@uluops/setup 0.9.0 → 0.9.1

package/dist/harnesses/codex.js

@@ -11,6 +11,7 @@ import { homedir } from "node:os";
 import { join } from "node:path";
 import { ULUOPS_SERVERS, } from "./types.js";
 import { atomicWrite } from "../lib/atomic-write.js";
+import { OPS_MCP_SPEC, REGISTRY_MCP_SPEC } from "../lib/mcp-packages.js";
 const RAW_TOML = "__rawToml";
 /**
  * Tools to seed with `approval_mode = "approve"` (Codex's auto-allow opt-in).
@@ -196,8 +197,8 @@ class CodexMcpConfig {
         const registryHasUserTools = hasUserToolEntries(raw, "uluops-registry");
         raw = removeServerConfigBlocks(removeServerConfigBlocks(raw, "uluops-tracker"), "uluops-registry");
         const blocks = [
-            serverBlock("uluops-tracker", "@uluops/ops-mcp", apiKey, trackerHasUserTools ? [] : TRACKER_READ_TOOLS),
-            serverBlock("uluops-registry", "@uluops/registry-mcp", apiKey, registryHasUserTools ? [] : REGISTRY_READ_TOOLS),
+            serverBlock("uluops-tracker", OPS_MCP_SPEC, apiKey, trackerHasUserTools ? [] : TRACKER_READ_TOOLS),
+            serverBlock("uluops-registry", REGISTRY_MCP_SPEC, apiKey, registryHasUserTools ? [] : REGISTRY_READ_TOOLS),
         ].join("\n\n");
         return { [RAW_TOML]: [raw.trimEnd(), blocks].filter(Boolean).join("\n\n") + "\n" };
     }

package/dist/harnesses/opencode.js

@@ -16,6 +16,7 @@ import { join, isAbsolute } from "node:path";
 import { parse as parseJsonc } from "jsonc-parser";
 import { ULUOPS_SERVERS, ConfigParseError } from "./types.js";
 import { atomicWrite } from "../lib/atomic-write.js";
+import { OPS_MCP_SPEC, REGISTRY_MCP_SPEC } from "../lib/mcp-packages.js";
 class OpenCodeMcpConfig {
     /** Maps requested path → actual resolved path (for .jsonc fallback). */
     resolvedPaths = new Map();
@@ -51,7 +52,7 @@ class OpenCodeMcpConfig {
         // their bundled SDKs. See lib/config-merger.ts for rationale.
         const tracker = {
             type: "local",
-            command: ["npx", "-y", "@uluops/ops-mcp"],
+            command: ["npx", "-y", OPS_MCP_SPEC],
             enabled: true,
             timeout: 30000,
             environment: {
@@ -60,7 +61,7 @@ class OpenCodeMcpConfig {
         };
         const registry = {
             type: "local",
-            command: ["npx", "-y", "@uluops/registry-mcp"],
+            command: ["npx", "-y", REGISTRY_MCP_SPEC],
             enabled: true,
             timeout: 30000,
             environment: {

package/dist/lib/config-merger.js

@@ -1,6 +1,6 @@
 import { readFile } from "node:fs/promises";
 import { atomicWrite } from "./atomic-write.js";
-const MCP_PACKAGES = ["@uluops/ops-mcp", "@uluops/registry-mcp"];
+import { MCP_PACKAGES, OPS_MCP_SPEC, REGISTRY_MCP_SPEC, } from "./mcp-packages.js";
 /**
  * In-process memoization for the npm availability probe.
  *
@@ -102,7 +102,7 @@ export function mergeUluopsMcp(config, apiKey, trust = false) {
             ...existing,
             "uluops-tracker": {
                 command: "npx",
-                args: ["-y", "@uluops/ops-mcp"],
+                args: ["-y", OPS_MCP_SPEC],
                 env: {
                     ULUOPS_API_KEY: apiKey,
                 },
@@ -110,7 +110,7 @@ export function mergeUluopsMcp(config, apiKey, trust = false) {
             },
             "uluops-registry": {
                 command: "npx",
-                args: ["-y", "@uluops/registry-mcp"],
+                args: ["-y", REGISTRY_MCP_SPEC],
                 env: {
                     ULUOPS_API_KEY: apiKey,
                 },

