@getmarrow/mcp 3.9.97 → 3.9.98

package/README.md

@@ -136,7 +136,11 @@ v3.9.87 hardens the authenticated control-path canary against single-sample tran
 
 v3.9.86 was published with the adapter version constant still at `3.9.85`, so the strict canary identity check rejected it; it is deprecated — use `3.9.87`. SDK `3.7.62` and installer `0.1.56` are unchanged; install MCP `3.9.87`, reload the host, review hook trust, and verify before claiming the updated client is active.
 
-## What's New in v3.9.97
+## What's New in v3.9.98
+
+v3.9.98 fixes `npx @getmarrow/mcp setup` and every other `npx @getmarrow/mcp …` command. Since 3.9.57 they failed with "could not determine executable to run", because the package had two executables and none named after the package. The package now also provides an executable named `mcp`, so those commands work again. `marrow-mcp` and `marrow-mcp-canary` are unchanged, and the `npx -y --package=@getmarrow/mcp@latest marrow-mcp …` commands shown in this README keep working. If you install the package globally (`npm install -g @getmarrow/mcp`), it now also adds a command named `mcp`, which may share a name with other tools; `npx` users are unaffected. Tools, hooks and policy behavior are unchanged.
+
+### Previous release: v3.9.97
 
 v3.9.97 makes native hook control easier to live with. Free and starter gates are advisory again, so an advisory gate no longer hard-blocks work; a `block` decision still denies on every plan. In Claude Code's default, acceptEdits and auto permission modes, an enforced review now shows an owner-approval prompt instead of a denial. In plan, dontAsk and bypassPermissions modes, and for arbitration reviews, the action is still denied. Read-only commands such as `git show`, `git log` and `ls` no longer trigger false blocks, and denial messages now say plainly why an action was stopped and what to do next. The hook sends `protocol_version` when it verifies an action permit. When an action is denied, the hook makes a best-effort attempt, capped at 2.5 s, to close the decision with a denied outcome; if the backend does not confirm, the decision stays open. Hooks return faster because telemetry is delivered by a detached background process that honors opt-outs and never blocks the action (see `MARROW_HOOK_BACKGROUND_NUDGE` in Environment). Pending writes are retried more reliably: the client honors `retry_after_ms` and the optional `lease_remaining_ms`, and resumes the same write instead of starting a new one (see `MARROW_WRITE_RECONCILIATION_BUDGET_MS`). Hook lifecycle receipts are much less likely to be dropped when many hook processes write the spool at once: each event takes the spool lock fewer times, and the lock wait is a 10 s time budget with randomized polling. A receipt can still be lost if the lock is held for the full 10 s. Policy decisions, proof requirements and fail-closed behavior are unchanged, except that an enforced review now asks the owner (in the modes above) instead of denying. Update, reload the host and review hook trust before relying on the new hook.
 

package/dist/hook-contract.d.ts

@@ -1,8 +1,8 @@
 import { resolveMarrowEnv, type ResolvedMarrowEnv } from './env';
-export declare const MCP_ADAPTER_VERSION = "3.9.97";
+export declare const MCP_ADAPTER_VERSION = "3.9.98";
 export declare const NATIVE_HOOK_MATCHER = "Bash|Edit|Write|MultiEdit|Read|Glob|Grep|Search|WebSearch|Task|functions\\.(?!mcp__marrow__marrow_).*|mcp__(?!marrow__marrow_).*";
 export declare const GROK_NATIVE_HOOK_MATCHER = "run_terminal_command|search_replace|write|spawn_subagent|use_tool|workflow|image_gen|image_edit|image_to_video|reference_to_video";
-export declare const MCP_PACKAGE_SPEC = "@getmarrow/mcp@3.9.97";
+export declare const MCP_PACKAGE_SPEC = "@getmarrow/mcp@3.9.98";
 export declare const CONTEXT_HOOK_COMMAND: string;
 export declare const PRE_ACTION_HOOK_COMMAND: string;
 export declare const ACTION_RESULT_HOOK_COMMAND: string;

package/dist/hook-contract.js

@@ -21,7 +21,7 @@ const node_fs_1 = require("node:fs");
 const node_os_1 = require("node:os");
 const node_path_1 = require("node:path");
 const env_1 = require("./env");
-exports.MCP_ADAPTER_VERSION = '3.9.97';
+exports.MCP_ADAPTER_VERSION = '3.9.98';
 exports.NATIVE_HOOK_MATCHER = 'Bash|Edit|Write|MultiEdit|Read|Glob|Grep|Search|WebSearch|Task|functions\\.(?!mcp__marrow__marrow_).*|mcp__(?!marrow__marrow_).*';
 exports.GROK_NATIVE_HOOK_MATCHER = 'run_terminal_command|search_replace|write|spawn_subagent|use_tool|workflow|image_gen|image_edit|image_to_video|reference_to_video';
 exports.MCP_PACKAGE_SPEC = `@getmarrow/mcp@${exports.MCP_ADAPTER_VERSION}`;

package/package.json

@@ -1,10 +1,11 @@
 {
   "name": "@getmarrow/mcp",
-  "version": "3.9.97",
+  "version": "3.9.98",
   "mcpName": "io.github.getmarrow/marrow",
   "description": "Runtime control, proof, and fleet intelligence for MCP-compatible AI agents.",
   "bin": {
     "marrow-mcp": "dist/cli.js",
+    "mcp": "dist/cli.js",
     "marrow-mcp-canary": "scripts/control-path-canary.cjs"
   },
   "main": "dist/index.js",
@@ -14,6 +15,7 @@
     "dev": "tsc --watch",
     "test": "npm run build && node --test --require ./test/support/isolated-environment.cjs test/*.test.js",
     "registry:check": "node scripts/mcp-registry-check.cjs",
+    "npx:check": "node scripts/npx-executable-check.cjs",
     "registry:verify": "node scripts/mcp-registry-verify.cjs",
     "canary:control-path": "node scripts/control-path-canary.cjs"
   },

package/server.json

@@ -6,12 +6,12 @@
     "url": "https://github.com/getmarrow/marrow-mcp",
     "source": "github"
   },
-  "version": "3.9.97",
+  "version": "3.9.98",
   "packages": [
     {
       "registryType": "npm",
       "identifier": "@getmarrow/mcp",
-      "version": "3.9.97",
+      "version": "3.9.98",
       "transport": {
         "type": "stdio"
       },