onde-cli 0.4.0__tar.gz → 0.4.2__tar.gz

{onde_cli-0.4.0 → onde_cli-0.4.2}/.agents/AGENTS.md

@@ -64,6 +64,7 @@ The `onde` crate provides the inference engine (`onde::mistralrs`, a vendored mi
 - **Commits:** include `Co-Authored-By: siGit Code <297239231+sigitc@users.noreply.github.com>` trailer when committing with the agent.
 - **`[patch.crates-io]` and `path =` deps:** commented out in `Cargo.toml` for local dev against `onde`/`smbcloud-*`/`candle`. Never commit with these uncommented.
 - **Distribution:** before touching any wrapper package (npm, PyPI, NuGet, pub.dev, Homebrew), read `.agents/skills/distribution/SKILL.md`. Keep all channel versions aligned with the Rust crate version in `Cargo.toml`.
+- **MCP Registry:** the listing's ownership markers ship inside the published npm and NuGet artifacts, so a version published without them can never be listed. See `docs/mcp-registry.md` before touching `server.json` or either marker.
 - **Wrapper packages** are in `npm/`, `pypi/`, `nuget/`, `pub/`. The npm base manifest is rewritten at release time by `npm/scripts/render-main-package.cjs`; do not hand-edit committed package.json versions as the source of truth for releases.
 - **Clippy** runs with `-D warnings` in CI; all lints must pass.
 - **Rust edition:** 2024; toolchain: stable.

{onde_cli-0.4.0 → onde_cli-0.4.2}/.agents/skills/distribution/SKILL.md

@@ -110,6 +110,34 @@ If a wrapper uses one naming scheme and a workflow uploads another, the installe
 
 ## Release workflow principles
 
+### One tag trigger, then fan out
+
+`release-crates.yml` is the only workflow that reacts to a tag push. It verifies the
+tag against `Cargo.toml` and `pubspec.yaml`, publishes the crate, then dispatches
+`release-github`, `release-npm`, `release-nuget`, and `release-pypi` with the same tag.
+`release-github` in turn dispatches `release-homebrew` and `release-pub` after the
+release assets exist.
+
+```
+tag push
+  └─ release-crates (verify -> publish -> dispatch)
+       ├─ release-github ─┬─ release-homebrew
+       │                  └─ release-pub
+       ├─ release-npm
+       ├─ release-nuget
+       └─ release-pypi
+```
+
+This mirrors `smbcloud-cli`. Two properties matter:
+
+- crates.io is the gate. If verify or publish fails, no wrapper publishes a version
+  that has no crate behind it.
+- every dispatch passes `ref: <tag>`, not `ref: main`, so downstream workflows run the
+  workflow definition from the release state instead of whatever `main` happens to be.
+
+Do not add `push: tags:` to a wrapper workflow. Several workflows racing on the same tag
+is what lets the pub.dev launcher publish before its GitHub Release assets exist.
+
 ### Build first, package second
 
 Always build native binaries in a target matrix first.

