xlsx-for-ai 2.19.0 → 2.19.1

package/lib/register.js

@@ -8,6 +8,12 @@
  *
  * Writes result to config and returns { client_id, api_key }.
  * Idempotent: if config already has api_key, returns it immediately.
+ *
+ * CI gate: when running in a CI environment (CI=true, GITHUB_ACTIONS=true,
+ * or XLSX_FOR_AI_CI=1) we skip registration entirely. This stops automated
+ * smoke tests + clean-install verifications from polluting the production
+ * client_id pool with synthetic per-publish UUIDs that don't represent
+ * real human users.
  */
 
 const os = require('os');
@@ -19,7 +25,33 @@ function platform() {
   return `${process.platform}-${process.arch}`;
 }
 
+// Detect common CI signals. Bias is toward FALSE POSITIVES on the CI side
+// (a real user running with CI=true in their shell will get the same skip).
+// Those cases are vanishingly rare, and the cost of a missed CI gate is much
+// higher: polluted analytics + 1M MAU dilution.
+function isCiEnvironment() {
+  if (process.env.XLSX_FOR_AI_CI === '1') return true;
+  // GitHub Actions auto-sets CI=true AND GITHUB_ACTIONS=true. Other major
+  // providers also set CI=true (CircleCI, GitLab, Travis, Azure Pipelines,
+  // BuildKite, Drone, Jenkins via plugin).
+  if (process.env.CI === 'true' || process.env.CI === '1') return true;
+  if (process.env.GITHUB_ACTIONS === 'true') return true;
+  return false;
+}
+
 async function ensureRegistered() {
+  if (isCiEnvironment()) {
+    // Return a sentinel handle. api_key prefix 'xfa_ci_' is invalid format,
+    // so any tool call would 401 with a clear "Invalid API key" rather than
+    // silently using a leaked real key. CI smoke tests that only call
+    // --version short-circuit before reaching this anyway.
+    return {
+      client_id: '00000000-0000-0000-0000-000000000000',
+      api_key: 'xfa_ci_skip_registration',
+      ci_skipped: true,
+    };
+  }
+
   const cfg = readConfig();
   if (cfg && cfg.api_key && cfg.client_id) {
     return { client_id: cfg.client_id, api_key: cfg.api_key };
@@ -34,4 +66,4 @@ async function ensureRegistered() {
   return { client_id: data.client_id, api_key: data.api_key };
 }
 
-module.exports = { ensureRegistered };
+module.exports = { ensureRegistered, isCiEnvironment };

package/package.json

@@ -1,7 +1,7 @@
 {
   "name": "xlsx-for-ai",
   "mcpName": "io.github.senoff/xlsx-for-ai",
-  "version": "2.19.0",
+  "version": "2.19.1",
   "description": "The MCP server that makes LLMs reliable on real-world Excel spreadsheets. Thin npm client over a hosted API — read, write, diff, redact, and supervise .xlsx files from any MCP-aware agent.",
   "main": "index.js",
   "bin": {