feat(release): bump the three security-affected packages to 1.2.0

CHANGELOG.md

@@ -2,10 +2,31 @@
 
 ## [Unreleased]
 
+## [1.2.0] - 2026-07-27
+
 Changes accumulated since the 1.0.0 release of 2026-06-28. Automated changelog
 generation was disconnected during this period (GT-552), so these entries were
-reconstructed from the commit history. The version number for this batch is
-deliberately unassigned.
+reconstructed from the commit history.
+
+**Which packages this version covers.** Only the three published packages the
+security wave actually touched are released at 1.2.0:
+`@beyondnet/evolith-mcp` (15 files), `@beyondnet/evolith-cli` (7) and
+`@beyondnet/evolith-agent-runtime` (1 — the `harness-process.adapter.ts` shell
+runner, CWE-78). The other five public packages stay at their current versions
+because the wave did not change them; publishing them again would only add noise
+to the registry.
+
+**A caveat about 1.1.0, recorded rather than tidied away.** The heading below is
+dated 2026-06-16, but npm served `1.1.0` from **2026-07-18** — so part of the
+batch in this section shipped inside that release without a changelog entry of
+its own. The dates are left as they are; do not read the 1.1.0 section as a
+complete description of what the 1.1.0 tarballs contained.
+
+**Why this section was unassigned until now.** The security fixes below landed on
+2026-07-23, five days after 1.1.0 reached the registry, and there was no
+automated path to publish seven of the eight packages — so they could not ship
+(GT-570). That path now exists (`npm-release.yml`), which is what makes assigning
+a version here meaningful instead of aspirational.
 
 
 ### Security Hardening (Phases 1-7)

product/products/smart-cli/product-inventory.es.md

@@ -7,7 +7,7 @@ Inventario generado de la superficie instalable de Evolith CLI y MCP. No editar
 
 | Campo | Valor |
 |---|---|
-| Package | `@beyondnet/evolith-cli@1.1.0` |
+| Package | `@beyondnet/evolith-cli@1.2.0` |
 | Binary | `evolith`, `evolith-cli` |
 | CLI commands | 35 |
 | MCP tools | 50 |

product/products/smart-cli/product-inventory.md

@@ -7,7 +7,7 @@ Generated inventory of the installable Evolith CLI and MCP surface. Do not edit
 
 | Field | Value |
 |---|---|
-| Package | `@beyondnet/evolith-cli@1.1.0` |
+| Package | `@beyondnet/evolith-cli@1.2.0` |
 | Binary | `evolith`, `evolith-cli` |
 | CLI commands | 35 |
 | MCP tools | 50 |

reference/core/control-center/maturity-reports/maturity-reconciliation.json

@@ -11,7 +11,7 @@
   },
   "evidence": {
     "closureRecords": 543,
-    "cliPackage": "@beyondnet/evolith-cli@1.1.0",
+    "cliPackage": "@beyondnet/evolith-cli@1.2.0",
     "adrCount": 139,
     "rulesetCount": 167,
     "schemaCount": 45

src/packages/agent-runtime/LICENSE

@@ -0,0 +1,21 @@
+MIT License
+
+Copyright (c) 2026 BeyondNet Code
+
+Permission is hereby granted, free of charge, to any person obtaining a copy
+of this software and associated documentation files (the "Software"), to deal
+in the Software without restriction, including without limitation the rights
+to use, copy, modify, merge, publish, distribute, sublicense, and/or sell
+copies of the Software, and to permit persons to whom the Software is
+furnished to do so, subject to the following conditions:
+
+The above copyright notice and this permission notice shall be included in all
+copies or substantial portions of the Software.
+
+THE SOFTWARE IS PROVIDED "AS IS", WITHOUT WARRANTY OF ANY KIND, EXPRESS OR
+IMPLIED, INCLUDING BUT NOT LIMITED TO THE WARRANTIES OF MERCHANTABILITY,
+FITNESS FOR A PARTICULAR PURPOSE AND NONINFRINGEMENT. IN NO EVENT SHALL THE
+AUTHORS OR COPYRIGHT HOLDERS BE LIABLE FOR ANY CLAIM, DAMAGES OR OTHER
+LIABILITY, WHETHER IN AN ACTION OF CONTRACT, TORT OR OTHERWISE, ARISING FROM,
+OUT OF OR IN CONNECTION WITH THE SOFTWARE OR THE USE OR OTHER DEALINGS IN THE
+SOFTWARE.