onde_cli-0.4.2/.github/workflows/release-crates.yml

@@ -0,0 +1,217 @@
+name: Release crates.io
+
+# This is the only workflow that reacts to a tag push. It verifies the tag,
+# publishes the crate, and then dispatches every distribution workflow with the
+# same tag. Wrappers never publish for a crate release that failed.
+
+on:
+  push:
+    tags:
+      - "v*.*.*"
+  workflow_dispatch:
+    inputs:
+      tag:
+        description: "Release tag (e.g. v0.4.0)"
+        required: true
+
+permissions:
+  contents: read
+  actions: write
+
+concurrency:
+  group: release-crates-${{ github.ref }}
+  cancel-in-progress: false
+
+env:
+  CARGO_TERM_COLOR: always
+  ONDE_APP_ID: ${{ secrets.ONDE_APP_ID }}
+  ONDE_APP_SECRET: ${{ secrets.ONDE_APP_SECRET }}
+  GRESIQ_API_KEY: ${{ secrets.GRESIQ_API_KEY }}
+  GRESIQ_API_SECRET: ${{ secrets.GRESIQ_API_SECRET }}
+  HF_TOKEN: ${{ secrets.HF_TOKEN }}
+
+jobs:
+  verify:
+    name: Verify release
+    runs-on: ubuntu-latest
+    outputs:
+      version: ${{ steps.release.outputs.version }}
+      tag: ${{ steps.release.outputs.tag }}
+    steps:
+      - name: Checkout
+        uses: actions/checkout@v6
+        with:
+          ref: ${{ github.event.inputs.tag || github.ref }}
+
+      - name: Read Rust toolchain
+        shell: bash
+        run: |
+          rust_toolchain="$(sed -n 's/^channel = "\(.*\)"/\1/p' rust-toolchain.toml | head -n 1)"
+          if [ -z "$rust_toolchain" ]; then
+            echo "Failed to read Rust toolchain from rust-toolchain.toml" >&2
+            exit 1
+          fi
+          echo "RUST_TOOLCHAIN=${rust_toolchain}" >> "$GITHUB_ENV"
+
+      - name: Install Rust toolchain
+        uses: dtolnay/rust-toolchain@3c5f7ea28cd621ae0bf5283f0e981fb97b8a7af9
+        with:
+          toolchain: ${{ env.RUST_TOOLCHAIN }}
+          components: clippy, rustfmt
+
+      - name: Cache cargo registry and build artifacts
+        uses: Swatinem/rust-cache@v2
+
+      - name: Set the release version
+        id: release
+        shell: bash
+        run: |
+          if [[ "${GITHUB_REF_TYPE}" == "tag" ]]; then
+            release_tag="${GITHUB_REF_NAME}"
+          else
+            release_tag="${{ github.event.inputs.tag }}"
+            release_tag="${release_tag#refs/tags/}"
+          fi
+          release_version="${release_tag#v}"
+
+          echo "tag=${release_tag}" >> "$GITHUB_OUTPUT"
+          echo "version=${release_version}" >> "$GITHUB_OUTPUT"
+
+      - name: Ensure tag matches Cargo.toml version
+        shell: bash
+        run: |
+          version="$(sed -n 's/^version = "\(.*\)"/\1/p' Cargo.toml | head -n 1)"
+          if [ -z "$version" ]; then
+            echo "::error::Failed to read package version from Cargo.toml"
+            exit 1
+          fi
+          if [ "$version" != "${{ steps.release.outputs.version }}" ]; then
+            echo "::error::Cargo.toml is ${version} but the tag is ${{ steps.release.outputs.version }}"
+            exit 1
+          fi
+
+      - name: Ensure the pub.dev wrapper matches the tag
+        shell: bash
+        run: |
+          pub_version="$(sed -n 's/^version: \(.*\)/\1/p' pub/onde_cli/pubspec.yaml | head -n 1)"
+          if [ "$pub_version" != "${{ steps.release.outputs.version }}" ]; then
+            echo "::error::pubspec.yaml is ${pub_version} but the tag is ${{ steps.release.outputs.version }}"
+            exit 1
+          fi
+
+      - name: Check formatting
+        run: cargo fmt --all -- --check
+
+      - name: Run clippy
+        run: cargo clippy --all-targets --all-features -- -D warnings
