diff --git a/.github/workflows/release.yml b/.github/workflows/release.yml index bac99cf..7d60400 100644 --- a/.github/workflows/release.yml +++ b/.github/workflows/release.yml @@ -311,11 +311,11 @@ jobs: VERSION: ${{ steps.metadata.outputs.version }} run: | for attempt in 1 2 3 4 5 6; do - if [[ "$(npm view "@codegraph/mcp@$VERSION" version --json 2>/dev/null)" == "\"$VERSION\"" ]]; then + if [[ "$(npm view "@agntk/codegraph-mcp@$VERSION" version --json 2>/dev/null)" == "\"$VERSION\"" ]]; then exit 0 fi if [[ "$attempt" == "6" ]]; then - echo "@codegraph/mcp@$VERSION did not become visible after six attempts" >&2 + echo "@agntk/codegraph-mcp@$VERSION did not become visible after six attempts" >&2 exit 1 fi sleep 10 @@ -327,9 +327,9 @@ jobs: VERSION: ${{ steps.metadata.outputs.version }} run: | mkdir -p tmp/registry - npm pack "@codegraph/mcp@$VERSION" --pack-destination tmp/registry + npm pack "@agntk/codegraph-mcp@$VERSION" --pack-destination tmp/registry node scripts/release/smoke-package.mjs \ - --tarball "tmp/registry/codegraph-mcp-$VERSION.tgz" \ + --tarball "tmp/registry/agntk-codegraph-mcp-$VERSION.tgz" \ --version "$VERSION" - name: Create package checksum @@ -394,14 +394,14 @@ jobs: VERSION: ${{ steps.metadata.outputs.version }} run: | mkdir -p tmp/registry - npm pack "@codegraph/mcp@$VERSION" --pack-destination tmp/registry + npm pack "@agntk/codegraph-mcp@$VERSION" --pack-destination tmp/registry if ! cmp -s "tmp/release/$FILENAME" "tmp/registry/$FILENAME"; then echo "Registry tarball does not match the artifact built from bootstrap_commit" >&2 sha256sum "tmp/release/$FILENAME" "tmp/registry/$FILENAME" >&2 exit 1 fi node scripts/release/smoke-package.mjs \ - --tarball "tmp/registry/codegraph-mcp-$VERSION.tgz" \ + --tarball "tmp/registry/agntk-codegraph-mcp-$VERSION.tgz" \ --version "$VERSION" - name: Create package checksum diff --git a/README.md b/README.md index 23e6b1d..e121273 100644 --- a/README.md +++ b/README.md @@ -17,7 +17,7 @@ CodeGraph turns source code and project knowledge into a searchable graph for AI - [Security policy](SECURITY.md) - [MIT license](LICENSE) -The public npm package is named `@codegraph/mcp`. Its npm link, version badge, and weekly-download badge will be added after the one-time `0.1.0` bootstrap publish is verified against the registry. +The public npm package is named `@agntk/codegraph-mcp`. Its npm link, version badge, and weekly-download badge will be added after the one-time `0.1.0` bootstrap publish is verified against the registry. ## What it does @@ -31,7 +31,7 @@ The public npm package is named `@codegraph/mcp`. Its npm link, version badge, a ## Choose how to start -CodeGraph requires Node.js 20 or newer. The npm commands below apply after `@codegraph/mcp` is visible in the npm registry. +CodeGraph requires Node.js 20 or newer. The npm commands below apply after `@agntk/codegraph-mcp` is visible in the npm registry. ### Agent-first with MCP @@ -42,7 +42,7 @@ Add this server configuration to an MCP client: "mcpServers": { "codegraph": { "command": "npx", - "args": ["-y", "-p", "@codegraph/mcp", "codegraph-mcp"] + "args": ["-y", "@agntk/codegraph-mcp"] } } } @@ -71,7 +71,7 @@ Configuration saves the project but does not index it. The full reindex parses s Start the dashboard directly from the package: ```bash -npx -y -p @codegraph/mcp codegraph-dashboard +npx -y -p @agntk/codegraph-mcp codegraph-dashboard ``` Open the URL printed by the process. A fresh database opens on the setup flow. Confirm storage and embeddings, choose Browse to select a folder, then select Index project. The page shows model download and indexing progress, finishes remaining embeddings automatically, and reports file, symbol, edge, and embedding counts before opening the graph explorer. @@ -171,7 +171,7 @@ pnpm release:check The basic installed-tarball smoke proves the package installs in a clean consumer, both binaries start, all five MCP tools are present, a fresh database is setup-safe, Browse and indexing work, data survives restarts, the dashboard and MCP process share one embedded server, and the exact tarball hash is reported. The release CI runs that installed artifact with embedded storage on Linux x64 and Apple silicon, and checks external FalkorDB guidance on Windows x64. An opt-in local-provider lane proves cold model download progress and a usable 768-dimension vector index. -A local tarball cannot prove npm registry resolution. Verify `npx -y -p @codegraph/mcp codegraph-mcp` and `npx -y -p @codegraph/mcp