@yawlabs/mcp 0.63.0 → 0.63.2

package/CHANGELOG.md

@@ -2,6 +2,41 @@
 
 All notable changes to `@yawlabs/mcp` (formerly `@yawlabs/mcph`) are documented here. This project uses [semantic versioning](https://semver.org) and a script-gated release flow: `./release.sh <version>` runs lint + tests + build, bumps, tags, publishes to npm, and creates the GitHub release.
 
+## 0.63.2 -- release pipeline: publish npm from CI
+
+No changes to the package runtime or CLI -- this release exists to exercise the
+new CI-on-tag-push publish flow end to end. The published artifact is identical
+to 0.63.1 aside from the version bump.
+
+- **npm is now published from CI, not the workstation.** A new `publish-npm` job
+  in `release.yml` publishes `@yawlabs/mcp` on every `v*` tag using the org
+  `NPM_TOKEN` + `--provenance` (the repo and package are public), gated on the
+  binary build so npm and the GitHub Release stay in lockstep. It is idempotent:
+  a version already live is a clean skip, and an `EPUBLISHCONFLICT` from
+  registry read-replica lag is treated as success. `publish-registry` now
+  `needs: publish-npm`, so the MCP-registry verify can no longer race ahead of
+  the npm publish. `release.sh`'s hand-off detection was tightened to key on a
+  real `npm publish` / `NODE_AUTH_TOKEN` signal instead of the registry job's
+  `id-token: write` (the false positive that wedged the 0.63.0/0.63.1 runs).
+- **Registry job hardening.** `mcp-publisher` is pinned to a tagged release and
+  verified against its published sha256 before execution (was an unpinned
+  `curl .../latest | tar`), and the job pins its Node toolchain via `setup-node`.
+
+## 0.63.1 -- CLI follow-ups: wire dead --dry-run/--stdin flags, fix completion drift, dedup probes
+
+Patch-level follow-ups on the 0.63.0 CLI hardening pass. All fixes; no behavior changes for callers who weren't already hitting the dead-flag bugs.
+
+- **`sync push --dry-run`** now short-circuits before any remote mutation. The flag was parsed but never checked by `syncPush`, so a "dry-run" PUT actually mutated `mcp_bundles`. Preview now prints server count and exits 0 without calling `putResource`.
+- **`secrets set --stdin`** now reads raw multi-line stdin even on a TTY. The flag was parsed but never consumed by `runSecrets`, so it silently fell through to the line-buffered echo-off prompt regardless. `--stdin` now forces the raw read path as documented.
+- **`install <client> --dry-run`** now bypasses the collision gate. With an existing yaw-mcp entry + non-TTY stdin, the gate refused before the dry-run preview block ever ran -- so the "...or --dry-run to preview" hint was unreachable. The decision chain now treats `dryRun` like `force` for the overwrite-vs-skip choice.
+- **Completion `SUBCOMMAND_SPEC` drift fixed.** `sync` no longer advertises a phantom `--key` (replaced with the real `--dry-run`); `secrets` no longer advertises a phantom `--key` (replaced with the real `--force`).
+- **`try-cmd` telemetry POSTs are now awaited.** Three fire-and-forget `postEvent(...).catch(() => undefined)` calls (try / cleanup / expiry-gc) could be killed by `process.exit` before the request landed. Now awaited so the analytics event reliably reaches the backend before exit.
+- **`doctor` `state.json` double-read eliminated.** `peekStateFile` hoisted to the caller and the result threaded into `renderStateSection`, removing the redundant disk read inside the section.
+- **`doctor` probe duplication removed.** Extracted `classifyProbeContent` shared by both sync and async client-config probes (~60 lines deduped). Also added the missing `try/catch` around `resolveInstallPath` in `probeClientsAsync` for parity with the sync variant.
+- **`secrets get` / `remove` against a missing vault or missing entry** now short-circuit before the passphrase prompt, avoiding the wasted scrypt key derivation just to say "not found".