+
+      - name: Run tests
+        run: cargo test --all-features --locked --verbose
+
+      - name: Run cargo check
+        run: cargo check --locked
+
+      - name: Verify package contents
+        run: cargo package --locked --allow-dirty
+
+  publish:
+    name: Publish to crates.io
+    runs-on: ubuntu-latest
+    needs: verify
+    environment:
+      name: crates-io
+    permissions:
+      contents: read
+    steps:
+      - name: Checkout
+        uses: actions/checkout@v6
+        with:
+          ref: ${{ github.event.inputs.tag || github.ref }}
+
+      - name: Read Rust toolchain
+        shell: bash
+        run: |
+          rust_toolchain="$(sed -n 's/^channel = "\(.*\)"/\1/p' rust-toolchain.toml | head -n 1)"
+          echo "RUST_TOOLCHAIN=${rust_toolchain}" >> "$GITHUB_ENV"
+
+      - name: Install Rust toolchain
+        uses: dtolnay/rust-toolchain@3c5f7ea28cd621ae0bf5283f0e981fb97b8a7af9
+        with:
+          toolchain: ${{ env.RUST_TOOLCHAIN }}
+
+      - name: Cache cargo registry and build artifacts
+        uses: Swatinem/rust-cache@v2
+
+      - name: Publish crate
+        env:
+          CARGO_REGISTRY_TOKEN: ${{ secrets.CARGO_REGISTRY_TOKEN }}
+        shell: bash
+        run: |
+          version="${{ needs.verify.outputs.version }}"
+          if curl -sSf "https://crates.io/api/v1/crates/onde-cli/${version}" >/dev/null 2>&1; then
+            echo "onde-cli ${version} is already on crates.io, skipping publish"
+            exit 0
+          fi
+          cargo publish --locked
+
+  dispatch-distributions:
+    name: Trigger distribution workflows
+    needs: [verify, publish]
+    runs-on: ubuntu-latest
+
+    steps:
+      - name: Trigger GitHub release
+        uses: actions/github-script@v7
+        with:
+          script: |
+            await github.rest.actions.createWorkflowDispatch({
+              owner: context.repo.owner,
+              repo: context.repo.repo,
+              workflow_id: 'release-github.yml',
+              ref: '${{ needs.verify.outputs.tag }}',
+              inputs: {
+                tag: '${{ needs.verify.outputs.tag }}'
+              }
+            })
+
+      - name: Trigger npm release
+        uses: actions/github-script@v7
+        with:
+          script: |
+            await github.rest.actions.createWorkflowDispatch({
+              owner: context.repo.owner,
+              repo: context.repo.repo,
+              workflow_id: 'release-npm.yml',
+              ref: '${{ needs.verify.outputs.tag }}',
+              inputs: {
+                tag: '${{ needs.verify.outputs.tag }}'
+              }
+            })
+
+      - name: Trigger NuGet release
+        uses: actions/github-script@v7
+        with:
+          script: |
+            await github.rest.actions.createWorkflowDispatch({
+              owner: context.repo.owner,
+              repo: context.repo.repo,
+              workflow_id: 'release-nuget.yml',
+              ref: '${{ needs.verify.outputs.tag }}',
+              inputs: {
+                tag: '${{ needs.verify.outputs.tag }}'
+              }
+            })
+
+      - name: Trigger PyPI release
+        uses: actions/github-script@v7
+        with:
+          script: |
+            await github.rest.actions.createWorkflowDispatch({
+              owner: context.repo.owner,
+              repo: context.repo.repo,
+              workflow_id: 'release-pypi.yml',
+              ref: '${{ needs.verify.outputs.tag }}',
+              inputs: {
+                tag: '${{ needs.verify.outputs.tag }}'
+              }
+            })

