fix: prepare 0.1.1 and preserve backup tool errors - #24
Merged
Conversation
…g fixes The first npm publication (0.1.0) completed on 2026-08-01, which left several documents describing a pre-release state and shipped two repository-only documents to npm consumers. - Exclude `docs/implementation-plan.md` (a completed internal build checklist containing agent directives) and `docs/github-publishing.md` (a maintainer release runbook) from the published tarball by listing the four consumer-facing documents explicitly in `files`. Both remain in the repo. - Correct `SECURITY.md`, which still claimed tagged releases did not exist. - Rewrite the publishing runbook around the completed first publication and make the pending Trusted Publishing migration explicit, including the ordering constraint that would otherwise break the next release. - Add verified npm version, supported-Node, and license badges, and lead the README setup with the published package instead of a source build. - Declare `repository-code` and `date-released` in `CITATION.cff`. - Record the pinned-dependency and `allowScripts` rationale in `AGENTS.md` so future contributors do not "fix" them. No runtime code changed. Verified with `npm run preflight`, `npm run pack:check`, `npm run release:check -- v0.1.1`, `npm audit --omit=dev` (0 vulnerabilities), and a clean install of the packed tarball whose config guards were smoke-tested offline. Co-Authored-By: Claude Opus 5 (1M context) <noreply@anthropic.com>
TheStreamCode
changed the title
This file contains hidden or bidirectional Unicode text that may be interpreted or compiled differently than what appears below. To review, open the file in an editor that reveals hidden Unicode characters.
Learn more about bidirectional Unicode characters
Sign up for free
to join this conversation on GitHub.
Already have an account?
Sign in to comment
1 participant
Add this suggestion to a batch that can be applied as a single commit.This suggestion is invalid because no changes were made to the code.Suggestions cannot be applied while the pull request is closed.Suggestions cannot be applied while viewing a subset of changes.Only one suggestion per line can be applied in a batch.Add this suggestion to a batch that can be applied as a single commit.Applying suggestions on deleted lines is not supported.You must change the existing code in this line in order to create a valid suggestion.Outdated suggestions cannot be applied.This suggestion has been applied or marked resolved.Suggestions cannot be applied from pending reviews.Suggestions cannot be applied on multi-line comments.Suggestions cannot be applied while the pull request is queued to merge.Suggestion cannot be applied right now. Please check back later.
Why
Version
0.1.0is live on npm. The repository still contained pre-release documentation and shipped two maintainer-only documents. Release smoke testing also found that backup tool failures did not satisfy their declared MCP output schemas, causing conforming clients to replace the useful application error with-32602.Changes
0.1.1acrosspackage.json,package-lock.json,CHANGELOG.md, andCITATION.cffAGENTS.mdValidation
npm ci— passnpm run preflight— pass (8 files / 28 tests)npm run release:check -- v0.1.1— passnpm run pack:check— pass (30 files, 33,753 bytes packed / 165,762 bytes unpacked)npm audit --omit=dev --audit-level=high— 0 vulnerabilitiesnpm audit --audit-level=high— 0 vulnerabilities.env.local, backups,node_modules, source maps, repository hero image, maintainer runbooks, detected Discord-token patterns, or local absolute pathsNo live Discord mutation was performed.
Release and publication
After required review and merge to protected
main, create GitHub Releasev0.1.1. That release triggers.github/workflows/publish.yml.NPM_TOKENremains configured because npm Trusted Publishing could not be verified (npm trust listreturned 403). Do not remove the token or workflow fallback until the trusted publisher is configured and verified on npmjs.com.Risk
Low. Runtime behavior changes only for backup-tool error delivery: clients now receive the intended structured error instead of an SDK schema-validation exception.