@smartergpt/lexrunner 2.1.0 → 2.2.0

package/CHANGELOG.md

@@ -6,6 +6,34 @@ The format is based on [Keep a Changelog](https://keepachangelog.com/en/1.1.0/)
 
 ## [Unreleased]
 
+## [2.2.0] - 2026-09-09
+
+### Added
+
+- Optional explicit `gitInputs` in plan Schema 1.0.1: repository identity, acquisition
+  mode and frozen target/source refs and commits for single-repository integration.
+- Visible `frozen` and `legacy-unbound` status, with compatibility guidance for old
+  plans and older strict parsers. Existing unbound plans remain supported.
+
+### Fixed
+
+- Execute generated GitHub plans through the shared local CLI/MCP integration path
+  using frozen commits instead of PR display names. Reject moved inputs, mismatched
+  checkouts and failed acquisition without local-ref fallback.
+- Reject passing commands that mutate tracked state, HEAD or the integration branch;
+  preserve unexpected changes and separate gate/post-check receipt references.
+- Resolve generated gate names to executable commands. Remove guessed output paths
+  while retaining strict validation of explicitly declared artifacts.
+- Export the complete plan JSON Schema through the installed Zod version.
+- Update vulnerable runtime/test dependencies, including Hono, sharp, js-yaml and
+  Vitest; the prepared lockfile passes npm audit with zero reported vulnerabilities.
+
+### Documentation
+
+- Explain the first integration trial, explicit local effects and retained review
+  boundaries; align Git test guidance with the existing isolated CI lane.
+- Use canonical SmarterGPT repository links and organization publisher guidance.
+
 ## [2.1.0] - 2026-09-06
 
 ### Added

package/README.mcp.md

@@ -1,6 +1,10 @@
 # MCP Server for lexrunner
 
-The Model Context Protocol (MCP) server for lexrunner provides read-only tools for plan creation, gate execution, and merge operations.
+The Model Context Protocol (MCP) server for lexrunner provides tools for plan creation, gate execution, and merge operations.
+Plan creation can write files and gate execution runs commands. `ALLOW_MUTATIONS=false`
+blocks protected mutations such as merging; it is not a read-only sandbox.
+
+Start with [installation and interface choices](docs/first-use-compatibility.md).
 
 **Architecture:** This server is aligned with LexBrain and LexMap MCP implementations, using direct stdio JSON-RPC 2.0 protocol handling for consistency and maintainability across the Lex ecosystem.
 

package/README.md

@@ -15,7 +15,37 @@ fit for a repository with one occasional PR and no integration-order problem.
 That evaluation is deliberately read-only. Installing the package, writing a plan, creating a
 branch, pushing, opening a PR, or merging requires separate approval.
 
-## What works today
+## Start here
+
+For your first trial, install **LexRunner only** in a GitHub repository with open
+PRs. Node.js 24+ and Git are required. npm installs LexRunner's dependencies; you
+do not need to install Lex, AXF, LexSona, a policy-host service, or an MCP server
+separately for this CLI workflow. These examples target the 2.2.0 candidate; verify
+npm availability before installation.
+
+```bash
+npm install --save-dev @smartergpt/lexrunner@2.2.0
+npx lexrunner --version
+npx lexrunner weave discover --json
+```
+
+Installation changes your package manifest, lockfile and dependencies. Discovery
+reads GitHub; private repositories need an authorized `GITHUB_TOKEN` supplied to
+the process. See the [merge-weave quickstart](MERGE_WEAVE_QUICKSTART.md) for setup,
+authentication and the complete first-use journey:
+
+**Discover → freeze a plan → inspect dependencies → preview gates.**
+
+The first useful result is an inspected plan and gate preview. A dry run neither
+executes gates nor proves merge eligibility. The quickstart separates local writes,
+command execution, independent review and the explicit merge boundary. Single-repository
+GitHub plans bind explicit refs and commits for local integration. The walkthrough
+explains clean-checkout preparation, exact-input checks and separately authorized execution.
+
+[Start the walkthrough](MERGE_WEAVE_QUICKSTART.md) ·
+[Choose another SmarterGPT workflow](https://smartergpt.dev/docs/how-to-use/)
+
+## Add capabilities when needed
 
 LexRunner’s supported workflow has grown in layers. A normal user can stop at any layer.
 
