npm - mcp-pacemaker - Versions diffs - 2.0.1 → 2.0.2 - Mend

mcp-pacemaker 2.0.1 → 2.0.2

This diff represents the content of publicly available package versions that have been released to one of the supported registries. The information contained in this diff is provided for informational purposes only and reflects changes between package versions as they appear in their respective public registries.

Files changed (5) hide show

package/CHANGELOG.md +31 -1
package/CONTRIBUTING.md +14 -4
package/README.md +110 -56
package/package.json +1 -1
package/ui/dist/third-party-manifest.json +1 -1

package/CHANGELOG.md CHANGED Viewed

@@ -7,10 +7,40 @@ and this project adheres to [Semantic Versioning](https://semver.org/spec/v2.0.0
 ## [Unreleased]
+Target release: **2.0.2**. This candidate has not yet been published.
 ### Fixed
-- Resolve native directory watcher paths before watching logs and test control files,
+- Replace the old GitHub-install quick start in the npm package documentation with
+  npm-first installation, exact-version commands, prerequisites and setup boundaries.
+- Preserve npm package-type permissions in isolated consumer checks instead of silently
+  reverting directory, file, Git, or remote dependency restrictions to npm defaults.
+- Resolve native directory watcher paths in publication and compatibility test helpers,
   avoiding Windows short-path watcher crashes without changing the selected files.
+- Restore the legacy publisher's skipped-matrix job and whole-second timestamp handling
+  in reusable secret-collection admission, preserving source and execution checks.
+### Changed
+- Make the manual npm publisher reusable for explicitly selected stable 1.x/2.x
+  versions, with immutable published comparison peers and no active bootstrap actions.
+- Keep the existing GitHub source-CI, collection/review, preparation, OIDC staging,
+  verification and separately approved owner-publication route for the selected release.
+### Security
+- Record a temporary **2.0.2-only producer risk acceptance** for `smol-toml 1.8.0`
+  in the CLI runtime and `braces 3.0.3`, `postcss-selector-parser 6.1.4` and
+  `source-map-js 1.2.1` in UI build tooling. The October 6 review keeps the
+  original **2026-10-12T00:00:00Z** expiry and binds both unchanged producer
+  locks and the exact native reports. Raw audit/OSV findings remain visible.
+  Dependency upgrades stay deferred from this documentation release.
+  This is not a patch or a clean advisory result; fresh-consumer findings are
+  not exempted. Remediation and exception removal are required
+  before expiry or the next release. See the
+  [exact advisories, exposure, mitigations and follow-up](docs/npm-publishing.md#temporary-202-producer-risk-acceptance).
+## [2.0.1]
 ### Changed

package/CONTRIBUTING.md CHANGED Viewed

@@ -103,15 +103,21 @@ instead of installing bundled Chromium. CI uses bundled Chromium, not that overr
 Both standalone test commands **fail** when preparation is missing or candidate bytes have
 changed. Clean and prepare again after changing package files, built assets, or Node major.
-Scope is explicitly **1.3.0, 1.3.1, 2.0.0 and 2.0.1**, not arbitrary compatible-looking versions.
+Historical compatibility baselines remain explicitly **1.3.0 and 2.0.0**.
+Candidate versions must be canonical stable **1.x legacy / 2.x current** versions.
+The owner selects the actual release and any exact opposite-major patch pair;
+support in the harness alone is not evidence that every patch was tested.
 The same harness runs in both maintained branches:
 | Preparation | Selected legacy / current pair |
 |---|---|
-| Default in the 2.0.1 checkout | Immutable 1.3.0 / packed 2.0.1 |
+| Default in the selected 2.0.2 checkout | Immutable 1.3.0 / packed 2.0.2 |
 | Default in the 1.3.1 checkout | Packed 1.3.1 / immutable 2.0.0 |
 | `npm run compat:prepare:baseline` | Immutable 1.3.0 / immutable 2.0.0 |
-| `npm run compat:prepare -- --peer-root <opposite-patch-checkout>` | Packed 1.3.1 / packed 2.0.1 |
+| `npm run compat:prepare -- --peer-root <opposite-patch-checkout>` | Packed 1.3.1 / packed 2.0.2 |
+These selections are not qualification evidence. The selected 1.3.1/2.0.2 pair
+requires fresh exact-byte gates; earlier 1.3.1/2.0.1 results remain historical.
 Run both API and browser gates for the explicit patch pair before publishing either complete
 dual-major release set. The two default CI pairs alone do not establish that combined result.
@@ -175,7 +181,7 @@ API, admin mutation, SSE and MCP requests go to the real backend, without respon
 Nested JS assets are included. The old-tab upgrade case does not substitute assets: it stops
 the actual selected 1.x process and starts the selected 2.x process on the same port before refresh.
-No other version compatibility is claimed. Writable downgrade is checked on a fresh
+Only the executed exact version pairs establish compatibility. Writable downgrade is checked on a fresh
 synthetic config with default ownership and inherited security. The test does not change
 tokens, elevate, or set ACLs. It checks unchanged caller authority and, on Windows, the actual
 selected 1.x helper's full/partial audit visibility. Caller-context hashes are not direct measurements
@@ -200,6 +206,10 @@ the user's global prefix, host configuration, live bridge, or npm credentials. I
 resolved caller registry/cache and offline setting without a mirror fallback. Registry
 signatures and provenance are separate post-publication checks, not inferred from this smoke test.
+The consumer preserves npm's effective `allow-directory`, `allow-file`, `allow-git`, and
+`allow-remote` values, including environment overrides. It does not replace restrictions
+with defaults or grant permissions when an install is rejected.
 ## Changing how a host is wired
 Host adapters live in `HOSTS` in `bin/cli.mjs`. Each one declares where that host's config

