@dollhousemcp/mcp-server 1.9.18 → 1.9.20

package/CHANGELOG.md

@@ -2,6 +2,103 @@
 
 ## [Unreleased]
 
+## [1.9.20] - 2025-10-17
+
+**Fix Release**: MCP Registry Publishing Compatibility
+
+### Fixed
+- MCP Registry publishing case sensitivity issue (#XXXX)
+  - Corrected `mcpName` field in package.json to match GitHub organization capitalization
+  - Changed from `io.github.dollhousemcp/mcp-server` to `io.github.DollhouseMCP/mcp-server`
+  - Resolves NPM package validation errors when publishing to MCP Registry
+  - Ensures proper namespace permission matching
+
+### Context
+The MCP Registry performs two case-sensitive validations:
+1. Permission check against GitHub org name (`io.github.DollhouseMCP/*`)
+2. NPM package validation against `mcpName` field in package.json
+
+The initial implementation incorrectly used lowercase for `mcpName`, causing a validation mismatch. This patch release corrects the capitalization to match our GitHub organization name.
+
+## [1.9.19] - 2025-10-17
+
+**Comprehensive Release**: 90 commits including security fixes, PostHog telemetry, MCP registry support, and major cleanup
+
+### Added
+- MCP registry publishing workflow with OIDC authentication (#1367)
+  - Automated publishing to registry.modelcontextprotocol.io
+  - GitHub Actions workflow with manual dry-run mode
+  - Comprehensive test suite for workflow validation (50+ tests)
+  - Pinned mcp-publisher CLI to v1.3.3 for reproducibility
+- PostHog remote telemetry integration (#1357, #1361)
+  - Opt-in remote analytics with DOLLHOUSE_TELEMETRY_OPTIN=true
+  - Usage patterns and error tracking
+  - Privacy-focused with explicit consent
+- MCP Resources support for capability index (#1360)
+  - Future-proof architecture (disabled by default)
+  - Ready for MCP protocol evolution
+- Dual licensing model with commercial option (#1350)
+  - AGPL-3.0 with platform stability commitments
+  - Commercial licensing pathway
+- Minimal installation telemetry (#1359)
+  - Operational metrics for v1.9.19
+  - Installation success tracking
+- Security telemetry tracking for blocked attacks (#1313)
+- Automated release issue verification system (#1249)
+- Orphaned issues checker for systematic cleanup (#1251)
+- Personal development notes directory (#1275)
+
+### Security
+- Phase 1: Background validation for memory security (#1316, #1320, #1322)
+- Phase 2: AES-256-GCM pattern encryption (#1323)
+- Fixed symlink path traversal vulnerability (#1290, #1306)
+  - Resolve symlinks before validation
+  - Enhanced audit logging
+  - Comprehensive path sanitization
+- Fixed command injection in verify-release-issues.js (#1249)
+  - DMCP-SEC-001: Critical vulnerability patched
+  - PATH injection protection with absolute paths
+- Tightened YAML bomb detection threshold from 10:1 to 5:1 (#1305)
+- Fixed multiple security audit issues (3 MEDIUM/LOW severity)
+
+### Fixed
+- Missing shell: bash declarations in MCP registry workflow
+- OAuth device flow zero-scopes bug (using OIDC instead)
+- Test isolation to prevent resource contention (#1288)
+- GitHub rate limiter test failures (#1285)
+- Recognition of MERGED state in release verification (#1250)
+- Resolved 26+ SonarCloud code quality issues across multiple files
+  - Import/export ordering issues
+  - Cognitive complexity reductions
+  - Security hotspot resolutions
+- Cross-platform workflow compatibility improvements
+- Namespace casing for MCP registry (DollhouseMCP)
+
+### Changed
+- Improved whitespace detection performance
+- Enhanced path traversal protection mechanisms
+- Skip Claude Code Review for Dependabot PRs (#1241)
+- Refactored CLAUDE.md into modular documentation (#1270)
+- Renamed docs/archive/ to docs/session-history/ (#1277)
+- Added node: prefix for built-in module imports
+- Reduced cognitive complexity in multiple modules
+
+### Dependencies
+- Updated @modelcontextprotocol/sdk from 1.18.0 to 1.20.0
+- Updated jest from 30.0.5 to 30.2.0
+- Updated @types/node from 24.4.0 to 24.7.0
+- Updated typescript from 5.9.2 to 5.9.3
+- Updated multiple dev dependencies
+- Added PostHog SDK for telemetry
+
+### Technical
+- OIDC permissions: id-token:write, contents:read
+- server.json included in NPM package
+- Docker build optimizations and multi-platform support
+- Auto-sync README files on develop push
+- Enhanced test coverage and reliability
+- Improved CI/CD pipeline stability
+
 ## [1.9.18] - 2025-10-17
 
