fix(openapi-mcp): avoid release adapter startup deadlock

[Adam Poulemanos (bashandbone)]

What

Fix the startup deadlock that prevented the first regular OpenAPI MCP release from reaching OIDC verification.

The release entrypoint awaited semantic-release while registering that same module's file path as its npm plugin. The plugin loader then awaited the entrypoint's unfinished module evaluation, producing Node's unsettled top-level-await warning and exit code 13.

Register the existing guarded adapter object as an inline plugin instead. Preserve its options, exported hooks, token/OIDC guards, tested-tarball checks, single publication, and mandatory public verification.

Add a Node subprocess regression around entrypoint/plugin initialization, with publication side effects disabled and the real installed plugin loader retained.

Failure evidence: regular release attempt 2. Package checks passed; startup failed before OIDC verification or npm publication. npm still contained only 0.0.0 when checked afterward.

Plugin(s) affected

• None (repo-level openapi-mcp release adapter)

Verification

• Regression RED/GREEN: the actual Node entrypoint exits 13 with the original self-file registration and exits 0 with the inline adapter, reaching all three existing guards through the installed semantic-release plugin loader.
• Full bun test: 1,004 passed, 1 existing Microsoft Graph test skipped, 0 failed; 4,907 assertions across 40 files.
• bun run validate: marketplace validation and generated-file checks passed.
• Biome checked all three changed files; git diff --check passed.
• Independent read-only review of a799e39..2446f41: no critical, important, or minor findings. Reviewer independently reproduced the original Node exit 13 and verified the fixed startup/guard reachability. This verifies startup, not OIDC authentication or publication success.

Release safety

OPENAPI_MCP_OIDC_READY remains false. This PR does not publish, approve a deployment, change npm settings, or enable a release. After merge, the fixed source needs a separately authorized regular-release attempt; rerunning the old failing source will not apply this fix.

Rollback: revert this PR with the release gate still disabled. Do not reintroduce a bootstrap token or republish 0.0.0.

Checklist

• Conventional commit with openapi-mcp scope
• Repository validation and regression tests pass
• No public runtime API or package-version change
• No manually authored changelog

[chatgpt-codex-connector]

Codex Review Summary

This comment shows the latest Codex review activity on this pull request.

Review	Status	Commit	Review trigger
📝 Code Review	✅ Completed 2026-09-05T18:01:19.279668Z	2446f41	PR opened
🔒 Security Review	✅ Completed 2026-09-05T18:02:19.969146Z	2446f41	PR opened

ℹ️ About Codex in GitHub

Your team has set up Codex to review pull requests in this repo. Reviews are triggered when you

• Open a pull request for review
• Mark a draft as ready
• Comment "Codex (@codex) review" or "Codex (@codex) security review".

Codex reacts with 👀 while any review is running, comments if it has suggestions, and reacts with 👍 once all reviews finish with no findings.

[github-actions]

🎉 This PR is included in version 1.0.0 🎉

The release is available on:

• npm package (@latest dist-tag)
• GitHub release

Your semantic-release bot 📦🚀