@klhapp/skillmux 0.4.2 → 0.4.4

package/CHANGELOG.md

@@ -5,6 +5,21 @@ All notable changes to this project are documented in this file.
 The format is based on [Keep a Changelog](https://keepachangelog.com/en/1.1.0/),
 and this project adheres to [Semantic Versioning](https://semver.org/spec/v2.0.0.html).
 
+## [0.4.4](https://github.com/klhq/skillmux/compare/v0.4.3...v0.4.4) (2026-07-23)
+
+
+### Fixed
+
+* connect stdio transport before blocking on runtime init ([#54](https://github.com/klhq/skillmux/issues/54)) ([847af1c](https://github.com/klhq/skillmux/commit/847af1c39265937701e432b631710fc0a2aa9ea0))
+
+## [0.4.3](https://github.com/klhq/skillmux/compare/v0.4.2...v0.4.3) (2026-07-23)
+
+
+### Fixed
+
+* **release:** prevent slim from overwriting latest ([#53](https://github.com/klhq/skillmux/issues/53)) ([8b5da28](https://github.com/klhq/skillmux/commit/8b5da285b5cb2c9b3231e94ed1ec29331cf8cb9a))
+* **release:** safe backfill and isolate publishing ([#51](https://github.com/klhq/skillmux/issues/51)) ([872333a](https://github.com/klhq/skillmux/commit/872333a70f32bf5be68cc3599c43bd4943a91051))
+
 ## [0.4.2](https://github.com/klhq/skillmux/compare/v0.4.1...v0.4.2) (2026-07-23)
 
 

package/docs/releasing.md

@@ -1,9 +1,10 @@
 # Releasing
 
 Release Please creates releases after `main` is green. When its release PR is
-merged, it creates the matching version tag and directly calls the reusable
-release workflow. The pipeline does not rely on a second workflow being
-triggered by a tag created with `GITHUB_TOKEN`.
+merged, the same workflow creates the matching version tag and runs the
+publishing jobs directly. The pipeline does not rely on a second workflow being
+triggered by a tag created with `GITHUB_TOKEN`, and production environment
+secrets do not cross a reusable-workflow boundary.
 
 ## Prepare
 
@@ -14,19 +15,23 @@ triggered by a tag created with `GITHUB_TOKEN`.
 ## Publish automatically
 
 After the Release Please PR merges, the same workflow run creates the tag and
-GitHub Release, then calls the publishing workflow with the exact tag and commit
-SHA returned by Release Please. The package version, tag, and commit must all
-match before publishing begins.
+GitHub Release, then publishes with the exact tag and commit SHA returned by
+Release Please. The package version, tag, and commit must all match before
+publishing begins.
 
-There is intentionally no tag-push or `workflow_dispatch` entry point. GitHub
-does not start a second workflow for a tag created with the default
-`GITHUB_TOKEN`; directly calling the publisher avoids that event-suppression
-edge case without adding a PAT or GitHub App token.
+There is intentionally no tag-push entry point. GitHub does not start a second
+workflow for a tag created with the default `GITHUB_TOKEN`; publishing in the
+Release Please workflow avoids that event-suppression edge case without adding
+a PAT or GitHub App token.
 
 ## Exceptional recovery
 
-Recover missed historical publications manually. Do not feed an old tag into
-the current automated publisher.
+Use the manual `workflow_dispatch` entry point only to backfill an existing
+Release Please tag. The workflow verifies that the tag is clean SemVer,
+resolves to the checked-out commit, is reachable from `main`, and still matches
+`package.json`. It also requires a matching existing GitHub Release. Manual
+backfills never publish npm, so a container or binary recovery cannot
+accidentally republish an existing npm version.
 
 The release workflow publishes:
 
@@ -40,6 +45,11 @@ The release workflow publishes:
 - Multi-architecture `linux/amd64` and `linux/arm64` images with SBOM and
   provenance
 
+GHCR is the canonical container build. After both GHCR variants are published,
+Docker Hub copies those exact multi-architecture images under its matching
+tags. A Docker Hub authentication or availability failure therefore cannot
+prevent GHCR from publishing.
+
 Each Docker tag is a multi-architecture manifest. Users run the same tag on
 AMD64 and ARM64; Docker automatically pulls the matching image.
 
@@ -55,8 +65,9 @@ Container images are published to:
 - `${DOCKERHUB_USERNAME}/skillmux` on Docker Hub
 
 The `production-release` GitHub environment provides the
-`DOCKERHUB_USERNAME` variable and `DOCKERHUB_TOKEN` secret. npm publishes with
-Trusted Publishing through the calling `release-please.yml` workflow, so no
+`DOCKERHUB_USERNAME` variable and `DOCKERHUB_TOKEN` secret. The npm job also
+uses this environment as its Trusted Publisher identity; configure npm with
+workflow `release-please.yml` and environment `production-release`. No
 long-lived npm token is required. GitHub Packages uses the workflow's scoped
 `GITHUB_TOKEN`.
 Private repositories still publish BuildKit SBOM/provenance with container

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "@klhapp/skillmux",
-  "version": "0.4.2",
+  "version": "0.4.4",
   "description": "Local read-only MCP server routing natural-language task queries to skills in a SKILL.md vault, with zero-loss delivery",
   "type": "module",
   "private": false,

package/src/cli.ts

@@ -148,6 +148,10 @@ async function main() {
         };
         process.once("SIGTERM", shutdown);
         process.once("SIGINT", shutdown);
+        if (transport === "stdio") {
+          process.stdin.on("close", shutdown);
+          process.stdin.on("end", shutdown);
+        }
         break;
       }
       case "index":

package/src/server.ts

@@ -60,9 +60,10 @@ export async function startServer(opts?: {
 }): Promise<ServerHandle> {
   const config = opts?.config ?? await loadConfig();
   configure({ config, clients: opts?.clients ?? createClients(config) });
-  await initializeRuntime(readinessState);
-  metricsRegistry.setReadiness(readinessState.get());
   const stopWatcher = await startVaultWatcher();
+  const initPromise = initializeRuntime(readinessState)
+    .then(() => metricsRegistry.setReadiness(readinessState.get()))
+    .catch((err) => console.error("skillmux runtime init error:", err));
 
   const server = new McpServer({ name: "skillmux", version: "0.1.0" });
 
@@ -403,6 +404,7 @@ export async function startServer(opts?: {
       },
     });
     let stopped = false;
+    await initPromise;
     console.log(`skillmux serving over HTTP on ${hostname}:${bunServer.port}`);
     return {
       port: bunServer.port,