@uluops/setup 0.12.0 → 0.13.1

package/CHANGELOG.md

@@ -4,6 +4,65 @@ All notable changes to `@uluops/setup` will be documented in this file.
 
 ## [Unreleased]
 
+## [0.13.1] - 2026-09-17
+
+### Changed
+
+- Bundle `@uluops/agent-metrics` 0.11.0 (previously 0.8.0) for metrics hook
+  installs and refreshes, including the Codex extraction and discovery fixes.
+- Pin tracker MCP to 0.20.1, which uses ops-sdk 6.5.2 and preserves harness,
+  token components and raw model identity across the metrics transport path.
+- Pin registry MCP to 0.8.0 (previously 0.3.7), verified against the published
+  package's tool registry and all four harness config writers. Its read-tool
+  approval list remains compatible.
+- Seed the tracker read tools `get_org_audit_feed`, `get_project_log` and
+  `get_log_stat` in fresh Codex configs. Existing custom tool approvals remain
+  untouched.
+
+- **`@uluops/ops-mcp` pin 0.17.2 → 0.20.0** (`OPS_MCP_VERSION`). Stale since ops-mcp 0.18.0
+  (org routing, 2026-09-14): fresh installs were stamping a server with no `org` argument on
+  any tool and none of the `get_project_log` / `get_log_stat` reads that 0.20.0 added
+  (ulu log Phase 5). Nothing checks this pin against npm; it was found by the ulu log
+  Phase 7 residue list, not by a test.
+- **Setup banner tagline** `operating intelligence as infrastructure` → `the operations layer
+  for agentic work` (messaging foundation 0.5.3 §4.1/§4.10 — the banner is an agent-read
+  surface, and the category string is the same on every surface by decision D6). uluops.ai's
+  install walkthrough mirrors this line and was changed in the same day's commit, so the
+  site shows the banner of this release, not of 0.13.0, until this ships.
+
+## [0.13.0] - 2026-09-11
+
+### Changed
+
+- **`@uluops/ops-mcp` pin 0.13.0 → 0.17.2** (`OPS_MCP_VERSION`). Every harness
+  writer stamps this into the MCP config, so this is the release that moves
+  first-launch users off a server that **silently stripped `cluster_key`** from
+  every recommendation on `save_run` / `update_run` / `validate_run` — the
+  schema was a plain `z.object()` and never declared the field, so within-run
+  convergence was recorded as NULL and read by the tracker as a collapsing
+  pipeline (ops-mcp 0.17.2 changelog; tracker issue `105c478f`). The jump also
+  crosses ops-mcp's 0.17.0 breaking train (strict ops-sdk 6.0.0; `list_agents`
+  and the list/query tools now return the `{data, total}` envelope; `get_run`
+  is a 14-key read projection). Setup itself calls none of these tools, but an
+  MCP client written against the 0.13.0 shapes will see the difference on
+  first launch after reattestation. Harness configs already on disk keep
+  resolving 0.13.0 until `npx @uluops/setup` runs again.
+- **Codex read-tool seed gains `preview_update_run`** (`src/harnesses/codex.ts`).
+  A read tool since ops-mcp 0.14 (2026-08-21) that the hand-maintained
+  `TRACKER_READ_TOOLS` list never picked up — three setup releases seeded a
+  Codex config that prompted on first use of it. Nothing checks this list
+  against the pinned package; the comment now says so, and deriving it is
+  tracked separately. Seeded only on fresh Codex configs, as before.
+
+### Not changed — deliberately
+
+- **`@uluops/registry-mcp` stays pinned at 0.3.7** while npm `latest` is
+  0.8.0. Two trees publish under that name — `packages/-uluops-registry-mcp`
+  (0.3.7) and `uluops-registry-mcp` (0.8.0), the latter being the live
+  registry registration's copy — and the 0.3.7 → 0.8.0 span has not been
+  validated against setup's Codex read-tool seed or the harness writers. That
+  is its own bump with its own changelog entry, not a rider on this one.
+
 ## [0.12.0] - 2026-08-21
 
 ### Added

package/README.md

@@ -1,4 +1,4 @@
-**[UluOps](https://uluops.ai)** · Operating Intelligence as Infrastructure
+**[UluOps](https://uluops.ai)** · The operations layer for agentic work
 
 ---
 
@@ -18,6 +18,15 @@ npx @uluops/setup
 
 ## Supported harnesses
 
+Setup 0.13.1 bundles agent-metrics **0.11.0** for hook installation and pins
+tracker MCP **0.20.1** and registry MCP **0.8.0** in generated configs. Tracker
+MCP uses ops-sdk **6.5.2**. Re-run setup to refresh existing configs and hook
+files, then restart the affected MCP connections in your harness.
+
+Optional global CLI installs resolve npm's current release when the CLI is
+absent. Setup preserves an existing global CLI rather than upgrading it;
+update existing `@uluops/cli` or `@uluops/agent-metrics` global installs with npm.
+
 | Harness | Status | Alias | Config |
 |---------|--------|-------|--------|
 | Claude Code | Fully supported (default) | `claude` | `~/.claude.json` |

