ast-mcp-server 0.7.1 → 0.7.2

This diff represents the content of publicly available package versions that have been released to one of the supported registries. The information contained in this diff is provided for informational purposes only and reflects changes between package versions as they appear in their respective public registries.
Files changed (6) hide show
  1. package/CHANGELOG.md +12 -1
  2. package/README.md +1 -1
  3. package/SECURITY.md +5 -4
  4. package/docs/support.md +2 -2
  5. package/package.json +2 -2
  6. package/skills/structural-code-editing/SKILL.md +1 -1
package/CHANGELOG.md CHANGED
@@ -4,13 +4,24 @@ All notable changes to this project will be documented in this file.
4
4
 
5
5
  The format is based on [Keep a Changelog](https://keepachangelog.com/en/1.1.0/), and this project adheres to [Semantic Versioning](https://semver.org/spec/v2.0.0.html).
6
6
 
7
- ## [0.7.1] — release candidate (unreleased, 2026-08-12)
7
+ ## [0.7.2] — release candidate (unreleased, 2026-08-12)
8
+
9
+ ### Fixed
10
+
11
+ - Promotion preflight now validates raw npm registry metadata exactly once, compares live integrity with the verified artifact before and after mutation, and classifies the normalized readback without reinterpreting its field schema.
12
+ - Added a composed regression covering eligible, already-promoted, and integrity-drift promotion readbacks.
13
+
14
+ ## [0.7.1] — published to `next`, verified, not promoted (2026-08-12)
8
15
 
9
16
  ### Fixed
10
17
 
11
18
  - Public-registry verification now creates physical fake Claude Code and Hermes executables, preserving each agent identity after executable canonicalization.
12
19
  - Added a regression through the real agent detector so future consumer smokes cannot reintroduce identity-collapsing symlinks.
13
20
 
21
+ ### Release status
22
+
23
+ - The package was published under the `next` dist-tag with valid npm provenance and passed its exact-SHA public-consumer verification. Promotion was rejected before mutation because the preflight passed a normalized registry record back into the raw-record validator. It was never promoted to `latest`, tagged, or released on GitHub; `0.7.2` supersedes it.
24
+
14
25
  ## [0.7.0] — published to `next`, not promoted (2026-08-12)
15
26
 
16
27
  ### Added
package/README.md CHANGED
@@ -82,7 +82,7 @@ The included batch benchmark records a 50% reduction in model round-trips and a
82
82
 
83
83
  ## Supported environment and trust boundary
84
84
 
85
- The supported v0.7.1 target is Linux x64 with GNU coreutils `mv` supporting `--update=none-fail`, under Node.js 22.5.0 and the current Node.js 24 line. The production-readiness matrix covers both runtimes on that target; the Node 22.5 persistence canary requires `--experimental-sqlite`. Other Linux architectures or systems without the required GNU `mv`, macOS, and Windows are unverified until they pass equivalent filesystem, process, MCP/CLI/package, and mutation gates.
85
+ The supported v0.7.2 target is Linux x64 with GNU coreutils `mv` supporting `--update=none-fail`, under Node.js 22.5.0 and the current Node.js 24 line. The production-readiness matrix covers both runtimes on that target; the Node 22.5 persistence canary requires `--experimental-sqlite`. Other Linux architectures or systems without the required GNU `mv`, macOS, and Windows are unverified until they pass equivalent filesystem, process, MCP/CLI/package, and mutation gates.
86
86
 
87
87
  This is a local stdio server. It runs with the invoking user's filesystem permissions, and clients may request any `project_root` that user can access. It does not provide HTTP authentication, sandboxing, tenant isolation, or a remote-service security boundary. Remote, untrusted, and multi-tenant operation is unsupported.
88
88
 
package/SECURITY.md CHANGED
@@ -2,15 +2,16 @@
2
2
 
3
3
  ## Supported versions
4
4
 
5
- Security fixes are provided for the latest published minor release and the current `main` development line. During the v0.7.1 release-candidate cycle, the support window is:
5
+ Security fixes are provided for the latest published minor release and the current `main` development line. During the v0.7.2 release-candidate cycle, the support window is:
6
6
 