package/README.md CHANGED Viewed

@@ -1,6 +1,13 @@
 # mcp-pacemaker
-**Keep your MCP servers alive across editor restarts, reboots, and token expiry.** The long-running bridge is dependency-free; a small CLI (commander · clack · picocolors) handles setup.
+**A local process supervisor and transport bridge for your MCP servers.** Manage server
+lifetime outside your editor or CLI, with opt-in pre-warming and compatible session sharing.
+The long-running bridge has no third-party runtime dependencies; the setup CLI and dashboards
+have their own dependencies.
+[Install from npm](https://www.npmjs.com/package/mcp-pacemaker) ·
+[Report a problem](https://github.com/girishkvs/mcp-pacemaker/issues) ·
+[Release notes](https://github.com/girishkvs/mcp-pacemaker/releases)
 MCP hosts — editors (VS Code, Cursor, Claude Desktop) **and** CLIs (Claude Code, Copilot CLI,
 Codex, Gemini) — run stdio MCP servers as child processes. When the host restarts, crashes, or
@@ -19,36 +26,45 @@ is separate planned work.
 ## Quick start
-This README describes **2.0.x**. The current line is 2.x; the explicit maintenance line is
-1.3.x. See the [legacy documentation](https://github.com/girishkvs/mcp-pacemaker/blob/v1.3.1/README.md)
-for its immediate-save behavior and [support policy](SECURITY.md#supported-versions).
+Install **mcp-pacemaker 2.0.2** from npm. Use a maintained **Node.js 22 or 24**
+release; Windows also needs PowerShell 7 and Windows Script Host.
+See [installation requirements](#install) before setup.
-Compatibility gates distinguish immutable **1.3.0 / 2.0.0** from the **1.3.1 / 2.0.1** candidates.
-A 2.x client handles legacy immediate saves. A 1.x client cannot write pooling settings to a
-2.x bridge: update the CLI and refresh old dashboard tabs. Before downgrading, settle pending
-or interrupted transactions with 2.x. See the [real-version gates](CONTRIBUTING.md#real-version-compatibility-gates)
-for exact pairs; other minor versions are not covered.
+```bash
+npm install -g mcp-pacemaker@2.0.2
+mcp-pacemaker --version
+```
+The version check prints `2.0.2` without running setup.
+Before setup, have a readable JSON host configuration containing server definitions, or
+prepare [`~/.mcp-pacemaker/servers.json`](#serversjson). Supported import sources are
+`vscode`, `cursor`, `claude` (Claude Desktop), `copilot-cli` and `gemini`.
+Codex and Claude Code are wiring destinations, not import sources.
+Then run interactive setup:
 ```bash
-npm i -g github:girishkvs/mcp-pacemaker#v2.0.1
 mcp-pacemaker init
 ```
-That one command does the whole setup:
+`init` detects supported hosts, imports **one source host** (or reuses `servers.json`),
+asks for confirmation before wiring the selected hosts, registers OS auto-start and
+starts the bridge. Reload or restart the selected hosts afterward.
-1. **detects** every MCP host you have installed — editors and CLIs,
-2. **imports** the servers already configured in them into `~/.mcp-pacemaker/servers.json`,
-3. **rewrites** each host's config to point at the bridge (backing every file up first),
-4. **registers** OS auto-start so the bridge returns after a reboot,
-5. **starts** the bridge and prints what it wired.
+**Setup changes local configuration and auto-start.** Importing can create or update
+`servers.json` before the wiring confirmation. Existing JSON/TOML host files get a `.bak`
+before replacement; native Claude Code registrations do not. Keep your own protected
+configuration backup, especially before repeating setup.
-Nothing is written before you see it: `mcp-pacemaker plan --client <host>` shows the exact
-changes, every config write leaves a `.bak`, and `mcp-pacemaker uninstall` restores them.
+`--from` chooses the import source; `--client` chooses wiring destinations. For example,
+`mcp-pacemaker init --from vscode --client codex` imports VS Code's definitions and wires
