@cosyte/cli 0.0.4 → 0.0.5

package/CHANGELOG.md

@@ -17,6 +17,36 @@ still do. Each entry was assigned to the release whose tag first contains it, re
 
 ### Fixed
 
+- **A red pre-publish gate showed a red X and merged anyway, because `ci / prepublish` was a
+  required check nowhere (CI-REQUIRED-CHECKS).** The shared pipeline this repo calls grew a
+  `prepublish` job on 2026-08-05 (`cosyte/.github#35`, `6142ac4`; its second layer defaulted on in
+  `#36`, `90936ea`), so `ci.yml` began emitting a `ci / prepublish` context on every pull request
+  here **with no commit landing in this repo**. Repository ruleset `19907924` did not name it, so
+  the job could fail and the merge still landed on `main`, which is the branch that publishes.
+  `ci / prepublish` is now a required context, `integration_id`-pinned like the other six.
+  - **What it gates is this package's own worst shipped defect.** The job is an offline manifest
+    lint that refuses a dependency specifier no registry can resolve, plus a probe that packs this
+    tree and installs the tarball into a clean directory. `@cosyte/cli@0.0.1` and `0.0.2` reached
+    the registry carrying `file:vendor/*.tgz` specifiers and are permanently uninstallable; the
+    manifest lint would have refused both. A gate that catches that and then cannot block the merge
+    reintroducing it is documentation.
+  - **The order was load-bearing and is recorded because it is easy to get backwards.** The context
+    name was read off a real `pull_request` check run before the ruleset was written, never off the
+    workflow's `name:` field. Requiring a context nothing emits does not fail a pull request, it
+    leaves it pending and unmergeable forever. A census of the eight most recent head shas here
+    (`#27` through `#34`) finds `ci / prepublish` **zero** times, because the newest of them merged
+    before the upstream job existed, so it could not have been required any earlier.
+  - **`ci.yml`'s banner now covers the hazard that actually bit.** Every previous wording of it was
+    scoped to splitting a step out of `verify` locally. The `uses:` reference is unpinned, so a job
+    added upstream emits a new `ci / <job>` context here with no commit in this repo, and it always
+    arrives unrequired.
+  - **Deliberately NOT in this change: `release.yml`'s version-PR trap note.** It carries a stale
+    required-context count and a claim about the "Version Packages" PR arriving with zero check runs
+    whose truth depends on whether `RELEASE_PR_TOKEN` is authoring that PR. Two attempts to correct
+    it inside this change each produced a fresh false claim: the first a false operational premise,
+    the second a false claim about the note's own history. So it is cut out to its own change rather
+    than rewritten a third time. Nothing about it is made worse here; it is left exactly as it was.
+
 - **The shipped documentation sidebar was off the canonical IA spine, and it was holding up the
   docs site's deploy (CLI-SIDEBAR-IA-NONCANONICAL).** `docs-content/sidebars.json` declared two
   top-level categories that are not on the spine, **"MCP server"** and **"Reference"**. The docs

package/README.md

@@ -1,7 +1,9 @@
-<picture>
-  <source media="(prefers-color-scheme: dark)" srcset="https://cosyte.com/tile/cosyte-lockup-tile-on-dark-1200x300.png">
-  <img alt="Cosyte: a plus mark set in two overlapping rounded squares, one solid and one outlined, beside the Cosyte wordmark" src="https://cosyte.com/tile/cosyte-lockup-tile-on-light-1200x300.png">
-</picture>
+<a href="https://cosyte.com">
+  <picture>
+    <source media="(prefers-color-scheme: dark)" srcset="https://cosyte.com/tile/cosyte-lockup-tile-on-dark-1200x300.png">
+    <img alt="Cosyte: a plus mark set in two overlapping rounded squares, one solid and one outlined, beside the Cosyte wordmark" src="https://cosyte.com/tile/cosyte-lockup-tile-on-light-1200x300.png">
+  </picture>
+</a>
 
 # @cosyte/cli
 

package/dist/bin/cosyte-mcp.cjs

@@ -7,7 +7,7 @@ var types_js = require('@modelcontextprotocol/sdk/types.js');
 var util = require('util');
 
 // src/core/version.ts
-var VERSION = "0.0.4";
+var VERSION = "0.0.5";
 
 // src/core/exit-codes.ts
 var EXIT = {