Merge pull request #95 from leadbay/fix/server-json-version-drift

fix(release): align server.json with package.json (0.18.2) + drift guard

Author: milstan

packages/mcp/CHANGELOG.md

@@ -1,5 +1,9 @@
 # Changelog — @leadbay/mcp
 
+## 0.18.2 — 2026-06-09
+
+- **Release-pipeline fix**: align `packages/mcp/server.json` with `package.json`. `server.json` had been stuck at `0.17.2` since the 0.17.2 release, so the MCP-Registry publish step (`Verify server.json version matches package.json`) failed on every release from 0.17.3 through 0.18.1 — npm and the GitHub `.mcpb` shipped, but the registry listing silently went stale. Both `server.json` version fields (top-level + `packages[0].version`) now track `package.json`, and a new audit test (`test/audit/server-json-version.test.ts`) fails the build on any future drift instead of letting it surface only at release time.
+
 ## 0.18.1 — 2026-06-09
 
 - **Quota rendering fix**: `leadbay_account_status` now renders the per-resource Daily / Weekly / Monthly **usage** table the API actually returns, instead of collapsing to "quota: null / no limits". Root cause: `quota_status` returns `count` (amount **used**) per resource per window with no cap field and a possibly-`null` `plan`; the old render hint tried to draw `used / cap` and gave up when there was no cap. The hint is now usage-only and explicitly warns that a missing cap / `null` plan is **not** "unlimited" or "no quota". `get-quota.ts` `outputSchema` corrected to the real `org` / `user.resources[]` shape (`{resource_type, count, window_type, resets_at}`, `count` = used), and a failed quota fetch is now distinguished from an empty quota.

packages/mcp/package.json

@@ -1,6 +1,6 @@
 {
   "name": "@leadbay/mcp",
-  "version": "0.18.1",
+  "version": "0.18.2",
   "mcpName": "io.github.leadbay/leadbay-mcp",
   "description": "Model Context Protocol (MCP) server for Leadbay — AI lead discovery, qualification, and enrichment for Claude Desktop, Cursor, and Claude Code.",
   "type": "module",

packages/mcp/server.json

@@ -3,7 +3,7 @@
   "name": "io.github.leadbay/leadbay-mcp",
   "title": "Leadbay",
   "description": "AI lead discovery, qualification, and outreach prep on your Leadbay account.",
-  "version": "0.17.2",
+  "version": "0.18.2",
   "repository": {
     "url": "https://github.com/leadbay/leadclaw",
     "source": "github",
@@ -15,7 +15,7 @@
       "registryType": "npm",
       "registryBaseUrl": "https://registry.npmjs.org",
       "identifier": "@leadbay/mcp",
-      "version": "0.17.2",
+      "version": "0.18.2",
       "transport": {
         "type": "stdio"
       },
@@ -27,13 +27,13 @@
         },
         {
           "type": "positional",
-          "value": "@leadbay/mcp@0.17"
+          "value": "@leadbay/mcp@0.18"
         }
       ],
       "environmentVariables": [
         {
           "name": "LEADBAY_TOKEN",
-          "description": "Bearer token; mint with `npx -y @leadbay/mcp@0.17 login --email <you> --region <us|fr>`.",
+          "description": "Bearer token; mint with `npx -y @leadbay/mcp@0.18 login --email <you> --region <us|fr>`.",
           "isRequired": true,
           "isSecret": true
         },

packages/mcp/test/audit/server-json-version.test.ts

@@ -0,0 +1,58 @@
+/**
+ * Audit: packages/mcp/server.json stays aligned with package.json.
+ *
+ * The release pipeline (.github/workflows/release.yml) refuses to publish to
+ * the MCP Registry unless server.json.version === package.json.version and
+ * server.json.name === package.json.mcpName. That guard only runs at release
+ * time, so a drift (e.g. bumping package.json without server.json) ships to
+ * npm + the GitHub .mcpb and only fails the registry step — silently, after
+ * the fact. server.json sat at 0.17.2 across the 0.17.3 / 0.18.0 / 0.18.1
+ * releases for exactly this reason. This test moves the check to PR time.
+ */
+import { readFileSync } from "node:fs";
+import { dirname, join } from "node:path";
+import { fileURLToPath } from "node:url";
+import { describe, it, expect } from "vitest";
+
+const __dirname = dirname(fileURLToPath(import.meta.url));
+// packages/mcp/test/audit -> packages/mcp
+const MCP_DIR = join(__dirname, "..", "..");
+
+const pkg = JSON.parse(readFileSync(join(MCP_DIR, "package.json"), "utf8"));
+const srv = JSON.parse(readFileSync(join(MCP_DIR, "server.json"), "utf8"));
+
+describe("audit: server.json aligns with package.json", () => {
+  it("top-level server.json.version matches package.json.version", () => {
+    expect(srv.version).toBe(pkg.version);
+  });
+
+  it("server.json.name matches package.json.mcpName", () => {
+    expect(srv.name).toBe(pkg.mcpName);
+  });
+
+  it("every server.json packages[].version matches package.json.version", () => {
+    const versions = (srv.packages ?? []).map((p: { version?: string }) => p.version);
+    for (const v of versions) {
+      expect(v).toBe(pkg.version);
+    }
+  });
+
+  it("the npm package entry identifies @leadbay/mcp", () => {
+    const npmPkg = (srv.packages ?? []).find(
+      (p: { registryType?: string }) => p.registryType === "npm"
+    );
+    expect(npmPkg?.identifier).toBe(pkg.name);
+  });
+
+  it("every @leadbay/mcp@<major.minor> npx pin tracks the current version line", () => {
+    // Pins appear in packages[].runtimeArguments AND in env-var description
+    // prose; scan the raw file so neither can silently lag (the registry would
+    // otherwise install an older line — exactly the 0.17 staleness this fixes).
+    const raw = readFileSync(join(MCP_DIR, "server.json"), "utf8");
+    const [major, minor] = pkg.version.split(".");
+    const line = `${major}.${minor}`;
+    const pins = [...raw.matchAll(/@leadbay\/mcp@(\d+\.\d+)/g)].map((m) => m[1]);
+    expect(pins.length).toBeGreaterThan(0);
+    for (const p of pins) expect(p).toBe(line);
+  });
+});