@createsomething/ground-mcp 0.3.3 → 0.3.5

package/README.md

@@ -67,11 +67,12 @@ view; read `discovered_changed_files`, `analyzable_changed_files`, and
 `unsupported_changed_files` and `excluded_changed_files`, so a clean claim is
 valid only with `PASS`.
 
-Ground 0.3.3 keeps `ground diff`'s complete changed-file coverage and makes
-source traversal deterministic and cycle-safe. Diff mode parses the complete
-corpus but only compares pairs involving changed files. Standalone broad
-duplicate scans retain their safety bound and report their non-pass status with
-`scan_complete: false` when the bound is hit.
+Ground 0.3.5 extends source-bearing orphan evidence to nested Cloudflare Worker
+configurations: `wrangler.toml` and `wrangler.json` `main` entries are protected
+with their exact config source. The legacy `ground find orphans` command now
+returns the same verified canonical report as `ground analyze --checks orphans`.
+Promptfoo and manual Ground configurations remain recognized alongside package
+scripts, and broad duplicate scans retain their explicit safety bound.
 
 The release package ships thin command wrappers for every platform. Install
 downloads the matching versioned release asset and verifies its SHA-256 against
@@ -82,6 +83,29 @@ that produced a receipt with:
 ground build-info --json
 ```
 
+### Maintainers: trusted publishing
+
+Ground tags publish through npm Trusted Publishing rather than a local
+one-time-password or a long-lived write token. Configure the package's
+**Trusted Publisher** in npm with:
+
+- Provider: **GitHub Actions**
+- Organization or user: `createsomethingtoday`
+- Repository: `create-something-monorepo`
+- Workflow filename: `ground-release.yml`
+- Allowed action: **npm publish**
+
+Do not configure an environment unless the release workflow adds one. The
+workflow publishes only after its matching GitHub Release and `SHA256SUMS`
+manifest have completed successfully.
+
+If a release was built successfully but npm publication was blocked (for
+example, during Trusted Publishing setup), rerun **Ground Release** manually
+with its exact `ground-v<version>` tag and **publish only** enabled. That path
+checks out the tag, requires it to match `package.json`, and verifies the
+existing release checksum manifest before publishing; it does not rebuild or
+replace GitHub Release assets.
+
 ## The Problem
 
 AI agents are confident. Too confident.
@@ -375,8 +399,30 @@ Ground loads `.ground.yml` from your project root for:
 - Ignore patterns (functions, files, directories)
 - Known drift exceptions with documented reasons
 - Context declarations for intentional exclusions
+- Explicit manual CLI entry points for orphan review
 - Similarity thresholds
 
+Declare a documented operator CLI by exact path relative to the directory you
+pass to `ground diff`. Ground keeps it in duplicate coverage, excludes it only
+from orphan findings, and records `manual_entry_point` in check coverage:
+
+```yaml
+entry_points:
+  manual:
+    - "scripts/rebuild-search-index.mjs"
+```
+
+For `ground_find_orphans` and `ground_analyze`, orphan coverage includes
+`entry_point_evidence`: the exact path, entry-point type, and source Ground used
+to protect it. Alongside package, framework, test, and script entry points,
+Ground recognizes exact `entry_points.manual` declarations, nested
+`wrangler.toml` and `wrangler.json` Worker `main` entries, and local
+`providers[].id`, `prompts[].id`, and assertion-value `file://…` references in
+`promptfooconfig*.yaml`. The config adapters accept only existing source files
+beneath their configuration file; they do not scan arbitrary YAML or follow
+parent/absolute paths. The legacy `ground find orphans` command returns this
+same canonical orphan evidence.
+
 See [Full Documentation](https://github.com/createsomethingtoday/create-something-monorepo/tree/main/packages/ground) for configuration reference.
 
 ## Native service pilot

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "@createsomething/ground-mcp",
-  "version": "0.3.3",
+  "version": "0.3.5",
   "description": "Grounded claims for code. MCP server that prevents AI hallucination in code analysis.",
   "author": "CREATE SOMETHING <hello@createsomething.io>",
   "license": "MIT",
@@ -62,7 +62,7 @@
     "pilot:verify": "pnpm run pilot:check && pnpm run pilot:test && pnpm run pilot:benchmark && pnpm run pilot:receipt:validate -- pilot/evidence/ground-native-benchmark-receipt.v1.json"
   },
   "devDependencies": {
-    "@modelcontextprotocol/sdk": "^1.25.3",
+    "@modelcontextprotocol/sdk": "^1.26.0",
     "@types/node": "^24.10.9",
     "ajv": "^8.17.1",
     "tsx": "^4.21.0",