codegraph-dashboard` only after publication. +A clean-consumer local tarball proof verifies that bare `npx -y @agntk/codegraph-mcp` selects the `codegraph-mcp` bin and that `npx -y -p @agntk/codegraph-mcp codegraph-dashboard` selects the dashboard bin. Repeat both commands against the package name after publication to verify npm registry resolution. ## Development @@ -201,7 +201,7 @@ FalkorDBLite's Linux x64 and Apple silicon macOS binaries are installed with the | [`@codegraph/plugin-nlp`](packages/plugin-nlp/) | Embeddings, reranking, entity resolution, and document ingestion | | [`@codegraph/mcp-server`](packages/mcp-server/) | MCP transport and the five public tool groups | | [`@codegraph/cli`](packages/cli/) | Source-checkout command-line tools | -| [`@codegraph/mcp`](packages/npm-package/) | Public npm distribution staging and entry point | +| [`@agntk/codegraph-mcp`](packages/npm-package/) | Public npm distribution staging and entry point | | [`@codegraph/mcpb`](packages/mcpb/) | Platform-local MCPB desktop extension build | | [`@codegraph/api`](packages/api/) | REST API consumed by the dashboard | | [`@codegraph/dashboard`](packages/dashboard/) | Static dashboard UI served by the API | diff --git a/SECURITY.md b/SECURITY.md index 7ba7924..08e6dae 100644 --- a/SECURITY.md +++ b/SECURITY.md @@ -19,7 +19,7 @@ The maintainer will aim to acknowledge a report within 72 hours, provide status ## Known advisories in the package dependency tree -`npm audit` reports findings against `@codegraph/mcp` that we cannot resolve from this +`npm audit` reports findings against `@agntk/codegraph-mcp` that we cannot resolve from this repository. They are listed here rather than suppressed, and the release pipeline enforces the list: `pnpm audit:consumer` resolves the dependency tree an end user actually installs and fails on any unacknowledged advisory at high severity or above. An acknowledgement that @@ -28,7 +28,7 @@ stops matching a real advisory also fails the build, so this list cannot go stal ### sharp (GHSA-f88m-g3jw-g9cj), high `sharp` versions below 0.35.0 inherit libvips vulnerabilities CVE-2026-33327, CVE-2026-33328, -CVE-2026-35590 and CVE-2026-35591. `@codegraph/mcp` does not depend on `sharp` directly. It +CVE-2026-35590 and CVE-2026-35591. `@agntk/codegraph-mcp` does not depend on `sharp` directly. It arrives through `@huggingface/transformers`, which declares `sharp ^0.34.x` in every published release from 3.8.1 through 4.2.0, so no upstream version of that package resolves to a patched `sharp`. diff --git a/apps/web/components/landing/hero-section.tsx b/apps/web/components/landing/hero-section.tsx index 6f62b1b..d3082fd 100644 --- a/apps/web/components/landing/hero-section.tsx +++ b/apps/web/components/landing/hero-section.tsx @@ -76,7 +76,7 @@ export function HeroSection() { className="mx-auto mt-5 max-w-2xl rounded-lg border border-amber-400/30 bg-amber-400/10 px-4 py-3 text-left text-xs leading-5 text-amber-100 sm:text-sm" aria-label="Package publication status" > - Not yet published to npm. The package is @codegraph/mcp@0.1.0. The npx -y -p @codegraph/mcp codegraph-dashboard and npx -y -p @codegraph/mcp codegraph-mcp commands activate at publication; use the source setup today. + Not yet published to npm. The package is @agntk/codegraph-mcp@0.1.0. The npx -y @agntk/codegraph-mcp and npx -y -p @agntk/codegraph-mcp codegraph-dashboard commands activate at publication; use the source setup today. diff --git a/apps/web/components/landing/release-section.tsx b/apps/web/components/landing/release-section.tsx index bd04f91..bf2b35c 100644 --- a/apps/web/components/landing/release-section.tsx +++ b/apps/web/components/landing/release-section.tsx @@ -58,7 +58,7 @@ export function ReleaseSection() {
- Publication gate: @codegraph/mcp@0.1.0 is not in the npm registry yet. The package defines both codegraph-mcp and codegraph-dashboard bins, but registry-based install copy becomes active only after publication is verified. + Publication gate: @agntk/codegraph-mcp@0.1.0 is not in the npm registry yet. The package defines both codegraph-mcp and codegraph-dashboard bins, but registry-based install copy becomes active only after publication is verified.
