@synapsor/runner 1.6.1 → 1.6.2

package/CHANGELOG.md

@@ -1,6 +1,25 @@
 # Changelog
 
-## 1.6.1 (prepared, not published)
+## 1.6.2 (prepared, not published)
+
+### Registry-installable packaging hotfix
+
+- Keeps Runner linked to the local `@synapsor/spec@1.5.0` workspace during
+  development while requiring pnpm to transform that dependency to the public
+  `^1.5.0` range in the release tarball.
+- Adds a `prepublishOnly` fail-closed guard that rejects `npm publish` and
+  requires `corepack pnpm publish`. It also rejects unexpected `workspace:`,
+  `file:`, `link:`, `portal:`, absolute-path, or incorrect Spec dependencies.
+- Changes the packed Runner release gate to inspect pnpm's actual transformed
+  tarball manifest and install that tarball by itself from a clean project.
+  This reproduces the public `npx` dependency-resolution path instead of
+  masking it with a simultaneously packed local Spec.
+- Contains the same proposal/evidence freshness runtime behavior prepared in
+  `1.6.1`; this patch changes packaging and version surfaces only.
+- Prepares only `@synapsor/runner@1.6.2`. `@synapsor/spec@1.5.0` and
+  `@synapsor/dsl@1.5.0` remain unchanged.
+
+## 1.6.1 (published 2026-07-23; install-broken)
 
 ### Fail-closed proposal and evidence freshness
 
@@ -26,8 +45,9 @@
 - Preserves existing contract normalization/digests, DSL, tools lists,
   approval paths, receipts, and deployments when the optional overlay is
   absent. `@synapsor/spec` and `@synapsor/dsl` remain at 1.5.0.
-- Prepares only `@synapsor/runner@1.6.1`. Nothing is published, tagged, pushed,
-  or released by this change.
+- Published with `@synapsor/spec: "workspace:^"` in the registry manifest,
+  causing clean npm/npx installs to fail with `EUNSUPPORTEDPROTOCOL`.
+  Superseded by the `1.6.2` packaging hotfix and should remain deprecated.
 
 ## 1.6.0 (published 2026-07-23)
 

package/dist/runner.mjs

@@ -46902,7 +46902,7 @@ import path3 from "node:path";
 // apps/runner/package.json
 var package_default = {
   name: "@synapsor/runner",
-  version: "1.6.1",
+  version: "1.6.2",
   description: "Stop giving AI agents execute_sql; expose reviewed Postgres/MySQL MCP actions with proposals, approval, writeback, and replay.",
   license: "Apache-2.0",
   type: "module",
@@ -46987,12 +46987,14 @@ var package_default = {
   },
   scripts: {
     build: "tsc -b && node ../../scripts/build-runner-package.mjs",
+    "check:publish-manifest": "node ../../scripts/check-runner-publish-manifest.mjs --source",
+    prepublishOnly: "node ../../scripts/check-runner-publish-manifest.mjs --source --require-pnpm",
     prepack: "cd ../.. && corepack pnpm build:runner-package",
     test: "vitest run"
   },
   dependencies: {
     "@modelcontextprotocol/sdk": "1.29.0",
-    "@synapsor/spec": "workspace:^",
+    "@synapsor/spec": "workspace:^1.5.0",
     jose: "6.2.3",
     mysql2: "^3.11.0",
     "pdf-lib": "1.17.1",
@@ -58524,7 +58526,7 @@ function createScopedExploreMcpServer(runtime) {
     }).strict().optional()
   }).strict();
   const server = new McpServer2(
-    { name: "synapsor-runner-authoring", version: "1.6.1" },
+    { name: "synapsor-runner-authoring", version: "1.6.2" },
     { capabilities: { tools: {} } }
   );
   server.registerTool(SCOPED_EXPLORE_DESCRIBE_TOOL, {

package/docs/cursor-plugin.md

@@ -19,7 +19,7 @@ claim that Cursor Marketplace review has completed.
 
