@easonwumac/computer-linker 0.1.5 → 0.1.7

package/CHANGELOG.md

@@ -5,6 +5,29 @@ All notable changes to Computer Linker will be documented in this file.
 This project follows a small pre-1.0 changelog: breaking contract changes are
 called out even when the package version is still `0.x`.
 
+## 0.1.7 - 2026-06-27
+
+### Changed
+
+- Public release audit now scans tracked and packed text files for suspicious
+  third-party provenance markers, including source-copy, adaptation,
+  snippet-site, and vendored-code references before public release.
+- Public release audit now blocks retired product-name markers without keeping
+  that retired name in repository text.
+- Release checklist now documents the provenance marker scan alongside license
+  and secret checks.
+
+## 0.1.6 - 2026-06-27
+
+### Changed
+
+- The local npm release wrapper now loads `NODE_AUTH_TOKEN` from the Windows
+  User environment when the current shell process has not inherited it, avoiding
+  a false `npm whoami` 401 after saving a token with `setx` or the Windows
+  environment UI.
+- README and release checklist now document that Windows release token
+  hydration behavior.
+
 ## 0.1.5 - 2026-06-27
 
 ### Changed

package/README.md

@@ -491,9 +491,12 @@ release tag after a successful npm publish. After npm accepts the publish, the
 wrapper waits for registry metadata, verifies the npm dist-tag, and runs the
 published CLI from a clean temporary directory. Use `npm run release:verify` to
 repeat that post-publish check for the current `package.json` version.
-
-For a public alpha from this private dogfooding checkout, use the fresh public
-snapshot path:
+On Windows, if `NODE_AUTH_TOKEN` is saved in the User environment but the
+current shell has not picked it up yet, the release wrapper loads it only into
+the current release process before running `npm whoami` or `npm publish`.
+
+For a public alpha from this private dogfooding checkout, use the fresh public
+snapshot path:
 
 ```bash
 npm run public:release-ready

package/docs/architecture.md

@@ -5,9 +5,9 @@ architecture should serve that spec: a local computer MCP service for controlled
 file access, commands, Codex, screenshots, computer info, and audit history.
 ChatGPT-specific setup is a client helper, not the product axis.
 
-## Product Name
-
-The product is named **Computer Linker**. It intentionally does not reuse DevSpace.
+## Product Name
+
+The product is named **Computer Linker**.
 
 ## Mental Model
 

package/docs/release-checklist.md

@@ -56,8 +56,10 @@ release tag automatically before publishing, `--otp <code>` for npm 2FA, and
 version metadata, verifies the configured npm dist-tag, and runs the published
 CLI from a clean temporary directory. `release:verify` repeats only that
 post-publish registry check for the current `package.json` version.
-
-For the one-command local alpha readiness gate, run:
+On Windows, a `NODE_AUTH_TOKEN` saved in the User environment is loaded into
+the release process automatically when the current shell has not inherited it.
+
+For the one-command local alpha readiness gate, run:
 
 ```bash
 npm run alpha:check
@@ -128,9 +130,10 @@ This is the release-oriented alpha readiness gate. It requires fresh external
 MCP evidence and a dated `CHANGELOG.md` heading for the current package version,
 so it reports both final blockers in one place before `public:mirror`.
 
-This adds the public-release audit: packed-file inspection, tracked and
-non-ignored untracked file secret-shape scanning, production `npm audit`,
-dependency license allowlist checks, and a high-risk Git history secret scan.
+This adds the public-release audit: packed-file inspection, tracked and
+non-ignored untracked file secret-shape scanning, production `npm audit`,
+dependency license allowlist checks, third-party provenance marker scanning,
+retired product-name marker scanning, and a high-risk Git history secret scan.
 
 Before changing the current GitHub repository to public visibility while
 preserving its Git history, run the stricter one-command gate:

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "@easonwumac/computer-linker",
-  "version": "0.1.5",
+  "version": "0.1.7",
   "description": "One computer, one permissioned MCP linker for local workspaces.",
   "type": "module",
   "main": "dist/client.js",