: false`; Node 18 is EOL and eslint 10 needs 20.19+,
+  and the 18 job's failure was cancelling the others before tests ran. `engines.node` is now
+  `>=20.19.0`, which is what is tested.
+
+### Fixed
+
+- CI was red on every pull request for one `prefer-const` lint error in `src/firewall.ts`.
+- The Doc Freshness workflow failed any push or PR made more than 8 hours after the last
+  SKILLS.md commit, whatever the change (two Dependabot bumps on 2026-09-07). It now measures
+  the change itself: source touched without a doc touched fails, anything else passes
+  (`[DOC-GATE-MEASURES-THE-DIFF]`).
+
 ## [2.8.0] 2026-09-06: health is measured, never estimated
 
 ### Added

package/dist/ci-status.d.ts

@@ -0,0 +1,16 @@
+export interface CiRun {
+    name: string;
+    status: string;
+    conclusion: string | null;
+    url: string;
+}
+export interface CiStatus {
+    sha: string;
+    state: "ok" | "failed" | "pending" | "no-runs" | "unavailable";
+    runs: CiRun[];
+    note?: string;
+}
+export type Runner = (cmd: string, args: string[], cwd: string) => string;
+export declare function ciStatusForHead(cwd: string, run?: Runner): CiStatus;
+export declare function formatCiStatus(s: CiStatus): string[];
+//# sourceMappingURL=ci-status.d.ts.map

package/dist/ci-status.js

@@ -0,0 +1,55 @@
+// [LOCKED] [PUSHED-MEANS-CI-READ] 2026-09-07
+// [NEVER] let end-session pass while a workflow run for HEAD has failed, and [NEVER] count
+//         "no runs found" as green.
+// WHY: main's CI had been red on every commit since 2026-09-04 (one lint error, then a Node 18
+//      job that eslint 10 cannot run on) and the Telegram alert fired each time. Thirty commits,
+//      five releases, nobody read it: the post-commit hook pushes, end-session ran after every
+//      push, and nothing in that loop looked at the result. A push is not done until its CI is.
+// FIX: end-session check 3c lists every workflow run for the exact HEAD sha through `gh run
+//      list` (hardcoded argv, no shell) and counts a failure as a FAIL item. gh missing, no
+//      GitHub remote, or no runs yet is reported as "not checked", never as pass.
+import { execFileSync } from "child_process";
+const defaultRunner = (cmd, args, cwd) => execFileSync(cmd, args, { cwd, encoding: "utf8", stdio: ["ignore", "pipe", "ignore"], timeout: 15_000 }).trim();
+export function ciStatusForHead(cwd, run = defaultRunner) {
+    let sha = "";
+    try {
+        sha = run("git", ["rev-parse", "HEAD"], cwd);
+    }
+    catch {
+        return { sha, state: "unavailable", runs: [], note: "not a git repository" };
+    }
+    let raw = "";
+    try {
+        raw = run("gh", ["run", "list", "--limit", "40", "--json", "name,status,conclusion,url,headSha"], cwd);
+    }
+    catch {
+        return { sha, state: "unavailable", runs: [], note: "gh not available, not logged in, or no GitHub remote" };
+    }
+    let all = [];
+    try {
+        all = JSON.parse(raw);
+    }
+    catch {
+        return { sha, state: "unavailable", runs: [], note: "gh returned no JSON" };
+    }
+    const runs = all.filter((r) => r.headSha === sha).map(({ name, status, conclusion, url }) => ({ name, status, conclusion, url }));
+    if (runs.length === 0)
+        return { sha, state: "no-runs", runs, note: "no workflow run for HEAD yet: pushed seconds ago, or CI not wired" };
+    const failed = runs.some((r) => r.conclusion === "failure" || r.conclusion === "timed_out" || r.conclusion === "startup_failure");
+    const pending = runs.some((r) => r.status !== "completed");
+    return { sha, state: failed ? "failed" : pending ? "pending" : "ok", runs };
+}
+export function formatCiStatus(s) {
+    const lines = [];
+    if (s.state === "unavailable" || s.state === "no-runs") {
+        lines.push(`- ⚠️ CI on HEAD${s.sha ? ` ${s.sha.slice(0, 7)}` : ""} not checked: ${s.note}`);
+        return lines;
+    }
+    for (const r of s.runs) {
+        const bad = r.conclusion === "failure" || r.conclusion === "timed_out" || r.conclusion === "startup_failure";
+        const icon = bad ? "❌ FAIL" : r.status !== "completed" ? "⏳" : r.conclusion === "success" ? "✅" : "▫️";
+        lines.push(`- ${icon} ${r.name}: ${r.conclusion ?? r.status}${bad ? `  ${r.url}` : ""}`);
+    }
+    return lines;
+}
+//# sourceMappingURL=ci-status.js.map

package/dist/cli.js

@@ -657,6 +657,7 @@ import { getStagedFiles, runSecretScan, runDocCoverage, runCommitMessageRequired
 import { safeAppend } from "./audit.js";
 import { listServers, formatServers } from "./server-registry.js";
 import { computeFleetHealth, formatFleetHealth } from "./fleet-health.js";
+import { ciStatusForHead, formatCiStatus } from "./ci-status.js";
 import { installSkill, locateBundledSkill, buildManagedBlock, syncClaudeMd, } from "./claude-integration.js";
 import { fileURLToPath } from "url";
 // ---------------------------------------------------------------------------
@@ -2238,6 +2239,17 @@ async function cliEndSession() {
     if (fleet.warnings.length > 0)
         failCount += fleet.warnings.length;
     checks.push("");
+    // --- Check 3c: CI on HEAD ([LOCK] [PUSHED-MEANS-CI-READ]) ---
+    checks.push("## 3c. CI on HEAD\n");
+    const ci = ciStatusForHead(process.cwd());
+    checks.push(...formatCiStatus(ci));
+    if (ci.state === "failed") {
+        failCount++;
+        checks.push("- ❌ FAIL: a workflow run for HEAD failed; a push is not done until its CI is");
+    }
+    else if (ci.state === "ok")
+        passCount++;
+    checks.push("");
     checks.push("## 4. Sessions\n");
     const sessions = listSessions();
     if (sessions.length > 0) {

package/dist/firewall.js

@@ -185,7 +185,7 @@ export class ProtocolFirewall {
         if (sessionUrgent && level === "footer")
             level = "header";
         // Prepend learning injection to response (always, if available)
-        let text = injection ? injection + "\n\n" + responseText : responseText;
+        const text = injection ? injection + "\n\n" + responseText : responseText;
         // Build session urgency block (always prepended when overdue)
         const urgentBlock = sessionUrgent ? this.buildSessionUrgentBlock() : null;
         if (level === "silent" && !urgentBlock)

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "@compr/opscontext-mcp",
-  "version": "2.8.0",
+  "version": "2.8.1",
   "description": "OpsContext for AI Agents — read-only fleet visibility (PM2/nginx/Docker/git/cron) + tamper-evident audit log + policy-as-code hooks. The ops + compliance layer Claude Code can't grow natively.",
   "type": "module",
   "main": "dist/index.js",
@@ -59,7 +59,7 @@
     "email": "yannick@compr.ch"
   },
   "engines": {
-    "node": ">=18.0.0"
+    "node": ">=20.19.0"
   },
   "files": [
     "dist/",