From f4afd65550f53b985f5d74d8c64c56614f75a269 Mon Sep 17 00:00:00 2001 From: Erkam Yaman Date: Sun, 18 Oct 2026 17:37:55 +0000 Subject: [PATCH] docs: drop the 1.0 wording and the release workflow for now The version stays 0.0.7 until a release is planned. The changelog section is now Unreleased, the docs and comments say "after 0.0.7" instead of naming 1.0, the tools page heading is "Renamed tools", and SECURITY.md is back to its early-development wording. The tag-driven release workflow and its notes script are removed until publishing is set up again. --- .github/workflows/e2e.yml | 4 +- .github/workflows/release.yml | 150 ------------------ SECURITY.md | 10 +- apps/docs/src/content/agents/tools.md | 4 +- .../src/content/contributing/publishing.md | 39 +---- apps/docs/src/content/security.md | 2 +- packages/devtools/CHANGELOG.md | 24 +-- .../devtools/src/__tests__/tool-input.test.ts | 4 +- packages/devtools/src/mcp-print-config.ts | 2 +- packages/devtools/src/rpc/tool-input.ts | 10 +- scripts/e2e-mcp.mjs | 8 +- scripts/release-notes.mjs | 71 --------- 12 files changed, 33 insertions(+), 295 deletions(-) delete mode 100644 .github/workflows/release.yml delete mode 100644 scripts/release-notes.mjs diff --git a/.github/workflows/e2e.yml b/.github/workflows/e2e.yml index ebcd2b73..e15312d8 100644 --- a/.github/workflows/e2e.yml +++ b/.github/workflows/e2e.yml @@ -2,8 +2,8 @@ name: E2E # The slow end-to-end checks that do not fit a pull request: every panel view in a real browser, # multi-tab and lifecycle resilience, and the install matrix from a packed tarball. Pull requests -# run the security and MCP checks (ci.yml), and the release runs a slice of the install matrix on -# the tarball it publishes (release.yml). See apps/docs/src/content/contributing/development.md. +# run the security and MCP checks (ci.yml), and a release can run a slice of the install matrix on +# its tarball. See apps/docs/src/content/contributing/development.md. on: schedule: # Mondays at 07:00 UTC, an hour after latest.yml and compat.yml. diff --git a/.github/workflows/release.yml b/.github/workflows/release.yml deleted file mode 100644 index 8ba5f35a..00000000 --- a/.github/workflows/release.yml +++ /dev/null @@ -1,150 +0,0 @@ -name: Release - -# Publishes @pangular-inspector/devtools to npm from a version tag, with provenance, after checking -# the exact tarball it publishes. Push a tag such as v1.0.0 on a commit of main whose CI passed, or -# run it from the Actions tab with that tag picked as the ref. See -# apps/docs/src/content/contributing/publishing.md#releasing. -on: - push: - tags: ['v*'] - # Run with "Use workflow from" set to the tag; a branch is refused. - workflow_dispatch: - -permissions: - contents: read - -concurrency: - # One release at a time, and never cancelled halfway through a publish. - group: release - cancel-in-progress: false - -jobs: - release: - name: Publish ${{ github.ref_name }} - runs-on: ubuntu-latest - timeout-minutes: 120 - # Protect this environment (required reviewers, tags only) in the repository settings. It holds - # the NPM_TOKEN secret. - environment: npm - permissions: - # gh release create - contents: write - # npm publish --provenance signs the attestation with the workflow's OIDC token. - id-token: write - # gh run list reads the CI runs of the tagged commit. - actions: read - env: - # Both triggers run on the tag itself: a tag push, or a manual run with the tag as the ref. - TAG: ${{ github.ref_name }} - steps: - - name: Check the run is for a tag - if: github.ref_type != 'tag' - run: | - echo "::error::Release runs only on a version tag, not on ${GITHUB_REF}. Pick the tag in \"Use workflow from\"." - exit 1 - - - uses: actions/checkout@v7 - with: - ref: ${{ github.ref }} - # The whole history, so the tagged commit can be checked against main. - fetch-depth: 0 - persist-credentials: false - - - name: Check the tag is on main - run: | - if ! git merge-base --is-ancestor HEAD origin/main; then - echo "::error::$TAG points at $(git rev-parse --short HEAD), which is not on main. Release from main only." - exit 1 - fi - - # The full CI (ci.yml) must have passed on main for this exact commit, so a commit whose CI - # failed, or is still running, is