tool-compass 2.5.3__tar.gz → 2.5.4__tar.gz

{tool_compass-2.5.3 → tool_compass-2.5.4}/.github/workflows/publish.yml

@@ -34,6 +34,9 @@ env:
   REGISTRY: ghcr.io
   IMAGE_NAME: ${{ github.repository }}
 
+permissions:
+  contents: read
+
 jobs:
   build:
     name: Build package

{tool_compass-2.5.3 → tool_compass-2.5.4}/CHANGELOG.md

@@ -7,6 +7,12 @@ and this project adheres to [Semantic Versioning](https://semver.org/spec/v2.0.0
 
 ## [Unreleased]
 
+## [2.5.4] - 2026-10-14
+
+### Security
+
+- **Workflow jobs run with a read-only token by default.** `publish.yml` had jobs with no `permissions` block, so they inherited the repository default token. A top-level `permissions: contents: read` now applies to every job that does not set its own (the jobs that publish or write keep theirs). Closes the `actions/missing-workflow-permissions` code-scanning alerts.
+
 ## [2.5.3] - 2026-10-14
 
 - Build fake credentials at runtime in config and HTTP backend tests so secret scanners do not flag test fixtures.

{tool_compass-2.5.3 → tool_compass-2.5.4}/PKG-INFO

@@ -1,6 +1,6 @@
 Metadata-Version: 2.5
 Name: tool-compass
-Version: 2.5.3
+Version: 2.5.4
 Summary: Semantic MCP tool discovery gateway - find tools by intent, not memory
 Project-URL: Homepage, https://github.com/mcp-tool-shop-org/tool-compass
 Project-URL: Documentation, https://github.com/mcp-tool-shop-org/tool-compass#readme

{tool_compass-2.5.3 → tool_compass-2.5.4}/atlas/README.md

@@ -1,14 +1,14 @@
 # tool-compass: how it works
 
-Mapped at 2026-10-01 from commit e6e5806 by Atlas 1.24.0.
+Mapped at 2026-10-14 from commit a7e6492 by Atlas 1.24.0.
 
 ## What this is
 
 8 parts, mostly Python (46 files), JavaScript (4), shell (4), CSS (2), TypeScript (2) and Astro (1). Work enters through 7 doors; the busiest is CI, which reaches 5 parts. It publishes to PyPI, @mcptoolshop/tool-compass to npm, and a container image. It deploys a site to GitHub Pages. People run tool-compass and tool-compass-ui.
 
-## What changed since 2026-10-01 (98f8498)
+## What changed since 2026-10-01 (e6e5806)
 
-Nothing structural changed since 2026-10-01; 1 file changed content.
+Nothing structural changed since 2026-10-01; 9 files changed content.
 
 ## What comes in
 

{tool_compass-2.5.3 → tool_compass-2.5.4}/atlas/page.json

@@ -28,21 +28,21 @@
   "changes": {
     "fileCounts": {
       "added": 0,
-      "changed": 1,
+      "changed": 9,
       "moved": 0,
-      "parts": 1,
+      "parts": 5,
       "removed": 0
     },
     "items": [
       {
         "kind": "counts",
-        "sentence": "Nothing structural changed since 2026-10-01; 1 file changed content.",
+        "sentence": "Nothing structural changed since 2026-10-01; 9 files changed content.",
         "subjects": []
       }
     ],
     "since": {
-      "commit": "98f849821fa76c12ed6b9d623bbd1573d13d0a0f",
-      "generatedAt": "2026-10-01T02:14:30.646Z"
+      "commit": "e6e5806a6d5d25c3deafe96867a4eda219ac07e5",
+      "generatedAt": "2026-10-01T02:36:16.838Z"
     },
     "unchanged": true
   },
@@ -51,7 +51,7 @@
     "Window: 180 days; a pair counts from 3 shared commits, since 0 source files reach 10 revisions; the floor rises to 10 when 25 do."
   ],
   "changesTogetherWithTests": 0,
-  "commit": "e6e5806a6d5d25c3deafe96867a4eda219ac07e5",
+  "commit": "a7e6492dab062818abb0ed14852c52d79be8b112",
   "defaultBranch": "main",
   "derived": "8 parts, mostly Python (46 files), JavaScript (4), shell (4), CSS (2), TypeScript (2) and Astro (1). Work enters through 7 doors; the busiest is CI, which reaches 5 parts. It publishes to PyPI, @mcptoolshop/tool-compass to npm, and a container image. It deploys a site to GitHub Pages. People run tool-compass and tool-compass-ui.",
   "doors": [
@@ -370,7 +370,7 @@
       ]
     }
   ],
-  "generatedAt": "2026-10-01T02:36:16.838Z",
+  "generatedAt": "2026-10-14T23:56:42.397Z",
   "limits": [
     "11 writes and 4 reads use paths built at run time and are not named here.",
     "5 writes and 35 reads go to a path their caller passes, not to this repository.",