 ## What the plugin installs
 
-- one production stdio MCP server pinned to `@synapsor/runner@1.6.1`;
+- one production stdio MCP server pinned to `@synapsor/runner@1.6.2`;
 - one `/synapsor-protect` agent command;
 - one discoverable Safe Action skill;
 - one file-scoped rule for `synapsor/actions/**/*.ts`;
@@ -80,7 +80,7 @@ Required listing media:
 
 ## Submission checklist
 
-- [ ] Runner 1.6.1 package and plugin version agree.
+- [ ] Runner 1.6.2 package and plugin version agree.
 - [ ] `corepack pnpm verify:cursor-plugin` passes from a clean checkout.
 - [ ] Plugin is manually loaded in current stable Cursor at workspace scope.
 - [ ] `/synapsor-protect` drafts and validates without activation.

package/docs/release-notes.md

@@ -10,7 +10,25 @@ npx -y -p @synapsor/runner synapsor-runner demo --quick
 The OSS runner command is `synapsor-runner`. The `synapsor` command is reserved
 for the Synapsor Cloud CLI.
 
-## 1.6.1 (prepared, not published)
+## 1.6.2 (prepared, not published)
+
+### Registry-installable packaging hotfix
+
+- Runner remains linked to the local Spec workspace during development, while
+  pnpm must transform that link to the public `@synapsor/spec@^1.5.0` range in
+  the release tarball.
+- A publish lifecycle guard rejects `npm publish`, requires
+  `corepack pnpm publish`, and rejects unexpected local dependency protocols or
+  incorrect Spec ranges.
+- The release gate inspects pnpm's transformed tarball manifest and installs
+  the Runner tarball alone in a clean project before invoking its CLI. The test
+  therefore exercises the dependency-resolution path used by public `npx`.
+- Runtime behavior is unchanged from the proposal/evidence freshness release.
+
+Prepared package version: `@synapsor/runner@1.6.2`.
+`@synapsor/spec@1.5.0` and `@synapsor/dsl@1.5.0` remain unchanged.
+
+## 1.6.1 (published 2026-07-23; install-broken)
 
 ### Fail-closed proposal and evidence freshness
 
@@ -33,9 +51,10 @@ for the Synapsor Cloud CLI.
 - Existing contracts, exact digests, DSL, model-facing tool lists, and
   non-freshness deployments keep their prior behavior.
 
-Prepared package version: `@synapsor/runner@1.6.1`.
-`@synapsor/spec@1.5.0` and `@synapsor/dsl@1.5.0` are unchanged. Nothing has
-been published by this repository change.
+The `1.6.1` registry manifest accidentally retained
+`@synapsor/spec: "workspace:^"`. Clean npm and npx installs reject that local
+workspace protocol with `EUNSUPPORTEDPROTOCOL`. The version should remain
+deprecated and is superseded by `1.6.2`. Spec and DSL were unaffected.
 
 ## 1.6.0 (published 2026-07-23)
 

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "@synapsor/runner",
-  "version": "1.6.1",
+  "version": "1.6.2",
   "description": "Stop giving AI agents execute_sql; expose reviewed Postgres/MySQL MCP actions with proposals, approval, writeback, and replay.",
   "license": "Apache-2.0",
   "type": "module",
@@ -83,14 +83,9 @@
   "engines": {
     "node": ">=22.13.0"
   },
-  "scripts": {
-    "build": "tsc -b && node ../../scripts/build-runner-package.mjs",
-    "prepack": "cd ../.. && corepack pnpm build:runner-package",
-    "test": "vitest run"
-  },
   "dependencies": {
     "@modelcontextprotocol/sdk": "1.29.0",
-    "@synapsor/spec": "workspace:^",
+    "@synapsor/spec": "^1.5.0",
     "jose": "6.2.3",
     "mysql2": "^3.11.0",
     "pdf-lib": "1.17.1",
@@ -116,5 +111,10 @@
   },
   "publishConfig": {
     "access": "public"
+  },
+  "scripts": {
+    "build": "tsc -b && node ../../scripts/build-runner-package.mjs",
+    "check:publish-manifest": "node ../../scripts/check-runner-publish-manifest.mjs --source",
+    "test": "vitest run"
   }
-}
+}