feat(release): bump the three security-affected packages to 1.2.0 - #225
Merged
Conversation
…x publish metadata Prepares the 1.2.0 release. Nothing is published by this commit. THE SCOPE WAS WRONG AND THE DRY RUN IS WHY WE KNOW -------------------------------------------------- The plan was to bump `@beyondnet/evolith-mcp` alone. That came from reading `git show --stat`, which TRUNCATES long paths with `...` — so the survey missed packages whose files sit deep in the tree. Redone with `--name-only`, the security wave (1b077ab, 3a39dd0, 60bfc63, 3f31fa6, 90eacdb, 4f29e11, 8ad4e2d) touches three published packages, not one: @beyondnet/evolith-mcp 15 files (survey said 10) @beyondnet/evolith-cli 7 files (survey said 1) @beyondnet/evolith-agent-runtime 1 file (survey said none) harness-process.adapter.ts, the CWE-78 shell runner Publishing the original plan would have shipped the mcp patch and left the CLI and agent-runtime vulnerable, then closed GT-570 against it. All three go to 1.2.0. The other five public packages stay where they are: the wave did not change them, and republishing would only add registry noise. Consumers pin `^1.1.0`, which 1.2.0 satisfies, so no ranges move. PUBLISH METADATA, FOUND BY THE DRY RUN -------------------------------------- The rehearsal (run 30265298045) packed @beyondnet/evolith-sdk and reported 30 files, not one of them a licence, on an MIT project. Root cause was two-sided: four packages had no LICENSE in their directory at all, and three did not list it in `files`. Both fixed, verified with `npm pack --dry-run` — the four packages about to ship now each carry it. npm was also auto-correcting `repository.url` on every publish and saying so. Publishing through a warning means letting npm guess your metadata; all eight manifests now declare `git+https://…` explicitly, and the warning count is 0. CHANGELOG --------- The 336-line `[Unreleased]` batch is assigned to `## [1.2.0] - 2026-07-27`, with two things written down rather than tidied away: which three packages the version actually covers, and the fact that the 1.1.0 heading is dated 2026-06-16 while npm served 1.1.0 from 2026-07-18 — so part of this batch shipped inside that release with no entry of its own. The dates are left alone; the caveat is explicit so nobody reads the 1.1.0 section as a complete description of its tarballs. A GUARD CAUGHT THE BUMP, CORRECTLY ---------------------------------- `10-validate-contract-conformance` went red: the machine-contracts manifest declares `producer.version` and it must equal the CLI's package.json. Synced to 1.2.0. That is precisely the drift the guard exists to prevent. Verified: ci-runner governance 17/17 exit 0, mcp-server 403, agent-runtime 321, contracts 32, contract suite 43/43, planner self-test 11/11. The planner now resolves 4 of 8 publishable: agent-runtime@1.2.0, sdk@2.0.0, mcp@1.2.0, cli@1.2.0. Co-Authored-By: Claude Opus 5 <noreply@anthropic.com>
|
You have reached your Codex usage limits for code reviews. You can see your limits in the Codex usage dashboard. |
📊 Bilingual Coverage ImpactPR Changes
Repository Coverage
To create skeletons: node .harness/scripts/generate-es-skeleton.mjs <file.md>Generated by GitHub Actions |
`Validate documentation` failed on #225. The first run died on an ECONNRESET fetching typescript-eslint during `npm ci` — a genuine network flake — and the rerun revealed what it had been masking: `11-validate-product-docs` reporting "Product inventory is stale". The cause is the bump itself. That validator asserts the CLI version advertised in `product/products/smart-cli/*` matches `src/sdk/cli/package.json`, and checks the generated inventory against the installable surface. Moving the CLI to 1.2.0 invalidated both. Regenerated with the generator rather than edited by hand: @beyondnet/evolith-cli@1.2.0 — 35 commands, 50 tools, 12 resources, 8 prompts, 45 schemas. WHY MY LOCAL RUN WAS GREEN AND CI WAS NOT ----------------------------------------- `ci-runner.mjs` only adds `11-validate-product-docs` to the set when it detects a code change, so `ci-runner governance` never executed it locally while the `Validate documentation` job in CI did. That is a blind spot in the local verification routine, not a difference in the code: a green `ci-runner governance` does not imply a green required check. Worth remembering — it is the same shape as the other local-vs-runner gaps this session (a stale dist, a gitignored directory, a threshold measured on the wrong machine), and the fix is the same: verify where it is enforced. Ran the code-triggered validators individually afterwards: 01, 04, 05, 08, 10, 19, 20 and 24 all exit 0. Co-Authored-By: Claude Opus 5 <noreply@anthropic.com>
This file contains hidden or bidirectional Unicode text that may be interpreted or compiled differently than what appears below. To review, open the file in an editor that reveals hidden Unicode characters.