+- **`upgrade-cmd`:** removed unreachable `if (!plan.command)` branch -- every install method whose plan reaches that point already returned earlier in the chain.
+- **`index.ts` help text:** corrected the `YAW_MCP_AUTO_UPGRADE` description ("yaw-mcp serve startup" was not a subcommand; now "server startup").
+
 ## 0.63.0 -- CLI hardening: flag parsing, exit-code consistency, secret-file perms, dispatch error handling
 
 A full-pass sweep of the `yaw-mcp` subcommand surface. Every change is a fix, a hardening, or additive; there are no breaking changes to the MCP server or the public CLI contract.

package/dist/index.js

@@ -1136,14 +1136,14 @@ var SUBCOMMAND_SPEC = [
     name: "sync",
     description: "Sync bundles across machines",
     positional: ["push", "pull", "status"],
-    flags: ["--key", "--json", "--help"]
+    flags: ["--dry-run", "--json", "--help"]
   },
   { name: "stats", description: "Show usage statistics", flags: ["--limit", "--days", "--json", "--help"] },
   {
     name: "secrets",
     description: "Manage stored secrets",
     positional: ["set", "get", "list", "remove", "lock", "push", "pull"],
-    flags: ["--key", "--value", "--stdin", "--json", "--help"]
+    flags: ["--force", "--value", "--stdin", "--json", "--help"]
   },
   {
     name: "set-active",
@@ -2376,7 +2376,7 @@ ${USAGE}`);
   }
   if (existingHasEntry) {
     let decision;
-    if (opts.force) decision = "overwrite";
+    if (opts.force || opts.dryRun) decision = "overwrite";
     else if (opts.skip) decision = "skip";
     else if (opts.promptAnswer) decision = opts.promptAnswer;
     else if (opts.io?.isTTY ?? (Boolean(process.stdin.isTTY) && Boolean(process.stdout.isTTY))) {
@@ -3236,7 +3236,7 @@ async function runTry(opts) {
   }
   const anonId = await loadOrCreateAnonId(home);
   const postEvent = opts.postEvent ?? defaultPostEvent;
-  postEvent(baseUrl, { slug, action: "try", anonId }).catch(() => void 0);
+  await postEvent(baseUrl, { slug, action: "try", anonId }).catch(() => void 0);
   const ttlPretty = formatTtl(ttlMs);
   print(`Trial wired: ${server.name} via yaw-mcp-try-${slug} -> ${resolved.absolute}`);
   print(`Expires in ${ttlPretty}; remove sooner with: yaw-mcp try-cleanup ${slug}`);
@@ -3318,7 +3318,7 @@ async function runTryCleanup(opts) {
   }
   const anonId = await loadOrCreateAnonId(home);
   const postEvent = opts.postEvent ?? defaultPostEvent;
-  postEvent(baseUrl, { slug, action: "cleanup", anonId }).catch(() => void 0);
+  await postEvent(baseUrl, { slug, action: "cleanup", anonId }).catch(() => void 0);
   print(`Trial for "${slug}" cleaned up.`);
   return { exitCode: 0, written };
 }
@@ -3392,7 +3392,7 @@ async function gcExpiredTrials(opts) {
         }
       }
       await unlink(trialMarkerPath(marker.slug, home));
-      postEvent(baseUrl, { slug: marker.slug, action: "expiry-gc", anonId }).catch(() => void 0);
+      await postEvent(baseUrl, { slug: marker.slug, action: "expiry-gc", anonId }).catch(() => void 0);
       cleared++;
     } catch (e) {
       log("debug", "trial gc failed", { slug: marker.slug, error: e.message });
@@ -3652,10 +3652,6 @@ async function runUpgrade(opts = {}) {
     print(`  ${BINARY_DOWNLOAD_URL}`);
     return { exitCode: opts.run ? 2 : 1, lines };
   }
-  if (!plan.command) {
-    print("No upgrade command available for this install method.");
-    return { exitCode: 0, lines };
-  }
   const installRoot = method === "local-node-modules" ? localInstallRoot(argvPath) : null;
   const runSpec = method === "global-npm" ? { cmd: "npm", args: ["install", "-g", "@yawlabs/mcp@latest"] } : method === "pnpm-global" ? { cmd: "pnpm", args: ["add", "-g", "@yawlabs/mcp@latest"] } : method === "bun-global" ? { cmd: "bun", args: ["add", "-g", "@yawlabs/mcp@latest"] } : method === "local-node-modules" && installRoot !== null ? { cmd: "npm", args: ["install", "@yawlabs/mcp@latest"], cwd: installRoot } : null;
