From 641b8c89909687f2aa5f3697adf87ea7625301b8 Mon Sep 17 00:00:00 2001 From: Randy Wilson Date: Sun, 23 Aug 2026 22:57:18 -0400 Subject: [PATCH] Publish under @codegraph/mcp: npm rejected the unscoped name as too similar npm's moderation blocked codegraph-mcp for similarity to the existing code-graph-mcp package, so the public package becomes @codegraph/mcp under the newly claimed codegraph org. Both bins keep their names, so documented commands use the explicit form: npx -y -p @codegraph/mcp codegraph-dashboard. The release gate, workflow, docs, and landing all follow, and the full installed-tarball smoke passes against the scoped artifact. Co-Authored-By: Claude Fable 5 --- .github/workflows/release.yml | 8 ++-- README.md | 12 +++--- SECURITY.md | 4 +- apps/web/components/landing/hero-section.tsx | 2 +- .../components/landing/release-section.tsx | 2 +- apps/web/scripts/audit-landing.mjs | 7 ++-- docker-compose.yml | 2 +- docs/DISTRIBUTION-SETUP.md | 10 ++--- mcp.json.example | 4 +- .../src/components/dashboard/setup-flow.tsx | 2 +- packages/mcp-server/README.md | 2 +- packages/npm-package/__tests__/cli.test.ts | 4 +- .../__tests__/package-metadata.test.ts | 4 +- .../npm-package/bin/codegraph-dashboard.mjs | 2 +- packages/npm-package/bin/codegraph-mcp.mjs | 4 +- packages/npm-package/build.mjs | 6 +-- packages/npm-package/lib/package-metadata.mjs | 4 +- packages/npm-package/package.json | 2 +- .../release/__tests__/smoke-package.test.ts | 18 +++++++++ .../__tests__/validate-package.test.ts | 10 ++--- .../__tests__/verify-release-tag.test.ts | 40 +++++++++---------- scripts/release/audit-consumer-tree.mjs | 2 +- scripts/release/smoke-package.mjs | 5 ++- scripts/release/validate-package.mjs | 8 ++-- scripts/release/verify-release-tag.mjs | 2 +- 25 files changed, 93 insertions(+), 73 deletions(-) diff --git a/.github/workflows/release.yml b/.github/workflows/release.yml index 308b5ecf..bac99cfd 100644 --- a/.github/workflows/release.yml +++ b/.github/workflows/release.yml @@ -311,11 +311,11 @@ jobs: VERSION: ${{ steps.metadata.outputs.version }} run: | for attempt in 1 2 3 4 5 6; do - if [[ "$(npm view "codegraph-mcp@$VERSION" version --json 2>/dev/null)" == "\"$VERSION\"" ]]; then + if [[ "$(npm view "@codegraph/mcp@$VERSION" version --json 2>/dev/null)" == "\"$VERSION\"" ]]; then exit 0 fi if [[ "$attempt" == "6" ]]; then - echo "codegraph-mcp@$VERSION did not become visible after six attempts" >&2 + echo "@codegraph/mcp@$VERSION did not become visible after six attempts" >&2 exit 1 fi sleep 10 @@ -327,7 +327,7 @@ jobs: VERSION: ${{ steps.metadata.outputs.version }} run: | mkdir -p tmp/registry - npm pack "codegraph-mcp@$VERSION" --pack-destination tmp/registry + npm pack "@codegraph/mcp@$VERSION" --pack-destination tmp/registry node scripts/release/smoke-package.mjs \ --tarball "tmp/registry/codegraph-mcp-$VERSION.tgz" \ --version "$VERSION" @@ -394,7 +394,7 @@ jobs: VERSION: ${{ steps.metadata.outputs.version }} run: | mkdir -p tmp/registry - npm pack "codegraph-mcp@$VERSION" --pack-destination tmp/registry + npm pack "@codegraph/mcp@$VERSION" --pack-destination tmp/registry if ! cmp -s "tmp/release/$FILENAME" "tmp/registry/$FILENAME"; then echo "Registry tarball does not match the artifact built from bootstrap_commit" >&2 sha256sum "tmp/release/$FILENAME" "tmp/registry/$FILENAME" >&2 diff --git a/README.md b/README.md index 62a1fdb3..23e6b1d8 100644 --- a/README.md +++ b/README.md @@ -17,7 +17,7 @@ CodeGraph turns source code and project knowledge into a searchable graph for AI - [Security policy](SECURITY.md) - [MIT license](LICENSE) -The public npm package is named `codegraph-mcp`. Its npm link, version badge, and weekly-download badge will be added after the one-time `0.1.0` bootstrap publish is verified against the registry. +The public npm package is named `@codegraph/mcp`. Its npm link, version badge, and weekly-download badge will be