{onde_cli-0.4.0 → onde_cli-0.4.2}/.github/workflows/release-github.yml

@@ -1,13 +1,11 @@
 name: GitHub Release
 
+# Dispatched by release-crates.yml once the crate publish succeeds.
 on:
-  push:
-    tags:
-      - "v*.*.*"
   workflow_dispatch:
     inputs:
       tag:
-        description: "Release tag (e.g. v0.3.1)"
+        description: "Release tag (e.g. v0.4.0)"
         required: true
 
 permissions:
@@ -124,6 +122,25 @@ jobs:
           echo "Archive: ${ARCHIVE_NAME}"
           echo "SHA256:  $(cat "${ARCHIVE_NAME}.sha256")"
 
+      # Scoop and winget consume the raw Windows binaries rather than a
+      # tarball, and both need a SHA256 sidecar. Windows runners use bash from
+      # Git for Windows, which has sha256sum; macOS only has shasum.
+      - name: Checksum release assets
+        shell: bash
+        run: |
+          cd release
+          for asset in *; do
+            case "${asset}" in *.sha256) continue ;; esac
+
+            if command -v sha256sum >/dev/null 2>&1; then
+              sha256sum "${asset}" | awk '{print $1}' > "${asset}.sha256"
+            else
+              shasum -a 256 "${asset}" | awk '{print $1}' > "${asset}.sha256"
+            fi
+
+            echo "${asset}: $(cat "${asset}.sha256")"
+          done
+
       - name: Upload binary artifact
         uses: actions/upload-artifact@v4
         with:
@@ -184,7 +201,7 @@ jobs:
               owner: context.repo.owner,
               repo: context.repo.repo,
               workflow_id: 'release-homebrew.yml',
-              ref: 'main',
+              ref: '${{ steps.tag.outputs.tag }}',
               inputs: {
                 tag: '${{ steps.tag.outputs.tag }}'
               }
@@ -199,9 +216,41 @@ jobs:
               owner: context.repo.owner,
               repo: context.repo.repo,
               workflow_id: 'release-pub.yml',
-              ref: 'main',
+              ref: '${{ steps.tag.outputs.tag }}',
               inputs: {
                 tag: '${{ steps.tag.outputs.tag }}'
               }
             })
             console.log('Dispatched release-pub.yml for tag ${{ steps.tag.outputs.tag }}')
+
+      # These channels publish outside this repo (a Scoop bucket,
+      # microsoft/winget-pkgs) and read checksums off the release created
+      # above, so they hang off this job rather than firing on the tag
+      # directly.
+      - name: Trigger OS package manager releases
+        uses: actions/github-script@v7
+        with:
+          script: |
+            const tag = '${{ steps.tag.outputs.tag }}'
+            const workflows = [
+              'release-scoop.yml',
+              'release-winget.yml',
+            ]
+
+            for (const workflow_id of workflows) {
+              try {
+                await github.rest.actions.createWorkflowDispatch({
+                  owner: context.repo.owner,
+                  repo: context.repo.repo,
+                  workflow_id,
+                  ref: tag,
+                  inputs: { tag },
+                })
+                console.log(`Dispatched ${workflow_id} for tag ${tag}`)
+              } catch (error) {
+                // One packaging channel being unconfigured (a missing secret,
+                // a bucket repo that does not exist yet) should not take the
+                // rest of the fan-out down with it.
+                core.warning(`Failed to dispatch ${workflow_id}: ${error.message}`)
+              }
+            }

{onde_cli-0.4.0 → onde_cli-0.4.2}/.github/workflows/release-homebrew.yml

@@ -4,7 +4,7 @@ on:
   workflow_dispatch:
     inputs:
       tag:
-        description: "Release tag (e.g. v0.3.1)"
+        description: "Release tag (e.g. v0.4.0)"
         required: true
 
 permissions:

