delimit-cli 3.6.5 → 3.6.7

package/README.md

@@ -39,7 +39,7 @@ That's it. Delimit auto-fetches the base branch spec, diffs it, and posts a PR c
 - Step-by-step migration guide
 - Policy violations
 
-[View on GitHub Marketplace →](https://github.com/marketplace/actions/delimit-api-governance)
+[View on GitHub Marketplace →](https://github.com/marketplace/actions/delimit-api-governance) · [See a live PR comment →](https://github.com/delimit-ai/delimit-quickstart/pull/1)
 
 ### Example PR comment
 

package/bin/delimit-setup.js

@@ -98,13 +98,32 @@ async function main() {
         fs.copyFileSync(serverSource, path.join(DELIMIT_HOME, 'server', 'mcp-server.py'));
     }
 
-    // Install Python deps
+    // Install Python deps into isolated venv with pinned versions
     log(`  ${dim('  Installing Python dependencies...')}`);
+    const venvDir = path.join(DELIMIT_HOME, 'venv');
+    const reqFile = path.join(DELIMIT_HOME, 'server', 'requirements.txt');
     try {
-        execSync(`${python} -m pip install --quiet fastmcp pyyaml pydantic packaging 2>/dev/null`, { stdio: 'pipe' });
-        log(`  ${green('✓')} Python dependencies installed`);
+        if (!fs.existsSync(venvDir)) {
+            execSync(`${python} -m venv "${venvDir}"`, { stdio: 'pipe' });
+        }
+        const venvPython = path.join(venvDir, 'bin', 'python');
+        const venvPythonWin = path.join(venvDir, 'Scripts', 'python.exe');
+        const venvPy = fs.existsSync(venvPython) ? venvPython : venvPythonWin;
+        if (fs.existsSync(reqFile)) {
+            execSync(`"${venvPy}" -m pip install --quiet -r "${reqFile}" 2>/dev/null`, { stdio: 'pipe' });
+        } else {
+            execSync(`"${venvPy}" -m pip install --quiet fastmcp==3.1.0 pyyaml==6.0.3 pydantic==2.12.5 packaging==26.0 2>/dev/null`, { stdio: 'pipe' });
+        }
+        python = venvPy;  // Use venv python for MCP config
+        log(`  ${green('✓')} Python dependencies installed (isolated venv)`);
     } catch {
-        log(`  ${yellow('!')} pip install failed — run manually: pip install fastmcp pyyaml pydantic packaging`);
+        log(`  ${yellow('!')} venv install failed — trying global pip`);
+        try {
+            execSync(`${python} -m pip install --quiet fastmcp==3.1.0 pyyaml==6.0.3 pydantic==2.12.5 packaging==26.0 2>/dev/null`, { stdio: 'pipe' });
+            log(`  ${green('✓')} Python dependencies installed (global)`);
+        } catch {
+            log(`  ${yellow('!')} pip install failed — run manually: pip install fastmcp pyyaml pydantic packaging`);
+        }
     }
 
     // Step 3: Configure Claude Code MCP
@@ -184,10 +203,14 @@ async function main() {
     }
 
     // Step 3d: Configure Gemini CLI (if installed)
-    const GEMINI_CONFIG = path.join(os.homedir(), '.gemini', 'settings.json');
-    if (fs.existsSync(GEMINI_CONFIG)) {
+    const GEMINI_DIR = path.join(os.homedir(), '.gemini');
+    const GEMINI_CONFIG = path.join(GEMINI_DIR, 'settings.json');
+    if (fs.existsSync(GEMINI_DIR)) {
         try {
-            let geminiConfig = JSON.parse(fs.readFileSync(GEMINI_CONFIG, 'utf-8'));
+            let geminiConfig = {};
+            if (fs.existsSync(GEMINI_CONFIG)) {
+                geminiConfig = JSON.parse(fs.readFileSync(GEMINI_CONFIG, 'utf-8'));
+            }
             if (!geminiConfig.mcpServers) geminiConfig.mcpServers = {};
             if (geminiConfig.mcpServers.delimit) {
                 log(`  ${green('✓')} Delimit already in Gemini CLI config`);
@@ -308,6 +331,13 @@ Run full governance compliance checks. Verify security, policy compliance, evide
     log('');
     log(`  ${green('Delimit is installed.')} Your AI now has persistent memory and governance.`);
     log('');
+    log('  Configured for:');
+    const tools = ['Claude Code'];
+    if (fs.existsSync(CODEX_CONFIG)) tools.push('Codex');
+    if (fs.existsSync(path.join(os.homedir(), '.cursor'))) tools.push('Cursor');
+    if (fs.existsSync(GEMINI_DIR)) tools.push('Gemini CLI');
+    log(`  ${green('✓')} ${tools.join(', ')}`);
+    log('');
     log('  Try it now:');
     log(`  ${bold('$ claude')}`);
     log('');

package/gateway/requirements.txt

@@ -0,0 +1,6 @@
+# Delimit MCP server dependencies — pinned for supply chain security
+# Update these when upgrading deps, then re-publish npm package
+fastmcp==3.1.0
+pyyaml==6.0.3
+pydantic==2.12.5
+packaging==26.0

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "delimit-cli",
-  "version": "3.6.5",
+  "version": "3.6.7",
   "description": "Catch breaking API changes before they ship. GitHub Action + CLI for OpenAPI specs.",
   "main": "index.js",
   "files": [