 **Feature Release**: PostHog remote telemetry (opt-in), MCP Resources support, and operational telemetry foundation

package/README.github.md

@@ -873,6 +873,103 @@ For detailed guidelines, see [CONTRIBUTING.md](CONTRIBUTING.md).
 
 ## 🏷️ Version History
 
+### v1.9.19 - October 17, 2025
+
+**Comprehensive Release**: 90 commits including security fixes, PostHog telemetry, MCP registry support, and major cleanup
+
+#### Added
+- MCP registry publishing workflow with OIDC authentication (#1367)
+- PostHog remote telemetry integration (#1357, #1361) - Opt-in remote analytics
+- MCP Resources support for capability index (#1360) - Future-proof architecture
+- Dual licensing model with commercial option (#1350)
+- Minimal installation telemetry (#1359)
+- Security telemetry tracking for blocked attacks (#1313)
+- Automated release issue verification system (#1249)
+- Orphaned issues checker for systematic cleanup (#1251)
+- Personal development notes directory (#1275)
+
+#### Security
+- Phase 1: Background validation for memory security (#1316, #1320, #1322)
+- Phase 2: AES-256-GCM pattern encryption (#1323)
+- Fixed symlink path traversal vulnerability (#1290, #1306)
+- Fixed command injection in verify-release-issues.js (#1249) - DMCP-SEC-001
+- Tightened YAML bomb detection threshold from 10:1 to 5:1 (#1305)
+
+#### Fixed
+- Missing shell: bash declarations in MCP registry workflow
+- OAuth device flow zero-scopes bug (using OIDC instead)
+- Test isolation to prevent resource contention (#1288)
+- GitHub rate limiter test failures (#1285)
+- Recognition of MERGED state in release verification (#1250)
+- Resolved 26+ SonarCloud code quality issues
+
+#### Changed
+- Updated @modelcontextprotocol/sdk from 1.18.0 to 1.20.0
+- Updated jest from 30.0.5 to 30.2.0
+- Enhanced path traversal protection mechanisms
+- Skip Claude Code Review for Dependabot PRs (#1241)
+
+---
+
+### v1.9.18 - October 17, 2025
+
+**Feature Release**: PostHog remote telemetry (opt-in), MCP Resources support, and operational telemetry foundation
+
+#### Added
+- **PostHog Remote Telemetry Integration** (#1357, #1361) - Opt-in remote analytics
+  - Simple opt-in: Set `DOLLHOUSE_TELEMETRY_OPTIN=true` to enable remote telemetry
+  - Uses shared PostHog project for community-wide insights
+  - Multiple control levels and GDPR compliant by design
+
+- **MCP Resources Support** (#1360) - Future-proof implementation
+  - Three resource variants exposed: summary (~3K tokens), full (~40K tokens), and stats (JSON)
+  - Status: Non-functional in Claude Code (Oct 2025) - discovery only
+  - Default: Disabled for safety - zero overhead when not enabled
+
+- **Operational Telemetry Foundation** (#1358, #1359) - Minimal installation tracking
+  - Tracks single installation event on first run
+  - Privacy-first design: no PII, no behavioral data, no user content
+
+#### Test Results
+- 2546 tests passing
+- Test coverage: >96% maintained
+- All CI checks passing across all platforms
+
+---
+
+### v1.9.17 - October 8, 2025
+
+**Test isolation and repository cleanup patch**
+
+#### Fixed
+- **Performance Test Isolation (#1288)**: Fixed flaky IndexOptimization test
+  - Created dedicated `jest.performance.config.cjs` with 4 parallel workers
+  - Main test suite no longer runs performance tests concurrently
+  - IndexOptimization test now consistently passes at 60-70ms
+
+- **Repository Cleanup (#1287)**: Removed ignored files from Git tracking
+  - Removed `.obsidian/` directory (4 files) and `test-results/` (3 files)
+
+- **Flaky Test Management (#1286)**: Skip flaky GitHubRateLimiter tests
+  - Marked intermittent GitHub API rate limiter tests as skipped
+
+#### Chores
+- Repository Organization (#1276): Added `.obsidian/` and `test-results/` to .gitignore
+- Documentation Structure (#1277): Renamed docs/archive/ to docs/session-history/
+- Documentation Refactor (#1270): Improved CLAUDE.md organization
+
+#### Features
+- Issue Management (#1251): Added orphaned issues checker
+- Developer Experience (#1275): Added dev-notes/ directory
+- CI Improvements: Added automated release issue verification (#1241)
+
+#### Test Results
+- Main suite: 2269 tests passing (performance tests excluded)
+- Performance suite: 62 tests passing (isolated execution)
+- Total: 2331 tests passing
+
+---
+
 ### v1.9.16 - October 3, 2025
 
 **Patch Release**: Platform-agnostic MCP client documentation + SonarCloud code quality (19 issues)

package/README.md.backup

@@ -873,67 +873,100 @@ For detailed guidelines, see [CONTRIBUTING.md](CONTRIBUTING.md).
 
 ## 🏷️ Version History
 
+### v1.9.19 - October 17, 2025
+
+**Comprehensive Release**: 90 commits including security fixes, PostHog telemetry, MCP registry support, and major cleanup
+
+#### Added
+- MCP registry publishing workflow with OIDC authentication (#1367)
+- PostHog remote telemetry integration (#1357, #1361) - Opt-in remote analytics
+- MCP Resources support for capability index (#1360) - Future-proof architecture
+- Dual licensing model with commercial option (#1350)
+- Minimal installation telemetry (#1359)
+- Security telemetry tracking for blocked attacks (#1313)
+- Automated release issue verification system (#1249)
+- Orphaned issues checker for systematic cleanup (#1251)
+- Personal development notes directory (#1275)
+
+#### Security
+- Phase 1: Background validation for memory security (#1316, #1320, #1322)
+- Phase 2: AES-256-GCM pattern encryption (#1323)
+- Fixed symlink path traversal vulnerability (#1290, #1306)
+- Fixed command injection in verify-release-issues.js (#1249) - DMCP-SEC-001
+- Tightened YAML bomb detection threshold from 10:1 to 5:1 (#1305)
+
+#### Fixed
+- Missing shell: bash declarations in MCP registry workflow
+- OAuth device flow zero-scopes bug (using OIDC instead)
+- Test isolation to prevent resource contention (#1288)
+- GitHub rate limiter test failures (#1285)
+- Recognition of MERGED state in release verification (#1250)
+- Resolved 26+ SonarCloud code quality issues
+
+#### Changed
+- Updated @modelcontextprotocol/sdk from 1.18.0 to 1.20.0
+- Updated jest from 30.0.5 to 30.2.0
+- Enhanced path traversal protection mechanisms
+- Skip Claude Code Review for Dependabot PRs (#1241)
+
+---
+
 ### v1.9.18 - October 17, 2025
 
 **Feature Release**: PostHog remote telemetry (opt-in), MCP Resources support, and operational telemetry foundation
 
-#### ✨ Features
-- **PostHog Remote Telemetry Integration** - Opt-in remote analytics with community insights
-  - Simple opt-in: Set `DOLLHOUSE_TELEMETRY_OPTIN=true` to enable
-  - Default PostHog project key embedded (safe to expose - write-only)
-  - Multiple control levels for privacy and data management
-  - GDPR compliant - fully opt-in by design
-
-- **MCP Resources Support** - Future-proof capability index (disabled by default)
-  - Server can expose element definitions as MCP Resources
-  - Alternative to tool-based element access for future MCP clients
-  - Disabled by default to maintain stability
-
-- **Operational Telemetry Foundation** - Infrastructure for monitoring and analytics
-  - TelemetryManager with local-first architecture
-  - Event aggregation and buffering (10s intervals)
-  - PostHog integration for remote insights (opt-in only)
-  - Privacy-preserving with PII filtering
+#### Added
+- **PostHog Remote Telemetry Integration** (#1357, #1361) - Opt-in remote analytics
+  - Simple opt-in: Set `DOLLHOUSE_TELEMETRY_OPTIN=true` to enable remote telemetry
+  - Uses shared PostHog project for community-wide insights
+  - Multiple control levels and GDPR compliant by design
 
-#### 🔧 Fixed
-- **SonarCloud Code Quality** - Resolved 6 issues across import management and security
-- **Security Audit** - Fixed 3 MEDIUM/LOW severity issues in dependencies
+- **MCP Resources Support** (#1360) - Future-proof implementation
+  - Three resource variants exposed: summary (~3K tokens), full (~40K tokens), and stats (JSON)
+  - Status: Non-functional in Claude Code (Oct 2025) - discovery only
+  - Default: Disabled for safety - zero overhead when not enabled
 
-#### 📊 Impact
-- ✅ Optional remote telemetry for community insights
-- ✅ Future-proof MCP Resources foundation
-- ✅ All SonarCloud quality gates PASSING
-- ✅ Zero HIGH/CRITICAL security issues
+- **Operational Telemetry Foundation** (#1358, #1359) - Minimal installation tracking
+  - Tracks single installation event on first run
+  - Privacy-first design: no PII, no behavioral data, no user content
+
+#### Test Results
+- 2546 tests passing
+- Test coverage: >96% maintained
+- All CI checks passing across all platforms
 
 ---
 
 ### v1.9.17 - October 8, 2025
 
-**Patch Release**: Test isolation and repository cleanup
+**Test isolation and repository cleanup patch**
 
-#### 🔧 Fixed
-- **Performance Test Isolation** - Fixed flaky IndexOptimization test with dedicated test suite
-  - Created `jest.performance.config.cjs` with 4 parallel workers
-  - Reduced execution time from 10+ minutes to 18.7 seconds
+#### Fixed
+- **Performance Test Isolation (#1288)**: Fixed flaky IndexOptimization test
+  - Created dedicated `jest.performance.config.cjs` with 4 parallel workers
   - Main test suite no longer runs performance tests concurrently
+  - IndexOptimization test now consistently passes at 60-70ms
 
-- **Repository Cleanup** - Removed ignored files from Git tracking
-  - Removed `.obsidian/` directory and `test-results/` from version control
-  - Files remain available locally but not tracked in repository
+- **Repository Cleanup (#1287)**: Removed ignored files from Git tracking
+  - Removed `.obsidian/` directory (4 files) and `test-results/` (3 files)
 
-- **Flaky Test Management** - Skipped intermittent GitHubRateLimiter tests
-  - Prevents CI failures from external API dependencies
+- **Flaky Test Management (#1286)**: Skip flaky GitHubRateLimiter tests
+  - Marked intermittent GitHub API rate limiter tests as skipped
 
-#### 📚 Documentation
-- Enhanced Docker environment file documentation
-- Added README to data/ directory
-- Improved CLAUDE.md organization and clarity
-- Renamed docs/archive/ to docs/session-history/
+#### Chores
+- Repository Organization (#1276): Added `.obsidian/` and `test-results/` to .gitignore
+- Documentation Structure (#1277): Renamed docs/archive/ to docs/session-history/
+- Documentation Refactor (#1270): Improved CLAUDE.md organization
 