Learn more about bidirectional Unicode characters
Sign up for free
to join this conversation on GitHub.
Already have an account?
Sign in to comment
1 participant
Add this suggestion to a batch that can be applied as a single commit.This suggestion is invalid because no changes were made to the code.Suggestions cannot be applied while the pull request is closed.Suggestions cannot be applied while viewing a subset of changes.Only one suggestion per line can be applied in a batch.Add this suggestion to a batch that can be applied as a single commit.Applying suggestions on deleted lines is not supported.You must change the existing code in this line in order to create a valid suggestion.Outdated suggestions cannot be applied.This suggestion has been applied or marked resolved.Suggestions cannot be applied from pending reviews.Suggestions cannot be applied on multi-line comments.Suggestions cannot be applied while the pull request is queued to merge.Suggestion cannot be applied right now. Please check back later.
Pull Request Summary
Prepares the 1.2.0 release. Nothing is published by this PR — it bumps versions and fixes publish metadata so the release, when it happens, is correct and permanent-safe.
The scope was wrong, and the dry run is why we know
The plan was to bump
@beyondnet/evolith-mcpalone. That came from readinggit show --stat, which truncates long paths with...— so the survey missed packages whose files sit deep in the tree. Redone with--name-only, the security wave touches three published packages:@beyondnet/evolith-mcp@beyondnet/evolith-cli@beyondnet/evolith-agent-runtimeharness-process.adapter.ts, the CWE-78 shell runnerPublishing the original plan would have shipped the mcp patch, left the CLI and agent-runtime vulnerable, and closed GT-570 against it. All three go to 1.2.0. The other five stay put — the wave did not change them, and republishing would only add registry noise. Consumers pin
^1.1.0, which 1.2.0 satisfies, so no ranges move.Publish metadata, found by the dry run
The rehearsal (run 30265298045) packed
@beyondnet/evolith-sdkand reported 30 files, not one of them a licence, on an MIT project. Two-sided root cause: four packages had noLICENSEin their directory at all, and three did not list it infiles. Both fixed, verified withnpm pack --dry-run— the four packages about to ship each carry it now.npm was also auto-correcting
repository.urlon every publish and saying so. Publishing through a warning means letting npm guess your metadata; all eight manifests now declaregit+https://…explicitly and the warning count is 0.This is what a rehearsable release path buys: both defects would have been permanent on the registry, where npm forbids unpublishing after 72 hours.
CHANGELOG
The 336-line
[Unreleased]batch is assigned to## [1.2.0] - 2026-07-27, with two things written down rather than tidied away: which three packages the version actually covers, and that the 1.1.0 heading is dated 2026-06-16 while npm served 1.1.0 from 2026-07-18 — so part of this batch shipped inside that release with no entry of its own. The dates are left alone and the caveat is explicit.A guard caught the bump, correctly
10-validate-contract-conformancewent red: the machine-contracts manifest declaresproducer.versionand it must equal the CLI'spackage.json. Synced to 1.2.0. Precisely the drift that guard exists to prevent.Evolith Core Quality Gates
01-validate-docs.mjsgreen (viaci-runner governance).04-check-bilingual-parity.mjsgreen (viaci-runner governance).Verification
ci-runner governance17/17 exit 0 · mcp-server 403 · agent-runtime 321 · contracts 32 · contract suite 43/43 · planner self-test 11/11 ·npm pack --dry-runconfirms LICENSE in all four shipping packages and 0 auto-correction warnings.The planner now resolves 4 of 8:
agent-runtime@1.2.0,sdk@2.0.0,mcp@1.2.0,cli@1.2.0.Linked ADRs / Issues
Conventional Commits
🤖 Generated with Claude Code