{tool_compass-2.5.3 → tool_compass-2.5.4}/atlas/statistics.json

@@ -65,7 +65,7 @@
       "confidence": "low",
       "highWater": null,
       "name": "npm",
-      "qualifyingSourceCommits": 4,
+      "qualifyingSourceCommits": 5,
       "rebaseline": null
     },
     {
@@ -83,7 +83,7 @@
       "confidence": "low",
       "highWater": null,
       "name": "root",
-      "qualifyingSourceCommits": 19,
+      "qualifyingSourceCommits": 17,
       "rebaseline": null
     },
     {
@@ -131,7 +131,7 @@
       "confidence": "low",
       "highWater": null,
       "name": "tests",
-      "qualifyingSourceCommits": 14,
+      "qualifyingSourceCommits": 13,
       "rebaseline": null
     }
   ],
@@ -154,23 +154,23 @@
         "path": ".gitattributes"
       },
       {
-        "commits": 6,
-        "lines": 151,
+        "commits": 4,
+        "lines": 115,
         "path": ".github/dependabot.yml"
       },
       {
-        "commits": 20,
-        "lines": 982,
+        "commits": 19,
+        "lines": 1000,
         "path": ".github/workflows/ci.yml"
       },
       {
-        "commits": 4,
-        "lines": 56,
+        "commits": 1,
+        "lines": 50,
         "path": ".github/workflows/pages.yml"
       },
       {
-        "commits": 12,
-        "lines": 406,
+        "commits": 9,
+        "lines": 380,
         "path": ".github/workflows/publish.yml"
       },
       {
@@ -199,8 +199,8 @@
         "path": "AUDIT_REPORT.md"
       },
       {
-        "commits": 11,
-        "lines": 503,
+        "commits": 13,
+        "lines": 507,
         "path": "CHANGELOG.md"
       },
       {
@@ -244,8 +244,8 @@
         "path": "README.ja.md"
       },
       {
-        "commits": 13,
-        "lines": 270,
+        "commits": 11,
+        "lines": 182,
         "path": "README.md"
       },
       {
@@ -294,8 +294,8 @@
         "path": "assets/logo.png"
       },
       {
-        "commits": 5,
-        "lines": 280,
+        "commits": 7,
+        "lines": 302,
         "path": "atlas/README.md"
       },
       {
@@ -304,18 +304,18 @@
         "path": "atlas/boundaries.yaml"
       },
       {
-        "commits": 5,
-        "lines": 1078,
+        "commits": 7,
+        "lines": 1124,
         "path": "atlas/page.json"
       },
       {
-        "commits": 5,
-        "lines": 1140,
+        "commits": 7,
+        "lines": 1200,
         "path": "atlas/statistics.json"
       },
       {
-        "commits": 5,
-        "lines": 15050,
+        "commits": 7,
+        "lines": 15102,
         "path": "atlas/structure.json"
       },
       {
@@ -329,8 +329,8 @@
         "path": "backend_client_simple.py"
       },
       {
-        "commits": 6,
-        "lines": 627,
+        "commits": 4,
+        "lines": 617,
         "path": "bootstrap.py"
       },
       {
@@ -354,8 +354,8 @@
         "path": "compass_config.example.json"
       },
       {
-        "commits": 12,
-        "lines": 1429,
+        "commits": 9,
+        "lines": 1273,
         "path": "config.py"
       },
       {
@@ -434,8 +434,8 @@
         "path": "npm/README.md"
       },
       {
-        "commits": 10,
-        "lines": 327,
+        "commits": 11,
+        "lines": 331,
         "path": "npm/bin/tool-compass.js"
       },
       {
@@ -444,8 +444,8 @@
         "path": "npm/logo-lockup.png"
       },
       {
-        "commits": 6,
-        "lines": 55,
+        "commits": 7,
+        "lines": 57,
         "path": "npm/package.json"
       },
       {
@@ -454,8 +454,8 @@
         "path": "npm/test/smoke.test.js"
       },
       {
-        "commits": 13,
-        "lines": 158,
+        "commits": 12,
+        "lines": 154,
         "path": "pyproject.toml"
       },
       {
@@ -463,11 +463,6 @@
         "lines": 31,
         "path": "pytest.ini"
       },
-      {
-        "commits": 2,
-        "lines": 8,
-        "path": "requirements-dev.txt"
-      },
       {
         "commits": 2,
         "lines": 8,
@@ -499,13 +494,13 @@
         "path": "site/astro.config.mjs"
       },
       {
-        "commits": 13,
-        "lines": 7011,
+        "commits": 5,
+        "lines": 6722,
         "path": "site/package-lock.json"
