feat(release): align main — 1.2.0 prepared for the three security-affected packages - #226
Merged
Conversation
…x publish metadata Prepares the 1.2.0 release. Nothing is published by this commit. THE SCOPE WAS WRONG AND THE DRY RUN IS WHY WE KNOW -------------------------------------------------- The plan was to bump `@beyondnet/evolith-mcp` alone. That came from reading `git show --stat`, which TRUNCATES long paths with `...` — so the survey missed packages whose files sit deep in the tree. Redone with `--name-only`, the security wave (1b077ab, 3a39dd0, 60bfc63, 3f31fa6, 90eacdb, 4f29e11, 8ad4e2d) touches three published packages, not one: @beyondnet/evolith-mcp 15 files (survey said 10) @beyondnet/evolith-cli 7 files (survey said 1) @beyondnet/evolith-agent-runtime 1 file (survey said none) harness-process.adapter.ts, the CWE-78 shell runner Publishing the original plan would have shipped the mcp patch and left the CLI and agent-runtime vulnerable, then closed GT-570 against it. All three go to 1.2.0. The other five public packages stay where they are: the wave did not change them, and republishing would only add registry noise. Consumers pin `^1.1.0`, which 1.2.0 satisfies, so no ranges move. PUBLISH METADATA, FOUND BY THE DRY RUN -------------------------------------- The rehearsal (run 30265298045) packed @beyondnet/evolith-sdk and reported 30 files, not one of them a licence, on an MIT project. Root cause was two-sided: four packages had no LICENSE in their directory at all, and three did not list it in `files`. Both fixed, verified with `npm pack --dry-run` — the four packages about to ship now each carry it. npm was also auto-correcting `repository.url` on every publish and saying so. Publishing through a warning means letting npm guess your metadata; all eight manifests now declare `git+https://…` explicitly, and the warning count is 0. CHANGELOG --------- The 336-line `[Unreleased]` batch is assigned to `## [1.2.0] - 2026-07-27`, with two things written down rather than tidied away: which three packages the version actually covers, and the fact that the 1.1.0 heading is dated 2026-06-16 while npm served 1.1.0 from 2026-07-18 — so part of this batch shipped inside that release with no entry of its own. The dates are left alone; the caveat is explicit so nobody reads the 1.1.0 section as a complete description of its tarballs. A GUARD CAUGHT THE BUMP, CORRECTLY ---------------------------------- `10-validate-contract-conformance` went red: the machine-contracts manifest declares `producer.version` and it must equal the CLI's package.json. Synced to 1.2.0. That is precisely the drift the guard exists to prevent. Verified: ci-runner governance 17/17 exit 0, mcp-server 403, agent-runtime 321, contracts 32, contract suite 43/43, planner self-test 11/11. The planner now resolves 4 of 8 publishable: agent-runtime@1.2.0, sdk@2.0.0, mcp@1.2.0, cli@1.2.0. Co-Authored-By: Claude Opus 5 <noreply@anthropic.com>
`Validate documentation` failed on #225. The first run died on an ECONNRESET fetching typescript-eslint during `npm ci` — a genuine network flake — and the rerun revealed what it had been masking: `11-validate-product-docs` reporting "Product inventory is stale". The cause is the bump itself. That validator asserts the CLI version advertised in `product/products/smart-cli/*` matches `src/sdk/cli/package.json`, and checks the generated inventory against the installable surface. Moving the CLI to 1.2.0 invalidated both. Regenerated with the generator rather than edited by hand: @beyondnet/evolith-cli@1.2.0 — 35 commands, 50 tools, 12 resources, 8 prompts, 45 schemas. WHY MY LOCAL RUN WAS GREEN AND CI WAS NOT ----------------------------------------- `ci-runner.mjs` only adds `11-validate-product-docs` to the set when it detects a code change, so `ci-runner governance` never executed it locally while the `Validate documentation` job in CI did. That is a blind spot in the local verification routine, not a difference in the code: a green `ci-runner governance` does not imply a green required check. Worth remembering — it is the same shape as the other local-vs-runner gaps this session (a stale dist, a gitignored directory, a threshold measured on the wrong machine), and the fix is the same: verify where it is enforced. Ran the code-triggered validators individually afterwards: 01, 04, 05, 08, 10, 19, 20 and 24 all exit 0. Co-Authored-By: Claude Opus 5 <noreply@anthropic.com>
…ment feat(release): bump the three security-affected packages to 1.2.0
|
You have reached your Codex usage limits for code reviews. You can see your limits in the Codex usage dashboard. |
📊 Bilingual Coverage ImpactPR Changes
Repository Coverage
To create skeletons: node .harness/scripts/generate-es-skeleton.mjs <file.md>Generated by GitHub Actions |
This file contains hidden or bidirectional Unicode text that may be interpreted or compiled differently than what appears below. To review, open the file in an editor that reveals hidden Unicode characters.
Learn more about bidirectional Unicode characters
Sign up for free
to join this conversation on GitHub.
Already have an account?
Sign in to comment
1 participant
Add this suggestion to a batch that can be applied as a single commit.This suggestion is invalid because no changes were made to the code.Suggestions cannot be applied while the pull request is closed.Suggestions cannot be applied while viewing a subset of changes.Only one suggestion per line can be applied in a batch.Add this suggestion to a batch that can be applied as a single commit.Applying suggestions on deleted lines is not supported.You must change the existing code in this line in order to create a valid suggestion.Outdated suggestions cannot be applied.This suggestion has been applied or marked resolved.Suggestions cannot be applied from pending reviews.Suggestions cannot be applied on multi-line comments.Suggestions cannot be applied while the pull request is queued to merge.Suggestion cannot be applied right now. Please check back later.
Aligns
mainwithdevelopfor the 1.2.0 preparation (GT-570). Nothing published.🤖 Generated with Claude Code