   if (!opts.run) {
@@ -3699,7 +3695,7 @@ async function runUpgrade(opts = {}) {
   return { exitCode: 3, lines };
 }
 function readCurrentVersion() {
-  return true ? "0.63.0" : "dev";
+  return true ? "0.63.2" : "dev";
 }
 
 // src/usage-hints.ts
@@ -3761,7 +3757,7 @@ function selectFlakyNamespaces(entries, limit) {
 }
 
 // src/doctor-cmd.ts
-var VERSION = true ? "0.63.0" : "dev";
+var VERSION = true ? "0.63.2" : "dev";
 function isPersistenceDisabled(env) {
   const raw = env.YAW_MCP_DISABLE_PERSISTENCE;
   return raw !== void 0 && raw !== "" && (raw === "1" || raw.toLowerCase() === "true");
@@ -3804,11 +3800,13 @@ async function runDoctor(opts = {}) {
   renderEnvSection({ env, print });
   const persistenceDisabled = isPersistenceDisabled(env);
   const stateFilePath = join8(userConfigDir(home), STATE_FILENAME);
-  const persistedState = persistenceDisabled ? null : await loadState(stateFilePath);
-  await renderStateSection({
+  const statePeek = persistenceDisabled ? null : await peekStateFile(stateFilePath);
+  const persistedState = statePeek?.kind === "ok" ? await loadState(stateFilePath) : null;
+  renderStateSection({
     filePath: stateFilePath,
     disabled: persistenceDisabled,
     persisted: persistedState,
+    peek: statePeek,
     print
   });
   renderReliabilitySection({ disabled: persistenceDisabled, persisted: persistedState, print });
@@ -4028,16 +4026,15 @@ function renderEnvSection(opts) {
   }
   print("");
 }
-async function renderStateSection(opts) {
-  const { filePath, disabled, persisted, print } = opts;
+function renderStateSection(opts) {
+  const { filePath, disabled, persisted, peek, print } = opts;
   print("STATE");
-  if (disabled) {
-    print("  status: disabled via YAW_MCP_DISABLE_PERSISTENCE");
+  if (disabled || !peek) {
+    if (disabled) print("  status: disabled via YAW_MCP_DISABLE_PERSISTENCE");
     print("");
     return;
   }
   print(`  path:   ${filePath}`);
-  const peek = await peekStateFile(filePath);
   if (peek.kind === "malformed") {
     print("  status: corrupt -- file exists but JSON is unparseable");
     print(`  fix:    \`yaw-mcp reset-learning\` to clear, or open ${filePath} and fix by hand`);
@@ -4196,29 +4193,14 @@ function probeClients(opts) {
         continue;
       }
       const exists3 = existsSync4(resolved.absolute);
-      let hasMcpEntry = false;
-      let hasLegacyEntry = false;
-      let legacyEntryName = null;
-      let malformed = false;
+      let classified = { hasMcpEntry: false, hasLegacyEntry: false, legacyEntryName: null, malformed: false };
       if (exists3) {
         try {
           statSync(resolved.absolute);
           const raw = readFileSync(resolved.absolute, "utf8");
-          if (raw.trim().length > 0) {
-            const parsed = parseJsonc(raw);
-            if (typeof parsed === "object" && parsed !== null && !Array.isArray(parsed)) {
-              const container = walkContainer(parsed, resolved.containerPath);
-              if (container) {
-                hasMcpEntry = ENTRY_NAME in container;
-                legacyEntryName = findLegacyEntry(container);
-                hasLegacyEntry = legacyEntryName !== null;
-              }
-            } else {
-              malformed = true;
-            }
-          }
+          classified = classifyProbeContent(raw, resolved.containerPath);
         } catch {
-          malformed = true;
+          classified = { hasMcpEntry: false, hasLegacyEntry: false, legacyEntryName: null, malformed: true };