       },
       {
-        "commits": 4,
-        "lines": 28,
+        "commits": 3,
+        "lines": 26,
         "path": "site/package.json"
       },
       {
@@ -559,8 +554,8 @@
         "path": "sync_manager.py"
       },
       {
-        "commits": 11,
-        "lines": 473,
+        "commits": 9,
+        "lines": 461,
         "path": "tests/conftest.py"
       },
       {
@@ -584,13 +579,13 @@
         "path": "tests/golden_set/queries.yaml"
       },
       {
-        "commits": 6,
-        "lines": 506,
+        "commits": 4,
+        "lines": 500,
         "path": "tests/test_analytics.py"
       },
       {
-        "commits": 4,
-        "lines": 180,
+        "commits": 2,
+        "lines": 174,
         "path": "tests/test_backend_client.py"
       },
       {
@@ -599,8 +594,8 @@
         "path": "tests/test_backend_client_simple.py"
       },
       {
-        "commits": 3,
-        "lines": 2662,
+        "commits": 4,
+        "lines": 2665,
         "path": "tests/test_backend_client_simple_coverage.py"
       },
       {
@@ -609,13 +604,13 @@
         "path": "tests/test_backend_client_simple_outcomes.py"
       },
       {
-        "commits": 4,
-        "lines": 1514,
+        "commits": 5,
+        "lines": 1517,
         "path": "tests/test_backend_http_wire.py"
       },
       {
-        "commits": 9,
-        "lines": 290,
+        "commits": 7,
+        "lines": 284,
         "path": "tests/test_chain_indexer.py"
       },
       {
@@ -624,8 +619,8 @@
         "path": "tests/test_cli_coverage.py"
       },
       {
-        "commits": 6,
-        "lines": 1160,
+        "commits": 4,
+        "lines": 1087,
         "path": "tests/test_config.py"
       },
       {
@@ -634,8 +629,8 @@
         "path": "tests/test_corruption_recovery.py"
       },
       {
-        "commits": 10,
-        "lines": 982,
+        "commits": 8,
+        "lines": 976,
         "path": "tests/test_embedder.py"
       },
       {
@@ -649,13 +644,13 @@
         "path": "tests/test_features_v2_2_0.py"
       },
       {
-        "commits": 7,
-        "lines": 872,
+        "commits": 5,
+        "lines": 864,
         "path": "tests/test_fuzz.py"
       },
       {
-        "commits": 4,
-        "lines": 75,
+        "commits": 2,
+        "lines": 69,
         "path": "tests/test_gateway.py"
       },
       {
@@ -674,8 +669,8 @@
         "path": "tests/test_golden_set.py"
       },
       {
-        "commits": 5,
-        "lines": 616,
+        "commits": 3,
+        "lines": 610,
         "path": "tests/test_indexer.py"
       },
       {
@@ -694,13 +689,13 @@
         "path": "tests/test_smoke_e2e.py"
       },
       {
-        "commits": 8,
-        "lines": 1072,
+        "commits": 6,
+        "lines": 1066,
         "path": "tests/test_sync_manager.py"
       },
       {
-        "commits": 5,
-        "lines": 103,
+        "commits": 3,
+        "lines": 97,
         "path": "tests/test_tool_manifest.py"
       },
       {
@@ -734,11 +729,19 @@
     "level": "low",
     "reason": "fewer than 25 source files reach 10 revisions in the window"
   },
-  "generatedAt": "2026-10-01T02:36:16.838Z",
+  "generatedAt": "2026-10-14T23:56:42.397Z",
   "generatedFrom": {
-    "commit": "e6e5806a6d5d25c3deafe96867a4eda219ac07e5"
+    "commit": "a7e6492dab062818abb0ed14852c52d79be8b112"
   },
-  "pairs": [],
+  "pairs": [
+    {
+      "a": "CHANGELOG.md",
+      "b": "pyproject.toml",
+      "either": 10,
+      "shared": 5,
+      "strength": 0.5
+    }
+  ],
   "parameters": {
     "appliedChangesetLimit": 31.25,
     "changeset": 50,
@@ -749,16 +752,16 @@
     "floor": "fallen",
     "floorHeld": false,
     "floorTrigger": "revision-depth",
-    "headDate": "2026-09-30T19:26:59-07:00",
+    "headDate": "2026-10-14T15:53:20-07:00",
     "inScopeFiles": 125,
     "pinnedStart": null,
     "priorFloor": "fallen",
-    "qualifyingCommits": 59,
+    "qualifyingCommits": 56,
     "qualifyingMinimum": 30,
     "revisions": 5,
     "shared": 10,
     "sharedFloorUsed": 3,
-    "since": "2026-04-04T02:26:59.000Z",
+    "since": "2026-04-17T22:53:20.000Z",
     "sourceExtensions": [
       ".js",
       ".mjs",

