signoff-cli 4.0.0 → 4.0.2

package/CHANGELOG.md

@@ -1,3 +1,19 @@
+## 4.0.2
+
+**修 MCP 注册表发布：`server.json` 里 `packages[0].version` 一直停在 3.9.4。**
+
+- 现象：注册表返回 400 `version '3.9.4' was not found`，所以 4.x 一直注册不上，`isLatest` 卡在 3.15.3。
+- 修法：`server.json` 的两个版本字段都由 `package.json` 派生；自测新增三条断言，版本漂移在提交前就会被拦下。
+- 这一版没有改任何功能，只让注册表能被正确发布。
+
+## 4.0.1
+
+**修 4.0.0 的 npx 入口：`npx signoff-cli` 找不到可执行文件。**
+
+- `bin` 增加同名别名 `signoff-cli`，`npx signoff-cli` 直接可用。
+- 生成的 CI workflow 改成 `npx --yes --package=signoff-cli@latest signoff ...`，不依赖 bin 名与包名一致。
+- 4.0.0 的 `npm i -g` 与本地命令本身正常，只有 npx 这条路径坏。
+
 ## 4.0.0
 
 **改名：`dsh-signoff` → `signoff-cli`。命令 `signoff`、仓库地址、功能集都不变。**

package/lib/guard.js

@@ -225,7 +225,7 @@ jobs:
         with: { node-version: "20" }
       - uses: actions/setup-python@v5
         with: { python-version: "3.11" }
-      - run: npx --yes signoff-cli@latest guard --ci
+      - run: npx --yes --package=signoff-cli@latest signoff guard --ci
       - name: audit trailers
         env:
           GITHUB_EVENT_BEFORE: \${{ github.event.before }}
@@ -238,7 +238,7 @@ jobs:
             BASE=$(git rev-parse --verify --quiet "HEAD~1^{commit}" || true)
           fi
           if [ -n "$BASE" ]; then
-            npx --yes signoff-cli@latest audit --range "$BASE..HEAD"
+            npx --yes --package=signoff-cli@latest signoff audit --range "$BASE..HEAD"
           else
             echo "no base commit in this clone; skipping the trailer audit"
           fi

package/package.json

@@ -1,13 +1,14 @@
 {
   "name": "signoff-cli",
-  "version": "4.0.0",
+  "version": "4.0.2",
   "description": "SignOff (落印) — five gates that make an agent's \"done\" provable: verify, coverage, queue, ledger, anti-slop.",
   "publishConfig": {
     "access": "public"
   },
   "license": "MIT",
   "bin": {
-    "signoff": "bin/signoff.js"
+    "signoff": "bin/signoff.js",
+    "signoff-cli": "bin/signoff.js"
   },
   "files": [
     "bin/",

package/test/selftest.js

@@ -1156,6 +1156,12 @@ check("hook mark names the new package", bootlib.HOOK_MARK.includes("signoff-cli
 check("legacy mark still recognised", bootlib.markedByUs("# generated by dsh-signoff 3.9.4"), true);
 check("new mark recognised", bootlib.markedByUs(bootlib.HOOK_MARK + " 4.0.0"), true);
 check("foreign hook is not ours", bootlib.markedByUs("#!/bin/sh\nnpx lint-staged"), false);
+check("ci template pins the package", /--package=signoff-cli/.test(require(path.join(__dirname, "..", "lib", "guard.js")).CI_BODY), true);
+const pkgj = require(path.join(__dirname, "..", "package.json"));
+const srvj = require(path.join(__dirname, "..", "server.json"));
+check("server.json tracks the package version", srvj.version === pkgj.version, true);
+check("server.json package version tracks too", srvj.packages[0].version === pkgj.version, true);
+check("server.json names the package", srvj.packages[0].identifier === pkgj.name, true);
 
       check("action runs signoff", /run: signoff \$\{\{ inputs.args \}\}/.test(action), true);
       check("integrations doc lists actions", /uses: ayuanxx-max\/dsh-signoff/.test(fs.readFileSync(path.join(__dirname, "..", "docs", "integrations.md"), "utf8")), true);