added after the one-time `0.1.0` bootstrap publish is verified against the registry. ## What it does @@ -31,7 +31,7 @@ The public npm package is named `codegraph-mcp`. Its npm link, version badge, an ## Choose how to start -CodeGraph requires Node.js 20 or newer. The npm commands below apply after `codegraph-mcp` is visible in the npm registry. +CodeGraph requires Node.js 20 or newer. The npm commands below apply after `@codegraph/mcp` is visible in the npm registry. ### Agent-first with MCP @@ -42,7 +42,7 @@ Add this server configuration to an MCP client: "mcpServers": { "codegraph": { "command": "npx", - "args": ["-y", "codegraph-mcp"] + "args": ["-y", "-p", "@codegraph/mcp", "codegraph-mcp"] } } } @@ -71,7 +71,7 @@ Configuration saves the project but does not index it. The full reindex parses s Start the dashboard directly from the package: ```bash -npx -y --package codegraph-mcp codegraph-dashboard +npx -y -p @codegraph/mcp codegraph-dashboard ``` Open the URL printed by the process. A fresh database opens on the setup flow. Confirm storage and embeddings, choose Browse to select a folder, then select Index project. The page shows model download and indexing progress, finishes remaining embeddings automatically, and reports file, symbol, edge, and embedding counts before opening the graph explorer. @@ -171,7 +171,7 @@ pnpm release:check The basic installed-tarball smoke proves the package installs in a clean consumer, both binaries start, all five MCP tools are present, a fresh database is setup-safe, Browse and indexing work, data survives restarts, the dashboard and MCP process share one embedded server, and the exact tarball hash is reported. The release CI runs that installed artifact with embedded storage on Linux x64 and Apple silicon, and checks external FalkorDB guidance on Windows x64. An opt-in local-provider lane proves cold model download progress and a usable 768-dimension vector index. -A local tarball cannot prove npm registry resolution. Verify `npx -y codegraph-mcp` and `npx -y --package codegraph-mcp codegraph-dashboard` only after publication. +A local tarball cannot prove npm registry resolution. Verify `npx -y -p @codegraph/mcp codegraph-mcp` and `npx -y -p @codegraph/mcp codegraph-dashboard` only after publication. ## Development @@ -201,7 +201,7 @@ FalkorDBLite's Linux x64 and Apple silicon macOS binaries are installed with the | [`@codegraph/plugin-nlp`](packages/plugin-nlp/) | Embeddings, reranking, entity resolution, and document ingestion | | [`@codegraph/mcp-server`](packages/mcp-server/) | MCP transport and the five public tool groups | | [`@codegraph/cli`](packages/cli/) | Source-checkout command-line tools | -| [`codegraph-mcp`](packages/npm-package/) | Public npm distribution staging and entry point | +| [`@codegraph/mcp`](packages/npm-package/) | Public npm distribution staging and entry point | | [`@codegraph/mcpb`](packages/mcpb/) | Platform-local MCPB desktop extension build | | [`@codegraph/api`](packages/api/) | REST API consumed by the dashboard | | [`@codegraph/dashboard`](packages/dashboard/) | Static dashboard UI served by the API | diff --git a/SECURITY.md b/SECURITY.md index 2a8a449a..7ba79245 100644 --- a/SECURITY.md +++ b/SECURITY.md @@ -19,7 +19,7 @@ The maintainer will aim to acknowledge a report within 72 hours, provide status ## Known advisories in the package dependency tree -`npm audit` reports findings against `codegraph-mcp` that we cannot resolve from this +`npm audit` reports findings against `@codegraph/mcp` that we cannot resolve from this repository. They are listed here rather than suppressed, and the release pipeline enforces the list: `pnpm audit:consumer` resolves the dependency tree an end user actually installs and fails on any unacknowledged advisory at high severity or above. An acknowledgement that @@ -28,7 +28,7 @@ stops matching a real advisory also fails the build, so