+Codex. Without `--from`, setup prefers the first detected JSON host; it does not merge
+every detected host. Omit `--yes` to keep the confirmation prompt.
-After setup, bare `mcp-pacemaker` reports status:
+Check the running bridge:
 ```bash
-mcp-pacemaker            # status: bridges, wired hosts, servers
+mcp-pacemaker status     # status without entering first-run setup
 mcp-pacemaker top        # live terminal dashboard
 mcp-pacemaker doctor     # diagnose config, reachability, wiring
 ```
@@ -56,12 +72,12 @@ mcp-pacemaker doctor     # diagnose config, reachability, wiring
 <details>
 <summary>Prefer to drive it yourself? The same steps, one at a time</summary>
-Every command takes any host id — `vscode`, `cursor`, `claude`, `claude-code`, `copilot-cli`,
-`codex`, `gemini` (see [Supported hosts](#supported-hosts)). `--from` / `--client` below are
-just examples; substitute whichever you use.
+`plan`, `install` and `emit` accept any [supported host](#supported-hosts) as a wiring target.
+`import --from` accepts the five JSON import sources listed above. Run import first unless
+you already have `servers.json`; `plan` needs that file.
 ```bash
-mcp-pacemaker import  --from <host>            # build servers.json from an existing host
+mcp-pacemaker import  --from <source>          # write servers.json from one JSON host config
 mcp-pacemaker plan    --client <host>          # dry run: show what install would change
 mcp-pacemaker install --client <host>          # wire one host (--port N gives it its own bridge)
 mcp-pacemaker start                            # start the bridge
@@ -81,23 +97,32 @@ them in.
 </details>
-## Why not just use supergateway / mcp-proxy?
+## Which process-sharing mode?
-Those are great, mature stdio↔SSE bridges. `mcp-pacemaker` targets a different problem —
-*durable local hosting on a dev workstation* — and adds things they don't:
+Sharing a bridge does not automatically share a server process.
-| | supergateway | mcp-proxy | **mcp-pacemaker** |
-|---|---|---|---|
-| stdio → SSE | ✅ | ✅ | ✅ |
-| Streamable HTTP | ✅ | ✅ | ✅ |
-| Dependencies | npm tree | PyPI tree | **bridge: zero** · tiny setup CLI |
-| Process supervision | ❌ | ❌ | ✅ |
-| OS auto-start (logon / unlock / boot) | ❌ | ❌ | ✅ (Windows / macOS / Linux) |
-| Dynamic per-request token (from a CLI, auto-refresh) | ❌ (static) | ❌ (static/OAuth2) | ✅ |
-| Sessions survive the bridge restarting | ❌ | ❌ | ✅ |
-| Scheduled recycle for interactively-authenticated servers | ❌ | ❌ | ✅ |
-| One-command import + client wiring | ❌ | ❌ | ✅ |
-| Web + terminal dashboard, HTTP API | ❌ | ❌ | ✅ |
+| Mode | Process behavior | Use when |
+|---|---|---|
+| `isolated` (default) | One child per session | The server needs per-client workspace, account or conversation state |
+| `pool` (opt-in) | Pre-started, uninitialized children; each is assigned exclusively to one session | Startup is slow but sessions must remain separate |
+| `shared` (opt-in) | One initialized child for compatible sessions | Tools are stateless, inputs are explicit and the credential context is common |
+Shared clients must send identical initialization parameters, including `clientInfo`, and
+empty client capabilities. It is not automatic cross-editor sharing. See
+[shared-mode limits](#shared-mode) before enabling it.
+## Choosing a transport tool
+Documentation checked September 27, 2026; this is a use-case guide, not a feature benchmark.
+| Tool | Consider it when |
+|---|---|
+| [Supergateway](https://github.com/supercorp-ai/supergateway) | You want command-line conversion between stdio and HTTP/SSE/WebSocket transports |
+| [mcp-proxy](https://github.com/sparfenyuk/mcp-proxy) | You want a Python-based adapter between local stdio clients/servers and remote MCP transports |
+| **mcp-pacemaker** | You want workstation process supervision, host wiring, auto-start, lifecycle diagnostics and explicit isolation/pooling/sharing policies |
