ssh-mcp-pro 1.4.2 → 1.4.3

package/CHANGELOG.md

@@ -5,6 +5,13 @@ All notable changes to this project will be documented in this file.
 The format is based on [Keep a Changelog](https://keepachangelog.com/en/1.1.0/),
 and this project adheres to [Semantic Versioning](https://semver.org/spec/v2.0.0.html).
 
+## [1.4.3](https://github.com/oaslananka/ssh-mcp-pro/compare/ssh-mcp-pro-v1.4.2...ssh-mcp-pro-v1.4.3) (2026-11-10)
+
+
+### Bug Fixes
+
+* **release:** tolerate npm registry post-publish processing ([#200](https://github.com/oaslananka/ssh-mcp-pro/issues/200)) ([6a8b4eb](https://github.com/oaslananka/ssh-mcp-pro/commit/6a8b4ebc976f902cd96a96dec89156947151f205))
+
 ## [1.4.2](https://github.com/oaslananka/ssh-mcp-pro/compare/ssh-mcp-pro-v1.4.1...ssh-mcp-pro-v1.4.2) (2026-11-10)
 
 

package/dist/mcp.d.ts

@@ -1,7 +1,7 @@
 import { McpServer } from "@modelcontextprotocol/server";
 import type { Transport } from "@modelcontextprotocol/server";
 import type { AppContainer } from "./container.js";
-export declare const SERVER_VERSION = "1.4.2";
+export declare const SERVER_VERSION = "1.4.3";
 export declare const SERVER_NAME = "io.github.oaslananka/ssh-mcp-pro";
 export declare class SSHMCPServer {
     private readonly container;

package/dist/mcp.js

@@ -5,7 +5,7 @@ import { listResources, readResource } from "./resources.js";
 import { getMCPPrompt, listMCPPrompts } from "./prompts.js";
 import { withSpan } from "./telemetry.js";
 import { createToolRegistry } from "./tools/index.js";
-export const SERVER_VERSION = "1.4.2"; // x-release-please-version
+export const SERVER_VERSION = "1.4.3"; // x-release-please-version
 export const SERVER_NAME = "io.github.oaslananka/ssh-mcp-pro";
 function getSessionIdFromArgs(args) {
     if (typeof args !== "object" || args === null || Array.isArray(args)) {

package/docs/development/release-process.md

@@ -6,11 +6,11 @@ Release Please v5 prepares Conventional Commit-driven version updates on `main`.
 
 When an unreleased version reaches `main`, the `Release` workflow preflights the **frozen dependency installation, full quality check, dependency freshness, package build, SBOM, checksums and GitHub artifact attestations** before Release Please creates the tag. It then attaches that exact prebuilt package and SBOM to the GitHub Release and dispatches an immutable-tag GHCR build. Ordinary main pushes without a new version do not repeat the heavy preflight.
 
-## One-click npm publication
+## Automatic npm publication
 
-**Actions → Release → Run workflow → main → Run workflow** is the **manual npm publish button**. No extra version input, stage job or automatic npm publish on release PR merge is involved.
+**Merge the Release Please PR** to publish the new version automatically. After preflight checks, Release Please creates the immutable GitHub Release, attaches the verified assets, and the dependent `publish-npm` job publishes that exact artifact. No separate manual workflow or npm approval step is part of the normal path. `Actions → Release → Run workflow → main` remains available as an idempotent recovery action for a release that has already been created.
 
-The `Publish current GitHub Release to npm` job identifies the `package.json` version on `main`, locates its immutable GitHub Release, downloads the already-built `.tgz` and checksum, verifies the tag's source/version, checks SHA-256, package metadata and the GitHub attestation, then calls **`npm publish` directly with GitHub-hosted Actions OIDC**. A version already public on npm is not published twice. After confirming that exact npm version is public, it dispatches the matching MCP Registry publication job. npm Trusted Publisher must authorize `.github/workflows/release.yml` and permit **direct publication**, not stage-only. This is a provider-side prerequisite, not a second GitHub workflow.
+The `Publish verified GitHub Release to npm` job identifies the `package.json` version on `main`, locates its immutable GitHub Release, downloads the already-built `.tgz` and checksum, verifies the tag's source/version, checks SHA-256, package metadata and the GitHub attestation, then calls **`npm publish` directly with GitHub-hosted Actions OIDC**. A version already public on npm is not published twice. Newly accepted npm packages can remain invisible while registry processing finishes; the publishing job retries public visibility for up to 10 minutes without prompting for manual approval. After confirming that exact npm version is public, it dispatches the matching MCP Registry publication job. npm Trusted Publisher must authorize `.github/workflows/release.yml` and permit **direct publication**, not stage-only. This is a provider-side prerequisite, not a second GitHub workflow.
 
