threadroot 0.1.3 → 0.1.4

package/CHANGELOG.md

@@ -4,6 +4,12 @@ All notable changes to Threadroot will be documented here.
 
 Threadroot follows semantic versioning after the first public release. While `0.x`, minor versions may include breaking changes as the harness format settles.
 
+## 0.1.4 - Stable npx MCP config
+
+### Fixed
+
+- `bootstrap --mcp` and `setup --global --mcp` now detect npm's `_npx` cache path and write a stable pinned `npx --yes threadroot@<version> mcp` Codex MCP command instead of pointing Codex at a transient npm cache file.
+
 ## 0.1.3 - Verified Codex MCP setup
 
 ### Added

package/README.md

@@ -109,10 +109,12 @@ tr start "current task"
 
 Without `--yes`, `tr bootstrap` prints a dry-run plan. With `--yes`, it installs global
 agent bootstrap skills, initializes `.threadroot/` if needed, runs doctor, and prints
-task context. With `--mcp`, it also writes Codex MCP config using the current CLI entry
-(`node /path/dist/index.js mcp` when Threadroot can resolve the package path, or
-`threadroot mcp` as a fallback) and verifies the stdio server handshake. It does not write
-provider-specific project files unless you pass `--expose`.
+task context. With `--mcp`, it also writes Codex MCP config using a durable command for
+the current launch path. `npx` runs write a pinned `npx --yes threadroot@<version> mcp`
+command instead of a transient npm cache path; local dev runs use
+`node /path/dist/index.js mcp`; unknown launch paths fall back to `threadroot mcp`. The
+setup verifies the stdio server handshake. It does not write provider-specific project
+files unless you pass `--expose`.
 
 Global setup installs a tiny `threadroot` skill into supported agent user-skill
 directories so agents know to call `threadroot bootstrap --yes` when setup is missing

package/dist/index.js

@@ -2399,6 +2399,11 @@ import { access, mkdtemp, readFile as readFile8, rm as rm2, writeFile as writeFi
 import { constants, realpathSync } from "fs";
 import { homedir as homedir2, tmpdir } from "os";
 import path14 from "path";
+
+// src/core/version.ts
+var THREADROOT_VERSION = "0.1.4";
+
+// src/core/mcp-check.ts
 var REQUIRED_MCP_TOOLS = [
   "context",
   "skills_list",
@@ -2419,14 +2424,19 @@ function codexConfigPath2(home = homedir2()) {
   return path14.join(home, ".codex", "config.toml");
 }
 function mcpEntryForCurrentProcess() {
-  const scriptPath = currentScriptPath();
+  return mcpEntryForScriptPath(process.argv[1]);
+}
+function mcpEntryForScriptPath(rawScriptPath) {
+  const scriptPath = currentScriptPath(rawScriptPath);
+  if (scriptPath && isNpxPackagePath(scriptPath)) {
+    return { command: "npx", args: ["--yes", `threadroot@${THREADROOT_VERSION}`, "mcp"] };
+  }
   if (scriptPath && path14.basename(scriptPath) === "index.js" && scriptPath.includes(`${path14.sep}dist${path14.sep}`)) {
     return { command: process.execPath, args: [scriptPath, "mcp"] };
   }
   return { command: "threadroot", args: ["mcp"] };
 }
-function currentScriptPath() {
-  const scriptPath = process.argv[1];
+function currentScriptPath(scriptPath) {
   if (!scriptPath) {
     return void 0;
   }
@@ -2436,6 +2446,10 @@ function currentScriptPath() {
     return scriptPath;
   }
 }
+function isNpxPackagePath(scriptPath) {
+  const normalized = scriptPath.split(path14.sep).join("/");
+  return normalized.includes("/.npm/_npx/") && normalized.includes("/node_modules/threadroot/");
+}
 async function readCodexThreadrootMcpEntry(home = homedir2()) {
   let raw;
   try {
@@ -2635,7 +2649,7 @@ function runMcpHandshake(entry, repoRoot, timeoutMs) {
         params: {
           protocolVersion: "2024-11-05",
           capabilities: {},
-          clientInfo: { name: "threadroot-check", version: "0.1.3" }
+          clientInfo: { name: "threadroot-check", version: THREADROOT_VERSION }
         }
       })}
 `
@@ -2658,7 +2672,7 @@ async function runOneShotMcpHandshake(entry, repoRoot, timeoutMs) {
           params: {
             protocolVersion: "2024-11-05",
             capabilities: {},
-            clientInfo: { name: "threadroot-check", version: "0.1.3" }
+            clientInfo: { name: "threadroot-check", version: THREADROOT_VERSION }
           }
         }),
         JSON.stringify({ jsonrpc: "2.0", method: "notifications/initialized" }),
@@ -4569,7 +4583,7 @@ async function handleMessage(repoRoot, request) {
     if (request.method === "initialize") {
       return resultResponse(request, {
         protocolVersion: "2024-11-05",
-        serverInfo: { name: "threadroot", version: "0.1.3" },
+        serverInfo: { name: "threadroot", version: THREADROOT_VERSION },
         capabilities: { tools: {} },
         instructions: "Threadroot exposes the repository's AI agent harness. Call `context` before broad coding work, `doctor` for health and trust checks, inspect skills/tools before risky actions, and use `memory_append` for durable handoffs."
       });
@@ -5541,7 +5555,7 @@ async function runConnectionsCheck(repoRoot) {
 // src/cli.ts
 function createProgram(repoRoot = process.cwd()) {
   const program = new Command();
-  program.name("threadroot").description("Git for your AI agent harness: one command to bootstrap, one .threadroot source.").version("0.1.3");
+  program.name("threadroot").description("Git for your AI agent harness: one command to bootstrap, one .threadroot source.").version(THREADROOT_VERSION);
   program.command("bootstrap").description("Plan or apply first-run Threadroot setup for this machine and repository.").option("-y, --yes", "Apply the setup plan. Without --yes, bootstrap prints a dry-run plan.").option("--dry-run", "Print the setup plan without writing files.").option("--agent <list>", "Provider(s): codex,claude,cursor,copilot,gemini,windsurf,antigravity,opencode,all.").option("--task <task>", "Task used for the initial context slice.").option("--mcp", "Also add Threadroot MCP to Codex global config when Codex is selected.").option("--expose <list>", "Also write project provider skill shims: codex,claude,cursor,copilot,gemini,windsurf,antigravity,opencode,all.").option("--no-global", "Skip one-time machine-level agent setup.").option("--no-init", "Skip project harness initialization.").option("--no-import", "Skip importing existing vendor files during init.").option("--profile <profile>", "Override the detected project profile during init.").action((options) => runBootstrap(repoRoot, options));
   program.command("start").argument("[task]", "Task to prepare context for.").option("--task <task>", "Task to prepare context for.").description("Start a focused Threadroot agent session: doctor, status, context, and command map.").action((task, options) => runStart(repoRoot, task, options));
   program.command("init").description("Scaffold a local-only Threadroot harness and import existing vendor files once.").option("--force", "Re-initialize over an existing harness.").option("--no-import", "Skip importing existing vendor files (blank-slate init).").option("--profile <profile>", "Override the detected project profile.").option("--adapters <list>", "Comma-separated adapters: agents,claude,copilot,cursor.").option("--expose <list>", "Comma-separated provider skill shims to write: codex,claude,cursor,copilot,gemini,windsurf,antigravity,opencode,all.").action((options) => runInit(repoRoot, options));

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "threadroot",
-  "version": "0.1.3",
+  "version": "0.1.4",
   "description": "Git for your AI agent harness: keep skills, tools, memory, rules, and agent setup in one local-first .threadroot directory.",
   "license": "MIT",
   "type": "module",