@yawlabs/mcp 0.63.1 → 0.63.2

package/CHANGELOG.md

@@ -2,6 +2,26 @@
 
 All notable changes to `@yawlabs/mcp` (formerly `@yawlabs/mcph`) are documented here. This project uses [semantic versioning](https://semver.org) and a script-gated release flow: `./release.sh <version>` runs lint + tests + build, bumps, tags, publishes to npm, and creates the GitHub release.
 
+## 0.63.2 -- release pipeline: publish npm from CI
+
+No changes to the package runtime or CLI -- this release exists to exercise the
+new CI-on-tag-push publish flow end to end. The published artifact is identical
+to 0.63.1 aside from the version bump.
+
+- **npm is now published from CI, not the workstation.** A new `publish-npm` job
+  in `release.yml` publishes `@yawlabs/mcp` on every `v*` tag using the org
+  `NPM_TOKEN` + `--provenance` (the repo and package are public), gated on the
+  binary build so npm and the GitHub Release stay in lockstep. It is idempotent:
+  a version already live is a clean skip, and an `EPUBLISHCONFLICT` from
+  registry read-replica lag is treated as success. `publish-registry` now
+  `needs: publish-npm`, so the MCP-registry verify can no longer race ahead of
+  the npm publish. `release.sh`'s hand-off detection was tightened to key on a
+  real `npm publish` / `NODE_AUTH_TOKEN` signal instead of the registry job's
+  `id-token: write` (the false positive that wedged the 0.63.0/0.63.1 runs).
+- **Registry job hardening.** `mcp-publisher` is pinned to a tagged release and
+  verified against its published sha256 before execution (was an unpinned
+  `curl .../latest | tar`), and the job pins its Node toolchain via `setup-node`.
+
 ## 0.63.1 -- CLI follow-ups: wire dead --dry-run/--stdin flags, fix completion drift, dedup probes
 
 Patch-level follow-ups on the 0.63.0 CLI hardening pass. All fixes; no behavior changes for callers who weren't already hitting the dead-flag bugs.

package/dist/index.js

@@ -3695,7 +3695,7 @@ async function runUpgrade(opts = {}) {
   return { exitCode: 3, lines };
 }
 function readCurrentVersion() {
-  return true ? "0.63.1" : "dev";
+  return true ? "0.63.2" : "dev";
 }
 
 // src/usage-hints.ts
@@ -3757,7 +3757,7 @@ function selectFlakyNamespaces(entries, limit) {
 }
 
 // src/doctor-cmd.ts
-var VERSION = true ? "0.63.1" : "dev";
+var VERSION = true ? "0.63.2" : "dev";
 function isPersistenceDisabled(env) {
   const raw = env.YAW_MCP_DISABLE_PERSISTENCE;
   return raw !== void 0 && raw !== "" && (raw === "1" || raw.toLowerCase() === "true");
@@ -6087,7 +6087,7 @@ function defaultSpawn2(cmd, args) {
 async function maybeAutoUpgrade(deps = {}) {
   const optOut = process.env.YAW_MCP_AUTO_UPGRADE;
   if (optOut === "0" || optOut?.toLowerCase() === "false") return;
-  const current = deps.currentVersion ?? (true ? "0.63.1" : "dev");
+  const current = deps.currentVersion ?? (true ? "0.63.2" : "dev");
   if (current === "dev") return;
   const method = (deps.isSeaImpl ? await deps.isSeaImpl() : await detectSea()) ? "binary" : detectInstallMethod(deps.argvPath ?? process.argv[1]);
   const latest = await (deps.fetchLatestImpl ?? fetchLatestVersion2)();
@@ -8778,7 +8778,7 @@ function categorizeSpawnError(err) {
 }
 async function connectToUpstream(config, onDisconnect, onListChanged) {
   const client = new Client(
-    { name: "yaw-mcp", version: true ? "0.63.1" : "dev" },
+    { name: "yaw-mcp", version: true ? "0.63.2" : "dev" },
     { capabilities: {} }
   );
   let transport;
@@ -9105,7 +9105,7 @@ var ConnectServer = class _ConnectServer {
     this.apiUrl = apiUrl5;
     this.token = token5;
     this.server = new Server(
-      { name: "yaw-mcp", version: true ? "0.63.1" : "dev" },
+      { name: "yaw-mcp", version: true ? "0.63.2" : "dev" },
       {
         capabilities: {
           tools: { listChanged: true },
@@ -12657,7 +12657,7 @@ if (subcommand === "compliance") {
 `);
   process.exit(0);
 } else if (subcommand === "--version" || subcommand === "-V") {
-  process.stdout.write(`yaw-mcp ${true ? "0.63.1" : "dev"}
+  process.stdout.write(`yaw-mcp ${true ? "0.63.2" : "dev"}
 `);
   process.exit(0);
 } else if (subcommand && !subcommand.startsWith("-")) {

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "@yawlabs/mcp",
-  "version": "0.63.1",
+  "version": "0.63.2",
   "mcpName": "io.github.YawLabs/mcp",
   "description": "Yaw MCP -- MCP servers, managed. Free to run locally; Yaw Team adds cross-machine sync.",
   "license": "UNLICENSED",