         }
       }
       out.push({
@@ -4226,10 +4208,7 @@ function probeClients(opts) {
         scope: scope.scope,
         path: resolved.absolute,
         exists: exists3,
-        hasMcpEntry,
-        hasLegacyEntry,
-        legacyEntryName,
-        malformed,
+        ...classified,
         unavailable: false
       });
     }
@@ -4245,6 +4224,30 @@ function walkContainer(root, path5) {
   if (typeof cur !== "object" || cur === null || Array.isArray(cur)) return null;
   return cur;
 }
+function classifyProbeContent(raw, containerPath) {
+  if (raw.trim().length === 0) {
+    return { hasMcpEntry: false, hasLegacyEntry: false, legacyEntryName: null, malformed: false };
+  }
+  try {
+    const parsed = parseJsonc(raw);
+    if (typeof parsed !== "object" || parsed === null || Array.isArray(parsed)) {
+      return { hasMcpEntry: false, hasLegacyEntry: false, legacyEntryName: null, malformed: true };
+    }
+    const container = walkContainer(parsed, containerPath);
+    if (!container) {
+      return { hasMcpEntry: false, hasLegacyEntry: false, legacyEntryName: null, malformed: false };
+    }
+    const legacyEntryName = findLegacyEntry(container);
+    return {
+      hasMcpEntry: ENTRY_NAME in container,
+      hasLegacyEntry: legacyEntryName !== null,
+      legacyEntryName,
+      malformed: false
+    };
+  } catch {
+    return { hasMcpEntry: false, hasLegacyEntry: false, legacyEntryName: null, malformed: true };
+  }
+}
 async function probeClientsAsync(opts) {
   const result = [];
   for (const target of INSTALL_TARGETS) {
@@ -4264,38 +4267,28 @@ async function probeClientsAsync(opts) {
       continue;
     }
     for (const scope of target.scopes) {
-      const resolved = resolveInstallPath({
-        clientId: target.clientId,
-        scope: scope.scope,
-        os: opts.os,
-        home: opts.home,
-        projectDir: scope.requiresProjectDir ? opts.cwd : void 0,
-        claudeConfigDir: opts.claudeConfigDir
-      });
+      let resolved;
+      try {
+        resolved = resolveInstallPath({
+          clientId: target.clientId,
+          scope: scope.scope,
+          os: opts.os,
+          home: opts.home,
+          projectDir: scope.requiresProjectDir ? opts.cwd : void 0,
+          claudeConfigDir: opts.claudeConfigDir
+        });
+      } catch {
+        continue;
+      }
       const exists3 = existsSync4(resolved.absolute);
-      let hasMcpEntry = false;
-      let hasLegacyEntry = false;
-      let legacyEntryName = null;
-      let malformed = false;
+      let classified = { hasMcpEntry: false, hasLegacyEntry: false, legacyEntryName: null, malformed: false };
       if (exists3) {
         try {
           await stat3(resolved.absolute);
           const raw = await readFile7(resolved.absolute, "utf8");
-          if (raw.trim().length > 0) {
-            const parsed = parseJsonc(raw);
-            if (typeof parsed === "object" && parsed !== null && !Array.isArray(parsed)) {
-              const container = walkContainer(parsed, resolved.containerPath);
-              if (container) {
-                hasMcpEntry = ENTRY_NAME in container;
-                legacyEntryName = findLegacyEntry(container);
-                hasLegacyEntry = legacyEntryName !== null;
-              }
-            } else {
-              malformed = true;
-            }
-          }
+          classified = classifyProbeContent(raw, resolved.containerPath);
         } catch {
-          malformed = true;
+          classified = { hasMcpEntry: false, hasLegacyEntry: false, legacyEntryName: null, malformed: true };
         }
       }
       result.push({
@@ -4303,10 +4296,7 @@ async function probeClientsAsync(opts) {