src/packages/agent-runtime/package.json

@@ -1,6 +1,6 @@
 {
   "name": "@beyondnet/evolith-agent-runtime",
-  "version": "1.1.0",
+  "version": "1.2.0",
   "description": "Evolith Agent Runtime — decoupled agentic layer that operates Evolith Core through Ports & Adapters (.harness, Core Evaluation, OPA, Tracker, Memory, Scheduler, Hermes). Hexagonal; no runtime/LLM technology is a domain dependency.",
   "license": "MIT",
   "main": "dist/index.js",
@@ -47,7 +47,7 @@
   "homepage": "https://github.com/beyondnetcode/evolith_arch32#readme",
   "repository": {
     "type": "git",
-    "url": "https://github.com/beyondnetcode/evolith_arch32.git",
+    "url": "git+https://github.com/beyondnetcode/evolith_arch32.git",
     "directory": "src/packages/agent-runtime"
   }
 }

src/packages/contracts/LICENSE

@@ -0,0 +1,21 @@
+MIT License
+
+Copyright (c) 2026 BeyondNet Code
+
+Permission is hereby granted, free of charge, to any person obtaining a copy
+of this software and associated documentation files (the "Software"), to deal
+in the Software without restriction, including without limitation the rights
+to use, copy, modify, merge, publish, distribute, sublicense, and/or sell
+copies of the Software, and to permit persons to whom the Software is
+furnished to do so, subject to the following conditions:
+
+The above copyright notice and this permission notice shall be included in all
+copies or substantial portions of the Software.
+
+THE SOFTWARE IS PROVIDED "AS IS", WITHOUT WARRANTY OF ANY KIND, EXPRESS OR
+IMPLIED, INCLUDING BUT NOT LIMITED TO THE WARRANTIES OF MERCHANTABILITY,
+FITNESS FOR A PARTICULAR PURPOSE AND NONINFRINGEMENT. IN NO EVENT SHALL THE
+AUTHORS OR COPYRIGHT HOLDERS BE LIABLE FOR ANY CLAIM, DAMAGES OR OTHER
+LIABILITY, WHETHER IN AN ACTION OF CONTRACT, TORT OR OTHERWISE, ARISING FROM,
+OUT OF OR IN CONNECTION WITH THE SOFTWARE OR THE USE OR OTHER DEALINGS IN THE
+SOFTWARE.

src/packages/contracts/package.json

@@ -53,7 +53,7 @@
   "homepage": "https://github.com/beyondnetcode/evolith_arch32#readme",
   "repository": {
     "type": "git",
-    "url": "https://github.com/beyondnetcode/evolith_arch32.git",
+    "url": "git+https://github.com/beyondnetcode/evolith_arch32.git",
     "directory": "src/packages/contracts"
   }
 }

src/packages/core-domain/package.json

@@ -98,7 +98,7 @@
   "homepage": "https://github.com/beyondnetcode/evolith_arch32#readme",
   "repository": {
     "type": "git",
-    "url": "https://github.com/beyondnetcode/evolith_arch32.git",
+    "url": "git+https://github.com/beyondnetcode/evolith_arch32.git",
     "directory": "src/packages/core-domain"
   }
 }

src/packages/core/package.json

@@ -37,7 +37,7 @@
   "homepage": "https://github.com/beyondnetcode/evolith_arch32#readme",
   "repository": {
     "type": "git",
-    "url": "https://github.com/beyondnetcode/evolith_arch32.git",
+    "url": "git+https://github.com/beyondnetcode/evolith_arch32.git",
     "directory": "src/packages/core"
   }
 }

src/packages/infra-providers/package.json

@@ -38,7 +38,7 @@
   "homepage": "https://github.com/beyondnetcode/evolith_arch32#readme",
   "repository": {
     "type": "git",
-    "url": "https://github.com/beyondnetcode/evolith_arch32.git",
+    "url": "git+https://github.com/beyondnetcode/evolith_arch32.git",
     "directory": "src/packages/infra-providers"
   }
 }

src/packages/mcp-server/LICENSE

@@ -0,0 +1,21 @@
+MIT License
+
+Copyright (c) 2026 BeyondNet Code
+
+Permission is hereby granted, free of charge, to any person obtaining a copy
+of this software and associated documentation files (the "Software"), to deal
+in the Software without restriction, including without limitation the rights
+to use, copy, modify, merge, publish, distribute, sublicense, and/or sell
+copies of the Software, and to permit persons to whom the Software is
+furnished to do so, subject to the following conditions:
+
+The above copyright notice and this permission notice shall be included in all
+copies or substantial portions of the Software.
+
+THE SOFTWARE IS PROVIDED "AS IS", WITHOUT WARRANTY OF ANY KIND, EXPRESS OR
+IMPLIED, INCLUDING BUT NOT LIMITED TO THE WARRANTIES OF MERCHANTABILITY,
+FITNESS FOR A PARTICULAR PURPOSE AND NONINFRINGEMENT. IN NO EVENT SHALL THE
+AUTHORS OR COPYRIGHT HOLDERS BE LIABLE FOR ANY CLAIM, DAMAGES OR OTHER
+LIABILITY, WHETHER IN AN ACTION OF CONTRACT, TORT OR OTHERWISE, ARISING FROM,
+OUT OF OR IN CONNECTION WITH THE SOFTWARE OR THE USE OR OTHER DEALINGS IN THE
+SOFTWARE.