 GitHub does not override npm account/package security settings. If the npm publisher is configured for stage-only access or another mandatory owner restriction, the direct publish job fails clearly instead of silently staging or bypassing security. Avoid publishing historical versions to work around an npm account restriction; repair the publisher configuration through authorized account settings.
 
@@ -18,12 +18,12 @@ GitHub does not override npm account/package security settings. If the npm publi
 
 The release workflow triggers `.github/workflows/docker.yml` with the immutable `ssh-mcp-pro-vX.Y.Z` tag. GHCR must grant this repository's GitHub Actions **Write** access to the existing `ghcr.io/oaslananka/ssh-mcp-pro` package. Package access is managed through **GitHub Packages → Package settings → Manage Actions access**. Docker publishing verifies the release tag and package version before pushing both platform tags.
 
-The MCP Registry job requires an existing GitHub Release and the *same publicly visible npm version*. It skips versions already registered and uses GitHub OIDC. There is no daily staged-publication reconciliation job. The manual npm publish workflow dispatches the MCP Registry publication only after npm confirms the version is public.
+The MCP Registry job requires an existing GitHub Release and the *same publicly visible npm version*. It skips versions already registered and uses GitHub OIDC. There is no daily staged-publication reconciliation job. The automatic npm publish job dispatches MCP Registry publication only after npm confirms the matching version is public; manual recovery uses the same checks.
 
 ## Verify and troubleshoot
 
 - `gh release view ssh-mcp-pro-vX.Y.Z --json assets` — the prepared GitHub Release.
-- `gh run list --workflow release.yml` — release preparation and manual npm publication status.
+- `gh run list --workflow release.yml` — release preparation, automatic npm publication and optional manual recovery status.
 - `npm view ssh-mcp-pro@X.Y.Z version` — independently verify actual npm publication.
 - `gh run list --workflow docker.yml` and `gh api users/oaslananka/packages/container/ssh-mcp-pro` — GHCR status.
 - `gh run list --workflow publish-mcp-registry.yml` — MCP Registry publication.

package/mcp.json

@@ -2,7 +2,7 @@
   "name": "ssh-mcp-pro",
   "display_name": "ssh-mcp-pro",
   "description": "Secure MCP SSH automation server with policy controls, resources, prompts, stdio, and HTTP.",
-  "version": "1.4.2",
+  "version": "1.4.3",
   "author": "Osman Aslan",
   "license": "MIT",
   "runtime": "node",

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "ssh-mcp-pro",
-  "version": "1.4.2",
+  "version": "1.4.3",
   "mcpName": "io.github.oaslananka/ssh-mcp-pro",
   "description": "Model Context Protocol (MCP) SSH client server for remote automation",
   "type": "module",

package/registry/ssh-mcp-pro/mcp.json

@@ -2,7 +2,7 @@
   "name": "ssh-mcp-pro",
   "display_name": "ssh-mcp-pro",
   "description": "Secure MCP SSH automation server with policy controls, resources, prompts, stdio, and HTTP.",
-  "version": "1.4.2",
+  "version": "1.4.3",
   "author": "Osman Aslan",
   "license": "MIT",
   "runtime": "node",

package/server.json

@@ -7,13 +7,13 @@
     "url": "https://github.com/oaslananka/ssh-mcp-pro",
     "source": "github"
   },
-  "version": "1.4.2",
+  "version": "1.4.3",
   "packages": [
     {
       "registryType": "npm",
       "registryBaseUrl": "https://registry.npmjs.org",
       "identifier": "ssh-mcp-pro",
-      "version": "1.4.2",
+      "version": "1.4.3",
       "transport": {
         "type": "stdio"
       }
@@ -22,7 +22,7 @@
       "registryType": "npm",
       "registryBaseUrl": "https://registry.npmjs.org",
       "identifier": "ssh-mcp-pro",
-      "version": "1.4.2",
+      "version": "1.4.3",
       "runtimeHint": "npx",
       "transport": {
         "type": "streamable-http",