playwright-e2e-mcp 0.2.1 → 0.2.2

package/README.md

@@ -67,7 +67,7 @@ and every other MCP client — pick whichever route fits:
 | --- | --- |
 | **npm (canonical, fastest)** | `npx -y playwright-e2e-mcp` |
 | **MCP Registry** (registry-aware clients discover it automatically) | `io.github.trajectiq-ai/E2E` — [listing](https://registry.modelcontextprotocol.io/) |
-| **Any client, no npm account needed** | `npx -y github:trajectiq-ai/E2E#v0.2.1` (pin a release tag) |
+| **Any client, no npm account needed** | `npx -y github:trajectiq-ai/E2E#v0.2.2` (pin a release tag) |
 | **Claude Desktop, zero Node setup** | double-click the [`.mcpb` extension](https://github.com/trajectiq-ai/E2E/releases) |
 | **Remote-only clients (ChatGPT connectors)** | `https://playwright-e2e-mcp.vercel.app/api/mcp` |
 
@@ -370,8 +370,8 @@ builds `dist/` automatically on install). Pin a release tag: an unpinned
 `github:trajectiq-ai/E2E` runs whatever is on the default branch at that moment.
 
 ```bash
-npx -y github:trajectiq-ai/E2E#v0.2.1
-npm install -D github:trajectiq-ai/E2E#v0.2.1 @playwright/test   # or as a project dependency
+npx -y github:trajectiq-ai/E2E#v0.2.2
+npm install -D github:trajectiq-ai/E2E#v0.2.2 @playwright/test   # or as a project dependency
 npx playwright install chromium
 ```
 
@@ -379,7 +379,7 @@ Or grab the packaged tarball from the repo's **GitHub Releases** page and instal
 it locally:
 
 ```bash
-npm install -D https://github.com/trajectiq-ai/E2E/releases/download/v0.2.1/playwright-e2e-mcp-0.2.1.tgz
+npm install -D https://github.com/trajectiq-ai/E2E/releases/download/v0.2.2/playwright-e2e-mcp-0.2.2.tgz
 ```
 
 Listed in the **official [MCP Registry](https://registry.modelcontextprotocol.io/)** as
@@ -395,7 +395,7 @@ Listed in the **official [MCP Registry](https://registry.modelcontextprotocol.io
   "mcpServers": {
     "playwright-e2e": {
       "command": "npx",
-      "args": ["-y", "github:trajectiq-ai/E2E#v0.2.1"],
+      "args": ["-y", "github:trajectiq-ai/E2E#v0.2.2"],
       "env": { "PW_MCP_PROJECT_ROOT": "/absolute/path/to/your/project" }
     }
   }
@@ -409,8 +409,8 @@ when the client launches it somewhere else (e.g. your home directory).
 **Codex / VS Code / Copilot CLIs:**
 
 ```bash
-codex mcp add playwright-e2e -- npx -y github:trajectiq-ai/E2E#v0.2.1
-code --add-mcp '{"name":"playwright-e2e","command":"npx","args":["-y","github:trajectiq-ai/E2E#v0.2.1"]}'
+codex mcp add playwright-e2e -- npx -y github:trajectiq-ai/E2E#v0.2.2
+code --add-mcp '{"name":"playwright-e2e","command":"npx","args":["-y","github:trajectiq-ai/E2E#v0.2.2"]}'
 ```
 
 Codex's defaults fight this server: the first launch clones the repo and runs
@@ -421,7 +421,7 @@ Codex's defaults fight this server: the first launch clones the repo and runs
 ```toml
 [mcp_servers.playwright-e2e]
 command = "npx"
-args = ["-y", "github:trajectiq-ai/E2E#v0.2.1"]
+args = ["-y", "github:trajectiq-ai/E2E#v0.2.2"]
 startup_timeout_sec = 60
 tool_timeout_sec = 600
 ```
@@ -436,7 +436,7 @@ into `PW_MCP_PROJECT_ROOT`, so the tools point at a real project from the first
 **Claude Code:**
 
 ```bash
-claude mcp add playwright-e2e -- npx -y github:trajectiq-ai/E2E#v0.2.1
+claude mcp add playwright-e2e -- npx -y github:trajectiq-ai/E2E#v0.2.2
 ```
 