never published. - - name: Check CI passed on the tagged commit - env: - GH_TOKEN: ${{ github.token }} - GH_REPO: ${{ github.repository }} - run: | - sha=$(git rev-parse HEAD) - passed=$(gh run list --workflow ci.yml --commit "$sha" --branch main --event push \ - --status success --json databaseId -q 'length > 0') - if [ "$passed" != "true" ]; then - echo "::error::CI has no successful run on main for $sha. Wait for it to pass, or fix main and tag again." - exit 1 - fi - - # The tag, the package version and the changelog section must agree. The section becomes the - # GitHub release notes. - - name: Check the version and the changelog - run: node scripts/release-notes.mjs --tag="$TAG" --out="$RUNNER_TEMP/release-notes.md" - - - uses: ./.github/actions/setup - with: - registry-url: https://registry.npmjs.org - - - name: Type-check - run: pnpm typecheck - - - name: Test devtools package - run: pnpm test:devtools - - - name: Test devtools panel - run: pnpm test:panel - - # `prepack` builds the library and the panel. The root .pnpmfile.cjs drops the workspace-only - # fields from the packed package.json. Everything after this step uses this one file. - - name: Pack the tarball - id: pack - run: | - mkdir -p dist/release - pnpm --filter @pangular-inspector/devtools pack --pack-destination "$PWD/dist/release" - tarball=$(ls "$PWD"/dist/release/*.tgz) - echo "tarball=$tarball" >> "$GITHUB_OUTPUT" - echo "Packed $(basename "$tarball")" >> "$GITHUB_STEP_SUMMARY" - - - name: Install Chromium - run: pnpm exec playwright install --with-deps chromium - - # Both publish the tarball to a throwaway local registry, never to npm. - - name: Verify the tarball (Angular CLI) - run: pnpm verify:publish --scenario=angular-cli --tarball="${{ steps.pack.outputs.tarball }}" - - - name: Verify the tarball (Analog) - run: pnpm verify:publish --scenario=analog --tarball="${{ steps.pack.outputs.tarball }}" - - # A small slice of the weekly install matrix (e2e.yml), plus the package audit. - - name: Install matrix on the tarball - run: >- - pnpm e2e:install --tarball="${{ steps.pack.outputs.tarball }}" - --cells=angular-cli:npm:22,angular-cli:pnpm:20.3,angular-cli-nossr:npm:22,analog:pnpm,cli:npm - --report=dist/release/e2e-install.json --logs=dist/release/e2e-install-logs - - - name: Keep the tarball and the reports - if: always() - uses: actions/upload-artifact@v4 - with: - name: release-${{ env.TAG }} - path: dist/release - if-no-files-found: ignore - - # A version with a prerelease part (1.1.0-rc.1) goes to the `next` dist-tag, so `latest` - # only ever moves to a stable release. - - name: Publish to npm - env: - NODE_AUTH_TOKEN: ${{ secrets.NPM_TOKEN }} - TARBALL: ${{ steps.pack.outputs.tarball }} - run: | - case "$TAG" in - *-*) dist_tag=next ;; - *) dist_tag=latest ;; - esac - npm publish "$TARBALL" --provenance --access public --tag "$dist_tag" - - - name: Create the GitHub release - env: - GH_TOKEN: ${{ github.token }} - TARBALL: ${{ steps.pack.outputs.tarball }} - run: | - prerelease=() - case "$TAG" in *-*) prerelease=(--prerelease) ;; esac - gh release create "$TAG" "$TARBALL" --verify-tag --title "$TAG" \ - --notes-file "$RUNNER_TEMP/release-notes.md" "${prerelease[@]}" diff --git a/SECURITY.md b/SECURITY.md index 904ab05f..ce21e06f 100644 --- a/SECURITY.md +++ b/SECURITY.md @@ -2,14 +2,8 @@ ## Supported versions -Security fixes go to the 1.x release line of `@pangular-inspector/devtools`, in its latest -minor release. Versions before 1.0 are not supported: upgrade to the latest 1.x release to get a -fix. - -| Version | Supported | -| ------- | --------- | -| 1.x | Yes | -| < 1.0 | No | +Pangular Inspector is in early development. Only the latest published release of +`@pangular-inspector/devtools` is supported. There are no older release lines to backport a fix to. ## Reporting a vulnerability diff --git a/apps/docs/src/content/agents/tools.md b/apps/docs/src/content/agents/tools.md index b3cf55a6..2cc95f0b 100644 --- a/apps/docs/src/content/agents/tools.md +++ b/apps/docs/src/content/agents/tools.md @@ -1013,9 +1013,9 @@ A server plugin adds tools named `plugin::`, which your client Use it for data that has no dedicated tool, such as hydration data and TransferState payloads (`pangular:http`, `pangular:http-payloads`) or live pipe usage (`pangular:pipe-usage`). See [Resources](./resources.md) for every key. -## Names before 1.0 +## Renamed tools -Version 1.0 renamed tools and arguments so that each name follows one pattern: an optional library prefix (`ngrx-`, `redux-`, `tanstack-`, `capacitor-`, `analog-`), then a verb that says whether the tool reads source (`scan`), reads the page (`list`, `inspect`, `explain`, `lint`) or writes (`run`, `set`, `record`). The old names are not accepted. +Tools and arguments were renamed after 0.0.7 so that each name follows one pattern: an optional library prefix (`ngrx-`, `redux-`, `tanstack-`, `capacitor-`, `analog-`), then a verb that says whether the tool reads source (`scan`), reads the page (`list`, `inspect`, `explain`, `lint`) or writes (`run`, `set`, `record`). The old names are not accepted. | Before | Now | | ---------------------------------------------------------------------------------------- | --------------------------------------------------------------------------------------------------------------- | diff --git a/apps/docs/src/content/contributing/publishing.md b/apps/docs/src/content/contributing/publishing.md index e0e1416b..ed6f130e 100644 --- a/apps/docs/src/content/contributing/publishing.md +++ b/apps/docs/src/content/contributing/publishing.md @@ -90,46 +90,11 @@ This runs `pnpm --filter @pangular-inspector/devtools publish --access public`. pnpm publish checks git before it publishes. Run it from a clean working tree on main. -## Releasing - -Releases publish from CI, not from a laptop. `.github/workflows/release.yml` publishes the npm package with [provenance](https://docs.npmjs.com/generating-provenance-statements), so npm shows which commit and workflow built it. - - - - In one pull request, set version in packages/devtools/package.json and add a ## 1.2.3 section to packages/devtools/CHANGELOG.md. List every removed or renamed export, option and tool under Upgrade notes. Merge it to main. - - - Wait for CI to pass on that commit of main. Then run git tag v1.2.3 on it and git push origin v1.2.3. The tag starts the workflow. To rerun a release, start Release from the Actions tab and pick the tag, not a branch, under Use workflow from. - - - The job runs in the npm environment, which holds the NPM_TOKEN secret. Approve it when the run asks. - - - -The workflow stops at the first check that fails, before anything reaches npm: - -1. The run is for a tag, and the tag is on `main`. The CI workflow (`ci.yml`) has a successful run on `main` for the tagged commit. The tag equals `v` plus the package version. The changelog has a non-empty section for that version (`scripts/release-notes.mjs`). -2. `pnpm typecheck`, `pnpm test:devtools` and `pnpm test:panel` pass. -3. `pnpm --filter @pangular-inspector/devtools pack` builds one tarball. The root `.pnpmfile.cjs` drops `devDependencies`, `scripts` and the `nx` block from the packed `package.json`. -4. `pnpm verify:publish` (Angular CLI and Analog) and a few cells of `pnpm e2e:install` install that exact tarball from a local registry into fresh apps, open them in Chromium and run the package audit. -5. `npm publish --provenance --access public` publishes the same file. A version with a prerelease part, such as `1.3.0-rc.1`, goes to the `next` dist-tag; any other goes to `latest`. -6. `gh release create` makes the GitHub release, with the changelog section as its notes and the tarball attached. - -The run keeps the tarball and the install reports as an artifact. To check a release candidate before you tag it, run the same steps locally: - -```bash -pnpm --filter @pangular-inspector/devtools pack --pack-destination dist/release -pnpm verify:publish --tarball=dist/release/pangular-inspector-devtools-1.2.3.tgz -pnpm e2e:install --tarball=dist/release/pangular-inspector-devtools-1.2.3.tgz --cells=angular-cli:npm:22 -``` - -`pnpm e2e:install` deletes its work folder when it ends, as it can reach several gigabytes. A failed run copies the logs out first and prints where they are. Pass `--keep` to keep the whole folder. - -### The public API +## The public API Each entry point exports only what these docs describe, and only that is covered by semver. The files in `packages/devtools/src/entries` choose those exports, and `public-api.test.ts` lists them, so a new export is a deliberate change. Code shared between the server, the overlay and the panel, such as most of `config.ts`, stays internal: the panel imports it as `@pangular-inspector/devtools/internal/config`, a workspace-only export that `publishConfig.exports` leaves out. Mark a declaration that has to be exported for the package's own modules with `@internal`, and the published types leave it out. -### Supported versions +## Supported versions The Angular peer range has an upper bound, `>=12.2.0 <23.0.0`, because the overlay reads Angular's private debug APIs. Raise it in the release after the new major passes the [compatibility jobs](./development.md#angular-compatibility), and update the tested versions in [Installation](../getting-started/installation.md#tested-versions). `engines.node` is `>=22.12.0`, the first Node.js 22 that can `require()` the ES modules the Express hub loads. diff --git a/apps/docs/src/content/security.md b/apps/docs/src/content/security.md index f77588fd..9c238f19 100644 --- a/apps/docs/src/content/security.md +++ b/apps/docs/src/content/security.md @@ -94,7 +94,7 @@ A refused code is never compared with the real one. devframe gives you a new cod A browser that exchanges the code gets a session token, so it doesn't need the code again after a reload. The server keeps those tokens in `~/.pangular-inspector/auth//auth.json`, one folder per project (named after a hash of its path), so a token from one project doesn't open another project's server. The folder is readable by you only (mode `0700`), and the file too (`0600`). A token expires 7 days after the code was exchanged. To sign out every browser, delete the project's folder, or all of `~/.pangular-inspector/auth`, and restart the server. -Versions before 1.0 kept the tokens in `~/.devframes/devframe/auth.json` (the Express hub and the Vite plugin) or `~/.pangular/devframe/auth.json` (the CLI), readable by other users and without expiry. Pangular Inspector 1.0 doesn't read those files. Delete them if no other devframe tool uses them. +Version 0.0.7 and earlier kept the tokens in `~/.devframes/devframe/auth.json` (the Express hub and the Vite plugin) or `~/.pangular/devframe/auth.json` (the CLI), readable by other users and without expiry. Newer versions don't read those files. Delete them if no other devframe tool uses them. ### Express hub diff --git a/packages/devtools/CHANGELOG.md b/packages/devtools/CHANGELOG.md index ee6b728f..10c55e9c 100644 --- a/packages/devtools/CHANGELOG.md +++ b/packages/devtools/CHANGELOG.md @@ -2,9 +2,9 @@ All notable changes to `@pangular-inspector/devtools` are listed here. The format follows [Keep a Changelog](https://keepachangelog.com). -## 1.0.0 +## Unreleased -The first stable release. From 1.0, the agent tool names, their arguments and answers, and the exports of each entry point follow semver. Most setups need changes when they come from 0.0.7, so read **Upgrading from 0.0.7** first. +Most setups need changes when they come from 0.0.7, so read **Upgrading from 0.0.7** first. ### Upgrading from 0.0.7 @@ -25,7 +25,7 @@ These changes can break a 0.0.7 setup without an error. - **`initDevframe()` hosts need `ws: false`** (or a `server`) to connect. Without it, Devframe advertises a WebSocket that `nodeMiddleware` alone does not serve, and the page never connects. Import `initDevframe` from `@pangular-inspector/devtools/devframe`. See "Mount only the panel" in the Express docs. - **Don't install `devframe` yourself.** The 0.0.7 README said `npm install @pangular-inspector/devtools devframe`. The package depends on the Devframe version it needs, and a second copy at another version can split the panel from the definition. Remove a direct `devframe` dependency unless your own code uses it. - **`pangular dev` asks for the MCP token.** While the one-time code is on, its `/__mcp` route needs the same bearer token as the Vite plugin and the Express hub. Send it as for those servers, or pass `--no-auth` to turn both the code and the token off. -- **Trusted browsers sign in again once.** Session tokens moved to `~/.pangular-inspector/auth//auth.json`, one folder per project, readable by you only. They expire 7 days after the code was exchanged. 1.0 doesn't read the old files, `~/.devframes/devframe/auth.json` and `~/.pangular/devframe/auth.json`. Delete them if no other devframe tool uses them. +- **Trusted browsers sign in again once.** Session tokens moved to `~/.pangular-inspector/auth//auth.json`, one folder per project, readable by you only. They expire 7 days after the code was exchanged. This release doesn't read the old files, `~/.devframes/devframe/auth.json` and `~/.pangular/devframe/auth.json`. Delete them if no other devframe tool uses them. - **Wrong one-time codes lock the server.** After 3 wrong codes on a connection, each attempt waits longer, up to 60 seconds. All clients together get at most 10 wrong codes a minute. After 50 wrong codes since the last right one, the server accepts no code until it restarts. Pages that already connected stay connected. If you didn't type those codes, something on your machine or network is guessing. Restart the dev server to get a new code. - **The Analog, Capacitor and TanStack Query agent tools are listed only for apps that use them:** the project's `package.json` lists the library, the project is an Analog app, or a page reports the library's data. To list them anyway, set `inspectors.` or `agent.tools.` to `true`. - **Analog on pnpm needs one setting.** `@analogjs/vite-plugin-nitro` imports `h3` without declaring it, so under pnpm it can resolve to the h3 2 that this package brings in, and `vite build` fails with "does not provide an export named 'createEvent'". Declare `h3@^1` for the plugin with pnpm `packageExtensions`, as the Analog guide shows. @@ -35,9 +35,9 @@ These changes can break a 0.0.7 setup without an error. ### Agent tools renamed -1.0 renames tools and arguments so that each name follows one pattern: an optional library prefix (`ngrx-`, `redux-`, `tanstack-`, `capacitor-`, `analog-`), then a verb that says whether the tool reads source (`scan`), reads the page (`list`, `inspect`, `explain`, `lint`) or writes (`run`, `set`, `record`). There are no aliases. A call to an old tool name is an unknown tool. An old argument is refused with `isError` and the name to use instead, such as ``There is no `selector` argument; pass `component`.`` An argument that moved to another tool (`record` on `change-detection`, `overlay` on `hydration`, `routeId` and `on` on `navigate`) is refused with `isError` and the tool to use. Tool ids are `pangular:` on the server and `pangular_` for MCP clients; the tables leave the prefix out. +This release renames tools and arguments so that each name follows one pattern: an optional library prefix (`ngrx-`, `redux-`, `tanstack-`, `capacitor-`, `analog-`), then a verb that says whether the tool reads source (`scan`), reads the page (`list`, `inspect`, `explain`, `lint`) or writes (`run`, `set`, `record`). There are no aliases. A call to an old tool name is an unknown tool. An old argument is refused with `isError` and the name to use instead, such as ``There is no `selector` argument; pass `component`.`` An argument that moved to another tool (`record` on `change-detection`, `overlay` on `hydration`, `routeId` and `on` on `navigate`) is refused with `isError` and the tool to use. Tool ids are `pangular:` on the server and `pangular_` for MCP clients; the tables leave the prefix out. -| 0.0.7 | 1.0.0 | +| 0.0.7 | Now | | ---------------------------------------------------------------------------------------- | --------------------------------------------------------------------------------------------------------------- | | `get-routes`, `get-components`, `get-pipes`, `get-signals`, `get-providers` | `scan-routes`, `scan-components`, `scan-pipes`, `scan-signals`, `scan-providers` | | `get-ngrx-store`, `build-meta` | `ngrx-scan`, `scan-build` | @@ -55,7 +55,7 @@ These changes can break a 0.0.7 setup without an error. Some tools are merged or split: -| 0.0.7 | 1.0.0 | +| 0.0.7 | Now | | ------------------------------------------------------------------------ | -------------------------------------------------------------------------------- | | `wait-for-form` (`since`) | `wait-for` with `condition: "form"` (`after`) | | `navigate` with `action: "navigate"` | `navigate` with `action: "go"` | @@ -69,7 +69,7 @@ Some tools are merged or split: Arguments and resources: -| 0.0.7 | 1.0.0 | +| 0.0.7 | Now | | --------------------------------------------------------------------------------------------------- | ------------------------------------------------------------------------------------------------------ | | `pageId` on any tool | `page` | | `selector` naming a component (`inspect-component`, `inspect-signals`, `inspect-route`, `wait-for`) | `component` | @@ -87,7 +87,7 @@ Answers changed too. Every tool answers with one plain text block that holds the ### Removed exports -Each entry point exports only its documented API, which semver covers from 1.0. The values below were internals, and their types are gone with them. If you used one, open an issue with the use case. +Each entry point exports only its documented API. The values below were internals, and their types are gone with them. If you used one, open an issue with the use case. | Entry point | Removed | | ------------------------------ | --------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------- | @@ -181,7 +181,7 @@ What remains: `/config` exports `DEFAULT_POPUP_HOTKEY`, `PANGULAR_ACTIONS`, `PAN ### Fixes -- Fixes from the audit of every inspector, the panel shell, the hub, the extension and the native overlays (#361, #362, #363, #364), the follow-ups in #418, and the 1.0.0 release blockers (#432). +- Fixes from the audit of every inspector, the panel shell, the hub, the extension and the native overlays (#361, #362, #363, #364), the follow-ups in #418, and the release blockers found by the test campaign (#432). - One malformed component report no longer breaks the agent tools for every page. Reports are checked when they reach the server. - Change detection counts only template runs, not skipped children or the `checkNoChanges` pass. - The forms tools answer with the forms of the tab they were asked about. @@ -202,12 +202,12 @@ What remains: `/config` exports `DEFAULT_POPUP_HOTKEY`, `PANGULAR_ACTIONS`, `PAN - A quick start, and a panel screenshot on every inspector page. - Pages for the command palette, settings, terminals, the popup and hub, configuration, other servers (Hono, h3, Fastify), Capacitor, the timeline, errors, audit, TanStack Query, agent skills, browser agents and writing a plugin. - A roadmap page. -- A **Names before 1.0** table in the agent tools page, and the release steps, the public API and the supported versions in the publishing guide. -- Corrected guides and samples from the 1.0 review: the Vite auth default in the Analog guide and the glossary, JSON samples without a path comment, no separate devframe install in the package README, and `ws: false` for a panel-only devframe host. +- A **Renamed tools** table in the agent tools page, and the public API and the supported versions in the publishing guide. +- Corrected guides and samples from the readiness review: the Vite auth default in the Analog guide and the glossary, JSON samples without a path comment, no separate devframe install in the package README, and `ws: false` for a panel-only devframe host. ### Release and CI -- A tag publishes the package from CI with npm provenance (`.github/workflows/release.yml`). The workflow checks that the tag, the version and this changelog agree, runs the tests, and installs the exact tarball into fresh apps with `verify:publish` and `e2e:install` before it publishes (#430). +- The `leaks-real` test expects the rows the collector really reports (#430). - Pull requests run the security and MCP end-to-end checks, and a weekly job runs the rest. - The packed `package.json` leaves out `devDependencies`, `scripts` and the `nx` block, and declares `sideEffects`. - Dependencies: devframe and `@devframes/*` 1.2.5 (was 1.2.0). `@devframes/plugin-messages`, `@devframes/plugin-terminals` and `axe-core` are added. `h3` is no longer a dependency. diff --git a/packages/devtools/src/__tests__/tool-input.test.ts b/packages/devtools/src/__tests__/tool-input.test.ts index d648de50..4452f6ae 100644 --- a/packages/devtools/src/__tests__/tool-input.test.ts +++ b/packages/devtools/src/__tests__/tool-input.test.ts @@ -93,7 +93,7 @@ describe('checkToolArgs', () => { ); }); - it('refuses the argument names 1.0 renamed, naming the new one', () => { + it('refuses the renamed argument names, naming the new one', () => { // `pageId` was the second page argument; it is refused even where the tool has no `page`. expect(error({ selector: 'x', pageId: 'p1' })).toBe( 'There is no `pageId` argument; pass `page`.', @@ -122,7 +122,7 @@ describe('checkToolArgs', () => { ); }); - it('refuses an argument 1.0 moved to another tool, naming that tool', () => { + it('refuses an argument that moved to another tool, naming that tool', () => { const none = { type: 'object', properties: { page: { type: 'string' } } }; const moved = (tool: string, args: Record) => { const checked = checkToolArgs(none, args, `pangular:${tool}`); diff --git a/packages/devtools/src/mcp-print-config.ts b/packages/devtools/src/mcp-print-config.ts index 239a08e6..7d75ba58 100644 --- a/packages/devtools/src/mcp-print-config.ts +++ b/packages/devtools/src/mcp-print-config.ts @@ -87,7 +87,7 @@ export function mcpEndpoint( const origin = `${scheme}://${clientHost(options.host ?? DEFAULT_HOST)}:${options.port ?? DEFAULT_PORT}`; const hub = options.base !== undefined && normalizeBase(options.base) !== '/'; const base = hub ? normalizeBase(options.base as string) : '/'; - // Every server asks for the token while the one-time code is on (the CLI too, since 1.0). + // Every server asks for the token while the one-time code is on (the CLI too). return { url: `${origin}${base}__mcp`, origin, token: true, hub }; } diff --git a/packages/devtools/src/rpc/tool-input.ts b/packages/devtools/src/rpc/tool-input.ts index e70d188e..3ab978ac 100644 --- a/packages/devtools/src/rpc/tool-input.ts +++ b/packages/devtools/src/rpc/tool-input.ts @@ -26,7 +26,7 @@ export type CheckedArgs = { args: Record } | { error: string }; const PAGE_KEYS = new Set(['page']); /** - * Argument names that 1.0 renamed, with the names that took their place. A + * Argument names that were renamed after 0.0.7, with the names that took their place. A * call that sends an old name the schema does not list is refused with the * new one, instead of the value being dropped without a word. */ @@ -39,7 +39,7 @@ const RENAMED_ARGUMENTS: Readonly> = { }; /** - * Arguments that 1.0 moved to another tool, by the tool they left: each names + * Arguments that moved to another tool after 0.0.7, by the tool they left: each names * where to go instead. Checked only while that tool's schema lacks the key, as * for {@link RENAMED_ARGUMENTS}, so the value is refused instead of dropped. */ @@ -225,8 +225,8 @@ function describe(schema: ToolInputSchema | undefined): string { * `additionalProperties: false`, or are checked against `additionalProperties` * when it is a schema, as for a listed argument. A `page` must be a string, * so a wrong one is refused instead of falling back to another tab; an empty - * one counts as left out. An argument name 1.0 renamed is refused with the - * name that replaced it (see {@link RENAMED_ARGUMENTS}), and one 1.0 moved off + * one counts as left out. An argument name renamed after 0.0.7 is refused with the + * name that replaced it (see {@link RENAMED_ARGUMENTS}), and one moved off * `toolId` with the tool to use instead (see {@link MOVED_ARGUMENTS}). */ export function checkToolArgs(schema: unknown, input: unknown, toolId?: string): CheckedArgs { @@ -286,7 +286,7 @@ function renamedTo(key: string, properties: Record): st return RENAMED_ARGUMENTS[key]!.find((name) => Object.hasOwn(properties, name)); } -/** The arguments 1.0 moved off the tool `toolId` (`pangular:`). */ +/** The arguments moved off the tool `toolId` (`pangular:`). */ function movedFrom(toolId: string): Readonly> | undefined { const name = toolId.replace(/^pangular:/, ''); return Object.hasOwn(MOVED_ARGUMENTS, name) ? MOVED_ARGUMENTS[name] : undefined; diff --git a/scripts/e2e-mcp.mjs b/scripts/e2e-mcp.mjs index d0937b1d..e1a6603f 100644 --- a/scripts/e2e-mcp.mjs +++ b/scripts/e2e-mcp.mjs @@ -2270,7 +2270,7 @@ async function runNegative(client, transport, tools, state) { checkAnswer(record, undefined, 'error'); } - // 1.0 is a clean break: the names before it are gone, not aliased. + // The rename is a clean break: the old names are gone, not aliased. const listed = new Set(tools.map((tool) => short(tool.name))); for (const old of RETIRED_TOOLS) { if (listed.has(old)) failure(`${transport} tools/list`, `retired tool ${old} is still listed`); @@ -2294,7 +2294,7 @@ async function runNegative(client, transport, tools, state) { } } -/** Tool names 1.0 retired (see apps/docs/src/content/agents/tools.md, Names before 1.0). */ +/** Retired tool names (see apps/docs/src/content/agents/tools.md, Renamed tools). */ const RETIRED_TOOLS = [ 'get-routes', 'get-components', @@ -2829,9 +2829,9 @@ async function runVariants(opts, sdk, browser, config, state) { function runDocs(state) { const docsDir = join(ROOT, 'apps/docs/src/content'); - // The table of names before 1.0 lists names that are gone on purpose. + // The renamed tools table lists names that are gone on purpose. const toolsMd = readFileSync(join(docsDir, 'agents/tools.md'), 'utf8').split( - /^## Names before 1\.0$/m, + /^## Renamed tools$/m, )[0]; const serverMd = readFileSync(join(docsDir, 'agents/mcp-server.md'), 'utf8'); const configMd = readFileSync(join(docsDir, 'getting-started/configuration.md'), 'utf8'); diff --git a/scripts/release-notes.mjs b/scripts/release-notes.mjs deleted file mode 100644 index 2652f587..00000000 --- a/scripts/release-notes.mjs +++ /dev/null @@ -1,71 +0,0 @@ -#!/usr/bin/env node -/** - * The release gate's first check, run by `.github/workflows/release.yml` before anything is built: - * the tag, the package version and the changelog must name the same release. - * - * - `--tag=v1.2.3` must be `v` plus `version` in `packages/devtools/package.json`. - * - `packages/devtools/CHANGELOG.md` must have a `## 1.2.3` section with something in it. - * - * Prints the section's body, or writes it to `--out=` for the GitHub release notes. Exits - * with 1 and an `::error::` line when they disagree. - * - * Usage: node scripts/release-notes.mjs --tag=v1.2.3 [--out=] - */ -import { readFileSync, writeFileSync } from 'node:fs'; -import { dirname, join } from 'node:path'; -import { fileURLToPath } from 'node:url'; - -const ROOT = join(dirname(fileURLToPath(import.meta.url)), '..'); -const arg = (name) => - process.argv.find((value) => value.startsWith(`--${name}=`))?.slice(name.length + 3); - -/** The body of the `## ` section, without its heading, or undefined when it is missing. */ -export function changelogSection(changelog, version) { - const lines = changelog.split('\n'); - const heading = lines.findIndex((line) => /^## /.test(line) && line.slice(3).trim() === version); - if (heading === -1) return undefined; - const next = lines.findIndex((line, i) => i > heading && /^## /.test(line)); - return lines - .slice(heading + 1, next === -1 ? undefined : next) - .join('\n') - .trim(); -} - -/** The problems that stop a release of `tag`, or an empty list. */ -export function releaseProblems(tag, version, section) { - const problems = []; - if (tag !== `v${version}`) { - problems.push( - `The tag ${tag} does not match packages/devtools/package.json, whose version is ${version}. Tag v${version}, or bump the version first.`, - ); - } - if (section === undefined) { - problems.push(`packages/devtools/CHANGELOG.md has no "## ${version}" section.`); - } else if (!section) { - problems.push(`The "## ${version}" section of packages/devtools/CHANGELOG.md is empty.`); - } - return problems; -} - -if (process.argv[1] === fileURLToPath(import.meta.url)) { - const tag = arg('tag'); - if (!tag) { - console.error('Usage: node scripts/release-notes.mjs --tag=v1.2.3 [--out=]'); - process.exit(2); - } - const pkg = JSON.parse(readFileSync(join(ROOT, 'packages/devtools/package.json'), 'utf8')); - const changelog = readFileSync(join(ROOT, 'packages/devtools/CHANGELOG.md'), 'utf8'); - const section = changelogSection(changelog, pkg.version); - const problems = releaseProblems(tag, pkg.version, section); - if (problems.length) { - for (const problem of problems) console.error(`::error::${problem}`); - process.exit(1); - } - const out = arg('out'); - if (out) { - writeFileSync(out, `${section}\n`); - console.log(`${tag}: version and changelog match; the notes are in ${out}`); - } else { - console.log(section); - } -}