         scope: scope.scope,
         path: resolved.absolute,
         exists: exists3,
-        hasMcpEntry,
-        hasLegacyEntry,
-        legacyEntryName,
-        malformed,
+        ...classified,
         unavailable: false
       });
     }
@@ -5736,11 +5726,11 @@ function readPassphraseFromTTY(stdin, stdout, prompt = "Vault passphrase: ") {
     stdin.on("data", onData);
   });
 }
-async function readStdinValue(io) {
+async function readStdinValue(io, forceRaw) {
   const stdin = io?.stdin ?? process.stdin;
   const stdout = io?.stdout ?? process.stdout;
   const isTTY = stdin.isTTY === true;
-  if (isTTY) {
+  if (isTTY && !forceRaw) {
     stdout.write("Secret value: ");
     return readPassphraseFromTTY(stdin, stdout);
   }
@@ -5785,6 +5775,18 @@ async function runSecrets(opts, io = {
     }
     return { exitCode: 0 };
   }
+  if (opts.action === "get" || opts.action === "remove") {
+    const existingVault = await loadVault(path5);
+    if (!existingVault || !(opts.name in existingVault.entries)) {
+      const name = opts.name;
+      const msg = `No secret named "${name}" in the vault.`;
+      if (opts.json) io.err(`${JSON.stringify({ ok: false, error: msg })}
+`);
+      else io.err(`yaw-mcp secrets: ${msg}
+`);
+      return { exitCode: 1 };
+    }
+  }
   let vault = await loadVault(path5) ?? newVault();
   const isFresh = !existsSync6(path5);
   const passphrase = await resolvePassphrase(opts);
@@ -5811,7 +5813,7 @@ async function runSecrets(opts, io = {
     const name = opts.name;
     let value;
     if (opts.value !== void 0) value = opts.value;
-    else value = await readStdinValue(opts.io);
+    else value = await readStdinValue(opts.io, opts.fromStdin);
     if (!value) {
       const msg = "Secret value cannot be empty.";
       if (opts.json) io.err(`${JSON.stringify({ ok: false, error: msg })}
@@ -6085,7 +6087,7 @@ function defaultSpawn2(cmd, args) {
 async function maybeAutoUpgrade(deps = {}) {
   const optOut = process.env.YAW_MCP_AUTO_UPGRADE;
   if (optOut === "0" || optOut?.toLowerCase() === "false") return;
-  const current = deps.currentVersion ?? (true ? "0.63.0" : "dev");
+  const current = deps.currentVersion ?? (true ? "0.63.2" : "dev");
   if (current === "dev") return;
   const method = (deps.isSeaImpl ? await deps.isSeaImpl() : await detectSea()) ? "binary" : detectInstallMethod(deps.argvPath ?? process.argv[1]);
   const latest = await (deps.fetchLatestImpl ?? fetchLatestVersion2)();
@@ -8776,7 +8778,7 @@ function categorizeSpawnError(err) {
 }
 async function connectToUpstream(config, onDisconnect, onListChanged) {
   const client = new Client(
-    { name: "yaw-mcp", version: true ? "0.63.0" : "dev" },
+    { name: "yaw-mcp", version: true ? "0.63.2" : "dev" },
     { capabilities: {} }
   );
   let transport;
@@ -9103,7 +9105,7 @@ var ConnectServer = class _ConnectServer {
     this.apiUrl = apiUrl5;
     this.token = token5;
     this.server = new Server(
-      { name: "yaw-mcp", version: true ? "0.63.0" : "dev" },
+      { name: "yaw-mcp", version: true ? "0.63.2" : "dev" },
       {
         capabilities: {
           tools: { listChanged: true },
@@ -12191,13 +12193,28 @@ async function syncPull(opts, io, home) {
 }
 async function syncPush(opts, io, home) {
   const local = await readLocalBundles(home);
+  const stripped = local.servers.map(stripEnvValues);
+  if (opts.dryRun) {
+    if (opts.json) {
+      io.out(
+        `${JSON.stringify({ ok: true, dryRun: true, serverCount: stripped.length }, null, 2)}
+`
+      );
+    } else {
+      io.out(
+        `[dry-run] would push ${stripped.length} server${stripped.length === 1 ? "" : "s"} (env values stripped); nothing sent.