{tool_compass-2.5.3 → tool_compass-2.5.4}/atlas/structure.json

@@ -25,7 +25,7 @@
           "path": ".github/workflows/ci.yml"
         },
         {
-          "hash": "2ee91a55a0f7bfda79f29fd336d2671c6b27fa05936f4bedc5f715cca8a60b28",
+          "hash": "11b3644468890257965539668f35cfda35618139de343b79283bc3b3b21bea6a",
           "path": ".github/workflows/publish.yml"
         },
         {
@@ -155,7 +155,7 @@
               "line": 94
             }
           ],
-          "hash": "74ce95f7da1cab8f5520655a5ccce278d8a698debef9703485124624ae2654ab",
+          "hash": "eb386a6ffc15cfdf3c7f7473ff2ec84622ba470fa80054bb9df4f9082d39dd28",
           "path": "npm/bin/tool-compass.js",
           "sequences": []
         },
@@ -164,7 +164,7 @@
           "path": "npm/logo-lockup.png"
         },
         {
-          "hash": "118815b24e6988a0b78bad7c951ff2c103167a089fcc59158c0b9259eb2b9f21",
+          "hash": "53c9ebebb0ef7c7b92b72a7510b5c65df0faceab6cec57353780f97af0d58ddd",
           "path": "npm/package.json"
         },
         {
@@ -222,7 +222,7 @@
           "path": ".pre-commit-config.yaml"
         },
         {
-          "hash": "aec042484dd806815fd342e2468b7664f79cc3830f06bbd69a01f46169ceed13",
+          "hash": "804cd9d15d521f3c2e9dad9775f6f2f2aaae98a869556387f121575373e5411f",
           "path": "CHANGELOG.md"
         },
         {
@@ -6392,7 +6392,7 @@
           "path": "logo.png"
         },
         {
-          "hash": "98d322e521294065f4407ae5c1ee8d749f096c06a694eceab54183417b78bcf6",
+          "hash": "67c54d4864867e84c5342ebdf2b8f50324f26bf4fb7bcf507a5f3807c7ca5e5b",
           "path": "pyproject.toml"
         },
         {
@@ -7294,7 +7294,7 @@
           "path": "site/astro.config.mjs"
         },
         {
-          "hash": "909ed4c45f18bed65799627e9af9d4b2cbc437e6ce6ee60f4c9f96e3a5d3eb43",
+          "hash": "bd15e57c9afd80af4ea9fdcdfffe4951583c50219e3877d6c634e49700536f2c",
           "path": "site/package-lock.json"
         },
         {
@@ -7501,7 +7501,7 @@
             "make_http_backend",
             "patch_sdk"
           ],
-          "hash": "f78c95045274f86c068b4198cffbd5526f4de48ecb63dcf092a47ce7e813460b",
+          "hash": "bf564e3cd82daf378632a2fc882b3da3519b842533dede191077bdcaa22347de",
           "importsFiles": [
             "backend_client_simple.py",
             "config.py"
@@ -7528,7 +7528,7 @@
             "test_string_jsonrpc_id_still_completes",
             "test_tools_list_nextcursor_page_two_is_consumable"
           ],
-          "hash": "d176f7f8fe24422037dec2e97645984616252217f4bfb4ca5b9caa09e1725338",
+          "hash": "c38c0203c063eabe5400af77127365cb5678c4011a944f8799bcf761a3c549e7",
           "importsFiles": [
             "backend_client_simple.py",
             "config.py"
@@ -7579,7 +7579,7 @@
           "testFramework": "pytest"
         },
         {
-          "hash": "0697a716a627b1db63ebab44a2ab1bbee253d8fe74706d55c33a31be055ba7d7",
+          "hash": "aab300cd633de5597f6e81c088e17f817cdd571dc9ec944a3fecd787dc0f547b",
           "importOrder": [
             "config.py",
             "analytics.py"
@@ -9913,7 +9913,7 @@
   ],
   "engine": "1.24.0",
   "generatedFrom": {
-    "commit": "e6e5806a6d5d25c3deafe96867a4eda219ac07e5",
+    "commit": "a7e6492dab062818abb0ed14852c52d79be8b112",
     "tracked": 120
   },
   "landings": [

{tool_compass-2.5.3 → tool_compass-2.5.4}/pyproject.toml

@@ -4,7 +4,7 @@ build-backend = "hatchling.build"
 
 [project]
 name = "tool-compass"
-version = "2.5.3"
+version = "2.5.4"
 description = "Semantic MCP tool discovery gateway - find tools by intent, not memory"
 readme = "README.md"
 license = "MIT"