@thenavidm/slipway 0.1.0 → 0.1.1

package/CHANGELOG.md

@@ -2,6 +2,10 @@
 
 What changed in Slipway, newest first.
 
+## 0.1.1, 2026-10-04: a safer install check
+
+- **No stranger's package through npx.** An unrelated npm package owns the bare name `slipway`, so a bare `npx slipway` with nothing installed fetched and ran it. SKILL.md now checks the install with `npm ls @thenavidm/slipway`, and every command that may run before an install names the package: `npx -p @thenavidm/slipway slipway <command>`.
+
 ## 0.1.0, 2026-10-04: the first release
 
 - **One definition, two surfaces.** `defineTool` describes a tool once; `slipway()` ships it as an MCP server tool and a CLI command under the same name. Both surfaces send every call through one function, so validation, the write guard, timeouts, cancellation and redaction cannot differ between them.

package/README.md

@@ -459,9 +459,11 @@ A server with a hundred tools costs a client that loads every definition up fron
 `slipway check` runs against your built app and its real MCP server:
 
 ```bash
-slipway check dist/app.js --bin dist/index.js --docs README.md,SKILL.md
+npx slipway check dist/app.js --bin dist/index.js --docs README.md,SKILL.md
 ```
 
+Run it in a project that has `@thenavidm/slipway` installed, where npx uses that copy. Anywhere else, name the package: `npx -p @thenavidm/slipway slipway openapi spec.json`. A bare `npx slipway` with nothing installed fetches an unrelated npm package of the same name.
+
 | Check | What fails |
 |---|---|
 | Names | A tool that takes a built-in command's name |
@@ -519,6 +521,7 @@ const mcp = await connect(app, { era: "modern", elicit: () => ({ action: "accept
 | Codex shows the server as failed at startup | The first npx download outlasted 10 seconds | `install codex` sets `startup_timeout_sec = 60`; add it by hand to an older entry |
 | `slipway check` warns about schema size | One tool's schema is large or repeats its definitions | Send the body schema once, or advertise a short one and validate the full one in the handler |
 | `slipway check` cannot load the app | The module starts the server when imported | Export the app from `app.ts` and call `app.main()` only in `index.ts` |
+| `npx slipway` prints something unexpected | Slipway is not installed in this folder, so npx fetched an unrelated package called `slipway` | Run `npm install @thenavidm/slipway`, or `npx -p @thenavidm/slipway slipway <command>` |
 
 ## Environment variables
 

package/SKILL.md

@@ -5,7 +5,7 @@ metadata:
   install:
     package: "@thenavidm/slipway"
     node: ">=22"
-    check: "npx slipway --version"
+    check: "npm ls @thenavidm/slipway"
 ---
 
 # Building with Slipway
@@ -14,7 +14,7 @@ Slipway turns one list of tool definitions into an MCP server and a CLI. Both su
 
 ## Install gate
 
-Run `npx slipway --version` in the repo. If it does not print a version, STOP: the package is missing. Install it with `npm install @thenavidm/slipway`, then check again.
+Run `npm ls @thenavidm/slipway` in the repo. If it does not list a version, STOP: the package is missing. Install it with `npm install @thenavidm/slipway`, then check again. Never test with a bare `npx slipway` before it is installed: an unrelated package on npm is called `slipway`, and npx would fetch and run that one.
 
 ## The three files
 
@@ -93,7 +93,7 @@ tools: fromOpenAPI(spec, {
 }),
 ```
 
-Run `npx slipway openapi openapi.json` first: it lists every tool the document becomes, what it skips and why, the schemas too large for a model, and the hash to pin. Fix a misleading method with `risk: { searchProducts: "read" }`, and rename with `names`.
+Run `npx -p @thenavidm/slipway slipway openapi openapi.json` first: it lists every tool the document becomes, what it skips and why, the schemas too large for a model, and the hash to pin. Fix a misleading method with `risk: { searchProducts: "read" }`, and rename with `names`.
 
 ## Shipping it to clients
 

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "@thenavidm/slipway",
-  "version": "0.1.0",
+  "version": "0.1.1",
   "description": "Slipway, the TypeScript framework for MCP servers and agent-native CLIs. One tool definition ships an MCP server and a CLI, with write safety, typed results and release checks built in.",
   "type": "module",
   "license": "Apache-2.0",