onde_cli-0.4.2/.github/workflows/release-mcp-registry.yml

@@ -0,0 +1,130 @@
+name: MCP Registry Release
+
+on:
+  workflow_dispatch:
+    inputs:
+      tag:
+        description: "Release tag (e.g. v0.4.1)"
+        required: true
+
+# OIDC is how we authenticate to the MCP Registry: the registry trusts a GitHub
+# Actions token issued for this repository, so no long-lived secret is needed.
+permissions:
+  id-token: write
+  contents: read
+
+jobs:
+  publish:
+    name: Publish server.json to the MCP Registry
+    runs-on: ubuntu-latest
+    steps:
+      # Unlike the other release workflows, this one builds nothing from source:
+      # it uploads metadata. So it checks out the branch it was dispatched on
+      # rather than the tag — `server.json` may have landed after the tag was
+      # cut — and uses the tag input only to pick the version to publish.
+      - name: Checkout
+        uses: actions/checkout@v6
+
+      - name: Set the release version
+        shell: bash
+        run: |
+          release_version="${{ github.event.inputs.tag }}"
+          release_version="${release_version#v}"
+
+          echo "RELEASE_VERSION=${release_version}" >> "$GITHUB_ENV"
+
+      - name: Check the server name is consistent across packages
+        shell: bash
+        run: |
+          server_name="$(jq -r '.name' server.json)"
+          echo "Server name: ${server_name}"
+
+          # npm proves ownership through `mcpName` in the published package.json,
+          # rendered at release time from this template.
+          grep -q "\"mcpName\": \"${server_name}\"" npm/package-main.json.tmpl
+
+          # NuGet proves ownership through an `mcp-name:` marker in the package README.
+          grep -q "mcp-name: ${server_name}" nuget/onde-cli/README.md
+
+      - name: Set the version in server.json
+        shell: bash
+        run: |
+          jq --arg v "${RELEASE_VERSION}" \
+            '.version = $v | .packages |= map(.version = $v)' \
+            server.json > server.tmp
+          mv server.tmp server.json
+          cat server.json
+
+      - name: Verify the published packages carry the ownership marker
+        shell: bash
+        run: |
+          # The registry stores metadata only, and validates it by fetching each
+          # listed package and looking for a marker naming this server. Checking
+          # the sources isn't enough: a package published before the marker
+          # landed will still be missing it. Both comparisons are case-sensitive.
+          server_name="$(jq -r '.name' server.json)"
+
+          # npm is queryable within seconds of publishing, but the npm release
+          # workflow may still be building its platform packages when this runs.
+          for attempt in $(seq 1 20); do
+            if npm view "@ondeinference/cli@${RELEASE_VERSION}" version; then
+              break
+            fi
+            if [ "${attempt}" -eq 20 ]; then
+              echo "@ondeinference/cli@${RELEASE_VERSION} is still not on npm after 10 minutes." >&2
+              exit 1
+            fi
+            echo "Waiting for @ondeinference/cli@${RELEASE_VERSION} on npm (attempt ${attempt}/20)..."
+            sleep 30
+          done
+
+          npm_mcp_name="$(npm view "@ondeinference/cli@${RELEASE_VERSION}" mcpName)"
+          if [ "${npm_mcp_name}" != "${server_name}" ]; then
+            echo "@ondeinference/cli@${RELEASE_VERSION} declares mcpName '${npm_mcp_name}', expected '${server_name}'." >&2
+            echo "npm versions are immutable — cut a new release with the marker in place." >&2
+            exit 1
+          fi
+
+          # nuget.org validates a package before it reaches the flat container,
+          # so a version pushed minutes ago is not queryable yet. Poll instead
+          # of failing the release on that race.
+          for attempt in $(seq 1 20); do
+            nuget_versions="$(curl -fsSL "https://api.nuget.org/v3-flatcontainer/onde.cli/index.json")"
+            if echo "${nuget_versions}" | jq -e --arg v "${RELEASE_VERSION}" '.versions | index($v)' >/dev/null; then
+              echo "Onde.Cli ${RELEASE_VERSION} is indexed."
+              break
+            fi
+            if [ "${attempt}" -eq 20 ]; then
+              echo "Onde.Cli ${RELEASE_VERSION} is still not indexed on nuget.org after 10 minutes." >&2
+              exit 1
+            fi
+            echo "Waiting for nuget.org to index ${RELEASE_VERSION} (attempt ${attempt}/20)..."
+            sleep 30
+          done
+
+          curl -fsSL -o package.nupkg \
+            "https://api.nuget.org/v3-flatcontainer/onde.cli/${RELEASE_VERSION}/onde.cli.${RELEASE_VERSION}.nupkg"
+          if ! unzip -p package.nupkg README.md | grep -q "mcp-name: ${server_name}"; then
+            echo "Onde.Cli ${RELEASE_VERSION} README is missing the 'mcp-name: ${server_name}' marker." >&2
+            exit 1
+          fi
+          rm package.nupkg
+
+      - name: Install mcp-publisher
+        shell: bash
+        run: |
+          curl -L "https://github.com/modelcontextprotocol/registry/releases/latest/download/mcp-publisher_$(uname -s | tr '[:upper:]' '[:lower:]')_$(uname -m | sed 's/x86_64/amd64/;s/aarch64/arm64/').tar.gz" | tar xz mcp-publisher
+
+      - name: Authenticate to the MCP Registry
+        shell: bash
+        run: ./mcp-publisher login github-oidc
+
+      - name: Publish
+        shell: bash
+        run: ./mcp-publisher publish
+
+      - name: Verify the server is listed
+        shell: bash
+        run: |
+          server_name="$(jq -r '.name' server.json)"
+          curl -fsSL "https://registry.modelcontextprotocol.io/v0.1/servers?search=${server_name}" | jq .

