chore: prepare 2.0.0 release - #70
Merged
Merged
Conversation
Packaging, version-reporting, and doc fixes that must land on main before
the release PR merges — npm-publish checks out main at the release commit,
so none of this can ride in the release PR itself.
Packaging (the blocker): package.json had no `files` array and there is no
.npmignore, so npm fell back to .gitignore. `npm pack` produced 153 files /
943kB including all of src/, all 33 test files, .github/, and
.claude/settings.local.json. Adding an explicit allowlist brings that to
80 files / 482kB. It also removes the latent hazard that .gitignore's
`dist/` entry could someday publish a package with no runtime code.
Version reporting: src/index.ts hardcoded "1.2.0" in the MCP Server
constructor (what every client sees in the initialize handshake) and
"1.2.3" in the connection status payload. Both are now 2.0.0 and carry
x-release-please-version annotations, with src/index.ts registered as a
generic extra-file so future releases stay in sync.
CI: add 24.x to the test matrix. The npm-publish job runs `npm test` on
Node 24, so a Node-24-only failure would otherwise surface as a git tag
and GitHub Release with no npm publish.
Docs: README gains a Node >=20.16.0 requirement (previously mentioned
nowhere), a 1.x upgrade note, and sections for the four undocumented
tools — most importantly evernote_get_resource, whose binary→text default
flip is the headline runtime break. Fixes the contributing instruction
that told people to target `develop`. CONNECTION_TROUBLESHOOTING.md, which
README links twice, presented ten retired tool names as the current API;
those now use evernote_connection({action}).
Co-Authored-By: Claude Opus 5 <noreply@anthropic.com>
release-please's config schema only allows json/toml/yaml/xml in the
object form of extra-files. `{"type": "generic", ...}` would have failed
validation and broken the release-please run outright — generic files
must be given as a plain path string.
Co-Authored-By: Claude Opus 5 <noreply@anthropic.com>
![chatgpt-codex-connector[bot]](https://avatars.githubusercontent.com/in/1144995?s=60&v=4){kind=small}
There was a problem hiding this comment.
💡 Codex Review
Here are some automated review suggestions for this pull request.
Reviewed commit: afda2f2c6d
ℹ️ About Codex in GitHub
Your team has set up Codex to review pull requests in this repo. Reviews are triggered when you
- Open a pull request for review
- Mark a draft as ready
- Comment "@codex review".
If Codex has suggestions, it will comment; otherwise it will react with 👍.
Codex can also answer questions or update the PR. Try commenting "@codex address that feedback".
Release PR #39 sat unmergeable for seven months. The org ruleset requires the `test` status check, but release-please-action authored its PR with the default GITHUB_TOKEN, and GitHub suppresses workflow triggers for GITHUB_TOKEN-authored events. ci.yml therefore never ran on the release branch — check-runs on its head SHA returned total_count 0 — so the required check could never appear and the PR could never merge. Passing the org-level RELEASE_PLEASE_TOKEN makes release PRs trigger CI like any other PR. Adding a push/pull_request trigger for release-please--* branches would not work; only workflow_dispatch and repository_dispatch escape the suppression. Co-Authored-By: Claude Opus 5 <noreply@anthropic.com>
jack-arturo
added a commit
that referenced
this pull request
Aug 12, 2026
package.json claimed `>=20.16.0`, but pdf-parse@2.4.5 declares `>=20.16.0 <21 || >=22.3.0` — a disjoint range. We were therefore claiming support for Node 21.x and 22.0-22.2, where an engine-strict install fails or PDF extraction is unavailable. The README's "20.16.0 or newer" repeated the same overclaim, and that README ships inside the published tarball. CI could not have caught this: the matrix pins `22.x`, which resolves to a current 22 release far past 22.3, so the gap is invisible to it. Adds __tests__/unit/engine-range.test.ts, which reads pdf-parse's own engines field from node_modules and fails if ours ever admits a version pdf-parse rejects. Verified it fails against the previous `>=20.16.0`, naming 21.0.0, 21.7.3, 22.0.0 and 22.2.0. This matters because the range is inherited from a dependency and will otherwise rot silently the next time pdf-parse moves it. semver was only present as an undeclared transitive; it and @types/semver are now proper devDependencies. Neither reaches consumers — the `files` allowlist excludes tests. Reported by Codex on #70. Co-authored-by: Claude Opus 5 <noreply@anthropic.com>
This file contains hidden or bidirectional Unicode text that may be interpreted or compiled differently than what appears below. To review, open the file in an editor that reveals hidden Unicode characters.