7
7
  | Version | Supported |
8
8
  | ---------------------------------- | ---------------------------------- |
9
- | `main` / v0.7.1 release candidates | Yes |
10
- | 0.6.x | Yes, until v0.7.1 becomes `latest` |
9
+ | `main` / v0.7.2 release candidates | Yes |
10
+ | 0.6.x | Yes, until v0.7.2 becomes `latest` |
11
+ | 0.7.0 / 0.7.1 | No, superseded `next` candidates |
11
12
  | 0.5.x and earlier | No |
12
13
 
13
- This project supports trusted single-user local stdio use. The current v0.7.1 target supports Linux x64 only when GNU coreutils `mv` provides `--update=none-fail`, with Node.js 22.5.0 or the current Node.js 24 line. Other Linux architectures, systems without that primitive, macOS and Windows are unverified. Remote, untrusted and multi-tenant use is outside the supported security boundary.
14
+ This project supports trusted single-user local stdio use. The current v0.7.2 target supports Linux x64 only when GNU coreutils `mv` provides `--update=none-fail`, with Node.js 22.5.0 or the current Node.js 24 line. Other Linux architectures, systems without that primitive, macOS and Windows are unverified. Remote, untrusted and multi-tenant use is outside the supported security boundary.
14
15
 
15
16
  ## Reporting a vulnerability
16
17
 
package/docs/support.md CHANGED
@@ -1,6 +1,6 @@
1
1
  # Support policy
2
2
 
3
- This document defines the supported platform, runtime, persistence, and operational boundary for `ast-mcp-server` v0.7.1.
3
+ This document defines the supported platform, runtime, persistence, and operational boundary for `ast-mcp-server` v0.7.2.
4
4
 
5
5
  ## Supported release target
6
6
 
@@ -35,7 +35,7 @@ Operation locks coordinate cooperating same-user processes. They do not stop edi
35
35
 
36
36
  The supported default is memory-only indexing. When `AST_SYMBOL_INDEX_PERSISTENCE` is absent, persistence remains disabled and no persistent cache is created.
37
37
 
38
- The only candidate-authorized opt-in persistence policy is `canary`; it is not enabled by default in v0.7.1:
38
+ The only candidate-authorized opt-in persistence policy is `canary`; it is not enabled by default in v0.7.2:
39
39
 
40
40
  ```bash
41
41
  AST_SYMBOL_INDEX_PERSISTENCE=canary \
package/package.json CHANGED
@@ -1,6 +1,6 @@
1
1
  {
2
2
  "name": "ast-mcp-server",
3
- "version": "0.7.1",
3
+ "version": "0.7.2",
4
4
  "description": "Structural code MCP server and batch CLI for compact TypeScript/JavaScript reads and hash-bound AST edits.",
5
5
  "keywords": [
6
6
  "mcp",
@@ -93,5 +93,5 @@
93
93
  "typescript-eslint": "^8.65.0",
94
94
  "vitest": "^4.1.10"
95
95
  },
96
- "gitHead": "8dc92b344fa54b4e542b6222dace079c8ba2466b"
96
+ "gitHead": "d27f8f80cf81bf81b1d1e5e76db7b8875344d91e"
97
97
  }
package/skills/structural-code-editing/SKILL.md CHANGED
@@ -40,7 +40,7 @@ El setup falla cerrado ante un registro `ast` conflictivo. No eliminar ni reempl
40
40
 
41
41
  ## Runtime, soporte y errores
42
42
 
43
- El paquete requiere Node.js `>=22.5.0`. El target verificado para v0.7.1 es Linux x64 con Node.js 22.5.0 o la línea actual de Node.js 24 y el `mv` de GNU coreutils requerido por la publicación atómica de evidencia. Otras arquitecturas Linux, sistemas sin ese primitivo, macOS y Windows están sin verificar.
43
+ El paquete requiere Node.js `>=22.5.0`. El target verificado para v0.7.2 es Linux x64 con Node.js 22.5.0 o la línea actual de Node.js 24 y el `mv` de GNU coreutils requerido por la publicación atómica de evidencia. Otras arquitecturas Linux, sistemas sin ese primitivo, macOS y Windows están sin verificar.
44
44
 
45
45
  El transporte soportado es stdio local bajo los permisos filesystem del usuario que invoca el proceso. No asumir autenticación HTTP, sandbox, aislamiento entre tenants ni una frontera segura para clientes remotos o no confiables.
46
46