docs: refresh CLAUDE.md CLI coverage and fix stale release runbook - #3
Merged
Merged
Conversation
CLAUDE.md had not caught up with `meter oauth-proxy` or the three scaffolding template trees, and it described `verify` more narrowly than it runs. Add the missing surface, then move the template internals to docs/CLI_TEMPLATES.md so the always-loaded file keeps only what most sessions need. The one template fact that stays inline is the trap: nothing under templates/cloudflare-oauth/ is compiled or executed by `npm run verify`, because it sits outside typecheck:templates and needs dependencies this repo does not install. Its proxy.test.ts never runs here either. Co-Authored-By: Claude Opus 5 (1M context) <noreply@anthropic.com>
…book The runbook named `masterleopold/meter-sdk`, but the remote and the `repository.url` that verify-sdk-release.mjs asserts are both `VoxTechnologies/meter-sdk`. Running the `npm trust --repo` commands as written would have bound trusted publishing to the wrong repository. It also predated @meter-mcp/cli: the package list, bootstrap publishes, trust registrations, publish order, and the "all three packages" check all omitted it, and the scope was written as `@meter` rather than `@meter-mcp`. Describe what the publish workflow actually enforces (version parity, exact `sdk-v<version>` tag, publishConfig/repository, then the full verify gate) in place of guarantees it does not make, and record the public-repo preflight and the skip-if-already-published re-run safety. Co-Authored-By: Claude Opus 5 (1M context) <noreply@anthropic.com>
The npm audit --audit-level=low gate in npm run verify (audit:release) started failing on three advisories in the dev-only @modelcontextprotocol/sdk@1.29.0 tree: - GHSA-frvp-7c67-39w9 (moderate) in @hono/node-server <2.0.5 - GHSA-v2hh-gcrm-f6hx (high) in fast-uri 3.0.0 - 3.1.3 (via ajv) 1.29.0 is the latest sdk and still pins the vulnerable ranges, so a bump can't fix it. Pin the transitive deps to patched versions via overrides (matching the existing esbuild override). These packages are only used to typecheck the CLI templates and ship in no published package; verify passes end-to-end including typecheck:templates. Co-authored-by: Codesmith <codesmith-bot@users.noreply.github.com>
This file contains hidden or bidirectional Unicode text that may be interpreted or compiled differently than what appears below. To review, open the file in an editor that reveals hidden Unicode characters.
Learn more about bidirectional Unicode characters
Sign up for free
to join this conversation on GitHub.
Already have an account?
Sign in to comment
1 participant
Add this suggestion to a batch that can be applied as a single commit.This suggestion is invalid because no changes were made to the code.Suggestions cannot be applied while the pull request is closed.Suggestions cannot be applied while viewing a subset of changes.Only one suggestion per line can be applied in a batch.Add this suggestion to a batch that can be applied as a single commit.Applying suggestions on deleted lines is not supported.You must change the existing code in this line in order to create a valid suggestion.Outdated suggestions cannot be applied.This suggestion has been applied or marked resolved.Suggestions cannot be applied from pending reviews.Suggestions cannot be applied on multi-line comments.Suggestions cannot be applied while the pull request is queued to merge.Suggestion cannot be applied right now. Please check back later.
Documentation-only accuracy pass. No source or config changes.
CLAUDE.md
meter oauth-proxyand the Cloudflare template trees landed in 0.4.0/0.4.1 but were never described. Adds them, notes thatnpm run typecheckalso compilesexamples/and the CLI templates, and records whatverify-sdk-release.mjsactually pins.The template internals then move to
docs/CLI_TEMPLATES.md, keeping the always-loaded file focused. One fact stays inline because it needs to be known before opening anything: nothing undertemplates/cloudflare-oauth/is compiled or executed bynpm run verify— it sits outsidetypecheck:templates(deliberately: it needs@cloudflare/workers-oauth-provider,@cloudflare/workers-types, and vitest, and uses bundler-style extensionless imports), and itsproxy.test.tsdoes not run here either. Verified withtsc --listFiles: zerocloudflare-oauthfiles reach the template typecheck.docs/SDK_RELEASE.md
The runbook had drifted in three ways that would each mislead someone following it:
masterleopold/meter-sdk; the remote and therepository.urlthatscripts/verify-sdk-release.mjsasserts are bothVoxTechnologies/meter-sdk. Thenpm trust --repocommands as written would have bound trusted publishing to the wrong repository.@meter-mcp/cliwas absent from the package list, bootstrap publishes, trust registrations, publish order, and the "all three packages" verification step, even thoughsdk-publish.ymlpublishes it.@meter; the packages are@meter-mcp/*.Also replaces guarantees the publish workflow does not make ("dirty generated output, malformed tarballs") with what it enforces, and records the public-repo preflight and the skip-if-already-published re-run safety.
🤖 Generated with Claude Code
Need help on this PR? Tag
@codesmith-botwith what you need. Autofix is enabled.