diff --git a/apps/web/scripts/audit-landing.mjs b/apps/web/scripts/audit-landing.mjs index eacef25..2fdf125 100644 --- a/apps/web/scripts/audit-landing.mjs +++ b/apps/web/scripts/audit-landing.mjs @@ -41,14 +41,15 @@ const requiredClaims = [ 'Load next', '59% smaller', '25 installed-package assertions', - '@codegraph/mcp@0.1.0', - 'npx -y -p @codegraph/mcp codegraph-mcp', - 'npx -y -p @codegraph/mcp codegraph-dashboard', + '@agntk/codegraph-mcp@0.1.0', + 'npx -y @agntk/codegraph-mcp', + 'npx -y -p @agntk/codegraph-mcp codegraph-dashboard', ] const forbiddenClaims = [ /Jina/i, - /npx(?:\s+-y)?\s+(?!-p\s+@codegraph\/mcp\s+)codegraph-(?:mcp|dashboard)/, + /@codegraph\/mcp/, + /npx(?:\s+-y)?\s+(?!@agntk\/codegraph-mcp(?:\s|<)|-p\s+@agntk\/codegraph-mcp\s+codegraph-dashboard(?:\s|<))codegraph-(?:mcp|dashboard)/, /CODEGRAPH_DRIVER[^\n]*embedded/i, /0\.969/, /4 persona tools/i, diff --git a/docker-compose.yml b/docker-compose.yml index 2a467f9..8683748 100644 --- a/docker-compose.yml +++ b/docker-compose.yml @@ -37,7 +37,7 @@ services: # The API and the dashboard now run as one process from a single binary: # # pnpm dashboard # from a checkout - # npx -y -p @codegraph/mcp codegraph-dashboard # from the published package + # npx -y -p @agntk/codegraph-mcp codegraph-dashboard # from the published package # # Both serve the UI and the REST API on http://localhost:3001. Point them at # this database with FALKORDB_HOST=localhost FALKORDB_PORT=6379, or omit those diff --git a/docs/DISTRIBUTION-SETUP.md b/docs/DISTRIBUTION-SETUP.md index 647478c..74c11a0 100644 --- a/docs/DISTRIBUTION-SETUP.md +++ b/docs/DISTRIBUTION-SETUP.md @@ -1,6 +1,6 @@ # Distribution and Release Setup -This is the operator guide for the public `@codegraph/mcp` npm package and the platform-local MCPB desktop extension. The canonical source is [Phoenixrr2113/codebase-graph](https://github.com/Phoenixrr2113/codebase-graph). +This is the operator guide for the public `@agntk/codegraph-mcp` npm package and the platform-local MCPB desktop extension. The canonical source is [Phoenixrr2113/codebase-graph](https://github.com/Phoenixrr2113/codebase-graph). ## Release model @@ -29,7 +29,7 @@ Use a clean checkout of the reviewed commit. Confirm authentication without disp git status --short git rev-parse HEAD npm whoami -npm view @codegraph/mcp version --json +npm view @agntk/codegraph-mcp version --json ``` The status output must be empty. Save the full 40-character commit SHA as `BOOTSTRAP_COMMIT`; it identifies the reviewed source used to build the registry package. An npm `E404` response is expected before the first publication. Then run the full local gate: @@ -51,7 +51,7 @@ pnpm release:check Publish only the exact tarball created and verified by `pnpm release:check`: ```bash -npm publish tmp/release/codegraph-mcp-0.1.0.tgz --access public +npm publish tmp/release/agntk-codegraph-mcp-0.1.0.tgz --access public ``` The authenticated bootstrap cannot use trusted-publishing provenance because the npm package does not exist yet. Later releases use the trusted publisher and receive automatic provenance from npm. @@ -73,17 +73,17 @@ Installed runtime defaults are part of the package contract. `API_PORT` defaults From the repository root: ```bash -npm view @codegraph/mcp@0.1.0 name version license repository bin dist --json +npm view @agntk/codegraph-mcp@0.1.0 name version license repository bin dist --json mkdir -p tmp/registry -npm pack @codegraph/mcp@0.1.0 --pack-destination tmp/registry +npm pack @agntk/codegraph-mcp@0.1.0 --pack-destination tmp/registry node scripts/release/smoke-package.mjs \ - --tarball tmp/registry/codegraph-mcp-0.1.0.tgz \ + --tarball tmp/registry/agntk-codegraph-mcp-0.1.0.tgz \ --version 0.1.0 ``` The basic smoke creates a temporary consumer and installs the exact tarball without lifecycle scripts. Its 25 runtime assertions cover the matching CLI version, dashboard health and built assets, empty projects and embedding coverage, setup status, Browse roots, MCP initialization, the exact five-tool surface (`analyze`, `codebase`, `knowledge`, `query`, and `search`), project configuration, indexing, graph queries, restart persistence, concurrent MCP and dashboard access through one embedded server, shutdown order, persisted data, and the tarball SHA-256. -Release CI runs this installed artifact with embedded FalkorDBLite on Linux x64 and Apple silicon macOS. The macOS job first runs `brew install libomp openssl@3`. The Windows x64 job verifies the exact external FalkorDB guidance without attempting embedded startup. A local tarball does not prove npm registry resolution for the documented `npx` entry paths; check those only after publication. +Release CI runs this installed artifact with embedded FalkorDBLite on Linux x64 and Apple silicon macOS. The