 **Gemini CLI / Qwen Code:** paste the `mcpServers` block above into
@@ -685,6 +685,7 @@ npm test        # build + test/run-tests.mjs (unit tests, any Node ≥20)
 npm run e2e     # build + e2e/run.mjs: live MCP ↔ Playwright integration suite
 npm run mcpb    # build + bundle dist/ into playwright-e2e-mcp-<version>.mcpb (+ .sha256)
 npm run mcpb:smoke   # ...then install that bundle in a temp dir, launch it and assert the handshake
+npm run mcpb:sign    # ...then sign it with MCPB_CERT/MCPB_KEY → <version>.signed.mcpb
 ```
 
 Tests cover the report parser (sample Playwright JSON, trace attachments), path utils
@@ -725,6 +726,51 @@ that only appear end-to-end:
 First run needs the browser once: `npx playwright install chromium`.
 CI runs the suite on Ubuntu and Windows (see `.github/workflows/ci.yml`).
 
+### Signing the bundle
+
+```bash
+MCPB_CERT=~/signing/cert.pem MCPB_KEY=~/signing/key.pem npm run mcpb:sign
+```
+
+Signing appends a PKCS#7 signature block to the bundle, so the signed file is
+*the reproducible bundle plus that block*. That ordering is the point: the bytes
+CI proved identical across platforms stay inside the signed file, and
+`mcpb unsign` returns them exactly. `scripts/sign-mcpb.mjs` asserts that round
+trip on every run and deletes its output if it fails, which is what keeps
+`<version>.signed.mcpb` tied to `<version>.mcpb`.
+
+The private key is read from a path you pass in (`--cert`/`--key` or
+`MCPB_CERT`/`MCPB_KEY`) and never from the repository — keep it outside version
+control, and back it up: the same key across releases is what makes the signer
+recognisable.
+
+What signing does and does not buy you is decided by the certificate, not by
+this script. `mcpb verify` and `mcpb info` accept a signature only when the
+certificate chains to something in the OS trust store, so with a self-signed
+certificate a host still reports **Not signed** — the signature is real
+integrity and key continuity, verifiable by the fingerprint the script prints,
+but not third-party identity. A certificate issued by a public CA, or an
+internal one installed on your machines, is what makes hosts report it as
+signed.
+
+### Verifying a published release
+
+```bash
+git checkout v0.2.2 && npm ci && npm run mcpb
+npm run release:verify -- v0.2.2
+```
+
+The release notes promise that the tag rebuilds the published bundle byte for
+byte. `scripts/verify-release.mjs` checks that promise from a checkout of the
+tag: the published bundle against your fresh build, every checksum the release
+publishes (and that nothing shippable is missing from `SHA256SUMS.txt`), a
+**signed** bundle against the bytes its signature wraps, and that the published
+archive still extracts with that version's manifest.
+`.github/workflows/verify-release.yml` runs it on every published release and on
+demand for any past tag. The `.tgz` is checked for download integrity only: npm
+records the packer's line endings, so a tarball packed locally on another OS is
+legitimately different.
+
 ### Try the example
 
 With Playwright installed in your project:

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "playwright-e2e-mcp",
-  "version": "0.2.1",
+  "version": "0.2.2",
   "description": "MCP server that runs, diagnoses and fixes failing Playwright end-to-end tests: trace analysis, verified locator fixes, flaky ranking",
   "author": "trajectiq-ai <trajectiq@gmail.com>",
   "mcpName": "io.github.trajectiq-ai/E2E",
@@ -51,6 +51,8 @@
     "e2e": "npm run build && node e2e/run.mjs",
     "mcpb": "npm run build && node scripts/build-mcpb.mjs",
     "mcpb:smoke": "npm run mcpb && node scripts/mcpb-launch-sim.mjs && node scripts/mcpb-client-check.mjs",
+    "mcpb:sign": "npm run mcpb && node scripts/sign-mcpb.mjs",
+    "release:verify": "node scripts/verify-release.mjs",
     "prepublishOnly": "npm test"
   },
   "engines": {