From c4e58c37a931a224ca34f1d10fa5ebf5849e3ffe Mon Sep 17 00:00:00 2001 From: ViperJuice Date: Thu, 27 Aug 2026 16:38:47 +0000 Subject: [PATCH] chore: v2.6.0 Ships #195 and #189. #195: npm package identity now comes from npm's own parser -- nopt, @npmcli/config and npm-package-arg, loaded from the npm the command actually resolves to, running in a persistent node child. Where anything is unusual it REFUSES rather than guessing: every parsed config key must be in {yes, package}, the server env overlay must set no npm_config_*/PATH/HOME/NODE_*/PREFIX/NVM_*, npm must set no local prefix from the effective cwd, and the spec must be a tag/version/range that does not begin with a dash. Minor rather than patch: behaviour visibly changes. A server launched with an unusual config can no longer be auto-updated -- it refuses by name rather than probing. All 79 bundled npm servers still resolve and match the real binary, so the shipped fleet is unaffected. #189: the release-path workflow guards run in CI. release.yml triggers only on tag push, so it never appeared in PR checks; three layers now gate it -- structural invariants, job-set drift against the merge base, and a label tripwire for the remainder. 37 committed mutants, 31 killed. Known residual: user and global .npmrc are invisible to the resolver, so a package= or registry= line there can still redirect what npm fetches. Co-Authored-By: Claude Opus 5 Claude-Session: https://claude.ai/code/session_01T61zMNiPF4K29186r3uqc3 --- CHANGELOG.md | 2 ++ pyproject.toml | 2 +- src/pmcp/__init__.py | 2 +- uv.lock | 2 +- 4 files changed, 5 insertions(+), 3 deletions(-) diff --git a/CHANGELOG.md b/CHANGELOG.md index ac819579..5ae00d7e 100644 --- a/CHANGELOG.md +++ b/CHANGELOG.md @@ -7,6 +7,8 @@ and this project adheres to [Semantic Versioning](https://semver.org/spec/v2.0.0 ## [Unreleased] +## [2.6.0] - 2026-08-27 + ### Added - **The release-path workflow guards now run in CI.** `release.yml` triggers only on tag push — the tag push *is* the publish — so it never appeared in a diff --git a/pyproject.toml b/pyproject.toml index d388eb52..50e4fbb0 100644 --- a/pyproject.toml +++ b/pyproject.toml @@ -4,7 +4,7 @@ build-backend = "hatchling.build" [project] name = "pmcp" -version = "2.5.2" +version = "2.6.0" description = "PMCP - Progressive MCP: Minimal context bloat with on-demand tool discovery" readme = "README.md" license = "MIT" diff --git a/src/pmcp/__init__.py b/src/pmcp/__init__.py index 861e05f8..22e250d2 100644 --- a/src/pmcp/__init__.py +++ b/src/pmcp/__init__.py @@ -1,3 +1,3 @@ """PMCP - A meta-server for minimal Claude Code tool bloat.""" -__version__ = "2.5.2" +__version__ = "2.6.0" diff --git a/uv.lock b/uv.lock index d61e51d0..6a0f3a64 100644 --- a/uv.lock +++ b/uv.lock @@ -1068,7 +1068,7 @@ wheels = [ [[package]] name = "pmcp" -version = "2.5.2" +version = "2.6.0" source = { editable = "." } dependencies = [ { name = "aiohttp" },