{onde_cli-0.4.0 → onde_cli-0.4.2}/.github/workflows/release-npm.yml

@@ -1,13 +1,11 @@
 name: NPM Release
 
+# Dispatched by release-crates.yml once the crate publish succeeds.
 on:
-  push:
-    tags:
-      - "v*.*.*"
   workflow_dispatch:
     inputs:
       tag:
-        description: "Release tag (e.g. v0.3.1)"
+        description: "Release tag (e.g. v0.4.0)"
         required: true
 
 permissions:

{onde_cli-0.4.0 → onde_cli-0.4.2}/.github/workflows/release-nuget.yml

@@ -1,13 +1,11 @@
 name: NuGet Release
 
+# Dispatched by release-crates.yml once the crate publish succeeds.
 on:
-  push:
-    tags:
-      - "v*.*.*"
   workflow_dispatch:
     inputs:
       tag:
-        description: "Release tag (e.g. v0.3.1)"
+        description: "Release tag (e.g. v0.4.0)"
         required: true
 
 permissions:
@@ -303,3 +301,26 @@ jobs:
             --api-key "${NUGET_API_KEY}" \
             --source https://api.nuget.org/v3/index.json \
             --skip-duplicate
+
+  dispatch-mcp-registry:
+    name: Trigger MCP Registry release
+    needs: publish-nuget
+    runs-on: ubuntu-latest
+    permissions:
+      actions: write
+    steps:
+      # The MCP Registry listing needs both npm and NuGet live at this version,
+      # and NuGet is the slower of the two, so it hangs off this workflow rather
+      # than the fan-out in release-crates.yml.
+      - name: Trigger MCP Registry release workflow
+        uses: actions/github-script@v7
+        with:
+          script: |
+            const tag = '${{ github.event.inputs.tag }}' || context.ref.replace('refs/tags/', '')
+            await github.rest.actions.createWorkflowDispatch({
+              owner: context.repo.owner,
+              repo: context.repo.repo,
+              workflow_id: 'release-mcp-registry.yml',
+              ref: tag,
+              inputs: { tag }
+            })

{onde_cli-0.4.0 → onde_cli-0.4.2}/.github/workflows/release-pub.yml

@@ -4,7 +4,7 @@ on:
   workflow_dispatch:
     inputs:
       tag:
-        description: "Release tag (e.g. v0.3.1)"
+        description: "Release tag (e.g. v0.4.0)"
         required: true
 
 permissions:

{onde_cli-0.4.0 → onde_cli-0.4.2}/.github/workflows/release-pypi.yml

@@ -1,13 +1,11 @@
 name: PyPI Release
 
+# Dispatched by release-crates.yml once the crate publish succeeds.
 on:
-  push:
-    tags:
-      - "v*.*.*"
   workflow_dispatch:
     inputs:
       tag:
-        description: "Release tag (e.g. v0.3.1)"
+        description: "Release tag (e.g. v0.4.0)"
         required: true
 
 permissions: