whitemagic-mcp 9.1.8 → 9.2.0

package/README.md

@@ -28,13 +28,13 @@ opencode) at:
 Or try it directly:
 
 ```bash
-npx whitemagic-mcp --version   # wm 9.0.0
+npx whitemagic-mcp --version   # wm 9.2.0
 npx whitemagic-mcp doctor      # environment health check
 ```
 
 The binary is cached under `~/.cache/whitemagic/bin/<release-tag>/`
 (respects `XDG_CACHE_HOME`); the package version's major tracks the
-release tag (9.0.0 → `v9`). Pin a different release with
+release tag (the `v9` tag line). Pin a different release with
 `WHITEMAGIC_RELEASE`.
 
 ## Platforms

package/bin/cli.mjs

@@ -15,7 +15,7 @@
 import { readFileSync } from "node:fs";
 import { platform } from "node:os";
 import { spawnSync } from "node:child_process";
-import { ensureBinary } from "./lib.mjs";
+import { childEnvironment, ensureBinary } from "./lib.mjs";
 
 const pkg = JSON.parse(readFileSync(new URL("../package.json", import.meta.url), "utf8"));
 
@@ -28,5 +28,9 @@ try {
 }
 
 const isWin = platform() === "win32";
-const result = spawnSync(bin, process.argv.slice(2), { stdio: "inherit", shell: isWin });
+const result = spawnSync(bin, process.argv.slice(2), {
+  stdio: "inherit",
+  shell: isWin,
+  env: childEnvironment(),
+});
 process.exit(result.status ?? 1);

package/bin/lib.mjs

@@ -28,6 +28,32 @@ export function releaseTag(pkgVersion, env = process.env) {
   return env.WHITEMAGIC_RELEASE ?? `v${pkgVersion}`;
 }
 
+/**
+ * Sanitize an install ref exactly as `scripts/install.sh` and the site
+ * middleware do: lowercase, `[a-z0-9_-]`, capped at 24 chars. Anything that
+ * sanitizes to empty means "no ref".
+ */
+export function sanitizeRef(raw) {
+  if (typeof raw !== "string") return "";
+  return raw
+    .toLowerCase()
+    .replace(/[^a-z0-9_-]/g, "")
+    .slice(0, 24);
+}
+
+/**
+ * Environment for the spawned `wm` child. Marks the install channel so the
+ * binary's local install funnel can attribute this launch (recorded
+ * on-device only). A `WM_INSTALL_REF` in the caller's environment rides the
+ * channel (`npm:<ref>`) so wrapper scripts and directory listings can tag
+ * npm installs the same way `install.sh?ref=` does.
+ * Returns a copy: the caller's environment is never mutated.
+ */
+export function childEnvironment(env = process.env) {
+  const ref = sanitizeRef(env.WM_INSTALL_REF ?? "");
+  return { ...env, WM_INSTALL_CHANNEL: ref ? `npm:${ref}` : "npm" };
+}
+
 export function assetFor(p = platform(), a = arch()) {
   if (p === "linux" && a === "x64") return "wm-linux-x86_64-musl";
   if (p === "darwin" && a === "arm64") return "wm-macos-aarch64";

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "whitemagic-mcp",
-  "version": "9.1.8",
+  "version": "9.2.0",
   "description": "WhiteMagic MCP server \u2014 local-first memory and session continuity for AI coding agents. Installs and runs the wm binary; no telemetry by default, no cloud.",
   "license": "MIT",
   "bin": {