+`
+      );
+    }
+    return { exitCode: 0 };
+  }
   const remote = await getResource(MCP_BUNDLES_RESOURCE, {
     home: opts.home,
     baseUrl: opts.baseUrl
   });
   const remoteServers = remote.data?.servers ?? [];
-  const stripped = mergeRemoteActive(local.servers.map(stripEnvValues), remoteServers);
-  const payload = { version: 1, servers: stripped };
+  const merged = mergeRemoteActive(stripped, remoteServers);
+  const payload = { version: 1, servers: merged };
   const syncState = await readSyncState(home);
   const lastPulled = syncState.mcp_bundles?.lastPulledVersion;
   const pushVersion = lastPulled ?? remote.version;
@@ -12207,10 +12224,10 @@ async function syncPush(opts, io, home) {
   });
   await writeSyncState(home, { mcp_bundles: { lastPulledVersion: res.version } });
   if (opts.json) {
-    io.out(`${JSON.stringify({ ok: true, serverCount: stripped.length, newVersion: res.version }, null, 2)}
+    io.out(`${JSON.stringify({ ok: true, serverCount: merged.length, newVersion: res.version }, null, 2)}
 `);
   } else {
-    io.out(`Pushed ${stripped.length} server${stripped.length === 1 ? "" : "s"} -> mcp_bundles v${res.version}.
+    io.out(`Pushed ${merged.length} server${merged.length === 1 ? "" : "s"} -> mcp_bundles v${res.version}.
 `);
     io.out("Env values stripped before upload; use `yaw-mcp secrets push` to sync secrets across machines.\n");
   }
@@ -12614,9 +12631,9 @@ if (subcommand === "compliance") {
                                gate (default: a clearly-winning server is
                                activated in the same call).
     YAW_MCP_AUTO_UPGRADE          Set to \`0\` to disable the background
-                               self-upgrade check at \`yaw-mcp serve\` startup
-                               (default: stale global-npm installs are
-                               upgraded in the background).
+                               self-upgrade check at server startup (default:
+                               stale global-npm installs are upgraded in the
+                               background).
     YAW_MCP_PRUNE_RESPONSES       Set to \`0\` to disable response pruning.
     YAW_MCP_DISABLE_PERSISTENCE   Disable cross-session learning state.
     YAW_MCP_CATALOG_URL          Override the catalog \`add\`/\`try\` resolve slugs
@@ -12640,7 +12657,7 @@ if (subcommand === "compliance") {
 `);
   process.exit(0);
 } else if (subcommand === "--version" || subcommand === "-V") {
-  process.stdout.write(`yaw-mcp ${true ? "0.63.0" : "dev"}
+  process.stdout.write(`yaw-mcp ${true ? "0.63.2" : "dev"}
 `);
   process.exit(0);
 } else if (subcommand && !subcommand.startsWith("-")) {

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "@yawlabs/mcp",
-  "version": "0.63.0",
+  "version": "0.63.2",
   "mcpName": "io.github.YawLabs/mcp",
   "description": "Yaw MCP -- MCP servers, managed. Free to run locally; Yaw Team adds cross-machine sync.",
   "license": "UNLICENSED",