-#### 📊 Impact
-- ✅ Improved CI reliability and test execution speed
-- ✅ Cleaner repository structure
-- ✅ Better documentation organization
+#### Features
+- Issue Management (#1251): Added orphaned issues checker
+- Developer Experience (#1275): Added dev-notes/ directory
+- CI Improvements: Added automated release issue verification (#1241)
+
+#### Test Results
+- Main suite: 2269 tests passing (performance tests excluded)
+- Performance suite: 62 tests passing (isolated execution)
+- Total: 2331 tests passing
 
 ---
 

package/dist/generated/version.d.ts

@@ -2,8 +2,8 @@
  * Auto-generated file - DO NOT EDIT
  * Generated at build time by scripts/generate-version.js
  */
-export declare const PACKAGE_VERSION = "1.9.18";
-export declare const BUILD_TIMESTAMP = "2025-10-17T16:44:23.719Z";
+export declare const PACKAGE_VERSION = "1.9.20";
+export declare const BUILD_TIMESTAMP = "2025-10-17T23:11:51.604Z";
 export declare const BUILD_TYPE: 'npm' | 'git';
 export declare const PACKAGE_NAME = "@dollhousemcp/mcp-server";
 //# sourceMappingURL=version.d.ts.map

package/dist/generated/version.js

@@ -2,8 +2,8 @@
  * Auto-generated file - DO NOT EDIT
  * Generated at build time by scripts/generate-version.js
  */
-export const PACKAGE_VERSION = '1.9.18';
-export const BUILD_TIMESTAMP = '2025-10-17T16:44:23.719Z';
+export const PACKAGE_VERSION = '1.9.20';
+export const BUILD_TIMESTAMP = '2025-10-17T23:11:51.604Z';
 export const BUILD_TYPE = 'npm';
 export const PACKAGE_NAME = '@dollhousemcp/mcp-server';
-//# sourceMappingURL=data:application/json;base64,eyJ2ZXJzaW9uIjozLCJmaWxlIjoidmVyc2lvbi5qcyIsInNvdXJjZVJvb3QiOiIiLCJzb3VyY2VzIjpbIi4uLy4uL3NyYy9nZW5lcmF0ZWQvdmVyc2lvbi50cyJdLCJuYW1lcyI6W10sIm1hcHBpbmdzIjoiQUFBQTs7O0dBR0c7QUFFSCxNQUFNLENBQUMsTUFBTSxlQUFlLEdBQUcsUUFBUSxDQUFDO0FBQ3hDLE1BQU0sQ0FBQyxNQUFNLGVBQWUsR0FBRywwQkFBMEIsQ0FBQztBQUMxRCxNQUFNLENBQUMsTUFBTSxVQUFVLEdBQWtCLEtBQUssQ0FBQztBQUMvQyxNQUFNLENBQUMsTUFBTSxZQUFZLEdBQUcsMEJBQTBCLENBQUMiLCJzb3VyY2VzQ29udGVudCI6WyIvKipcbiAqIEF1dG8tZ2VuZXJhdGVkIGZpbGUgLSBETyBOT1QgRURJVFxuICogR2VuZXJhdGVkIGF0IGJ1aWxkIHRpbWUgYnkgc2NyaXB0cy9nZW5lcmF0ZS12ZXJzaW9uLmpzXG4gKi9cblxuZXhwb3J0IGNvbnN0IFBBQ0tBR0VfVkVSU0lPTiA9ICcxLjkuMTgnO1xuZXhwb3J0IGNvbnN0IEJVSUxEX1RJTUVTVEFNUCA9ICcyMDI1LTEwLTE3VDE2OjQ0OjIzLjcxOVonO1xuZXhwb3J0IGNvbnN0IEJVSUxEX1RZUEU6ICducG0nIHwgJ2dpdCcgPSAnbnBtJztcbmV4cG9ydCBjb25zdCBQQUNLQUdFX05BTUUgPSAnQGRvbGxob3VzZW1jcC9tY3Atc2VydmVyJztcbiJdfQ==
+//# sourceMappingURL=data:application/json;base64,eyJ2ZXJzaW9uIjozLCJmaWxlIjoidmVyc2lvbi5qcyIsInNvdXJjZVJvb3QiOiIiLCJzb3VyY2VzIjpbIi4uLy4uL3NyYy9nZW5lcmF0ZWQvdmVyc2lvbi50cyJdLCJuYW1lcyI6W10sIm1hcHBpbmdzIjoiQUFBQTs7O0dBR0c7QUFFSCxNQUFNLENBQUMsTUFBTSxlQUFlLEdBQUcsUUFBUSxDQUFDO0FBQ3hDLE1BQU0sQ0FBQyxNQUFNLGVBQWUsR0FBRywwQkFBMEIsQ0FBQztBQUMxRCxNQUFNLENBQUMsTUFBTSxVQUFVLEdBQWtCLEtBQUssQ0FBQztBQUMvQyxNQUFNLENBQUMsTUFBTSxZQUFZLEdBQUcsMEJBQTBCLENBQUMiLCJzb3VyY2VzQ29udGVudCI6WyIvKipcbiAqIEF1dG8tZ2VuZXJhdGVkIGZpbGUgLSBETyBOT1QgRURJVFxuICogR2VuZXJhdGVkIGF0IGJ1aWxkIHRpbWUgYnkgc2NyaXB0cy9nZW5lcmF0ZS12ZXJzaW9uLmpzXG4gKi9cblxuZXhwb3J0IGNvbnN0IFBBQ0tBR0VfVkVSU0lPTiA9ICcxLjkuMjAnO1xuZXhwb3J0IGNvbnN0IEJVSUxEX1RJTUVTVEFNUCA9ICcyMDI1LTEwLTE3VDIzOjExOjUxLjYwNFonO1xuZXhwb3J0IGNvbnN0IEJVSUxEX1RZUEU6ICducG0nIHwgJ2dpdCcgPSAnbnBtJztcbmV4cG9ydCBjb25zdCBQQUNLQUdFX05BTUUgPSAnQGRvbGxob3VzZW1jcC9tY3Atc2VydmVyJztcbiJdfQ==