@@ -34,31 +64,6 @@ host/reboot recovery remains release evidence, and Stage 5 fault-injection and a
 remain unproven. See [ADR-010](docs/adr/ADR-010-agent-work-orchestration-protocol.md) and the
 [headless proof boundary](docs/architecture/headless-supervisor.md).
 
-## Smallest useful trial
-
-First inspect without mutation:
-
-```bash
-lexrunner --version
-lexrunner workspace doctor --json
-lexrunner weave discover --json
-```
-
-After approving a local, reversible artifact, freeze and inspect a plan:
-
-```bash
-lexrunner weave plan --from-github --output plan.json --json
-lexrunner schema validate plan.json --json
-lexrunner weave merge-order plan.json --json
-lexrunner gate run plan.json --dry-run --json
-```
-
-These commands do not merge. `lexrunner weave apply --execute` is a separate mutation and should be
-run only after reviewing the frozen plan, authority, gates, and target branch.
-
-For a guided merge-weave walkthrough, use
-[MERGE_WEAVE_QUICKSTART.md](MERGE_WEAVE_QUICKSTART.md).
-
 ## Architecture boundary
 
 LexRunner has two contracts that must not be blurred:
@@ -89,8 +94,7 @@ source tree. Canonical terms live in [`docs/TERMS.md`](docs/TERMS.md).
 ## Install and authenticate
 
 Ecosystem 3.1 requires Node.js 24 or newer. The npm package is publicly readable without
-an npm login. Current source uses Apache-2.0; the first package under those terms is
-the 2.1.0 release candidate. Earlier published versions retain their applicable licenses.
+an npm login. Current source uses Apache-2.0; 2.1.0 is the first public npm release under those terms. Earlier published versions retain their applicable licenses.
 
 ```bash
 npm install --save-dev @smartergpt/lexrunner
@@ -115,11 +119,12 @@ The checked-in package version is the single source for `lexrunner --version` an
 
 <!-- BEGIN GENERATED PACKAGE VERSION -->
 
-Current repository package version: **2.1.0**. npm availability and dist-tags are separate
+Current repository package version: **2.2.0**. npm availability and dist-tags are separate
 release evidence; inspect the registry rather than inferring publication from source metadata.
 <!-- END GENERATED PACKAGE VERSION -->
 
-See the [2.1.0 open-source release](docs/releases/2.1.0.md), the
+See the [2.2.0 frozen-input release candidate](docs/releases/2.2.0.md), the
+[2.1.0 open-source release](docs/releases/2.1.0.md), the
 [2.0.2 generated timeout correction](docs/releases/2.0.2.md), the
 [2.0.1 MCP identity correction](docs/releases/2.0.1.md), the
 [2.0.0 plan-bound evidence release](docs/releases/2.0.0.md), the
@@ -134,9 +139,11 @@ supported assisted behavior, and deferred guarantees.
 
 ## Choose a surface
 
-- **Human CLI:** start with `workspace doctor`, `weave discover`, `weave plan`,
-  `weave merge-order`, and `gate run`.
-- **Agent/MCP:** use the matching canonical tools and bounded contracts in
+- **Human CLI:** follow the [first-use walkthrough](MERGE_WEAVE_QUICKSTART.md).
+- **Agent/MCP:** LexRunner ships `lexrunner-mcp`; use it for plans, gates and
+  integration. No MCP setup is needed for the CLI trial. Tool calls can write
+  artifacts or run commands even when merge mutations are disabled. See the
+  [compatibility and setup guide](docs/first-use-compatibility.md), plus
   [`docs/AX.md`](docs/AX.md) and [`README.mcp.md`](README.mcp.md).
 - **Assisted agent work:** run `attempt preflight` before packet construction. When it reports
   `broker_required`, use `attempt projection status|prepare` to bind the exact committed base into

package/dist/{autopilot-JWIOXBCZ.js → autopilot-7PX6YG55.js}

@@ -16,7 +16,7 @@ import {
   hasCapability,
   parseAutopilotConfig,
   validateAutopilotConfig
-} from "./chunk-SHSL643G.js";
+} from "./chunk-M6AAYMHH.js";
 import "./chunk-4FFGNTAV.js";
 import "./chunk-6A4IE3TI.js";
 import "./chunk-VAGHAQT2.js";