From 940d394d73374be776c15268db2125271f6b7e60 Mon Sep 17 00:00:00 2001 From: Qwynn Marcelle Date: Mon, 20 Jul 2026 15:35:21 -0400 Subject: [PATCH 1/3] release: bump @workspacejson/codex-mcp to 0.1.7 Stages 0.1.7 across the three sync points (package.json, package-lock, runtime VERSION in src/index.ts). Cut from main so PR #10 (e0827a8, array frameworkManifest normalization) is included -- the prior release branch did not contain it. Normalizer fix only. Extension stays 0.1.2 (separate vsce track). --- package-lock.json | 4 ++-- package.json | 2 +- src/index.ts | 2 +- 3 files changed, 4 insertions(+), 4 deletions(-) diff --git a/package-lock.json b/package-lock.json index 5325fdd..32a53b9 100644 --- a/package-lock.json +++ b/package-lock.json @@ -1,12 +1,12 @@ { "name": "@workspacejson/codex-mcp", - "version": "0.1.6", + "version": "0.1.7", "lockfileVersion": 3, "requires": true, "packages": { "": { "name": "@workspacejson/codex-mcp", - "version": "0.1.6", + "version": "0.1.7", "license": "Apache-2.0", "dependencies": { "@modelcontextprotocol/sdk": "^1.20.0", diff --git a/package.json b/package.json index 2b816ee..356d37b 100644 --- a/package.json +++ b/package.json @@ -1,6 +1,6 @@ { "name": "@workspacejson/codex-mcp", - "version": "0.1.6", + "version": "0.1.7", "description": "MCP server that surfaces workspace.json fragility and co-change intelligence to OpenAI Codex before it edits code.", "license": "Apache-2.0", "type": "module", diff --git a/src/index.ts b/src/index.ts index 0a100e4..861f16d 100644 --- a/src/index.ts +++ b/src/index.ts @@ -5,7 +5,7 @@ import { isVerifyEnabled } from "./config.js"; import { SERVER_INSTRUCTIONS } from "./constants.js"; import { registerWorkspaceTools } from "./tools/workspace.js"; -const VERSION = "0.1.6"; +const VERSION = "0.1.7"; function buildServer(): McpServer { const server = new McpServer( From c16539344ee4460743a090b518ec478734b0791f Mon Sep 17 00:00:00 2001 From: Qwynn Marcelle Date: Mon, 20 Jul 2026 16:05:48 -0400 Subject: [PATCH 2/3] chore: gitignore local editor state .vscode/ is untracked developer convenience (extension-host launch + build task). It failed check:structure, the first gate in prepublishOnly, blocking local publish. The checker consults git check-ignore plus config/repository-structure.json; .vscodeignore governs vsce bundling only and has no bearing here. Kept separate from the 0.1.7 version bump. --- .gitignore | 4 ++++ biome.json | 1 + 2 files changed, 5 insertions(+) diff --git a/.gitignore b/.gitignore index 8ded44e..1685541 100644 --- a/.gitignore +++ b/.gitignore @@ -18,6 +18,10 @@ hac120-desktop.png # Local Claude state is machine-specific, not product source. .claude/ +# Local editor state. The extension-host launch config is a developer +# convenience, not a release input; keep it out of the published repo. +.vscode/ + # Local Codex transcript-processing scratchwork may contain prompts and tool traces. /scripts/extract-session*.mjs diff --git a/biome.json b/biome.json index 13096d8..d00857f 100644 --- a/biome.json +++ b/biome.json @@ -24,6 +24,7 @@ "ignore": [ ".claude", ".local", + ".vscode", "dist", "node_modules", "fixture", From 62bbddfc0954f44530119b05042bf97444850970 Mon Sep 17 00:00:00 2001 From: Qwynn Marcelle Date: Mon, 20 Jul 2026 17:48:44 -0400 Subject: [PATCH 3/3] ci(publish): assert the normalizer fix is in the shipped tarball The npm publish workflow asserted tarball contents by filename only, so a release could ship without the array-manifest normalizer and stay green. 0.1.5 and 0.1.6 both did exactly that (HAC-206). Extracts the packed tarball and greps dist/services/workspace.js for normalizeFrameworkManifest. Verified to discriminate: the published 0.1.6 tarball fails this check, a 0.1.7 pack passes it. Scope is deliberately narrow -- this is a presence check on a symbol. It catches the fix going missing, not the fix being wrong. A behavioural gate needs a non-empty frameworkManifest fixture, because an empty array normalizes to undefined with or without the fix and discriminates nothing. That fixture is the follow-up. --- .github/workflows/publish-npm.yml | 11 +++++++++++ 1 file changed, 11 insertions(+) diff --git a/.github/workflows/publish-npm.yml b/.github/workflows/publish-npm.yml index 083d9ff..0395471 100644 --- a/.github/workflows/publish-npm.yml +++ b/.github/workflows/publish-npm.yml @@ -52,6 +52,17 @@ jobs: test -f "$TAR" tar -tzf "$TAR" | grep -F 'package/.codex-plugin/assets/marketplace-icon.svg' tar -tzf "$TAR" | grep -F 'package/hooks/pre-edit-check.mjs' + # Assert the array-manifest normalizer is in the SHIPPED bytes, not + # merely in the branch. 0.1.5 and 0.1.6 both published without it + # while every branch check was green (HAC-206). Note this is a + # presence check on a symbol: it catches the fix going missing, not + # the fix being wrong. A behavioural gate needs a non-empty + # frameworkManifest fixture -- an empty array normalizes to + # undefined with or without the fix, so it discriminates nothing. + mkdir -p /tmp/workspacejson-release/inspect + tar -xzf "$TAR" -C /tmp/workspacejson-release/inspect + grep -q 'normalizeFrameworkManifest' \ + /tmp/workspacejson-release/inspect/package/dist/services/workspace.js - name: Install packed artifact in a clean project run: | mkdir -p /tmp/workspacejson-release/install