Learn more about bidirectional Unicode characters
Sign up for free
to join this conversation on GitHub.
Already have an account?
Sign in to comment
1 participant
Add this suggestion to a batch that can be applied as a single commit.This suggestion is invalid because no changes were made to the code.Suggestions cannot be applied while the pull request is closed.Suggestions cannot be applied while viewing a subset of changes.Only one suggestion per line can be applied in a batch.Add this suggestion to a batch that can be applied as a single commit.Applying suggestions on deleted lines is not supported.You must change the existing code in this line in order to create a valid suggestion.Outdated suggestions cannot be applied.This suggestion has been applied or marked resolved.Suggestions cannot be applied from pending reviews.Suggestions cannot be applied on multi-line comments.Suggestions cannot be applied while the pull request is queued to merge.Suggestion cannot be applied right now. Please check back later.
Prep work that must land on
mainbefore release PR #39 merges. Thenpm-publishjob does a bareactions/checkout@v4on thepush: mainevent, so the tarball is built frommainat the release commit — not from #39's diff. None of this can ride in the release PR.Closes the packaging gap that would otherwise ship a personal permissions file to npm.
Packaging — the blocker
package.jsonhad nofilesarray and there is no.npmignore, so npm fell back to.gitignore:maintodayThe 81 extra files included all 21 of
src/, all 33 of__tests__/, 6.github/files, and.claude/settings.local.json.There was also a latent hazard:
.gitignore:2isdist/. If a future npm applied the fallback strictly, the published package would contain no runtime code and every install would break. An explicitfilesallowlist is deny-by-default and makes the.gitignorecoupling irrelevant.Verified the result still contains everything the bins need —
dist/index.js,dist/auth-standalone.js, bothpostbuild-copied.cjsfiles, and all fourscripts/files (postinstallrunsscripts/post-install.js, which importsscripts/detect-environment.js).Version reporting
Two hardcoded strings release-please does not touch:
src/index.ts:625—version: "1.2.0"in the MCPServerconstructor. This is what every client sees in theinitializehandshake, and it was already wrong for 1.2.3.src/index.ts:1339—version: "1.2.3"in theconnection({action:"status"})payload.Both are now
2.0.0and carry// x-release-please-versionannotations, withsrc/index.tsregistered as agenericextra-file inrelease-please-config.jsonso future releases stay in sync. (Registering the path alone does nothing — the annotation is what thegenericupdater matches. Set by hand as well, so 2.0.0 is correct either way.)CI
release-please.ymlrunsnpm teston Node 24 at publish time, but the matrix only covered20.16.x/22.x. A Node-24-only failure would produce a git tag and GitHub Release with no npm publish — a half-released state costing a version bump to escape. Added24.x.Verified locally on Node 24.15.0 first: lint clean, build OK, 280/280 tests across 27 suites.
Docs
README
grep -ni node README.mdpreviously returned zero matches — the>=20.16.0floor lived only inpackage.jsonandAGENTS.md, neither of which a user reads.get_resourcedefault flip, and the alias-compatible 27→15 consolidation.evernote_get_resource,evernote_add_resource_to_note,evernote_update_notebook,evernote_update_tag. The reference documented 11 of 15.get_resourceis the important one — its binary→text default flip is the headline runtime break, and a README-only reader got no warning at all.develop; corrected tomain(contradictedAGENTS.md). Also dropped a stale "Railway template deployments" claim — nothing here deploys a Railway template.## Connection Resilience (v1.2.0+).CONNECTION_TROUBLESHOOTING.md (linked twice from README) presented ten retired tool names as the current API rather than as aliases.
evernote_reconnect→evernote_connection({action:"reconnect"}),evernote_health_check({verbose:true})→evernote_connection({action:"status", verbose:true}), plus twov1.2.0headings.Context
Unblocks #69 — npm has served the pre-
getUserUrls()build since 2026-01-21 while the fix sat unreleased onmain.Follow-ups intentionally not in this PR: #61 (polling drops >100 changes/interval, real but gated behind
EVERNOTE_POLLING_ENABLED) → 2.0.1; remaining doc debt (MIGRATION.md Node note,TEST_DOCUMENTATION.mdNode matrix, README's 9 missing env vars incl.EVERNOTE_WEBHOOK_SECRET,SECURITY.md/CONTRIBUTING.md) → separate docs PR.🤖 Generated with Claude Code