this list cannot go stal ### sharp (GHSA-f88m-g3jw-g9cj), high `sharp` versions below 0.35.0 inherit libvips vulnerabilities CVE-2026-33327, CVE-2026-33328, -CVE-2026-35590 and CVE-2026-35591. `codegraph-mcp` does not depend on `sharp` directly. It +CVE-2026-35590 and CVE-2026-35591. `@codegraph/mcp` does not depend on `sharp` directly. It arrives through `@huggingface/transformers`, which declares `sharp ^0.34.x` in every published release from 3.8.1 through 4.2.0, so no upstream version of that package resolves to a patched `sharp`. diff --git a/apps/web/components/landing/hero-section.tsx b/apps/web/components/landing/hero-section.tsx index e1303983..6f62b1b6 100644 --- a/apps/web/components/landing/hero-section.tsx +++ b/apps/web/components/landing/hero-section.tsx @@ -76,7 +76,7 @@ export function HeroSection() { className="mx-auto mt-5 max-w-2xl rounded-lg border border-amber-400/30 bg-amber-400/10 px-4 py-3 text-left text-xs leading-5 text-amber-100 sm:text-sm" aria-label="Package publication status" > - Not yet published to npm. The package is codegraph-mcp@0.1.0. The npx codegraph-dashboard and npx codegraph-mcp commands activate at publication; use the source setup today. + Not yet published to npm. The package is @codegraph/mcp@0.1.0. The npx -y -p @codegraph/mcp codegraph-dashboard and npx -y -p @codegraph/mcp codegraph-mcp commands activate at publication; use the source setup today. diff --git a/apps/web/components/landing/release-section.tsx b/apps/web/components/landing/release-section.tsx index d7c17427..bd04f91e 100644 --- a/apps/web/components/landing/release-section.tsx +++ b/apps/web/components/landing/release-section.tsx @@ -58,7 +58,7 @@ export function ReleaseSection() {
- Publication gate: codegraph-mcp@0.1.0 is not in the npm registry yet. The package defines both codegraph-mcp and codegraph-dashboard bins, but registry-based install copy becomes active only after publication is verified. + Publication gate: @codegraph/mcp@0.1.0 is not in the npm registry yet. The package defines both codegraph-mcp and codegraph-dashboard bins, but registry-based install copy becomes active only after publication is verified.
diff --git a/apps/web/scripts/audit-landing.mjs b/apps/web/scripts/audit-landing.mjs index 8948d9fa..eacef253 100644 --- a/apps/web/scripts/audit-landing.mjs +++ b/apps/web/scripts/audit-landing.mjs @@ -41,13 +41,14 @@ const requiredClaims = [ 'Load next', '59% smaller', '25 installed-package assertions', - 'codegraph-mcp', - 'codegraph-dashboard', + '@codegraph/mcp@0.1.0', + 'npx -y -p @codegraph/mcp codegraph-mcp', + 'npx -y -p @codegraph/mcp codegraph-dashboard', ] const forbiddenClaims = [ /Jina/i, - /@codegraph\/mcp/, + /npx(?:\s+-y)?\s+(?!-p\s+@codegraph\/mcp\s+)codegraph-(?:mcp|dashboard)/, /CODEGRAPH_DRIVER[^\n]*embedded/i, /0\.969/, /4 persona tools/i, diff --git a/docker-compose.yml b/docker-compose.yml index 19d25238..2a467f98 100644 --- a/docker-compose.yml +++ b/docker-compose.yml @@ -37,7 +37,7 @@ services: # The API and the dashboard now run as one process from a single binary: # # pnpm dashboard # from a checkout - # npx codegraph-dashboard # from the published package + # npx -y -p @codegraph/mcp codegraph-dashboard # from the published package # # Both serve the UI and the REST API on http://localhost:3001. Point them at # this database with FALKORDB_HOST=localhost FALKORDB_PORT=6379, or omit those diff --git a/docs/DISTRIBUTION-SETUP.md b/docs/DISTRIBUTION-SETUP.md index 2184a26f..647478c7 100644 --- a/docs/DISTRIBUTION-SETUP.md +++ b/docs/DISTRIBUTION-SETUP.md @@ -1,6 +1,6 @@ # Distribution and Release Setup -This is the operator guide for the public `codegraph-mcp` npm package and the platform-local MCPB desktop extension. The canonical source is [Phoenixrr2113/codebase-graph](https://github.com/Phoenixrr2113/codebase-graph). +This is the operator guide for the public `@codegraph/mcp` npm package