src/packages/mcp-server/package.json

@@ -1,6 +1,6 @@
 {
   "name": "@beyondnet/evolith-mcp",
-  "version": "1.1.0",
+  "version": "1.2.0",
   "description": "Evolith MCP Gateway — NestJS-based Model Context Protocol server for AI agents. Supports stdio and SSE transports.",
   "main": "dist/main.js",
   "types": "dist/main.d.ts",
@@ -33,7 +33,8 @@
   ],
   "files": [
     "dist/",
-    "README.md"
+    "README.md",
+    "LICENSE"
   ],
   "dependencies": {
     "@beyondnet/evolith-agent-runtime": "^1.1.0",
@@ -91,7 +92,7 @@
   "homepage": "https://github.com/beyondnetcode/evolith_arch32#readme",
   "repository": {
     "type": "git",
-    "url": "https://github.com/beyondnetcode/evolith_arch32.git",
+    "url": "git+https://github.com/beyondnetcode/evolith_arch32.git",
     "directory": "src/packages/mcp-server"
   },
   "publishConfig": {

src/packages/sdk-client/LICENSE

@@ -0,0 +1,21 @@
+MIT License
+
+Copyright (c) 2026 BeyondNet Code
+
+Permission is hereby granted, free of charge, to any person obtaining a copy
+of this software and associated documentation files (the "Software"), to deal
+in the Software without restriction, including without limitation the rights
+to use, copy, modify, merge, publish, distribute, sublicense, and/or sell
+copies of the Software, and to permit persons to whom the Software is
+furnished to do so, subject to the following conditions:
+
+The above copyright notice and this permission notice shall be included in all
+copies or substantial portions of the Software.
+
+THE SOFTWARE IS PROVIDED "AS IS", WITHOUT WARRANTY OF ANY KIND, EXPRESS OR
+IMPLIED, INCLUDING BUT NOT LIMITED TO THE WARRANTIES OF MERCHANTABILITY,
+FITNESS FOR A PARTICULAR PURPOSE AND NONINFRINGEMENT. IN NO EVENT SHALL THE
+AUTHORS OR COPYRIGHT HOLDERS BE LIABLE FOR ANY CLAIM, DAMAGES OR OTHER
+LIABILITY, WHETHER IN AN ACTION OF CONTRACT, TORT OR OTHERWISE, ARISING FROM,
+OUT OF OR IN CONNECTION WITH THE SOFTWARE OR THE USE OR OTHER DEALINGS IN THE
+SOFTWARE.

src/packages/sdk-client/package.json

@@ -7,7 +7,8 @@
   "main": "dist/index.js",
   "types": "dist/index.d.ts",
   "files": [
-    "dist"
+    "dist",
+    "LICENSE"
   ],
   "scripts": {
     "build": "tsc -p tsconfig.json",
@@ -51,7 +52,7 @@
   "homepage": "https://github.com/beyondnetcode/evolith_arch32#readme",
   "repository": {
     "type": "git",
-    "url": "https://github.com/beyondnetcode/evolith_arch32.git",
+    "url": "git+https://github.com/beyondnetcode/evolith_arch32.git",
     "directory": "src/packages/sdk-client"
   },
   "publishConfig": {

src/rulesets/contracts/evolith-machine-contracts.json

@@ -3,7 +3,7 @@
   "compatibilityPolicy": "semver-major",
   "producer": {
     "package": "@beyondnet/evolith-cli",
-    "version": "1.1.0"
+    "version": "1.2.0"
   },
   "schemas": [
     {

src/sdk/cli/package.json

@@ -1,6 +1,6 @@
 {
   "name": "@beyondnet/evolith-cli",
-  "version": "1.1.0",
+  "version": "1.2.0",
   "description": "Evolith CLI - Governance, standards validation, and AI agent integration for satellite repositories",
   "main": "dist/main.js",
   "bin": {
@@ -52,7 +52,7 @@
   "license": "MIT",
   "repository": {
     "type": "git",
-    "url": "https://github.com/beyondnetcode/evolith_arch32.git",
+    "url": "git+https://github.com/beyondnetcode/evolith_arch32.git",
     "directory": "src/sdk/cli"
   },
   "engines": {
@@ -64,7 +64,8 @@
     "shell/",
     "templates/",
     "README.md",
-    "ARCHITECTURE.md"
+    "ARCHITECTURE.md",
+    "LICENSE"
   ],
   "dependencies": {
     "@clack/prompts": "1.5.1",