@createsomething/ground-mcp 0.3.3 → 0.3.4

package/README.md

@@ -67,11 +67,13 @@ view; read `discovered_changed_files`, `analyzable_changed_files`, and
 `unsupported_changed_files` and `excluded_changed_files`, so a clean claim is
 valid only with `PASS`.
 
-Ground 0.3.3 keeps `ground diff`'s complete changed-file coverage and makes
-source traversal deterministic and cycle-safe. Diff mode parses the complete
-corpus but only compares pairs involving changed files. Standalone broad
-duplicate scans retain their safety bound and report their non-pass status with
-`scan_complete: false` when the bound is hit.
+Ground 0.3.4 adds source-bearing entry-point evidence to orphan analysis, so
+declarative Promptfoo and manual Ground configurations are recognized alongside
+package scripts. It keeps `ground diff`'s complete changed-file coverage and
+deterministic, cycle-safe source traversal. Diff mode parses the complete corpus
+but only compares pairs involving changed files. Standalone broad duplicate scans
+retain their safety bound and report a non-pass status with `scan_complete: false`
+when the bound is hit.
 
 The release package ships thin command wrappers for every platform. Install
 downloads the matching versioned release asset and verifies its SHA-256 against
@@ -82,6 +84,29 @@ that produced a receipt with:
 ground build-info --json
 ```
 
+### Maintainers: trusted publishing
+
+Ground tags publish through npm Trusted Publishing rather than a local
+one-time-password or a long-lived write token. Configure the package's
+**Trusted Publisher** in npm with:
+
+- Provider: **GitHub Actions**
+- Organization or user: `createsomethingtoday`
+- Repository: `create-something-monorepo`
+- Workflow filename: `ground-release.yml`
+- Allowed action: **npm publish**
+
+Do not configure an environment unless the release workflow adds one. The
+workflow publishes only after its matching GitHub Release and `SHA256SUMS`
+manifest have completed successfully.
+
+If a release was built successfully but npm publication was blocked (for
+example, during Trusted Publishing setup), rerun **Ground Release** manually
+with its exact `ground-v<version>` tag and **publish only** enabled. That path
+checks out the tag, requires it to match `package.json`, and verifies the
+existing release checksum manifest before publishing; it does not rebuild or
+replace GitHub Release assets.
+
 ## The Problem
 
 AI agents are confident. Too confident.
@@ -375,8 +400,28 @@ Ground loads `.ground.yml` from your project root for:
 - Ignore patterns (functions, files, directories)
 - Known drift exceptions with documented reasons
 - Context declarations for intentional exclusions
+- Explicit manual CLI entry points for orphan review
 - Similarity thresholds
 
+Declare a documented operator CLI by exact path relative to the directory you
+pass to `ground diff`. Ground keeps it in duplicate coverage, excludes it only
+from orphan findings, and records `manual_entry_point` in check coverage:
+
+```yaml
+entry_points:
+  manual:
+    - "scripts/rebuild-search-index.mjs"
+```
+
+For `ground_find_orphans` and `ground_analyze`, orphan coverage includes
+`entry_point_evidence`: the exact path, entry-point type, and source Ground used
+to protect it. Alongside package, framework, test, and script entry points,
+Ground recognizes exact `entry_points.manual` declarations and local
+`providers[].id`, `prompts[].id`, and assertion-value `file://…` references in
+`promptfooconfig*.yaml`. The Promptfoo adapter accepts only existing source
+files beneath that configuration file; it does not scan arbitrary YAML or
+follow parent/absolute paths.
+
 See [Full Documentation](https://github.com/createsomethingtoday/create-something-monorepo/tree/main/packages/ground) for configuration reference.
 
 ## Native service pilot

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "@createsomething/ground-mcp",
-  "version": "0.3.3",
+  "version": "0.3.4",
   "description": "Grounded claims for code. MCP server that prevents AI hallucination in code analysis.",
   "author": "CREATE SOMETHING <hello@createsomething.io>",
   "license": "MIT",
@@ -62,7 +62,7 @@
     "pilot:verify": "pnpm run pilot:check && pnpm run pilot:test && pnpm run pilot:benchmark && pnpm run pilot:receipt:validate -- pilot/evidence/ground-native-benchmark-receipt.v1.json"
   },
   "devDependencies": {
-    "@modelcontextprotocol/sdk": "^1.25.3",
+    "@modelcontextprotocol/sdk": "^1.26.0",
     "@types/node": "^24.10.9",
     "ajv": "^8.17.1",
     "tsx": "^4.21.0",