mcp-prompt-optimizer 3.7.1 → 3.7.2

package/CHANGELOG.md

@@ -5,6 +5,15 @@ All notable changes to this project will be documented in this file.
 The format is based on [Keep a Changelog](https://keepachangelog.com/en/1.0.0/),
 and this project adheres to [Semantic Versioning](https://semver.org/spec/v2.0.0.html).
 
+## [3.7.2] - 2026-07-05
+
+### Fixed
+- **Stdout JSON-RPC corruption risk**: MCP server startup logs (banner, status lines, key validation, mode indicators) now route to **stderr** instead of stdout. On stdio transports, stdout is the JSON-RPC channel — any non-protocol writes from the server can corrupt the stream and cause client-side parse failures. All server-side logging in `startValidatedMCPServer` and `CloudApiKeyManager._log` (`success`/`info` levels) is now stderr-safe.
+
+### Internal
+- **Contract test** (`tests/contract-check.js` + `tests/fixtures/optimize-response.json`): pins the `/optimize` response shape against the backend Pydantic model (`OptimizeResponse`), including runtime-injected fields (`quota_used`, `quota_limit`) and metadata (`ai_context`, `routing_score`, `routing_tier`, `model_used`). Catches backend response drift before publish. Runs with no network/API key via `npm run test:contract`.
+- **CI workflow** (`.github/workflows/ci.yml`): runs `npm ci`, health check, and the contract check on push/PR across Node 18, 20, and 22. The contract check is the publish gate.
+
 ## [3.6.0] - 2026-06-11
 
 ### Fixed

package/README.md

@@ -1,4 +1,4 @@
-# MCP Prompt Optimizer v3.6.0
+# MCP Prompt Optimizer v3.7.2
 
 [![NPM Version](https://img.shields.io/npm/v/mcp-prompt-optimizer)](https://www.npmjs.com/package/mcp-prompt-optimizer)
 [![License](https://img.shields.io/badge/license-Commercial-blue.svg)](LICENSE)
@@ -438,6 +438,11 @@ Windsurf, Cline, VS Code, Zed, Replit, JetBrains IDEs, and Neovim are all suppor
 
 ## 📦 Changelog
 
+### v3.7.2
+- **Stdout / JSON-RPC safety** — All MCP server startup logs (banner, status, mode indicators, key validation) now route to **stderr** instead of stdout. On stdio transports stdout is the JSON-RPC channel; previously any non-protocol writes there risk corrupting the stream. No user-facing change beyond logging.
+- **Contract test** — `npm run test:contract` pins the `/optimize` response shape (Pydantic fields + runtime-injected `quota_used`/`quota_limit` + metadata `routing_score`/`routing_tier`/`model_used`) against a canonical fixture. Catches backend drift before publish.
+- **CI workflow** — `.github/workflows/ci.yml` runs `npm ci` + health check + contract check on push/PR across Node 18, 20, and 22.
+
 ### v3.6.0
 - **Free tier MCP access** — Free users can now create an API key (`sk-opt-*`) and use the MCP server for 7 LLM optimizations/month at no cost. Previously, key creation was blocked in the live service due to a bug introduced when the free-tier launch landed in an unused module. Keys with `subscription_status: NULL` (all free accounts) now validate correctly.
 - **`connect` wizard** — `npx mcp-prompt-optimizer connect` interactively writes your API key to Claude Desktop config on macOS, Windows, and Linux. Replaces manual JSON editing for new users.