macOS job first runs `brew install libomp openssl@3`. The Windows x64 job verifies the exact external FalkorDB guidance without attempting embedded startup. A clean-consumer local tarball proof verifies the documented invocation shapes: bare `npx -y @agntk/codegraph-mcp` selects the MCP bin, while `npx -y -p @agntk/codegraph-mcp codegraph-dashboard` selects the dashboard bin. Repeat both commands against the package name after publication to verify npm registry resolution. After the registry smoke passes, create the GitHub `npm` environment for later tag releases. In GitHub Actions, open the Release workflow, choose **Run workflow** from `main`, enter `0.1.0` as `bootstrap_version`, and enter the saved full SHA as `bootstrap_commit`. This one-time path accepts only the `0.1.0` package version, checks out that exact commit, requires it to be reachable from `main`, reruns the full release gate, confirms that the exact version already exists on npm, requires the registry tarball to be byte-for-byte identical to the artifact rebuilt from `bootstrap_commit`, creates the annotated `v0.1.0` tag on that commit, and publishes the tarball plus checksum as a GitHub release. It does not use the `npm` environment, request an OIDC token, or call `npm publish` again. @@ -91,7 +91,7 @@ Do not push `v0.1.0` yourself after the manual npm publication. A normal tag-tri ## Configure trusted publishing -After `@codegraph/mcp` exists on npm, open its package settings and add a GitHub Actions trusted publisher with: +After `@agntk/codegraph-mcp` exists on npm, open its package settings and add a GitHub Actions trusted publisher with: | Field | Value | | --- | --- | diff --git a/mcp.json.example b/mcp.json.example index 2e3e180..ed2f26a 100644 --- a/mcp.json.example +++ b/mcp.json.example @@ -8,12 +8,12 @@ } } -// Post-publication, after @codegraph/mcp is verified in the npm registry +// Post-publication, after @agntk/codegraph-mcp is verified in the npm registry { "mcpServers": { "codegraph": { "command": "npx", - "args": ["-y", "-p", "@codegraph/mcp", "codegraph-mcp"] + "args": ["-y", "@agntk/codegraph-mcp"] } } } diff --git a/packages/dashboard/src/components/dashboard/setup-flow.tsx b/packages/dashboard/src/components/dashboard/setup-flow.tsx index c6dbf5e..1e66e99 100644 --- a/packages/dashboard/src/components/dashboard/setup-flow.tsx +++ b/packages/dashboard/src/components/dashboard/setup-flow.tsx @@ -436,7 +436,7 @@ export function SetupFlow({ apiUrl, status, onStatusRefresh, onProjectParsed, on
diff --git a/packages/mcp-server/README.md b/packages/mcp-server/README.md index bef7df6..dfade63 100644 --- a/packages/mcp-server/README.md +++ b/packages/mcp-server/README.md @@ -1,6 +1,6 @@ # @codegraph/mcp-server -Private workspace implementation of the CodeGraph Model Context Protocol server. The public `@codegraph/mcp` package stages this server with its runtime dependencies and dashboard. +Private workspace implementation of the CodeGraph Model Context Protocol server. The public `@agntk/codegraph-mcp` package stages this server with its runtime dependencies and dashboard. ## Grouped tools diff --git a/packages/npm-package/__tests__/cli.test.ts b/packages/npm-package/__tests__/cli.test.ts index 231d3a5..07af5da 100644 --- a/packages/npm-package/__tests__/cli.test.ts +++ b/packages/npm-package/__tests__/cli.test.ts @@ -25,7 +25,7 @@ describe('codegraph-mcp CLI', () => { ); writeFileSync( join(fixtureDirectory, 'package.json'), - JSON.stringify({ name: '@codegraph/mcp', version: '9.8.7', type: 'module' }), + JSON.stringify({ name: '@agntk/codegraph-mcp', version: '9.8.7', type: 'module' }), ); const result = spawnSync( @@ -50,7 +50,7 @@ describe('codegraph-mcp CLI', () => { ); writeFileSync( join(fixtureDirectory, 'package.json'), - JSON.stringify({ name: '@codegraph/mcp', version: '9.8.7', type: 'module' }), + JSON.stringify({ name: '@agntk/codegraph-mcp', version: '9.8.7', type: 'module' }), ); writeFileSync( join(fixtureDirectory, 'server', 'index.mjs'), diff --git a/packages/npm-package/__tests__/package-metadata.test.ts b/packages/npm-package/__tests__/package-metadata.test.ts index 5aff835..90f43bc 100644 --- a/packages/npm-package/__tests__/package-metadata.test.ts +++ b/packages/npm-package/__tests__/package-metadata.test.ts @@ -3,7 +3,7 @@ import { createPublishedManifest } from '../lib/package-metadata.mjs'; import { canonicalPackCommand, rejectSourcePackagePack } from '../guard-pack.mjs'; const packageManifest = { - name: '@codegraph/mcp', + name: '@agntk/codegraph-mcp', version: '0.1.0', description: 'CodeGraph MCP Server', type: 'module', @@ -71,7 +71,7 @@ describe('createPublishedManifest', () => { const manifest = createPublishedManifest({ packageManifest, dependencyManifests }); expect(manifest).toMatchObject({ - name: '@codegraph/mcp', + name: '@agntk/codegraph-mcp', version: '0.1.0', description: 'CodeGraph MCP Server', license: 'MIT', diff --git a/packages/npm-package/bin/codegraph-dashboard.mjs b/packages/npm-package/bin/codegraph-dashboard.mjs index 33f4879..dfdbbb9 100755 --- a/packages/npm-package/bin/codegraph-dashboard.mjs +++ b/packages/npm-package/bin/codegraph-dashboard.mjs @@ -31,7 +31,7 @@ function readPackageVersion() { if ( typeof manifest !== 'object' || manifest === null || - manifest.name !== '@codegraph/mcp' || + manifest.name !== '@agntk/codegraph-mcp' || typeof manifest.version !== 'string' ) { throw new Error('invalid package manifest'); diff --git a/packages/npm-package/bin/codegraph-mcp.mjs b/packages/npm-package/bin/codegraph-mcp.mjs index dbe632b..f794fa6 100644 --- a/packages/npm-package/bin/codegraph-mcp.mjs +++ b/packages/npm-package/bin/codegraph-mcp.mjs @@ -4,7 +4,7 @@ * * Usage: * codegraph-mcp # start MCP server (stdio transport) - * npx -y -p @codegraph/mcp codegraph-mcp # run without global install + * npx -y @agntk/codegraph-mcp # run without global install * * Environment: * CODEGRAPH_EMBEDDING_PROVIDER Embedding provider or "none" for offline mode @@ -26,7 +26,7 @@ function readPackageVersion() { if ( typeof manifest !== 'object' || manifest === null || - manifest.name !== '@codegraph/mcp' || + manifest.name !== '@agntk/codegraph-mcp' || typeof manifest.version !== 'string' ) { throw new Error('invalid package manifest'); diff --git a/packages/npm-package/build.mjs b/packages/npm-package/build.mjs index 82e1764..b9f06c2 100644 --- a/packages/npm-package/build.mjs +++ b/packages/npm-package/build.mjs @@ -141,7 +141,7 @@ Add this configuration to an MCP client after the package is visible in the npm "mcpServers": { "codegraph": { "command": "npx", - "args": ["-y", "-p", "@codegraph/mcp", "codegraph-mcp"] + "args": ["-y", "@agntk/codegraph-mcp"] } } } @@ -164,7 +164,7 @@ Configuration saves the project. Reindexing parses structure and finishes embedd Start the dashboard directly from this package: \`\`\`bash -npx -y -p @codegraph/mcp codegraph-dashboard +npx -y -p @agntk/codegraph-mcp codegraph-dashboard \`\`\` Open the URL printed by the process. A fresh database opens on setup. Confirm storage and embeddings, use Browse to choose a folder, then select Index project. The page shows download and indexing progress before opening the explorer. @@ -225,5 +225,5 @@ MIT ); const bundleBytes = readFileSync(resolve(outputDirectory, 'server/index.mjs')).byteLength; -console.log(`Built @codegraph/mcp staging directory (${(bundleBytes / 1024 / 1024).toFixed(1)} MB bundle).`); +console.log(`Built @agntk/codegraph-mcp staging directory (${(bundleBytes / 1024 / 1024).toFixed(1)} MB bundle).`); console.log('Canonical package command: pnpm pack:npm'); diff --git a/packages/npm-package/lib/package-metadata.mjs b/packages/npm-package/lib/package-metadata.mjs index 30e04c6..9b198ad 100644 --- a/packages/npm-package/lib/package-metadata.mjs +++ b/packages/npm-package/lib/package-metadata.mjs @@ -93,8 +93,8 @@ export function createPublishedManifest({ packageManifest, dependencyManifests } } const name = requireString(source, 'name', 'packageManifest'); - if (name !== '@codegraph/mcp') { - throw new TypeError('packageManifest.name must be @codegraph/mcp'); + if (name !== '@agntk/codegraph-mcp') { + throw new TypeError('packageManifest.name must be @agntk/codegraph-mcp'); } const publishConfig = cloneRecord(source, 'publishConfig', 'packageManifest'); if (publishConfig.access !== 'public') { diff --git a/packages/npm-package/package.json b/packages/npm-package/package.json index dc7322b..14df2b7 100644 --- a/packages/npm-package/package.json +++ b/packages/npm-package/package.json @@ -1,5 +1,5 @@ { - "name": "@codegraph/mcp", + "name": "@agntk/codegraph-mcp", "version": "0.1.0", "description": "CodeGraph MCP Server: Index any codebase into a graph database. Search by meaning, trace relationships, and manage project knowledge.", "type": "module", diff --git a/scripts/release/__tests__/smoke-package.test.ts b/scripts/release/__tests__/smoke-package.test.ts index 3df4639..cf4633d 100644 --- a/scripts/release/__tests__/smoke-package.test.ts +++ b/scripts/release/__tests__/smoke-package.test.ts @@ -43,7 +43,7 @@ function processResult( function createTarball(): string { const directory = mkdtempSync(join(tmpdir(), 'codegraph-smoke-test-')); temporaryDirectories.push(directory); - const tarballPath = join(directory, 'codegraph-mcp-0.1.0.tgz'); + const tarballPath = join(directory, 'agntk-codegraph-mcp-0.1.0.tgz'); writeFileSync(tarballPath, 'fixture'); return tarballPath; } @@ -200,10 +200,10 @@ describe('smokePackage', () => { }); expect(runner.run.mock.calls[1][1][0]).toMatch( - /node_modules[\\/]@codegraph[\\/]mcp[\\/]bin[\\/]codegraph-mcp\.mjs$/, + /node_modules[\\/]@agntk[\\/]codegraph-mcp[\\/]bin[\\/]codegraph-mcp\.mjs$/, ); expect(runner.run.mock.calls[2][1][2]).toMatch( - /node_modules[\\/]@codegraph[\\/]mcp$/, + /node_modules[\\/]@agntk[\\/]codegraph-mcp$/, ); }); }); @@ -344,12 +344,12 @@ describe('resolveSmokeInput', () => { it('accepts an exact tarball and version for downloaded CI artifacts', () => { expect(resolveSmokeInput([ '--tarball', - '/repo/tmp/release/codegraph-mcp-0.1.0.tgz', + '/repo/tmp/release/agntk-codegraph-mcp-0.1.0.tgz', '--version', '0.1.0', ], '/repo/tmp/release/package-result.json')).toEqual({ kind: 'tarball', - tarballPath: '/repo/tmp/release/codegraph-mcp-0.1.0.tgz', + tarballPath: '/repo/tmp/release/agntk-codegraph-mcp-0.1.0.tgz', expectedVersion: '0.1.0', mode: 'basic', }); @@ -371,7 +371,7 @@ describe('resolveSmokeInput', () => { it('rejects incomplete direct tarball input', () => { expect(() => resolveSmokeInput([ '--tarball', - '/repo/tmp/release/codegraph-mcp-0.1.0.tgz', + '/repo/tmp/release/agntk-codegraph-mcp-0.1.0.tgz', ], '/repo/tmp/release/package-result.json')).toThrow('--version'); }); }); @@ -379,11 +379,11 @@ describe('resolveSmokeInput', () => { describe('resolveValidatedPackageInput', () => { it('relocates a downloaded artifact beside its validation result', () => { expect(resolveValidatedPackageInput({ - tarballPath: '/home/runner/work/repo/tmp/release/codegraph-mcp-0.1.0.tgz', - filename: 'codegraph-mcp-0.1.0.tgz', + tarballPath: '/home/runner/work/repo/tmp/release/agntk-codegraph-mcp-0.1.0.tgz', + filename: 'agntk-codegraph-mcp-0.1.0.tgz', version: '0.1.0', }, '/different-runner/tmp/release/package-result.json')).toEqual({ - tarballPath: '/different-runner/tmp/release/codegraph-mcp-0.1.0.tgz', + tarballPath: '/different-runner/tmp/release/agntk-codegraph-mcp-0.1.0.tgz', expectedVersion: '0.1.0', }); }); diff --git a/scripts/release/__tests__/validate-package.test.ts b/scripts/release/__tests__/validate-package.test.ts index 3ea0a74..9b10c97 100644 --- a/scripts/release/__tests__/validate-package.test.ts +++ b/scripts/release/__tests__/validate-package.test.ts @@ -32,7 +32,7 @@ function createValidFixture(): string { writeFileSync(join(directory, 'LICENSE'), 'MIT License\n'); writeFileSync(join(directory, 'README.md'), '# CodeGraph\n'); writeFileSync(join(directory, 'package.json'), JSON.stringify({ - name: '@codegraph/mcp', + name: '@agntk/codegraph-mcp', version: '0.1.0', license: 'MIT', repository: { @@ -57,7 +57,7 @@ describe('validatePackageDirectory', () => { const directory = createValidFixture(); await expect(validatePackageDirectory(pathToFileURL(directory))).resolves.toMatchObject({ - name: '@codegraph/mcp', + name: '@agntk/codegraph-mcp', version: '0.1.0', fileCount: 8, }); @@ -137,28 +137,40 @@ describe('validatePackageDirectory', () => { describe('validatePackReport', () => { it('returns package and size metadata for a valid npm report', () => { expect(validatePackReport([{ - name: '@codegraph/mcp', + name: '@agntk/codegraph-mcp', version: '0.1.0', - filename: 'codegraph-mcp-0.1.0.tgz', + filename: 'agntk-codegraph-mcp-0.1.0.tgz', size: 1024, unpackedSize: 4096, entryCount: 5, files: [{ path: 'package/bin/codegraph-mcp.mjs', size: 20, mode: 493 }], }])).toEqual({ - name: '@codegraph/mcp', + name: '@agntk/codegraph-mcp', version: '0.1.0', - filename: 'codegraph-mcp-0.1.0.tgz', + filename: 'agntk-codegraph-mcp-0.1.0.tgz', fileCount: 5, packedSize: 1024, unpackedSize: 4096, }); }); - it('rejects packed artifacts over 15 MB', () => { + it('rejects a tarball filename that does not match the scoped package name', () => { expect(() => validatePackReport([{ - name: '@codegraph/mcp', + name: '@agntk/codegraph-mcp', version: '0.1.0', filename: 'codegraph-mcp-0.1.0.tgz', + size: 1024, + unpackedSize: 4096, + entryCount: 5, + files: [], + }])).toThrow('agntk-codegraph-mcp-0.1.0.tgz'); + }); + + it('rejects packed artifacts over 15 