and the platform-local MCPB desktop extension. The canonical source is [Phoenixrr2113/codebase-graph](https://github.com/Phoenixrr2113/codebase-graph). ## Release model @@ -29,7 +29,7 @@ Use a clean checkout of the reviewed commit. Confirm authentication without disp git status --short git rev-parse HEAD npm whoami -npm view codegraph-mcp version --json +npm view @codegraph/mcp version --json ``` The status output must be empty. Save the full 40-character commit SHA as `BOOTSTRAP_COMMIT`; it identifies the reviewed source used to build the registry package. An npm `E404` response is expected before the first publication. Then run the full local gate: @@ -73,9 +73,9 @@ Installed runtime defaults are part of the package contract. `API_PORT` defaults From the repository root: ```bash -npm view codegraph-mcp@0.1.0 name version license repository bin dist --json +npm view @codegraph/mcp@0.1.0 name version license repository bin dist --json mkdir -p tmp/registry -npm pack codegraph-mcp@0.1.0 --pack-destination tmp/registry +npm pack @codegraph/mcp@0.1.0 --pack-destination tmp/registry node scripts/release/smoke-package.mjs \ --tarball tmp/registry/codegraph-mcp-0.1.0.tgz \ --version 0.1.0 @@ -91,7 +91,7 @@ Do not push `v0.1.0` yourself after the manual npm publication. A normal tag-tri ## Configure trusted publishing -After `codegraph-mcp` exists on npm, open its package settings and add a GitHub Actions trusted publisher with: +After `@codegraph/mcp` exists on npm, open its package settings and add a GitHub Actions trusted publisher with: | Field | Value | | --- | --- | diff --git a/mcp.json.example b/mcp.json.example index 90a22ae0..2e3e1808 100644 --- a/mcp.json.example +++ b/mcp.json.example @@ -8,12 +8,12 @@ } } -// Post-publication, after codegraph-mcp is verified in the npm registry +// Post-publication, after @codegraph/mcp is verified in the npm registry { "mcpServers": { "codegraph": { "command": "npx", - "args": ["-y", "codegraph-mcp"] + "args": ["-y", "-p", "@codegraph/mcp", "codegraph-mcp"] } } } diff --git a/packages/dashboard/src/components/dashboard/setup-flow.tsx b/packages/dashboard/src/components/dashboard/setup-flow.tsx index 26e0f772..c6dbf5e5 100644 --- a/packages/dashboard/src/components/dashboard/setup-flow.tsx +++ b/packages/dashboard/src/components/dashboard/setup-flow.tsx @@ -436,7 +436,7 @@ export function SetupFlow({ apiUrl, status, onStatusRefresh, onProjectParsed, on
diff --git a/packages/mcp-server/README.md b/packages/mcp-server/README.md index 181a0ffa..bef7df63 100644 --- a/packages/mcp-server/README.md +++ b/packages/mcp-server/README.md @@ -1,6 +1,6 @@ # @codegraph/mcp-server -Private workspace implementation of the CodeGraph Model Context Protocol server. The public `codegraph-mcp` package stages this server with its runtime dependencies and dashboard. +Private workspace implementation of the CodeGraph Model Context Protocol server. The public `@codegraph/mcp` package stages this server with its runtime dependencies and dashboard. ## Grouped tools diff --git a/packages/npm-package/__tests__/cli.test.ts b/packages/npm-package/__tests__/cli.test.ts index 2601eac8..231d3a56 100644 --- a/packages/npm-package/__tests__/cli.test.ts +++ b/packages/npm-package/__tests__/cli.test.ts @@ -25,7 +25,7 @@ describe('codegraph-mcp CLI', () => { ); writeFileSync( join(fixtureDirectory, 'package.json'), - JSON.stringify({ name: 'codegraph-mcp', version: '9.8.7', type: 'module' }), + JSON.stringify({ name: '@codegraph/mcp', version: '9.8.7', type: 'module' }), ); const result = spawnSync( @@ -50,7 +50,7 @@ describe('codegraph-mcp CLI', () => { ); writeFileSync( join(fixtureDirectory, 'package.json'), - JSON.stringify({ name: 'codegraph-mcp', version: '9.8.7', type: 'module' }), + JSON.stringify({ name: '@codegraph/mcp', version: '9.8.7', type: 'module' }), ); writeFileSync( join(fixtureDirectory, 'server', 'index.mjs'), diff --git a/packages/npm-package/__tests__/package-metadata.test.ts b/packages/npm-package/__tests__/package-metadata.test.ts index 9d32e7a9..5aff835e 100644 --- a/packages/npm-package/__tests__/package-metadata.test.ts +++ b/packages/npm-package/__tests__/package-metadata.test.ts @@ -3,7 +3,7 @@ import { createPublishedManifest } from '../lib/package-metadata.mjs'; import { canonicalPackCommand, rejectSourcePackagePack } from '../guard-pack.mjs'; const packageManifest = { - name: 'codegraph-mcp', + name: '@codegraph/mcp', version: '0.1.0', description: 'CodeGraph MCP Server', type: 'module', @@ -71,7 +71,7 @@ describe('createPublishedManifest', () => { const manifest = createPublishedManifest({ packageManifest, dependencyManifests }); expect(manifest).toMatchObject({ - name: 'codegraph-mcp', + name: '@codegraph/mcp', version: '0.1.0', description: 'CodeGraph MCP Server', license: 'MIT', diff --git a/packages/npm-package/bin/codegraph-dashboard.mjs b/packages/npm-package/bin/codegraph-dashboard.mjs index 2380ec27..33f48799 100755 --- a/packages/npm-package/bin/codegraph-dashboard.mjs +++ b/packages/npm-package/bin/codegraph-dashboard.mjs @@ -31,7 +31,7 @@ function readPackageVersion() { if ( typeof manifest !== 'object' || manifest === null || - manifest.name !== 'codegraph-mcp' || + manifest.name !== '@codegraph/mcp' || typeof manifest.version !== 'string' ) { throw new Error('invalid package manifest'); diff --git a/packages/npm-package/bin/codegraph-mcp.mjs b/packages/npm-package/bin/codegraph-mcp.mjs index a2b42330..dbe632b7 100644 --- a/packages/npm-package/bin/codegraph-mcp.mjs +++ b/packages/npm-package/bin/codegraph-mcp.mjs @@ -4,7 +4,7 @@ * * Usage: * codegraph-mcp # start MCP server (stdio transport) - * npx codegraph-mcp # run without global install + * npx -y -p @codegraph/mcp codegraph-mcp # run without global install * * Environment: * CODEGRAPH_EMBEDDING_PROVIDER Embedding provider or "none" for offline mode @@ -26,7 +26,7 @@ function readPackageVersion() { if ( typeof manifest !== 'object' || manifest === null || - manifest.name !== 'codegraph-mcp' || + manifest.name !== '@codegraph/mcp' || typeof manifest.version !== 'string' ) { throw new Error('invalid package manifest'); diff --git a/packages/npm-package/build.mjs b/packages/npm-package/build.mjs index 074a35f0..82e1764c 100644 --- a/packages/npm-package/build.mjs +++ b/packages/npm-package/build.mjs @@ -141,7 +141,7 @@ Add this configuration to an MCP client after the package is visible in the npm "mcpServers": { "codegraph": { "command": "npx", - "args": ["-y", "codegraph-mcp"] + "args": ["-y", "-p", "@codegraph/mcp", "codegraph-mcp"] } } } @@ -164,7 +164,7 @@ Configuration saves the project. Reindexing parses structure and finishes embedd Start the dashboard directly from this package: \`\`\`bash -npx -y --package codegraph-mcp codegraph-dashboard +npx -y -p @codegraph/mcp codegraph-dashboard \`\`\` Open the URL printed by the process. A fresh database opens on setup. Confirm storage and embeddings, use Browse to choose a folder, then select Index project. The page shows download and indexing progress before opening the explorer. @@ -225,5 +225,5 @@ MIT ); const bundleBytes = readFileSync(resolve(outputDirectory, 'server/index.mjs')).byteLength; -console.log(`Built codegraph-mcp staging directory (${(bundleBytes / 1024 / 1024).toFixed(1)} MB bundle).`); +console.log(`Built @codegraph/mcp staging directory (${(bundleBytes / 1024 / 1024).toFixed(1)} MB bundle).`); console.log('Canonical package command: pnpm pack:npm'); diff --git a/packages/npm-package/lib/package-metadata.mjs b/packages/npm-package/lib/package-metadata.mjs index 0d00bdb5..30e04c6a 100644 --- a/packages/npm-package/lib/package-metadata.mjs +++ b/packages/npm-package/lib/package-metadata.mjs @@ -93,8 +93,8 @@ export function createPublishedManifest({ packageManifest, dependencyManifests } } const name = requireString(source, 'name', 'packageManifest'); - if (name !