+These projects have overlapping capabilities. Reconnecting to a fresh server is not recovery
+of arbitrary application state, and a transport bridge is not a sandbox for untrusted tools.
 ## Supported hosts
@@ -125,26 +150,25 @@ Use a maintained **Node.js 22 or 24** release. Node 20 remains a compatibility t
 end-of-life, not a recommended secure runtime. The bridge has no npm runtime dependencies;
 the setup CLI and dashboard have their own dependencies.
-GitHub and npm publication are separate. Until the npm release is announced from
-[this repository](https://github.com/girishkvs/mcp-pacemaker/releases), use the pinned GitHub
-release. Do not assume that an npm package with a matching name is this project.
+Install the released package from [npm](https://www.npmjs.com/package/mcp-pacemaker).
+Its repository link should point to
+[`girishkvs/mcp-pacemaker`](https://github.com/girishkvs/mcp-pacemaker).
+Use an exact version for a repeatable installation:
 ```bash
-npm i -g github:girishkvs/mcp-pacemaker#v2.0.1
-# Deliberate legacy installation instead:
-npm i -g github:girishkvs/mcp-pacemaker#v1.3.1
+npm install -g mcp-pacemaker@2.0.2
+mcp-pacemaker --version
 ```
-After npm publication, `mcp-pacemaker@latest` selects the current 2.x line and
-`mcp-pacemaker@legacy` selects maintained 1.3.x. Verify the official listing's repository and
-maintainer before installing. For a repeatable installation, choose an exact released version:
+The current line uses the `latest` npm channel; the maintenance line uses `legacy` when that
+channel has been published. Check the actual registry values before choosing a channel:
 ```bash
-npm i -g mcp-pacemaker@2.0.1
-# Or, deliberately:
-npm i -g mcp-pacemaker@1.3.1
+npm view mcp-pacemaker dist-tags --json
 ```
+GitHub tags and npm publication are separate: a tag does not establish that the same
+version or channel is available on npm, or that its package bytes are identical.
 `@1` and `@2` are version ranges, not the maintained channels. They can select a version
 withdrawn from a channel. `upgrade --self` resolves the installed major's channel and prints
 an exact-version command; it never installs or downgrades anything.
@@ -158,11 +182,26 @@ Automatic configuration edits need .NET Framework 4.6.2 or newer. The bundled he
 unsigned; npm provenance is not Authenticode signing or an application-control allowlist.
 Windows ARM64 is not validated.
+### Version compatibility
+This README describes **2.0.x**. For 1.3.x immediate-save behavior, see the
+[legacy documentation](https://github.com/girishkvs/mcp-pacemaker/blob/v1.3.1/README.md)
+and [support policy](SECURITY.md#supported-versions). Those documents do not establish
+that a legacy version is available on npm.
+The historical baselines remain **1.3.0 / 2.0.0**. The earlier **1.3.1 / 2.0.1**
+patch-pair evidence is not transferable to a new release. The selected **1.3.1 / 2.0.2**
+pair requires fresh exact-byte compatibility and service-replacement gates.
+A 2.x client handles legacy immediate saves. A 1.x client cannot write pooling settings to a
+2.x bridge: update the CLI and refresh old dashboard tabs. Before downgrading, settle pending
+or interrupted transactions with 2.x. See the [real-version gates](CONTRIBUTING.md#real-version-compatibility-gates)
+for exact pairs; only the exact executed pairs are covered.
 ### Command reference
 | Command | What it does |
 |---|---|
-| `init [--client a,b] [--yes]` | **The one you want.** Detect hosts, import, wire, auto-start, launch |
+| `init [--from source] [--client a,b] [--yes]` | Interactive setup: import one source, wire selected hosts, auto-start, launch |
 | `status` | Bridges, wired hosts, servers, and any server currently failing |
 | `reload` | Re-read `servers.json` into the running bridge without restarting it |
 | `doctor` | Diagnose config, bridge reachability, host wiring |