MB', () => { + expect(() => validatePackReport([{ + name: '@agntk/codegraph-mcp', + version: '0.1.0', + filename: 'agntk-codegraph-mcp-0.1.0.tgz', size: (15 * 1024 * 1024) + 1, unpackedSize: 20 * 1024 * 1024, entryCount: 5, diff --git a/scripts/release/__tests__/verify-release-tag.test.ts b/scripts/release/__tests__/verify-release-tag.test.ts index 67ce92f..702a6e3 100644 --- a/scripts/release/__tests__/verify-release-tag.test.ts +++ b/scripts/release/__tests__/verify-release-tag.test.ts @@ -8,8 +8,8 @@ import { describe('verifyReleaseTag', () => { it('accepts the exact stable package tag', () => { - expect(verifyReleaseTag('refs/tags/v0.1.0', '@codegraph/mcp', '0.1.0')).toEqual({ - packageName: '@codegraph/mcp', + expect(verifyReleaseTag('refs/tags/v0.1.0', '@agntk/codegraph-mcp', '0.1.0')).toEqual({ + packageName: '@agntk/codegraph-mcp', version: '0.1.0', }); }); @@ -17,7 +17,7 @@ describe('verifyReleaseTag', () => { it('rejects prerelease versions until a non-latest dist-tag policy exists', () => { expect(() => verifyReleaseTag( 'refs/tags/v1.2.3-rc.1', - '@codegraph/mcp', + '@agntk/codegraph-mcp', '1.2.3-rc.1', )).toThrow('stable'); }); @@ -25,7 +25,7 @@ describe('verifyReleaseTag', () => { it('rejects a tag without the v prefix', () => { expect(() => verifyReleaseTag( 'refs/tags/0.1.0', - '@codegraph/mcp', + '@agntk/codegraph-mcp', '0.1.0', )).toThrow('refs/tags/v0.1.0'); }); @@ -33,7 +33,7 @@ describe('verifyReleaseTag', () => { it('rejects a tag that does not match the package version', () => { expect(() => verifyReleaseTag( 'refs/tags/v0.2.0', - '@codegraph/mcp', + '@agntk/codegraph-mcp', '0.1.0', )).toThrow(/v0\.1\.0/); }); @@ -41,9 +41,9 @@ describe('verifyReleaseTag', () => { it('rejects the wrong package name', () => { expect(() => verifyReleaseTag( 'refs/tags/v0.1.0', - 'codegraph-mcp', + '@codegraph/mcp', '0.1.0', - )).toThrow('@codegraph/mcp'); + )).toThrow('@agntk/codegraph-mcp'); }); it.each([ @@ -55,7 +55,7 @@ describe('verifyReleaseTag', () => { ])('rejects invalid semantic version %s', (version) => { expect(() => verifyReleaseTag( `refs/tags/v${version}`, - '@codegraph/mcp', + '@agntk/codegraph-mcp', version, )).toThrow('valid semantic version'); }); @@ -69,10 +69,10 @@ describe('verifyBootstrapRelease', () => { 'refs/heads/main', '0.1.0', reviewedCommit, - '@codegraph/mcp', + '@agntk/codegraph-mcp', '0.1.0', )).toEqual({ - packageName: '@codegraph/mcp', + packageName: '@agntk/codegraph-mcp', version: '0.1.0', reviewedCommit, }); @@ -83,7 +83,7 @@ describe('verifyBootstrapRelease', () => { 'refs/heads/release', '0.1.0', reviewedCommit, - '@codegraph/mcp', + '@agntk/codegraph-mcp', '0.1.0', )).toThrow('main'); }); @@ -93,7 +93,7 @@ describe('verifyBootstrapRelease', () => { 'refs/heads/main', '0.2.0', reviewedCommit, - '@codegraph/mcp', + '@agntk/codegraph-mcp', '0.2.0', )).toThrow('0.1.0'); }); @@ -103,7 +103,7 @@ describe('verifyBootstrapRelease', () => { 'refs/heads/main', '0.1.0', reviewedCommit, - '@codegraph/mcp', + '@agntk/codegraph-mcp', '0.1.1', )).toThrow('match'); }); @@ -113,7 +113,7 @@ describe('verifyBootstrapRelease', () => { 'refs/heads/main', '0.1.0', '0123456', - '@codegraph/mcp', + '@agntk/codegraph-mcp', '0.1.0', )).toThrow('40-character'); }); @@ -125,7 +125,7 @@ describe('verifyVersionIsUnpublished', () => { status: 1, stderr: 'npm error code E404\nnpm error 404 Not Found', stdout: '', - }, '@codegraph/mcp', '0.1.0')).not.toThrow(); + }, '@agntk/codegraph-mcp', '0.1.0')).not.toThrow(); }); it('rejects a version that already exists', () => { @@ -133,7 +133,7 @@ describe('verifyVersionIsUnpublished', () => { status: 0, stderr: '', stdout: '"0.1.0"\n', - }, '@codegraph/mcp', '0.1.0')).toThrow('already exists'); + }, '@agntk/codegraph-mcp', '0.1.0')).toThrow('already exists'); }); it('does not treat authentication or network failures as availability', () => { @@ -141,7 +141,7 @@ describe('verifyVersionIsUnpublished', () => { status: 1, stderr: 'npm error code E401', stdout: '', - }, '@codegraph/mcp', '0.1.0')).toThrow('Unable to verify'); + }, '@agntk/codegraph-mcp', '0.1.0')).toThrow('Unable to verify'); }); }); @@ -151,7 +151,7 @@ describe('verifyVersionIsPublished', () => { status: 0, stderr: '', stdout: '"0.1.0"\n', - }, '@codegraph/mcp', '0.1.0')).not.toThrow(); + }, '@agntk/codegraph-mcp', '0.1.0')).not.toThrow(); }); it('rejects a missing package version', () => { @@ -159,7 +159,7 @@ describe('verifyVersionIsPublished', () => { status: 1, stderr: 'npm error code E404', stdout: '', - }, '@codegraph/mcp', '0.1.0')).toThrow('must already exist'); + }, '@agntk/codegraph-mcp', '0.1.0')).toThrow('must already exist'); }); it('rejects an unexpected published version response', () => { @@ -167,6 +167,6 @@ describe('verifyVersionIsPublished', () => { status: 0, stderr: '', stdout: '"0.1.1"\n', - }, '@codegraph/mcp', '0.1.0')).toThrow('expected 0.1.0'); + }, '@agntk/codegraph-mcp', '0.1.0')).toThrow('expected 0.1.0'); }); }); diff --git a/scripts/release/audit-consumer-tree.mjs b/scripts/release/audit-consumer-tree.mjs index f5f4391..604f28a 100644 --- a/scripts/release/audit-consumer-tree.mjs +++ b/scripts/release/audit-consumer-tree.mjs @@ -5,7 +5,7 @@ * * `pnpm audit --prod` audits this monorepo, where root `pnpm.overrides` can pin * a transitive dependency to a patched version. Those overrides are a property - * of this workspace and do NOT travel to anyone who runs `npm i @codegraph/mcp`. + * of this workspace and do NOT travel to anyone who runs `npm i @agntk/codegraph-mcp`. * Auditing only the workspace therefore reports "clean" while consumers install * something else. This script closes that gap by resolving the published * manifest's dependencies the way npm would for an end user. diff --git a/scripts/release/smoke-package.mjs b/scripts/release/smoke-package.mjs index ec66d1c..ffd5c7e 100644 --- a/scripts/release/smoke-package.mjs +++ b/scripts/release/smoke-package.mjs @@ -157,8 +157,8 @@ export async function smokePackage({ const binPath = join( consumerDirectory, 'node_modules', - '@codegraph', - 'mcp', + '@agntk', + 'codegraph-mcp', 'bin', 'codegraph-mcp.mjs', ); @@ -199,7 +199,7 @@ export async function smokePackage({ CODEGRAPH_DATA_DIR: dataDirectory, CODEGRAPH_DB_PATH: databaseDirectory, }; - const packageDirectory = join(consumerDirectory, 'node_modules', '@codegraph', 'mcp'); + const packageDirectory = join(consumerDirectory, 'node_modules', '@agntk', 'codegraph-mcp'); const runtimeResult = runner.run( process.execPath, [ diff --git a/scripts/release/validate-package.mjs b/scripts/release/validate-package.mjs index 5936690..1108a01 100644 --- a/scripts/release/validate-package.mjs +++ b/scripts/release/validate-package.mjs @@ -118,8 +118,8 @@ export async function validatePackageDirectory(directoryUrl) { if (workspaceLocation) { violations.push(`workspace: range found at ${workspaceLocation}`); } - if (manifest.name !== '@codegraph/mcp') { - violations.push('package.json name must be @codegraph/mcp'); + if (manifest.name !== '@agntk/codegraph-mcp') { + violations.push('package.json name must be @agntk/codegraph-mcp'); } if (typeof manifest.version !== 'string' || manifest.version.length === 0) { violations.push('package.json version must be a non-empty string'); @@ -226,14 +226,19 @@ export function validatePackReport(report) { } const item = requireRecord(report[0], 'npm pack report item', violations); const files = Array.isArray(item.files) ? item.files : []; - if (item.name !== '@codegraph/mcp') { - violations.push('packed package name must be @codegraph/mcp'); + if (item.name !== '@agntk/codegraph-mcp') { + violations.push('packed package name must be @agntk/codegraph-mcp'); } if (typeof item.version !== 'string' || item.version.length === 0) { violations.push('packed package version is missing'); } if (typeof item.filename !== 'string' || item.filename.length === 0) { violations.push('packed package filename is missing'); + } else if ( + typeof item.version === 'string' + && item.filename !== `agntk-codegraph-mcp-${item.version}.tgz` + ) { + violations.push(`packed package filename must be agntk-codegraph-mcp-${item.version}.tgz`); } if (typeof item.size !== 'number' || !Number.isFinite(item.size)) { violations.push('packed package size is invalid'); diff --git a/scripts/release/verify-release-tag.mjs b/scripts/release/verify-release-tag.mjs index 5768d44..631e9ff 100644 --- a/scripts/release/verify-release-tag.mjs +++ b/scripts/release/verify-release-tag.mjs @@ -5,7 +5,7 @@ import { readFile } from 'node:fs/promises'; import { dirname, resolve } from 'node:path'; import { fileURLToPath } from 'node:url'; -const packageName = '@codegraph/mcp'; +const packageName = '@agntk/codegraph-mcp'; const semanticVersionPattern = /^(0|[1-9]\d*)\.(0|[1-9]\d*)\.(0|[1-9]\d*)(?:-((?:0|[1-9]\d*|\d*[A-Za-z-][0-9A-Za-z-]*)(?:\.(?:0|[1-9]\d*|\d*[A-Za-z-][0-9A-Za-z-]*))*))?(?:\+([0-9A-Za-z-]+(?:\.[0-9A-Za-z-]+)*))?$/; const releaseDirectory = dirname(fileURLToPath(import.meta.url)); const rootDirectory = resolve(releaseDirectory, '../..');