== 'codegraph-mcp') { - throw new TypeError('packageManifest.name must be codegraph-mcp'); + if (name !== '@codegraph/mcp') { + throw new TypeError('packageManifest.name must be @codegraph/mcp'); } const publishConfig = cloneRecord(source, 'publishConfig', 'packageManifest'); if (publishConfig.access !== 'public') { diff --git a/packages/npm-package/package.json b/packages/npm-package/package.json index 8ac3e465..dc7322b3 100644 --- a/packages/npm-package/package.json +++ b/packages/npm-package/package.json @@ -1,5 +1,5 @@ { - "name": "codegraph-mcp", + "name": "@codegraph/mcp", "version": "0.1.0", "description": "CodeGraph MCP Server: Index any codebase into a graph database. Search by meaning, trace relationships, and manage project knowledge.", "type": "module", diff --git a/scripts/release/__tests__/smoke-package.test.ts b/scripts/release/__tests__/smoke-package.test.ts index 317834e0..3df4639d 100644 --- a/scripts/release/__tests__/smoke-package.test.ts +++ b/scripts/release/__tests__/smoke-package.test.ts @@ -188,6 +188,24 @@ describe('smokePackage', () => { })); expect(String(handshakeOptions.env?.CODEGRAPH_DB_PATH).length).toBeLessThan(90); }); + + it('boots both installed entry points from the scoped package directory', async () => { + const runner = successfulRunner(); + + await smokePackage({ + verifyDashboard: async () => ({ port: 0, asset: '/assets/index-test.js' }), + tarballPath: createTarball(), + expectedVersion: '0.1.0', + runner, + }); + + expect(runner.run.mock.calls[1][1][0]).toMatch( + /node_modules[\\/]@codegraph[\\/]mcp[\\/]bin[\\/]codegraph-mcp\.mjs$/, + ); + expect(runner.run.mock.calls[2][1][2]).toMatch( + /node_modules[\\/]@codegraph[\\/]mcp$/, + ); + }); }); describe('smoke helpers', () => { diff --git a/scripts/release/__tests__/validate-package.test.ts b/scripts/release/__tests__/validate-package.test.ts index 1e544dec..3ea0a749 100644 --- a/scripts/release/__tests__/validate-package.test.ts +++ b/scripts/release/__tests__/validate-package.test.ts @@ -32,7 +32,7 @@ function createValidFixture(): string { writeFileSync(join(directory, 'LICENSE'), 'MIT License\n'); writeFileSync(join(directory, 'README.md'), '# CodeGraph\n'); writeFileSync(join(directory, 'package.json'), JSON.stringify({ - name: 'codegraph-mcp', + name: '@codegraph/mcp', version: '0.1.0', license: 'MIT', repository: { @@ -57,7 +57,7 @@ describe('validatePackageDirectory', () => { const directory = createValidFixture(); await expect(validatePackageDirectory(pathToFileURL(directory))).resolves.toMatchObject({ - name: 'codegraph-mcp', + name: '@codegraph/mcp', version: '0.1.0', fileCount: 8, }); @@ -137,7 +137,7 @@ describe('validatePackageDirectory', () => { describe('validatePackReport', () => { it('returns package and size metadata for a valid npm report', () => { expect(validatePackReport([{ - name: 'codegraph-mcp', + name: '@codegraph/mcp', version: '0.1.0', filename: 'codegraph-mcp-0.1.0.tgz', size: 1024, @@ -145,7 +145,7 @@ describe('validatePackReport', () => { entryCount: 5, files: [{ path: 'package/bin/codegraph-mcp.mjs', size: 20, mode: 493 }], }])).toEqual({ - name: 'codegraph-mcp', + name: '@codegraph/mcp', version: '0.1.0', filename: 'codegraph-mcp-0.1.0.tgz', fileCount: 5, @@ -156,7 +156,7 @@ describe('validatePackReport', () => { it('rejects packed artifacts over 15 MB', () => { expect(() => validatePackReport([{ - name: 'codegraph-mcp', + name: '@codegraph/mcp', version: '0.1.0', filename: 'codegraph-mcp-0.1.0.tgz', size: (15 * 1024 * 1024) + 1, diff --git a/scripts/release/__tests__/verify-release-tag.test.ts b/scripts/release/__tests__/verify-release-tag.test.ts index 16462c8f..67ce92f6 100644 --- a/scripts/release/__tests__/verify-release-tag.test.ts +++ b/scripts/release/__tests__/verify-release-tag.test.ts @@ -8,8 +8,8 @@ import { describe('verifyReleaseTag', () => { it('accepts