@@ -171,13 +210,13 @@ Windows ARM64 is not validated.
 | `logs [--follow] [--since 2h] [--server name] [--grep text]` | Read and filter durable logs, including retained rotation |
 | `top` / `dashboard` | Live terminal UI / web dashboard |
 | `plan --client <host>` | Dry run — show exactly what `install` would change |
-| `import --from <host>` | Build `~/.mcp-pacemaker/servers.json` from an existing host |
+| `import --from <source>` | Build `~/.mcp-pacemaker/servers.json` from one supported JSON host config |
 | `install --client <host> [--port N]` | Wire one host (its own `--port` gives it its own bridge) |
 | `emit --client <host>` | Print the config entries without writing anything |
 | `start` / `stop` | Start or stop bridges (`--port` for one, else all) |
 | `upgrade [--self]` | Re-wire hosts; `--self` only prints same-major, exact-version installation guidance |
 | `update-check [--json]` | Compare the installed version with its maintained npm channel |
-| `uninstall` | Stop the bridge, remove auto-start, restore configs from `.bak` |
+| `uninstall` | Stop managed bridges, remove auto-start, restore available host-file `.bak` copies; native entries are not restored |
 > Package installation does not upgrade a running backend. `upgrade` rewires host configuration;
 > it does not replace package files, restart an adopted backend, or update its autostart path.
@@ -198,7 +237,10 @@ relying on an implicit socket-location fallback.
 Isolated and pooled stdio servers support HTTP+SSE (`/<name>/sse`) and Streamable HTTP
 (`/<name>/mcp`). Shared mode requires Streamable HTTP.
-`install` writes a `.bak` of your client config before touching it, and `uninstall` restores it.
+`install` backs up an existing JSON/TOML host file to `.bak`; repeating it replaces that backup.
+`uninstall` restores available host-file backups, leaves files without backups as-is, and
+keeps `servers.json`. Native Claude Code registrations are not backed up or automatically
+restored; record their original definitions separately and restore them through Claude Code.
 ### Replacing or rolling back a running installation
@@ -607,7 +649,19 @@ See [the shared-session contract](docs/shared-sessions.md) for limits and failur
 ## Uninstall
 ```bash
-npx mcp-pacemaker uninstall   # stop bridge, remove auto-start, restore client config from .bak
+mcp-pacemaker uninstall      # use the CLI from the matching installed version
+```
+This stops managed bridges, removes auto-start entries and restores available host-file
+backups. It leaves files without backups and native Claude Code registrations unchanged.
+It is not scoped to one port; review [replacement and rollback](#replacing-or-rolling-back-a-running-installation)
+first if another instance must remain running. Do not fetch a different CLI with `npx`
+to remove an existing installation.
+After the installed service has been removed successfully, remove the global npm package:
+```bash
+npm uninstall -g mcp-pacemaker
 ```
 ## Project

package/package.json CHANGED Viewed

@@ -1,6 +1,6 @@
 {
   "name": "mcp-pacemaker",
-  "version": "2.0.1",
+  "version": "2.0.2",
   "description": "Keeps your MCP servers alive across editor restarts, reboots, and token expiry — pluggable auth, cross-platform auto-start, one-command setup. Zero-dependency bridge; a small CLI for setup.",
   "type": "module",
   "bin": {

package/ui/dist/third-party-manifest.json CHANGED Viewed

@@ -27,7 +27,7 @@
       "version": "7.3.6"
     }
   ],
-  "producerLockSha256": "3946d2db15350b7ad8f815710004243dd1116682e9cdcb880beac27baed92244",
+  "producerLockSha256": "b88a73a6212e26f4c4dde985d84eadf39870c8758e4698cdd5544b8a55eb8cca",
   "projectLicenseSha256": "590ad9c29ee5580f83b9c05e403ca259d89e8366d1ed4c7207aa5e0a07afbf79",
   "noticesSha256": "11abb641d5175ce3817909603274fd0675b222ed53fae98d3513fd3f25eb56fc",
   "chunks": [