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "@dollhousemcp/mcp-server",
-  "version": "1.9.18",
+  "version": "1.9.20",
   "description": "DollhouseMCP - A Model Context Protocol (MCP) server that enables dynamic AI persona management from markdown files, allowing Claude and other compatible AI assistants to activate and switch between different behavioral personas.",
   "type": "module",
   "main": "dist/index.js",
@@ -102,7 +102,7 @@
     "url": "https://github.com/DollhouseMCP/mcp-server/issues"
   },
   "homepage": "https://dollhousemcp.com",
-  "mcpName": "io.github.dollhousemcp/mcp-server",
+  "mcpName": "io.github.DollhouseMCP/mcp-server",
   "files": [
     "dist/**/*.js",
     "dist/**/*.d.ts",
@@ -115,6 +115,7 @@
     "data/ensembles/**/*.md",
     "!dist/__tests__/**",
     "!dist/**/*.test.*",
+    "server.json",
     "oauth-helper.mjs",
     "README.md",
     "LICENSE",

package/server.json

@@ -0,0 +1,38 @@
+{
+  "$schema": "https://static.modelcontextprotocol.io/schemas/2025-10-17/server.schema.json",
+  "name": "io.github.DollhouseMCP/mcp-server",
+  "title": "DollhouseMCP",
+  "description": "OSS to create Personas, Skills, Templates, Agents, and Memories to customize your AI experience.",
+  "version": "1.9.20",
+  "homepage": "https://dollhousemcp.com",
+  "repository": {
+    "type": "git",
+    "url": "https://github.com/DollhouseMCP/mcp-server",
+    "source": "github"
+  },
+  "license": "AGPL-3.0",
+  "keywords": [
+    "mcp",
+    "model-context-protocol",
+    "ai",
+    "persona",
+    "prompt",
+    "claude",
+    "ai-assistant",
+    "behavioral-profiles",
+    "dynamic-prompting",
+    "typescript",
+    "dollhouse",
+    "marketplace"
+  ],
+  "packages": [
+    {
+      "registryType": "npm",
+      "identifier": "@dollhousemcp/mcp-server",
+      "version": "1.9.20",
+      "transport": {
+        "type": "stdio"
+      }
+    }
+  ]
+}