package/dist/lib/mcp-packages.d.ts

@@ -0,0 +1,34 @@
+/**
+ * Pinned MCP server package versions.
+ *
+ * Every harness's MCP config writer (claude-code/gemini-cli/opencode JSON
+ * mergers, codex TOML writer) stamps these spec strings into the harness
+ * config so `npx -y <spec>` resolves a known-good version instead of
+ * latest. Pinning makes a `@uluops/setup` release self-contained — what
+ * users get on first launch is what the package was tested against,
+ * regardless of when later MCP server versions ship.
+ *
+ * **Bump rule:** when an MCP server publishes a new version, bump the
+ * version here in the same setup release. A pinned setup install never
+ * silently picks up a downstream regression; a missed bump shows up as
+ * the next setup release stamping the previous combination.
+ *
+ * The bare package NAMES (without versions) remain available as
+ * `MCP_PACKAGES` for the npm availability probe — that probe asks
+ * "does this name exist on the registry" not "does this version exist".
+ * Pinning the probe to a specific version would turn a temporary
+ * registry blip on an older version into a setup failure even when
+ * the latest version was reachable.
+ */
+export declare const OPS_MCP_PACKAGE = "@uluops/ops-mcp";
+export declare const OPS_MCP_VERSION = "0.3.1";
+export declare const OPS_MCP_SPEC: "@uluops/ops-mcp@0.3.1";
+export declare const REGISTRY_MCP_PACKAGE = "@uluops/registry-mcp";
+export declare const REGISTRY_MCP_VERSION = "0.2.5";
+export declare const REGISTRY_MCP_SPEC: "@uluops/registry-mcp@0.2.5";
+/**
+ * Bare package names for the npm availability probe. The probe checks
+ * existence on the registry, not version-specific resolvability, so it
+ * uses these unversioned names.
+ */
+export declare const MCP_PACKAGES: readonly string[];

package/dist/lib/mcp-packages.js

@@ -0,0 +1,37 @@
+/**
+ * Pinned MCP server package versions.
+ *
+ * Every harness's MCP config writer (claude-code/gemini-cli/opencode JSON
+ * mergers, codex TOML writer) stamps these spec strings into the harness
+ * config so `npx -y <spec>` resolves a known-good version instead of
+ * latest. Pinning makes a `@uluops/setup` release self-contained — what
+ * users get on first launch is what the package was tested against,
+ * regardless of when later MCP server versions ship.
+ *
+ * **Bump rule:** when an MCP server publishes a new version, bump the
+ * version here in the same setup release. A pinned setup install never
+ * silently picks up a downstream regression; a missed bump shows up as
+ * the next setup release stamping the previous combination.
+ *
+ * The bare package NAMES (without versions) remain available as
+ * `MCP_PACKAGES` for the npm availability probe — that probe asks
+ * "does this name exist on the registry" not "does this version exist".
+ * Pinning the probe to a specific version would turn a temporary
+ * registry blip on an older version into a setup failure even when
+ * the latest version was reachable.
+ */
+export const OPS_MCP_PACKAGE = "@uluops/ops-mcp";
+export const OPS_MCP_VERSION = "0.3.1";
+export const OPS_MCP_SPEC = `${OPS_MCP_PACKAGE}@${OPS_MCP_VERSION}`;
+export const REGISTRY_MCP_PACKAGE = "@uluops/registry-mcp";
+export const REGISTRY_MCP_VERSION = "0.2.5";
+export const REGISTRY_MCP_SPEC = `${REGISTRY_MCP_PACKAGE}@${REGISTRY_MCP_VERSION}`;
+/**
+ * Bare package names for the npm availability probe. The probe checks
+ * existence on the registry, not version-specific resolvability, so it
+ * uses these unversioned names.
+ */
+export const MCP_PACKAGES = [
+    OPS_MCP_PACKAGE,
+    REGISTRY_MCP_PACKAGE,
+];

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "@uluops/setup",
-  "version": "0.9.0",
+  "version": "0.9.1",
   "description": "Zero-friction installer for UluOps agentic harnesses",
   "license": "MIT",
   "repository": {