the exact stable package tag', () => { - expect(verifyReleaseTag('refs/tags/v0.1.0', 'codegraph-mcp', '0.1.0')).toEqual({ - packageName: 'codegraph-mcp', + expect(verifyReleaseTag('refs/tags/v0.1.0', '@codegraph/mcp', '0.1.0')).toEqual({ + packageName: '@codegraph/mcp', version: '0.1.0', }); }); @@ -17,7 +17,7 @@ describe('verifyReleaseTag', () => { it('rejects prerelease versions until a non-latest dist-tag policy exists', () => { expect(() => verifyReleaseTag( 'refs/tags/v1.2.3-rc.1', - 'codegraph-mcp', + '@codegraph/mcp', '1.2.3-rc.1', )).toThrow('stable'); }); @@ -25,7 +25,7 @@ describe('verifyReleaseTag', () => { it('rejects a tag without the v prefix', () => { expect(() => verifyReleaseTag( 'refs/tags/0.1.0', - 'codegraph-mcp', + '@codegraph/mcp', '0.1.0', )).toThrow('refs/tags/v0.1.0'); }); @@ -33,7 +33,7 @@ describe('verifyReleaseTag', () => { it('rejects a tag that does not match the package version', () => { expect(() => verifyReleaseTag( 'refs/tags/v0.2.0', - 'codegraph-mcp', + '@codegraph/mcp', '0.1.0', )).toThrow(/v0\.1\.0/); }); @@ -41,9 +41,9 @@ describe('verifyReleaseTag', () => { it('rejects the wrong package name', () => { expect(() => verifyReleaseTag( 'refs/tags/v0.1.0', - '@codegraph/mcp', + 'codegraph-mcp', '0.1.0', - )).toThrow('codegraph-mcp'); + )).toThrow('@codegraph/mcp'); }); it.each([ @@ -55,7 +55,7 @@ describe('verifyReleaseTag', () => { ])('rejects invalid semantic version %s', (version) => { expect(() => verifyReleaseTag( `refs/tags/v${version}`, - 'codegraph-mcp', + '@codegraph/mcp', version, )).toThrow('valid semantic version'); }); @@ -69,10 +69,10 @@ describe('verifyBootstrapRelease', () => { 'refs/heads/main', '0.1.0', reviewedCommit, - 'codegraph-mcp', + '@codegraph/mcp', '0.1.0', )).toEqual({ - packageName: 'codegraph-mcp', + packageName: '@codegraph/mcp', version: '0.1.0', reviewedCommit, }); @@ -83,7 +83,7 @@ describe('verifyBootstrapRelease', () => { 'refs/heads/release', '0.1.0', reviewedCommit, - 'codegraph-mcp', + '@codegraph/mcp', '0.1.0', )).toThrow('main'); }); @@ -93,7 +93,7 @@ describe('verifyBootstrapRelease', () => { 'refs/heads/main', '0.2.0', reviewedCommit, - 'codegraph-mcp', + '@codegraph/mcp', '0.2.0', )).toThrow('0.1.0'); }); @@ -103,7 +103,7 @@ describe('verifyBootstrapRelease', () => { 'refs/heads/main', '0.1.0', reviewedCommit, - 'codegraph-mcp', + '@codegraph/mcp', '0.1.1', )).toThrow('match'); }); @@ -113,7 +113,7 @@ describe('verifyBootstrapRelease', () => { 'refs/heads/main', '0.1.0', '0123456', - 'codegraph-mcp', + '@codegraph/mcp', '0.1.0', )).toThrow('40-character'); }); @@ -125,7 +125,7 @@ describe('verifyVersionIsUnpublished', () => { status: 1, stderr: 'npm error code E404\nnpm error 404 Not Found', stdout: '', - }, 'codegraph-mcp', '0.1.0')).not.toThrow(); + }, '@codegraph/mcp', '0.1.0')).not.toThrow(); }); it('rejects a version that already exists', () => { @@ -133,7 +133,7 @@ describe('verifyVersionIsUnpublished', () => { status: 0, stderr: '', stdout: '"0.1.0"\n', - }, 'codegraph-mcp', '0.1.0')).toThrow('already exists'); + }, '@codegraph/mcp', '0.1.0')).toThrow('already exists'); }); it('does not treat authentication or network failures as availability', () => { @@ -141,7 +141,7 @@ describe('verifyVersionIsUnpublished', () => { status: 1, stderr: 'npm error code E401', stdout: '', - }, 'codegraph-mcp', '0.1.0')).toThrow('Unable to verify'); + }, '@codegraph/mcp', '0.1.0')).toThrow('Unable to verify'); }); }); @@ -151,7 +151,7 @@ describe('verifyVersionIsPublished', () => { status: 0, stderr: '', stdout: '"0.1.0"\n', - }, 'codegraph-mcp', '0.1.0')).not.toThrow(); + }, '@codegraph/mcp', '0.1.0')).not.toThrow(); }); it('rejects a missing package version', () => { @@ -159,7 +159,7 @@ describe('verifyVersionIsPublished', () => { status: 1, stderr: 'npm error code E404', stdout: '', - }, 'codegraph-mcp', '0.1.0')).toThrow('must already exist'); + }, '@codegraph/mcp', '0.1.0')).toThrow('must