@easonwumac/computer-linker 0.1.2 → 0.1.3

package/CHANGELOG.md

@@ -3,11 +3,26 @@
 All notable changes to Computer Linker will be documented in this file.
 
 This project follows a small pre-1.0 changelog: breaking contract changes are
-called out even when the package version is still `0.x`.
-
+called out even when the package version is still `0.x`.
+
+## 0.1.3 - 2026-06-27
+
+### Added
+
+- Added `release:verify` to confirm a published npm version's exact metadata,
+  dist-tag, and published CLI from a clean temporary directory.
+
+### Changed
+
+- `release:publish` now runs the post-publish npm registry verification
+  automatically after npm accepts the package.
+- `release:publish -- --push` now pushes `HEAD` and the exact release tag
+  explicitly, so lightweight release tags are not skipped by `git push
+  --follow-tags`.
+
 ## 0.1.2 - 2026-06-27
-
-### Added
+
+### Added
 
 - Local npm release wrapper commands: `release:check`, `release:dry-run`, and
   `release:publish`.

package/README.md

@@ -471,19 +471,21 @@ For npm publishing, use the local release wrapper instead of hand-running every
 step:
 
 ```bash
-npm run release:check
-npm run release:dry-run
-npm run release:publish -- --create-tag --otp <code>
-git push origin main --follow-tags
-```
+npm run release:check
+npm run release:dry-run
+npm run release:publish -- --create-tag --push --otp <code>
+```
 
 `release:check` runs the local product/public package gates without publishing.
 `release:dry-run` runs `npm publish --dry-run` and creates a temporary local
 `v<package.version>` tag only for that dry-run when the tag is missing.
-`release:publish` requires a clean main/master worktree, a dated changelog
-heading, npm login, and a release tag. Pass `--create-tag` to create the tag
-on `HEAD`; pass `--push` only when you want the script to push `HEAD` and tags
-after a successful npm publish.
+`release:publish` requires a clean main/master worktree, a dated changelog
+heading, npm login, and a release tag. Pass `--create-tag` to create the tag
+on `HEAD`; pass `--push` only when you want the script to push `HEAD` and the
+release tag after a successful npm publish. After npm accepts the publish, the
+wrapper waits for registry metadata, verifies the npm dist-tag, and runs the
+published CLI from a clean temporary directory. Use `npm run release:verify` to
+repeat that post-publish check for the current `package.json` version.
 
 For a public alpha from this private dogfooding checkout, use the fresh public
 snapshot path:

package/docs/release-checklist.md

@@ -33,11 +33,10 @@ npm run public:check
 Use the local wrapper when you are ready to publish from the current repository:
 
 ```bash
-npm run release:check
-npm run release:dry-run
-npm run release:publish -- --create-tag --otp <code>
-git push origin main --follow-tags
-```
+npm run release:check
+npm run release:dry-run
+npm run release:publish -- --create-tag --push --otp <code>
+```
 
 `release:check` runs the local product and public package gates without
 publishing. It does not require a clean worktree, so it is useful before the
@@ -48,12 +47,15 @@ It runs `npm publish --dry-run`; if `v<package.version>` is missing, it creates
 a temporary local tag for the dry-run and removes it afterward. If that tag
 already exists on another commit, bump the package version before releasing.
 
-`release:publish` performs the real npm publish. It requires a clean
-main/master worktree, a dated `CHANGELOG.md` heading for the package version,
-npm login, and a release tag on `HEAD`. Pass `--create-tag` to create the
-release tag automatically before publishing, `--otp <code>` for npm 2FA, and
-`--push` only when the script should push `HEAD` and tags to `origin` after a
-successful publish.
+`release:publish` performs the real npm publish. It requires a clean
+main/master worktree, a dated `CHANGELOG.md` heading for the package version,
+npm login, and a release tag on `HEAD`. Pass `--create-tag` to create the
+release tag automatically before publishing, `--otp <code>` for npm 2FA, and
+`--push` only when the script should push `HEAD` and the release tag to
+`origin` after a successful publish. After npm accepts the publish, it also waits for exact
+version metadata, verifies the configured npm dist-tag, and runs the published
+CLI from a clean temporary directory. `release:verify` repeats only that
+post-publish registry check for the current `package.json` version.
 
 For the one-command local alpha readiness gate, run:
 

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "@easonwumac/computer-linker",
-  "version": "0.1.2",
+  "version": "0.1.3",
   "description": "One computer, one permissioned MCP linker for local workspaces.",
   "type": "module",
   "main": "dist/client.js",
@@ -64,6 +64,7 @@
     "release:check": "node scripts/release-npm.mjs --check",
     "release:dry-run": "node scripts/release-npm.mjs --dry-run",
     "release:publish": "node scripts/release-npm.mjs --publish",
+    "release:verify": "node scripts/verify-npm-release.mjs",
     "release:validate": "node scripts/release-validate.mjs",
     "start": "node dist/cli.js start",
     "test": "node scripts/run-tests.mjs",