package/dist/harnesses/codex.js

@@ -25,10 +25,19 @@ const RAW_TOML = "__rawToml";
  * Only read-side tools are seeded. Writes still prompt — the user retains a
  * choice point on every state-changing operation. Lists mirror the
  * `sideEffects: 'read'` declarations in the respective server's tool-registry
- * (sources of truth: ops-uluops-mcp/src/config/tool-registry.ts and
- * uluops-registry-mcp/src/config/tool-registry.ts). If a new read tool ships
- * there, add it here in the same PR — Codex users will silently get a prompt
- * on first use otherwise.
+ * (sources of truth: the tool-registry.ts of whichever copy OPS_MCP_SPEC /
+ * REGISTRY_MCP_SPEC actually pin — `@uluops/ops-mcp` is published from
+ * packages/-uluops-ops-mcp, NOT from ops-uluops-mcp, which is the live
+ * tracker registration's copy; the two are twins but not the same tree).
+ * If a new read tool ships there, add it here in the same PR — Codex users
+ * will silently get a prompt on first use otherwise.
+ *
+ * This list is hand-maintained and nothing checks it against the pinned
+ * package: `preview_update_run` (a read tool since ops-mcp 0.14, 2026-08-21)
+ * was absent here until the 0.17.2 pin bump on 2026-09-11 — three setup
+ * releases stamped a seed missing one read tool. The package's exports map
+ * exposes only its server entry, so a derived test needs ops-mcp to export
+ * its registry first; tracked separately.
  */
 const TRACKER_READ_TOOLS = [
     "diff_runs",
@@ -44,8 +53,11 @@ const TRACKER_READ_TOOLS = [
     "get_issue_details",
     "get_issue_history",
     "get_latest_run",
+    "get_log_stat",
+    "get_org_audit_feed",
     "get_project",
     "get_project_analysis",
+    "get_project_log",
     "get_project_summary",
     "get_project_trends",
     "get_run",
@@ -56,6 +68,7 @@ const TRACKER_READ_TOOLS = [
     "list_agents",
     "list_projects",
     "list_runs",
+    "preview_update_run",
     "query_analysis_records",
     "query_issues",
     "search_issues",

package/dist/lib/display.js

@@ -17,7 +17,7 @@ export function printHarnessHeader(displayName) {
 export function printSetupBanner(version, targetSummary) {
     console.log();
     console.log(`  ${chalk.dim("⟨u⟩")} ${chalk.cyan.bold("ulu")}${chalk.bold("·ops")}`);
-    console.log(`      ${chalk.dim("operating intelligence as infrastructure")}`);
+    console.log(`      ${chalk.dim("the operations layer for agentic work")}`);
     console.log();
     console.log(`  Setup v${version} — ${chalk.bold(targetSummary)}`);
     console.log();

package/dist/lib/mcp-packages.d.ts

@@ -22,11 +22,11 @@
  * MCP launch. A pin is not a publish; the probe is what enforces that here.
  */
 export declare const OPS_MCP_PACKAGE = "@uluops/ops-mcp";
-export declare const OPS_MCP_VERSION = "0.13.0";
-export declare const OPS_MCP_SPEC: "@uluops/ops-mcp@0.13.0";
+export declare const OPS_MCP_VERSION = "0.20.1";
+export declare const OPS_MCP_SPEC: "@uluops/ops-mcp@0.20.1";
 export declare const REGISTRY_MCP_PACKAGE = "@uluops/registry-mcp";
-export declare const REGISTRY_MCP_VERSION = "0.3.7";
-export declare const REGISTRY_MCP_SPEC: "@uluops/registry-mcp@0.3.7";
+export declare const REGISTRY_MCP_VERSION = "0.8.0";
+export declare const REGISTRY_MCP_SPEC: "@uluops/registry-mcp@0.8.0";
 /** Probe targets: the pinned versions the harness will actually resolve. */
 export declare const MCP_PROBE_TARGETS: readonly {
     pkg: string;

package/dist/lib/mcp-packages.js

@@ -22,10 +22,10 @@
  * MCP launch. A pin is not a publish; the probe is what enforces that here.
  */
 export const OPS_MCP_PACKAGE = "@uluops/ops-mcp";
-export const OPS_MCP_VERSION = "0.13.0";
+export const OPS_MCP_VERSION = "0.20.1";
 export const OPS_MCP_SPEC = `${OPS_MCP_PACKAGE}@${OPS_MCP_VERSION}`;
 export const REGISTRY_MCP_PACKAGE = "@uluops/registry-mcp";
-export const REGISTRY_MCP_VERSION = "0.3.7";
+export const REGISTRY_MCP_VERSION = "0.8.0";
 export const REGISTRY_MCP_SPEC = `${REGISTRY_MCP_PACKAGE}@${REGISTRY_MCP_VERSION}`;
 /** Probe targets: the pinned versions the harness will actually resolve. */
 export const MCP_PROBE_TARGETS = [

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "@uluops/setup",
-  "version": "0.12.0",
+  "version": "0.13.1",
   "description": "Zero-friction installer for UluOps agentic harnesses",
   "license": "MIT",
   "repository": {
@@ -49,7 +49,7 @@
   },
   "dependencies": {
     "@inquirer/prompts": "8.6.0",
-    "@uluops/agent-metrics": "0.8.0",
+    "@uluops/agent-metrics": "0.11.0",
     "chalk": "5.6.2",
     "commander": "15.0.0",
     "jsonc-parser": "3.3.1"