already exist'); }); it('rejects an unexpected published version response', () => { @@ -167,6 +167,6 @@ describe('verifyVersionIsPublished', () => { status: 0, stderr: '', stdout: '"0.1.1"\n', - }, 'codegraph-mcp', '0.1.0')).toThrow('expected 0.1.0'); + }, '@codegraph/mcp', '0.1.0')).toThrow('expected 0.1.0'); }); }); diff --git a/scripts/release/audit-consumer-tree.mjs b/scripts/release/audit-consumer-tree.mjs index ea8a07e2..f5f43914 100644 --- a/scripts/release/audit-consumer-tree.mjs +++ b/scripts/release/audit-consumer-tree.mjs @@ -5,7 +5,7 @@ * * `pnpm audit --prod` audits this monorepo, where root `pnpm.overrides` can pin * a transitive dependency to a patched version. Those overrides are a property - * of this workspace and do NOT travel to anyone who runs `npm i codegraph-mcp`. + * of this workspace and do NOT travel to anyone who runs `npm i @codegraph/mcp`. * Auditing only the workspace therefore reports "clean" while consumers install * something else. This script closes that gap by resolving the published * manifest's dependencies the way npm would for an end user. diff --git a/scripts/release/smoke-package.mjs b/scripts/release/smoke-package.mjs index fe294bb0..ec66d1c8 100644 --- a/scripts/release/smoke-package.mjs +++ b/scripts/release/smoke-package.mjs @@ -157,7 +157,8 @@ export async function smokePackage({ const binPath = join( consumerDirectory, 'node_modules', - 'codegraph-mcp', + '@codegraph', + 'mcp', 'bin', 'codegraph-mcp.mjs', ); @@ -198,7 +199,7 @@ export async function smokePackage({ CODEGRAPH_DATA_DIR: dataDirectory, CODEGRAPH_DB_PATH: databaseDirectory, }; - const packageDirectory = join(consumerDirectory, 'node_modules', 'codegraph-mcp'); + const packageDirectory = join(consumerDirectory, 'node_modules', '@codegraph', 'mcp'); const runtimeResult = runner.run( process.execPath, [ diff --git a/scripts/release/validate-package.mjs b/scripts/release/validate-package.mjs index 47113e4b..5936690b 100644 --- a/scripts/release/validate-package.mjs +++ b/scripts/release/validate-package.mjs @@ -118,8 +118,8 @@ export async function validatePackageDirectory(directoryUrl) { if (workspaceLocation) { violations.push(`workspace: range found at ${workspaceLocation}`); } - if (manifest.name !== 'codegraph-mcp') { - violations.push('package.json name must be codegraph-mcp'); + if (manifest.name !== '@codegraph/mcp') { + violations.push('package.json name must be @codegraph/mcp'); } if (typeof manifest.version !== 'string' || manifest.version.length === 0) { violations.push('package.json version must be a non-empty string'); @@ -226,8 +226,8 @@ export function validatePackReport(report) { } const item = requireRecord(report[0], 'npm pack report item', violations); const files = Array.isArray(item.files) ? item.files : []; - if (item.name !== 'codegraph-mcp') { - violations.push('packed package name must be codegraph-mcp'); + if (item.name !== '@codegraph/mcp') { + violations.push('packed package name must be @codegraph/mcp'); } if (typeof item.version !== 'string' || item.version.length === 0) { violations.push('packed package version is missing'); diff --git a/scripts/release/verify-release-tag.mjs b/scripts/release/verify-release-tag.mjs index 51eef964..5768d442 100644 --- a/scripts/release/verify-release-tag.mjs +++ b/scripts/release/verify-release-tag.mjs @@ -5,7 +5,7 @@ import { readFile } from 'node:fs/promises'; import { dirname, resolve } from 'node:path'; import { fileURLToPath } from 'node:url'; -const packageName = 'codegraph-mcp'; +const packageName = '@codegraph/mcp'; const semanticVersionPattern = /^(0|[1-9]\d*)\.(0|[1-9]\d*)\.(0|[1-9]\d*)(?:-((?:0|[1-9]\d*|\d*[A-Za-z-][0-9A-Za-z-]*)(?:\.(?:0|[1-9]\d*|\d*[A-Za-z-][0-9A-Za-z-]*))*))?(?:\+([0-9A-Za-z-]+(?:\.[0-9A-Za-z-]+)*))?$/; const releaseDirectory = dirname(fileURLToPath(import.meta.url)); const rootDirectory = resolve(releaseDirectory, '../..');