@projectsolo/solo-mission-mcp 0.23.2 → 0.23.3

package/.github/workflows/lint.yml

@@ -0,0 +1,42 @@
+name: Lint
+
+# Stage 1 of the CI contract: a PR into dev runs fast static checks only
+# (typecheck + the live-spec tool-coverage gate). No tests, no build.
+on:
+  pull_request:
+    branches: [dev]
+
+concurrency:
+  group: ${{ github.workflow }}-pr-${{ github.event.pull_request.number }}
+  cancel-in-progress: true
+
+jobs:
+  lint:
+    name: Typecheck & spec coverage
+    timeout-minutes: 5
+    runs-on: [self-hosted, solo_mission_mcp-vps]
+    permissions:
+      contents: read
+
+    steps:
+      - uses: actions/checkout@v4
+
+      # No setup-node npm cache: ci-runner-vm keeps ~/.npm warm on local disk.
+      # Node floor ^22.23.4: older 22.x trusts the eMudhra CAs compromised in
+      # October 2026 (the server refuses to start on it). check-latest still
+      # picks up later 22.x security releases.
+      - uses: actions/setup-node@v4
+        with:
+          node-version: '^22.23.4'
+          check-latest: true
+
+      - name: Install dependencies
+        run: npm ci
+
+      - name: Typecheck
+        run: npm run typecheck
+
+      # Static regex over src/tools/*.ts plus one fetch of the live OpenAPI spec:
+      # fails if the spec documents a route no MCP tool calls.
+      - name: Check tool coverage against live API spec
+        run: npx tsx src/scripts/check-tools-against-spec.ts

package/.github/workflows/release.yml

@@ -12,6 +12,13 @@ on:
       - 'v[0-9]+.[0-9]+.[0-9]+'
       - 'u[0-9]+.[0-9]+.[0-9]+'
 
+# One group per workflow (not per ref: every tag is its own ref). A newer tag
+# replaces an older run that is still queued; a publish already running is
+# never cancelled, so npm is never left with a half-finished publish.
+concurrency:
+  group: ${{ github.workflow }}-release
+  cancel-in-progress: false
+
 jobs:
   publish:
     name: Build & Publish to npm
@@ -24,11 +31,19 @@ jobs:
     steps:
       - uses: actions/checkout@v4
 
+      # npm cache is skipped on the self-hosted (u*) path: ci-runner-vm keeps
+      # ~/.npm warm on local disk between jobs, so actions/setup-node's npm
+      # cache there only round-trips a tarball through GitHub's remote cache
+      # every run for no benefit. GitHub-hosted (v*) runners are ephemeral,
+      # so caching still helps there.
+      # Node floor ^22.23.4: older 22.x trusts the eMudhra CAs compromised in
+      # October 2026, and this job carries the npm publish credential.
+      # check-latest still picks up later 22.x security releases.
       - uses: actions/setup-node@v4
         with:
-          node-version: 22
+          node-version: '^22.23.4'
           check-latest: true
-          cache: npm
+          cache: ${{ startsWith(github.ref_name, 'u') && '' || 'npm' }}
           registry-url: 'https://registry.npmjs.org'
 
       # Trusted Publishing (OIDC) requires npm CLI >= 11.5.1; Node 22's bundled
@@ -40,15 +55,12 @@ jobs:
       - name: Install dependencies
         run: npm ci
 
-      - name: Typecheck
-        run: npm run typecheck
-
+      # Typecheck and the spec-coverage gate run on the PR (lint.yml), unit
+      # tests on the push to dev (test.yml). Release only builds what npm
+      # ships, checks the tag against package.json, and publishes.
       - name: Build
         run: npm run build
 
-      - name: Check tool coverage against live API spec
-        run: npx tsx src/scripts/check-tools-against-spec.ts
-
       - name: Verify tag matches package.json version
         run: |
           TAG_VERSION="${GITHUB_REF_NAME#[uv]}"

package/.github/workflows/test.yml

@@ -0,0 +1,37 @@
+name: Test
+
+# Stage 2 of the CI contract: a push to dev (i.e. a merge) runs the unit
+# tests only. Lint already ran on the PR; nothing deploys here.
+on:
+  push:
+    branches: [dev]
+
+concurrency:
+  group: ${{ github.workflow }}-${{ github.ref }}
+  cancel-in-progress: true
+
+jobs:
+  test:
+    name: Unit tests (vitest)
+    timeout-minutes: 10
+    runs-on: [self-hosted, solo_mission_mcp-vps]
+    permissions:
+      contents: read
+
+    steps:
+      - uses: actions/checkout@v4
+
+      # No setup-node npm cache: ci-runner-vm keeps ~/.npm warm on local disk.
+      # Node floor ^22.23.4: older 22.x trusts the eMudhra CAs compromised in
+      # October 2026 (the server refuses to start on it). check-latest still
+      # picks up later 22.x security releases.
+      - uses: actions/setup-node@v4
+        with:
+          node-version: '^22.23.4'
+          check-latest: true
+
+      - name: Install dependencies
+        run: npm ci
+
+      - name: Run tests
+        run: npm test

package/DEVELOPER_README.md

@@ -6,6 +6,8 @@ For end-user usage and setup, see [README.md](README.md).
 
 ## Local Development
 
+Use Node.js 22.23.4+, 24.22.1+ or 26.12.1+. Older releases still trust the eMudhra certificate authorities compromised in October 2026, so the server (including `npm run dev` and the inspector) exits at startup on them, with no override.
+
 Clone and build from source:
 
 ```bash
@@ -64,7 +66,7 @@ If you're developing the MCP server and want to point your client at the built o
 }
 ```
 
-Restart the client after changing config.
+Restart the client after changing config. `"command": "node"` must resolve to a patched Node.js (see above); if the client's `PATH` finds an older one, give the absolute path to a patched `node` binary instead.
 
 ---
 

package/README.md

@@ -57,7 +57,7 @@ The Agent SDK spawns the MCP server as a subprocess, exposes all Solo tools to C
 
 ## Prerequisites
 
-- Node.js >= 20
+- Node.js **22.23.4+, 24.22.1+ or 26.12.1+**. Older releases, including all of Node 20, 21, 23 and 25, still trust eMudhra certificate authorities compromised in October 2026, so a network attacker could read or change the server's traffic, including your agent key; the server refuses to start on them.
 - A Solo account at [solomission.ai](https://solomission.ai)
 - An agent API key (see below)
 
@@ -132,6 +132,8 @@ Edit `~/.cursor/mcp.json` (or your project’s `.cursor/mcp.json`):
 
 Restart the client. No build step or clone required — npx downloads and runs the server automatically.
 
+`npx` runs the server with the first `node` on the client's `PATH`, so that Node.js must meet the [Prerequisites](#prerequisites); on an older one the server exits with an upgrade message in the client's MCP log.
+
 **Building from source or using a local path?** See [DEVELOPER_README.md](DEVELOPER_README.md).
 
 ### Optional env var